aws-accounts/main.tf at main · urmanac/aws-accounts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
provider "aws" {
  # profile = "${var.environment}-bootstrap" # expects you to set up ~/.aws/credentials
  # profile = "terraform-admin-${var.environment}-mfa" # now with MFA required
  #profile= To use Session Token AWS authentication, run ./get_mfa_session.sh
  region = "us-east-1" # pick one
}

# Alias for eu-west-1
provider "aws" {
  alias  = "eu_west_1"
  region = "eu-west-1"
}

module "bootstrap_admin" {
  source      = "./modules/bootstrap-admin"
  environment = var.environment
  account_id  = var.account_map[var.environment]

  # Connect break-glass users to assumable roles
  break_glass_assume_roles_policy_arn = module.assumable_roles.break_glass_policy_arn
}

# OIDC Identity Providers
module "oidc_identity" {
  source      = "./modules/oidc-identity"
  environment = var.environment

  # Enable GitHub OIDC (primary)
  enable_github_oidc   = true
  github_organizations = ["urmanac", "kingdon-ci"]

  # Future: Enable GitLab and Custom OIDC
  enable_gitlab_oidc = false
  enable_custom_oidc = false
}

# Assumable Roles for RBAC
module "assumable_roles" {
  source = "./modules/assumable-roles"

  environment       = var.environment
  role_prefix      = "${var.environment}-"
  oidc_trust_policy = module.oidc_identity.multi_provider_trust_policy

  # Regional restrictions for CI role
  allowed_regions = ["us-east-1", "eu-west-1"]
}


locals {
  env = { for kv in regexall("(\\w+)=(.*)", file(".env")) : kv[0] => kv[1] }
}

module "bastion_ci" {
  source      = "./modules/bastion-ci"
  # providers   = { aws = aws.eu_west_1 }

  name                      = "tf"
  region                    = "eu-west-1"
  vpc_id                    = module.vpc_eu_west_1.vpc_id
  public_subnet_ids         = module.vpc_eu_west_1.public_subnet_ids
  private_subnet_ids        = module.vpc_eu_west_1.private_subnet_ids
  ssm_security_group_id     = module.vpc_eu_west_1.ssm_security_group_id
  bastion_security_group_id = module.vpc_eu_west_1.bastion_security_group_id
  instance_type             = "t4g.small"
  # assign from .env
  my_public_ssh_key         = local.env["MY_PUBLIC_SSH_KEY"]
  my_wireguard_client_key   = local.env["MY_WIREGUARD_CLIENT_KEY"]
  my_wireguard_client_pub   = local.env["MY_WIREGUARD_CLIENT_PUB"]
  my_wireguard_server_pub   = local.env["MY_WIREGUARD_SERVER_PUB"]
  my_wireguard_server_ipv6  = local.env["MY_WIREGUARD_SERVER_IPV6"]
  # GHCR credentials for cozystack registry cache (optional)
  cozystack_ghcr_username   = lookup(local.env, "GHCR_USERNAME", "")
  cozystack_ghcr_token      = lookup(local.env, "GHCR_TOKEN", "")
}

module "vpc_eu_west_1" {
  source = "./modules/vpc"
  name   = "sandbox-eu"
  providers = { aws = aws.eu_west_1 }
  cidr   = "10.10.0.0/16"
  region = "eu-west-1"
  enable_bastion_networking = true
  enable_bastion_private_networking = false
  enable_talos_networking = true
}

module "vpc_us_east_1" {
  source = "./modules/vpc"
  name   = "sandbox-us"
  cidr   = "10.20.0.0/16"
  region = "us-east-1"
}