You have been given access to the Serverless Release Dashboard.
+You have been given access to Moot, a Serverless Release Dashboard.
Please see below for temporary credentials:
username: {username}
password: {####}
diff --git a/deployments/terraform/assets/dynamodb_put_item_input.json b/deployments/terraform/assets/dynamodb_put_item_input.json index 3fc5a8b..08175e6 100644 --- a/deployments/terraform/assets/dynamodb_put_item_input.json +++ b/deployments/terraform/assets/dynamodb_put_item_input.json @@ -6,6 +6,6 @@ "S": "${admin_user_email}" }, "ID": { - "S": "${uud}" + "S": "${uuid}" } } diff --git a/deployments/terraform/data.tf b/deployments/terraform/data.tf index d1e8d05..a4d6de4 100644 --- a/deployments/terraform/data.tf +++ b/deployments/terraform/data.tf @@ -1,20 +1,30 @@ data "aws_caller_identity" "current" {} data "aws_region" "current" {} -data "null_data_source" "wait_for_lambda_build" { - for_each = local.lambdas +data "aws_route53_zone" "this" { + count = var.hosted_zone_name != "" ? 1 : 0 - inputs = { - lambda_build_id = null_resource.lambda_build[each.key].id - source = "${local.path}/bin/${each.key}" - } + name = var.hosted_zone_name + private_zone = false +} + +data "external" "admin_user_id" { + count = var.admin_user_email != "" && !var.enable_delete_admin_user ? 1 : 0 + depends_on = [null_resource.create_admin_user[0]] + + program = [ + "go", "run", "${path.module}/assets/cognito.go", + "--admin-user-email", var.admin_user_email, + "--user-pool-id", aws_cognito_user_pool.this.id, + ] } data "archive_file" "this" { - for_each = local.lambdas + for_each = local.lambdas + depends_on = [null_resource.lambda_build] type = "zip" - source_file = data.null_data_source.wait_for_lambda_build[each.key].outputs["source"] + source_file = "${local.path}/bin/${each.key}" output_path = "${local.path}/archive/${each.key}.zip" } @@ -46,11 +56,11 @@ data "aws_iam_policy_document" "policy" { data "aws_iam_policy_document" "s3" { statement { actions = ["s3:GetObject"] - resources = ["arn:aws:s3:::release-dashboard-${data.aws_caller_identity.current.account_id}/*"] + resources = ["arn:aws:s3:::${replace(var.name, "_", "-")}-${data.aws_caller_identity.current.account_id}/*"] principals { type = "AWS" - identifiers = module.cloudfront.this_cloudfront_origin_access_identity_iam_arns + identifiers = module.cloudfront.cloudfront_origin_access_identity_iam_arns } } } diff --git a/deployments/terraform/examples/complete/.terraform.lock.hcl b/deployments/terraform/examples/complete/.terraform.lock.hcl new file mode 100644 index 0000000..377156c --- /dev/null +++ b/deployments/terraform/examples/complete/.terraform.lock.hcl @@ -0,0 +1,74 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/archive" { + version = "2.2.0" + hashes = [ + "h1:2K5LQkuWRS2YN1/YoNaHn9MAzjuTX8Gaqy6i8Mbfv8Y=", + "zh:06bd875932288f235c16e2237142b493c2c2b6aba0e82e8c85068332a8d2a29e", + "zh:0c681b481372afcaefddacc7ccdf1d3bb3a0c0d4678a526bc8b02d0c331479bc", + "zh:100fc5b3fc01ea463533d7bbfb01cb7113947a969a4ec12e27f5b2be49884d6c", + "zh:55c0d7ddddbd0a46d57c51fcfa9b91f14eed081a45101dbfc7fd9d2278aa1403", + "zh:73a5dd68379119167934c48afa1101b09abad2deb436cd5c446733e705869d6b", + "zh:841fc4ac6dc3479981330974d44ad2341deada8a5ff9e3b1b4510702dfbdbed9", + "zh:91be62c9b41edb137f7f835491183628d484e9d6efa82fcb75cfa538c92791c5", + "zh:acd5f442bd88d67eb948b18dc2ed421c6c3faee62d3a12200e442bfff0aa7d8b", + "zh:ad5720da5524641ad718a565694821be5f61f68f1c3c5d2cfa24426b8e774bef", + "zh:e63f12ea938520b3f83634fc29da28d92eed5cfbc5cc8ca08281a6a9c36cca65", + "zh:f6542918faa115df46474a36aabb4c3899650bea036b5f8a5e296be6f8f25767", + ] +} + +provider "registry.terraform.io/hashicorp/aws" { + version = "3.42.0" + hashes = [ + "h1:C6/yDp6BhuDFx0qdkBuJj/OWUJpAoraHTJaU6ac38Rw=", + "zh:126c856a6eedddd8571f161a826a407ba5655a37a6241393560a96b8c4beca1a", + "zh:1a4868e6ac734b5fc2e79a4a889d176286b66664aad709435aa6acee5871d5b0", + "zh:40fed7637ab8ddeb93bef06aded35d970f0628025b97459ae805463e8aa0a58a", + "zh:68def3c0a5a1aac1db6372c51daef858b707f03052626d3427ac24cba6f2014d", + "zh:6db7ec9c8d1803a0b6f40a664aa892e0f8894562de83061fa7ac1bc51ff5e7e5", + "zh:7058abaad595930b3f97dc04e45c112b2dbf37d098372a849081f7081da2fb52", + "zh:8c25adb15a19da301c478aa1f4a4d8647cabdf8e5dae8331d4490f80ea718c26", + "zh:8e129b847401e39fcbc54817726dab877f36b7f00ff5ed76f7b43470abe99ff9", + "zh:d268bb267a2d6b39df7ddee8efa7c1ef7a15cf335dfa5f2e64c9dae9b623a1b8", + "zh:d6eeb3614a0ab50f8e9ab5666ae5754ea668ce327310e5b21b7f04a18d7611a8", + "zh:f5d3c58055dff6e38562b75d3edc908cb2f1e45c6914f6b00f4773359ce49324", + ] +} + +provider "registry.terraform.io/hashicorp/external" { + version = "2.1.0" + hashes = [ + "h1:LTl5CGW8wiIEe16AC4MtXN/95xWWNDbap70zJsBTk0w=", + "zh:0d83ffb72fbd08986378204a7373d8c43b127049096eaf2765bfdd6b00ad9853", + "zh:7577d6edc67b1e8c2cf62fe6501192df1231d74125d90e51d570d586d95269c5", + "zh:9c669ded5d5affa4b2544952c4b6588dfed55260147d24ced02dca3a2829f328", + "zh:a404d46f2831f90633947ab5d57e19dbfe35b3704104ba6ec80bcf50b058acfd", + "zh:ae1caea1c936d459ceadf287bb5c5bd67b5e2a7819df6f5c4114b7305df7f822", + "zh:afb4f805477694a4b9dde86b268d2c0821711c8aab1c6088f5f992228c4c06fb", + "zh:b993b4a1de8a462643e78f4786789e44ce5064b332fee1cb0d6250ed085561b8", + "zh:c84b2c13fa3ea2c0aa7291243006d560ce480a5591294b9001ce3742fc9c5791", + "zh:c8966f69b7eccccb771704fd5335923692eccc9e0e90cb95d14538fe2e92a3b8", + "zh:d5fe68850d449b811e633a300b114d0617df6d450305e8251643b4d143dc855b", + "zh:ddebfd1e674ba336df09b1f27bbaa0e036c25b7a7087dc8081443f6e5954028b", + ] +} + +provider "registry.terraform.io/hashicorp/null" { + version = "3.1.0" + hashes = [ + "h1:xhbHC6in3nQryvTQBWKxebi3inG5OCgHgc4fRxL0ymc=", + "zh:02a1675fd8de126a00460942aaae242e65ca3380b5bb192e8773ef3da9073fd2", + "zh:53e30545ff8926a8e30ad30648991ca8b93b6fa496272cd23b26763c8ee84515", + "zh:5f9200bf708913621d0f6514179d89700e9aa3097c77dac730e8ba6e5901d521", + "zh:9ebf4d9704faba06b3ec7242c773c0fbfe12d62db7d00356d4f55385fc69bfb2", + "zh:a6576c81adc70326e4e1c999c04ad9ca37113a6e925aefab4765e5a5198efa7e", + "zh:a8a42d13346347aff6c63a37cda9b2c6aa5cc384a55b2fe6d6adfa390e609c53", + "zh:c797744d08a5307d50210e0454f91ca4d1c7621c68740441cf4579390452321d", + "zh:cecb6a304046df34c11229f20a80b24b1603960b794d68361a67c5efe58e62b8", + "zh:e1371aa1e502000d9974cfaff5be4cfa02f47b17400005a16f14d2ef30dc2a70", + "zh:fc39cc1fe71234a0b0369d5c5c7f876c71b956d23d7d6f518289737a001ba69b", + "zh:fea4227271ebf7d9e2b61b89ce2328c7262acd9fd190e1fd6d15a591abfa848e", + ] +} diff --git a/deployments/terraform/examples/complete/main.tf b/deployments/terraform/examples/complete/main.tf new file mode 100644 index 0000000..a1bbe6d --- /dev/null +++ b/deployments/terraform/examples/complete/main.tf @@ -0,0 +1,14 @@ +module "dashboard" { + source = "../../" + + name = "moot" + admin_user_email = var.admin_user_email + enable_delete_admin_user = false + github_token = var.github_token + gitlab_token = var.gitlab_token + slack_webhook_url = var.slack_webhook_url + fqdn_alias = "moot.link" + hosted_zone_name = "moot.link" + enable_api_gateway_access_logs = true + tags = var.tags +} diff --git a/deployments/terraform/examples/complete/provider.tf b/deployments/terraform/examples/complete/provider.tf new file mode 100644 index 0000000..c125940 --- /dev/null +++ b/deployments/terraform/examples/complete/provider.tf @@ -0,0 +1,3 @@ +provider "aws" { + region = "us-east-1" +} diff --git a/deployments/terraform/examples/complete/terraform.tfvars b/deployments/terraform/examples/complete/terraform.tfvars new file mode 100644 index 0000000..43a5b93 --- /dev/null +++ b/deployments/terraform/examples/complete/terraform.tfvars @@ -0,0 +1,4 @@ +tags = { + name = "moot" + managed_by = "terraform" +} diff --git a/deployments/terraform/examples/complete/variables.tf b/deployments/terraform/examples/complete/variables.tf new file mode 100644 index 0000000..ecc8acc --- /dev/null +++ b/deployments/terraform/examples/complete/variables.tf @@ -0,0 +1,40 @@ +variable "tags" { + type = map(string) + description = "Map of tags to be applied to resources." +} + +variable "admin_user_email" { + type = string + description = <<-DESC + Controls the creation of an admin user that is required to initially gain access to the + dashboard. + + If access to the dashboard is completely lost, do the following + • `var.enable_delete_admin_user = true` + • `terraform apply` + • `var.enable_delete_admin_user = false` + • `terraform apply` + + If the initial admin user should no longer be able to access the dashboard, revoke access by + setting `var.enable_delete_admin_user = true` and running `terraform apply` + DESC + default = "" +} + +variable "github_token" { + type = string + description = "Token for Github." + default = "" +} + +variable "gitlab_token" { + type = string + description = "Token for Gitlab." + default = "" +} + +variable "slack_webhook_url" { + type = string + description = "URL to send slack message payloads to." + default = "" +} diff --git a/deployments/terraform/locals.tf b/deployments/terraform/locals.tf index b2546f4..0b0997e 100644 --- a/deployments/terraform/locals.tf +++ b/deployments/terraform/locals.tf @@ -1,5 +1,5 @@ locals { - path = "${path.root}/../.." + path = "${path.module}/../.." ssm_parameters = { client_pool_secret = { @@ -20,6 +20,13 @@ locals { } } + null = { + lambda_binary_exists = { for key, _ in local.lambdas : key => fileexists("${local.path}/bin/${key}") } + } + + frontend_module_comprehension = [for module in jsondecode(file("${path.root}/.terraform/modules/modules.json"))["Modules"] : module if length(regexall("vuejs_frontend", module.Key)) > 0][0] + frontend_module_path = "${path.root}/${local.frontend_module_comprehension.Dir}" + lambdas = { auth = { description = "Administrates user login, token refreshes, and password resets." @@ -50,6 +57,7 @@ locals { description = "Creates github and gitlab releases for repository specified in the event." authorizer = true environment = { + DASHBOARD_NAME = var.name SLACK_WEBHOOK_URL = aws_ssm_parameter.this["slack_webhook_url"].value TABLE_NAME = aws_dynamodb_table.this.id } @@ -73,7 +81,8 @@ locals { description = "Writes github and gitlab repository details to DynamoDB." authorizer = true environment = { - TABLE_NAME = aws_dynamodb_table.this.id + DASHBOARD_NAME = var.name + TABLE_NAME = aws_dynamodb_table.this.id } routes = { "/repositories/create" = "POST" diff --git a/deployments/terraform/main.tf b/deployments/terraform/main.tf deleted file mode 100644 index 7abd241..0000000 --- a/deployments/terraform/main.tf +++ /dev/null @@ -1,5 +0,0 @@ -provider "aws" { - region = "us-east-1" - allowed_account_ids = ["744000309083"] - profile = "sean" -} diff --git a/deployments/terraform/modules.tf b/deployments/terraform/modules.tf index 2a4879d..06730a6 100644 --- a/deployments/terraform/modules.tf +++ b/deployments/terraform/modules.tf @@ -1,25 +1,26 @@ +module "vuejs_frontend" { + source = "github.com/seanturner026/moot-frontend.git?ref=v0.3.0" +} + module "cloudfront" { - source = "terraform-aws-modules/cloudfront/aws" - version = "v1.8.0" - - # aliases = [""] - comment = "Serverless Release Dashboard" - enabled = true - is_ipv6_enabled = true - price_class = "PriceClass_All" - retain_on_delete = false - wait_for_deployment = false - default_root_object = "/index.html" + source = "terraform-aws-modules/cloudfront/aws" + version = "v2.4.0" + depends_on = [aws_acm_certificate_validation.this[0]] + aliases = var.fqdn_alias != "" ? [var.fqdn_alias] : null + comment = "Moot, a Serverless Release Dashboard" + enabled = true + is_ipv6_enabled = true + price_class = "PriceClass_All" + retain_on_delete = false + wait_for_deployment = true + default_root_object = "/index.html" create_origin_access_identity = true + origin_access_identities = { - s3 = "Cloudfront access to Serverless Release Dashboard bucket" + s3 = "Cloudfront access to moot S3 bucket" } - # logging_config = { - # bucket = "logs-my-cdn.s3.amazonaws.com" - # } - origin = { s3 = { domain_name = aws_s3_bucket.this.bucket_domain_name @@ -40,8 +41,10 @@ module "cloudfront" { } viewer_certificate = { - cloudfront_default_certificate = true, - minimum_protocol_versione = "TLSv1" + cloudfront_default_certificate = var.hosted_zone_name != "" && var.fqdn_alias != "" ? false : true + minimum_protocol_versione = var.hosted_zone_name != "" && var.fqdn_alias != "" ? "TLSv1.2" : "TLSv1" + acm_certificate_arn = var.hosted_zone_name != "" && var.fqdn_alias != "" ? aws_acm_certificate.this[0].arn : null + ssl_support_method = var.hosted_zone_name != "" && var.fqdn_alias != "" ? "sni-only" : null } custom_error_response = { diff --git a/deployments/terraform/outputs.tf b/deployments/terraform/outputs.tf new file mode 100644 index 0000000..4dc6fb3 --- /dev/null +++ b/deployments/terraform/outputs.tf @@ -0,0 +1,4 @@ +output "cloudfront_domain_name" { + description = "FQDN of Cloudfront Distribution that can be used for DNS." + value = module.cloudfront.cloudfront_distribution_domain_name +} diff --git a/deployments/terraform/r_acm.tf b/deployments/terraform/r_acm.tf new file mode 100644 index 0000000..3b9040b --- /dev/null +++ b/deployments/terraform/r_acm.tf @@ -0,0 +1,18 @@ +resource "aws_acm_certificate" "this" { + count = var.hosted_zone_name != "" && var.fqdn_alias != "" ? 1 : 0 + + domain_name = var.fqdn_alias + validation_method = "DNS" + tags = merge(var.tags, { Name = var.name }) + + lifecycle { + create_before_destroy = true + } +} + +resource "aws_acm_certificate_validation" "this" { + count = var.hosted_zone_name != "" && var.fqdn_alias != "" ? 1 : 0 + + certificate_arn = aws_acm_certificate.this[0].arn + validation_record_fqdns = [for record in aws_route53_record.acm : record.fqdn] +} diff --git a/deployments/terraform/r_api_gateway.tf b/deployments/terraform/r_api_gateway.tf index ca32208..48b1eef 100644 --- a/deployments/terraform/r_api_gateway.tf +++ b/deployments/terraform/r_api_gateway.tf @@ -1,13 +1,13 @@ resource "aws_apigatewayv2_api" "this" { - name = var.tags.name + name = var.name protocol_type = "HTTP" - description = "HTTP API for serverless release dashboard" + description = "HTTP API for moot, a serverless release dashboard" cors_configuration { allow_credentials = true allow_headers = ["Content-Type", "Authorization", "X-Session-Id"] allow_methods = ["GET", "OPTIONS", "POST"] - allow_origins = ["http://localhost:8080", var.dev_cloudfront_dns] + allow_origins = ["https://${var.fqdn_alias}"] max_age = 600 } @@ -19,26 +19,45 @@ resource "aws_apigatewayv2_stage" "this" { api_id = aws_apigatewayv2_api.this.id auto_deploy = true - access_log_settings { - destination_arn = aws_cloudwatch_log_group.this["api_gateway"].arn - format = jsonencode({ - "requestId" : "$context.requestId", - "ip" : "$context.identity.sourceIp", - "requestTime" : "$context.requestTime", - "httpMethod" : "$context.httpMethod", - "routeKey" : "$context.routeKey", - "status" : "$context.status", - "protocol" : "$context.protocol", - "responseLength" : "$context.responseLength", - "integrationError " : "$context.integrationErrorMessage" - }) + dynamic "access_log_settings" { + for_each = var.enable_api_gateway_access_logs ? [var.enable_api_gateway_access_logs] : [] + + content { + destination_arn = aws_cloudwatch_log_group.api_gateway[0].arn + format = jsonencode({ + "requestId" : "$context.requestId", + "ip" : "$context.identity.sourceIp", + "requestTime" : "$context.requestTime", + "httpMethod" : "$context.httpMethod", + "routeKey" : "$context.routeKey", + "status" : "$context.status", + "protocol" : "$context.protocol", + "responseLength" : "$context.responseLength", + "integrationError " : "$context.integrationErrorMessage" + }) + } + } + + tags = var.tags +} + +resource "aws_apigatewayv2_domain_name" "this" { + count = var.hosted_zone_name != "" && var.fqdn_alias != "" ? 1 : 0 + depends_on = [aws_acm_certificate_validation.this[0]] + + domain_name = var.fqdn_alias + + domain_name_configuration { + certificate_arn = aws_acm_certificate.this[0].arn + endpoint_type = "REGIONAL" + security_policy = "TLS_1_2" } tags = var.tags } resource "aws_apigatewayv2_authorizer" "this" { - name = var.tags.name + name = var.name api_id = aws_apigatewayv2_api.this.id authorizer_type = "JWT" identity_sources = ["$request.header.Authorization"] @@ -59,10 +78,6 @@ resource "aws_apigatewayv2_integration" "this" { integration_uri = aws_lambda_function.this[each.value.lambda_key].arn timeout_milliseconds = 10500 payload_format_version = "2.0" - - # tls_config { - # server_name_to_verify = "" - # } } resource "aws_apigatewayv2_route" "this" { diff --git a/deployments/terraform/r_cloudwatch.tf b/deployments/terraform/r_cloudwatch.tf index 7f5d0a8..4fa5f58 100644 --- a/deployments/terraform/r_cloudwatch.tf +++ b/deployments/terraform/r_cloudwatch.tf @@ -1,7 +1,15 @@ resource "aws_cloudwatch_log_group" "this" { - for_each = merge(local.lambdas, { "api_gateway" = {} }) + for_each = local.lambdas - name = "/aws/lambda/${each.key}" + name = "/aws/lambda/${var.name}_${each.key}" + retention_in_days = 7 + tags = var.tags +} + +resource "aws_cloudwatch_log_group" "api_gateway" { + count = var.enable_api_gateway_access_logs ? 1 : 0 + + name = "/aws/${var.name}/api_gateway/access" retention_in_days = 7 tags = var.tags } diff --git a/deployments/terraform/r_cognito.tf b/deployments/terraform/r_cognito.tf index 5dac78c..3d2bdcf 100644 --- a/deployments/terraform/r_cognito.tf +++ b/deployments/terraform/r_cognito.tf @@ -1,13 +1,12 @@ resource "aws_cognito_user_pool" "this" { - name = var.tags.name + name = var.name username_attributes = ["email"] auto_verified_attributes = ["email"] admin_create_user_config { - invite_message_template { - email_subject = "Serverless Release Dashboard User Signup" - email_message = file("${path.root}/assets/cognito_invite_template.html") + email_subject = "Moot User Signup" + email_message = file("${path.module}/assets/cognito_invite_template.html") sms_message = <<-MESSAGE username: {username} password: {####} @@ -35,12 +34,15 @@ resource "aws_cognito_user_pool" "this" { } resource "aws_cognito_user_pool_client" "this" { - name = var.tags.name + name = var.name user_pool_id = aws_cognito_user_pool.this.id generate_secret = true allowed_oauth_flows = ["code", "implicit"] allowed_oauth_flows_user_pool_client = true allowed_oauth_scopes = ["email", "openid"] + supported_identity_providers = ["COGNITO"] + callback_urls = ["https://${var.fqdn_alias}"] + explicit_auth_flows = [ "ALLOW_ADMIN_USER_PASSWORD_AUTH", "ALLOW_CUSTOM_AUTH", @@ -48,12 +50,10 @@ resource "aws_cognito_user_pool_client" "this" { "ALLOW_USER_PASSWORD_AUTH", "ALLOW_USER_SRP_AUTH", ] - supported_identity_providers = ["COGNITO"] - callback_urls = ["https://localhost:3000"] } resource "aws_cognito_identity_pool" "this" { - identity_pool_name = var.tags.name + identity_pool_name = var.name allow_unauthenticated_identities = false cognito_identity_providers { @@ -65,10 +65,17 @@ resource "aws_cognito_identity_pool" "this" { } resource "null_resource" "create_admin_user" { - count = var.enable_admin_user_creation ? 