Skip to content

Dev-to-Stage: ECR for new Bursar Transfer Application #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 31, 2023
Merged

Dev-to-Stage: ECR for new Bursar Transfer Application #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,7 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
| Name | Source | Version |
|------|--------|---------|
| ecr\_alma\_webhook\_lambdas | ./modules/ecr | n/a |
| ecr\_bursar | ./modules/ecr | n/a |
| ecr\_carbon | ./modules/ecr | n/a |
| ecr\_creditcardslips | ./modules/ecr | n/a |
| ecr\_dss | ./modules/ecr | n/a |
Expand Down Expand Up @@ -122,6 +123,10 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
| alma\_webhook\_lambdas\_makefile | Full contents of the Makefile for the alma-webhook-lambdas repo (allows devs to push to Dev account only) |
| alma\_webhook\_lambdas\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-webhook-lambdas repo |
| alma\_webhook\_lambdas\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-webhook-lambdas repo |
| bursar\_dev\_build\_workflow | Full contents of the dev-build.yml for the alma-bursartransfer repo |
| bursar\_makefile | Full contents of the Makefile for the alma-bursartransfer repo (allows devs to push to Dev account only) |
| bursar\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-bursartransfer repo |
| bursar\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-bursartransfer repo |
| carbon\_dev\_build\_workflow | Full contents of the dev-build.yml for the carbon repo |
| carbon\_makefile | Full contents of the Makefile for the carbon repo (allows devs to push to Dev account only) |
| carbon\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the carbon repo |
Expand Down
62 changes: 62 additions & 0 deletions almaintegrations-ecrs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,3 +185,65 @@ output "sapinvoices_prod_promote_workflow" {
)
description = "Full contents of the prod-promote.yml for the alma-sapinvoices repo"
}


################################################################################
## bursar transfer app
module "ecr_bursar" {
source = "./modules/ecr"
repo_name = "alma-bursartransfer"
login_policy_arn = aws_iam_policy.login.arn
oidc_arn = data.aws_ssm_parameter.oidc_arn.value
environment = var.environment
tfoutput_ssm_path = var.tfoutput_ssm_path
tags = {
app-repo = "alma-bursartransfer"
}
}

# Outputs in dev
output "bursar_dev_build_workflow" {
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
region = var.aws_region
role = module.ecr_bursar.gha_role
ecr = module.ecr_bursar.repository_name
function = ""
}
)
description = "Full contents of the dev-build.yml for the alma-bursartransfer repo"
}
output "bursar_makefile" {
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/makefile.tpl", {
ecr_name = module.ecr_bursar.repository_name
ecr_url = module.ecr_bursar.repository_url
function = ""
}
)
description = "Full contents of the Makefile for the alma-bursartransfer repo (allows devs to push to Dev account only)"
}

# Outputs in stage
output "bursar_stage_build_workflow" {
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
region = var.aws_region
role = module.ecr_bursar.gha_role
ecr = module.ecr_bursar.repository_name
function = ""
}
)
description = "Full contents of the stage-build.yml for the alma-bursartransfer repo"
}

# Outputs after promotion to prod
output "bursar_prod_promote_workflow" {
value = var.environment == "stage" || var.environment == "dev" ? null : templatefile("${path.module}/files/prod-promote.tpl", {
region = var.aws_region
role_stage = "${module.ecr_bursar.repo_name}-gha-stage"
role_prod = "${module.ecr_bursar.repo_name}-gha-prod"
ecr_stage = "${module.ecr_bursar.repo_name}-stage"
ecr_prod = "${module.ecr_bursar.repo_name}-prod"
function = ""
}
)
description = "Full contents of the prod-promote.yml for the alma-bursartransfer repo"
}
3 changes: 3 additions & 0 deletions modules/ecr/ssm_outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
# ecr repository_name
# Type:string datatype:text format:string
resource "aws_ssm_parameter" "ecr_repository_name" {
#checkov:skip=CKV_AWS_337:By default we are not encrypting parameters in tfoutput_ssm_path
#checkov:skip=CKV2_AWS_34:By default we are not encrypting parameters in tfoutput_ssm_path
type = "String"
name = "${var.tfoutput_ssm_path}/${var.repo_name}/ecr-repository-name"
Expand All @@ -16,6 +17,7 @@ resource "aws_ssm_parameter" "ecr_repository_name" {
# ecr repository_url
# Type:string datatype:text format:string
resource "aws_ssm_parameter" "ecr_repository_url" {
#checkov:skip=CKV_AWS_337:By default we are not encrypting parameters in tfoutput_ssm_path
#checkov:skip=CKV2_AWS_34:By default we are not encrypting parameters in tfoutput_ssm_path
type = "String"
name = "${var.tfoutput_ssm_path}/${var.repo_name}/ecr-repository-url"
Expand All @@ -29,6 +31,7 @@ resource "aws_ssm_parameter" "ecr_repository_url" {
# ecr role so that we can add the updatefunctioncode to it after the lambda itself is created
# Type:string datatype:text format:string
resource "aws_ssm_parameter" "gha_role" {
#checkov:skip=CKV_AWS_337:By default we are not encrypting parameters in tfoutput_ssm_path
#checkov:skip=CKV2_AWS_34:By default we are not encrypting parameters in tfoutput_ssm_path
type = "String"
name = "${var.tfoutput_ssm_path}/${var.repo_name}/gha-role"
Expand Down