govuk-infrastructure/terraform/deployments/govuk-publishing-infrastructure/main.tf at d5d88f83623e6ff91cbc3ca267c193cfe799297f · alphagov/govuk-infrastructure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
terraform {
  cloud {
    organization = "govuk"
    workspaces {
      tags = ["govuk-publishing-infrastructure", "eks", "aws"]
    }
  }

  required_version = "~> 1.10"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.1"
    }
    fastly = {
      source  = "fastly/fastly"
      version = "~> 7.0"
    }
    tfe = {
      source  = "hashicorp/tfe"
      version = "0.66.0"
    }
  }
}

locals {
  cluster_name         = data.tfe_outputs.cluster_infrastructure.nonsensitive_values.cluster_id
  internal_dns_zone_id = data.tfe_outputs.root_dns.nonsensitive_values.internal_root_zone_id
  external_dns_zone_id = data.tfe_outputs.cluster_infrastructure.nonsensitive_values.external_dns_zone_id
  elasticache_subnets  = [for name, subnet in data.tfe_outputs.vpc.nonsensitive_values.private_subnet_ids : subnet if startswith(name, "elasticache_")]

  target_private_subnets = ["a", "b", "c"]
  private_subnet_ids     = [for name, subnet in data.tfe_outputs.vpc.nonsensitive_values.private_subnet_ids : subnet if contains(local.target_private_subnets, name)]

  default_tags = {
    Product              = "GOV.UK"
    System               = "GOV.UK Publishing"
    Environment          = var.govuk_environment
    Owner                = "govuk-platform-engineering@digital.cabinet-office.gov.uk"
    repository           = "govuk-infrastructure"
    terraform_deployment = basename(abspath(path.root))
  }
}

provider "aws" {
  region = "eu-west-1"
  default_tags { tags = local.default_tags }
}

provider "aws" {
  region = "eu-west-2"
  alias  = "replica"
  default_tags { tags = local.default_tags }
}

provider "random" {}

# used by the fastly ip ranges provider.
# an API key is needed but 'fake' seems to work.
provider "fastly" {
  api_key = "fake"
}

# This will use credentials provided by `terraform login`
provider "tfe" {
}

provider "google" {
  default_labels = {
    product              = "gov-uk"
    system               = "terraform-cloud"
    environment          = var.govuk_environment
    owner                = "govuk-platform-engineering"
    repository           = "govuk-infrastructure"
    terraform_deployment = lower(basename(abspath(path.root)))
  }
}

data "aws_caller_identity" "current" {}