1 : 0 - depends_on = [aws_lambda_function.this] + count = var.admin_user_email != "" && !var.enable_delete_admin_user ? 1 : 0 provisioner "local-exec" { command = "aws --region ${data.aws_region.current.name} cognito-idp admin-create-user --user-pool-id ${aws_cognito_user_pool.this.id} --username ${var.admin_user_email} --user-attributes Name=email,Value=${var.admin_user_email}" } } + +resource "null_resource" "delete_admin_user" { + count = var.admin_user_email != "" && var.enable_delete_admin_user ? 1 : 0 + + provisioner "local-exec" { + command = "aws --region ${data.aws_region.current.name} cognito-idp admin-delete-user --user-pool-id ${aws_cognito_user_pool.this.id} --username ${var.admin_user_email}" + } +} diff --git a/deployments/terraform/r_dynamodb.tf b/deployments/terraform/r_dynamodb.tf index e26d171..5c5efda 100644 --- a/deployments/terraform/r_dynamodb.tf +++ b/deployments/terraform/r_dynamodb.tf @@ -1,5 +1,5 @@ resource "aws_dynamodb_table" "this" { - name = var.tags.name + name = var.name billing_mode = "PAY_PER_REQUEST" hash_key = "PK" range_key = "SK" @@ -17,12 +17,8 @@ resource "aws_dynamodb_table" "this" { tags = var.tags } -resource "random_uuid" "this" { - count = var.enable_admin_user_creation ? 1 : 0 -} - resource "aws_dynamodb_table_item" "this" { - count = var.enable_admin_user_creation ? 1 : 0 + count = var.admin_user_email != "" && !var.enable_delete_admin_user ? 1 : 0 depends_on = [null_resource.create_admin_user] table_name = aws_dynamodb_table.this.name @@ -30,10 +26,10 @@ resource "aws_dynamodb_table_item" "this" { range_key = aws_dynamodb_table.this.range_key item = templatefile( - "${path.root}/assets/dynamodb_put_item_input.json", + "${path.module}/assets/dynamodb_put_item_input.json", { admin_user_email = var.admin_user_email - uud = random_uuid.this[0].id + uuid = data.external.admin_user_id[0].result.user_id } ) } diff --git a/deployments/terraform/r_iam.tf b/deployments/terraform/r_iam.tf index 5b23385..9870f75 100644 --- a/deployments/terraform/r_iam.tf +++ b/deployments/terraform/r_iam.tf @@ -1,7 +1,7 @@ resource "aws_iam_role" "this" { for_each = local.lambdas - name = "${var.tags.name}_${each.key}" + name = "${var.name}_${each.key}" assume_role_policy = data.aws_iam_policy_document.role.json tags = var.tags } @@ -9,7 +9,7 @@ resource "aws_iam_role" "this" { resource "aws_iam_role_policy" "this" { for_each = local.lambdas - name = "${var.tags.name}_${each.key}" + name = "${var.name}_${each.key}" role = aws_iam_role.this[each.key].name policy = data.aws_iam_policy_document.policy[each.key].json } diff --git a/deployments/terraform/r_lambda.tf b/deployments/terraform/r_lambda.tf index 92930f6..bc1057b 100644 --- a/deployments/terraform/r_lambda.tf +++ b/deployments/terraform/r_lambda.tf @@ -2,7 +2,7 @@ resource "null_resource" "lambda_build" { for_each = local.lambdas triggers = { - binary_exists = fileexists("${local.path}/bin/${each.key}") + binary_exists = local.null.lambda_binary_exists[each.key] main = join("", [ for file in fileset("${local.path}/cmd/${each.key}", "*.go") : filebase64("${local.path}/cmd/${each.key}/${file}") @@ -45,7 +45,7 @@ resource "aws_lambda_function" "this" { for_each = local.lambdas filename = "${local.path}/archive/${each.key}.zip" - function_name = each.key + function_name = "${var.name}_${each.key}" description = each.value.description role = aws_iam_role.this[each.key].arn handler = each.key diff --git a/deployments/terraform/r_null.tf b/deployments/terraform/r_null.tf new file mode 100644 index 0000000..5e2fd28 --- /dev/null +++ b/deployments/terraform/r_null.tf @@ -0,0 +1,22 @@ +resource "null_resource" "build_frontend" { + + triggers = { + deploy_on_version_changes = split("?ref=", local.frontend_module_comprehension.Source)[1] + } + + provisioner "local-exec" { + command = "cd ${local.frontend_module_path} && yarn install" + } + + provisioner "local-exec" { + command = "cd ${local.frontend_module_path} && echo \"VUE_APP_API_GATEWAY_ENDPOINT=${aws_apigatewayv2_api.this.api_endpoint}\" > .env" + } + + provisioner "local-exec" { + command = "cd ${local.frontend_module_path} && yarn build" + } + + provisioner "local-exec" { + command = "cd ${local.frontend_module_path} && aws s3 sync --cache-control 'max-age=604800' dist/ s3://${aws_s3_bucket.this.id}" + } +} diff --git a/deployments/terraform/r_route53.tf b/deployments/terraform/r_route53.tf new file mode 100644 index 0000000..c18db7d --- /dev/null +++ b/deployments/terraform/r_route53.tf @@ -0,0 +1,30 @@ +resource "aws_route53_record" "alias" { + count = var.hosted_zone_name != "" && var.fqdn_alias != "" ? 1 : 0 + + zone_id = data.aws_route53_zone.this[0].zone_id + name = var.fqdn_alias + type = "A" + + alias { + name = module.cloudfront.cloudfront_distribution_domain_name + zone_id = module.cloudfront.cloudfront_distribution_hosted_zone_id + evaluate_target_health = false + } +} + +resource "aws_route53_record" "acm" { + for_each = { + for dvo in aws_acm_certificate.this[0].domain_validation_options : dvo.domain_name => { + name = dvo.resource_record_name + record = dvo.resource_record_value + type = dvo.resource_record_type + } if var.hosted_zone_name != "" && var.fqdn_alias != "" + } + + allow_overwrite = true + name = each.value.name + records = [each.value.record] + ttl = 60 + type = each.value.type + zone_id = data.aws_route53_zone.this[0].zone_id +} diff --git a/deployments/terraform/r_s3.tf b/deployments/terraform/r_s3.tf index ea91627..4469313 100644 --- a/deployments/terraform/r_s3.tf +++ b/deployments/terraform/r_s3.tf @@ -1,12 +1,13 @@ resource "aws_s3_bucket" "this" { - bucket = "release-dashboard-${data.aws_caller_identity.current.account_id}" - acl = "public-read" - policy = data.aws_iam_policy_document.s3.json + bucket = "${replace(var.name, "_", "-")}-${data.aws_caller_identity.current.account_id}" + acl = "public-read" + policy = data.aws_iam_policy_document.s3.json + force_destroy = true cors_rule { allowed_headers = ["*"] allowed_methods = ["GET", "POST"] - allowed_origins = [var.dev_cloudfront_dns] + allowed_origins = [var.fqdn_alias] expose_headers = ["ETag"] max_age_seconds = 3000 } diff --git a/deployments/terraform/r_ssm.tf b/deployments/terraform/r_ssm.tf index 96d3eee..22fc043 100644 --- a/deployments/terraform/r_ssm.tf +++ b/deployments/terraform/r_ssm.tf @@ -1,7 +1,7 @@ resource "aws_ssm_parameter" "this" { for_each = local.ssm_parameters - name = "/${var.tags.name}/${each.key}" + name = "/${var.name}/${each.key}" description = each.value.description type = "SecureString" value = each.value.parameter_value diff --git a/deployments/terraform/terraform.tfvars b/deployments/terraform/terraform.tfvars deleted file mode 100644 index 5011895..0000000 --- a/deployments/terraform/terraform.tfvars +++ /dev/null @@ -1,6 +0,0 @@ -tags = { - name = "dev_release_dashboard" - managed_by = "terraform" -} - -enable_admin_user_creation = true diff --git a/deployments/terraform/variables.tf b/deployments/terraform/variables.tf index f7bd871..1551424 100644 --- a/deployments/terraform/variables.tf +++ b/deployments/terraform/variables.tf @@ -1,29 +1,41 @@ +variable "name" { + type = string + description = "Name to be applied to all resources." + default = "release_dashboard" +} + variable "tags" { type = map(string) description = "Map of tags to be applied to resources." + default = {} } variable "admin_user_email" { type = string - description = "Email address for dashboard admin" -} - -variable "enable_admin_user_creation" { - type = bool description = <<-DESC Controls the creation of an admin user that is required to initially gain access to the dashboard. If access to the dashboard is completely lost, do the following - • `var.enable_admin_user_creation = false` - • terraform apply - • `var.enable_admin_user_creation = true` - • terraform apply + • `var.enable_delete_admin_user = true` + • `terraform apply` + • `var.enable_delete_admin_user = false` + • `terraform apply` If the initial admin user should no longer be able to access the dashboard, revoke access by - setting `var.enable_admin_user_creation = false` and running `terraform apply` + setting `var.enable_delete_admin_user = true` and running `terraform apply` + DESC + default = "" +} + +variable "enable_delete_admin_user" { + type = bool + description = <<-DESC + Destroys the admin user. + + Set this value to true to destroy the user, and to false to recreate the user. DESC - default = true + default = false } variable "github_token" { @@ -44,6 +56,23 @@ variable "slack_webhook_url" { default = "" } -variable "dev_cloudfront_dns" { - type = string +variable "hosted_zone_name" { + type = string + description = "Name of AWS Route53 Hosted Zone for DNS." + default = "" +} + +variable "fqdn_alias" { + type = string + description = <<-DESC + ALIAS for the Cloudfront distribution, S3, Cognito and API Gateway. Must be in the form of + `example.com`. + DESC + default = "" +} + +variable "enable_api_gateway_access_logs" { + type = bool + description = "Enables API Gateway access logging to cloudwatch for the default stage." + default = false } diff --git a/go.mod b/go.mod index fe8ccb8..ec10eef 100644 --- a/go.mod +++ b/go.mod @@ -1,4 +1,4 @@ -module github.com/seanturner026/serverless-release-dashboard +module github.com/seanturner026/moot go 1.16 @@ -11,6 +11,7 @@ require ( github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-retryablehttp v0.6.8 // indirect github.com/sirupsen/logrus v1.8.1 + github.com/urfave/cli/v2 v2.2.0 github.com/xanzy/go-gitlab v0.44.0 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 // indirect golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93 diff --git a/go.sum b/go.sum index 1ca8957..9950ac9 100644 --- a/go.sum +++ b/go.sum @@ -44,6 +44,7 @@ github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMn github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU= +github.com/cpuguy83/go-md2man/v2 v2.0.0 h1:EoUDS0afbrsXAZ9YQ9jdu/mZ2sXgT1/2yyNng4PGlyM= github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= @@ -134,7 +135,9 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= +github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q= github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE= github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= @@ -143,6 +146,7 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/urfave/cli/v2 v2.2.0 h1:JTTnM6wKzdA0Jqodd966MVj4vWbbquZykeX1sKbe2C4= github.com/urfave/cli/v2 v2.2.0/go.mod h1:SE9GqnLQmjVa0iPEY0f1w3ygNIYcIJ0OKPMoW2caLfQ= github.com/xanzy/go-gitlab v0.44.0 h1:cEiGhqu7EpFGuei2a2etAwB+x6403E5CvpLn35y+GPs= github.com/xanzy/go-gitlab v0.44.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug= diff --git a/internal/util/post_to_slack.go b/internal/util/post_to_slack.go index ce5eea4..0f075fb 100644 --- a/internal/util/post_to_slack.go +++ b/internal/util/post_to_slack.go @@ -28,7 +28,6 @@ func PostToSlack(webhookURL, message string) error { req.Header.Add("Content-Type", "application/json") clientSlack := &http.Client{Timeout: 4 * time.Second} - log.Printf("[INFO] sending slack notification...") resp, err := clientSlack.Do(req) if err != nil { log.Error(fmt.Sprintf("unable to send POST request, %v", err))