new-environment.yml

name: "Terraform: New environment"

on:
  push:
    branches:
      - main
    paths:
      - '.github/workflows/new-environment.yml'
      - 'terraform/environments/*.tf'
      - 'environments/**.json'
      - 'terraform/environments/bootstrap/**'
  pull_request:
    branches:
      - main
    types: [opened, edited, reopened, synchronize]
    paths:
      - '.github/workflows/new-environment.yml'
      - 'terraform/environments/*.tf'
      - 'environments/**.json'
  workflow_dispatch:

env:
  TF_IN_AUTOMATION: true
  AWS_REGION: "eu-west-2"
  ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

defaults:
  run:
    shell: bash

jobs:
  check-environments-deployment-plan:
    runs-on: ubuntu-latest
    if: github.ref != 'refs/heads/main' && github.event_name != 'workflow_dispatch'
    env:
      TF_VAR_github_token: ${{ secrets.TERRAFORM_GITHUB_TOKEN }}

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.aws_organizations_root_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/ModernisationPlatformGithubActionsRole"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@97f030cf6dc0b4f5e0da352c7bca9cca34579800 # v3.1.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false

      - name: Run terraform plan for root terraform/environments
        run: |
          terraform --version
          # Test if this is a PR or PULL event

          #USE IF RUNNING IN GITHUB ACTIONS
          if [ ! -z ${{ github.event.pull_request.number }} ]
          then

          #USE IF USING ACT
          # if [ ! -z ${PULL_REQUEST_NUMBER} ]
          # then

          #CONFIGURE TERRAFORM
          bash scripts/terraform-init.sh terraform/environments

          #RUN TERRAFORM PLAN
          PLAN=`bash scripts/terraform-plan.sh terraform/environments | tee /dev/stderr | grep '^Plan: \|^No changes.'`
          PLAN="> TERRAFORM PLAN RESULT - ACCOUNTS-TO-CREATE/MODIFY/DELETE -
          ${PLAN}"
          bash scripts/update-pr-comments.sh "${PLAN}"
          fi
        env:
          SECRET: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ secrets.GITHUB_REPOSITORY }}
          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
  create-environment:
    runs-on: ubuntu-latest
    if: github.event.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    env:
      TF_VAR_github_token: ${{ secrets.TERRAFORM_GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.aws_organizations_root_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/ModernisationPlatformGithubActionsRole"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@97f030cf6dc0b4f5e0da352c7bca9cca34579800 # v3.1.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: Run terraform init in terraform/environments
        run: bash scripts/terraform-init.sh terraform/environments
      - name: Run terraform plan in terraform/environments
        run: bash scripts/terraform-plan.sh terraform/environments
      - name: Run terraform apply in terraform/environments
        run: bash scripts/terraform-apply.sh terraform/environments
      - name: Slack failure notification
        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
        with:
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        if: ${{ failure() }}
  provision-workspaces:
    runs-on: ubuntu-latest
    if: github.event.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    needs: [create-environment]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@97f030cf6dc0b4f5e0da352c7bca9cca34579800 # v3.1.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: Provision workspaces in terraform/environments/bootstrap/*
        run: bash scripts/provision-terraform-workspaces.sh bootstrap
      - name: Provision workspaces in terraform/environments/*
        run: bash scripts/provision-terraform-workspaces.sh all-environments
      - name: Slack failure notification
        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
        with:
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        if: ${{ failure() }}
  delegate-access:
    runs-on: ubuntu-latest
    if: github.event.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    needs: [provision-workspaces]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.aws_organizations_root_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/ModernisationPlatformGithubActionsRole"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@97f030cf6dc0b4f5e0da352c7bca9cca34579800 # v3.1.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: get new account(s)
        id: new_account
        run: |
          files=$(git diff --name-only --diff-filter=AM @^ -- 'environments/*.json' | uniq | sed 's#environments/##' | sed 's/\.json$//' | base64 )
          echo "files=$files" >> $GITHUB_OUTPUT
      - name: Run delegate access
        run: |
          readarray -t accounts <<< "$(echo "${{ steps.new_account.outputs.files }}" | base64 --decode)"
          if [[ ! -z ${accounts} ]]
          then
          for i in "${accounts[@]}"
          do
          echo "[+] Running delegate-access baseline for account ${i}"
          bash scripts/terraform-init.sh terraform/environments/bootstrap/delegate-access
          bash scripts/setup-baseline.sh terraform/environments/bootstrap/delegate-access "${i}" plan
          bash scripts/setup-baseline.sh terraform/environments/bootstrap/delegate-access "${i}" apply
          done
          else
          echo "[+] There were no AWS member accounts to process"
          fi
      - name: Slack failure notification
        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
        with:
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        if: ${{ failure() }}
  remove-default-vpc:
    runs-on: ubuntu-latest
    if: github.event.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    needs: [delegate-access]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - name: get new account(s)
        id: new_account
        run: |
          files=$(git diff --name-only --diff-filter=AM @^ -- 'environments/*.json' | uniq | sed 's#environments/##' | sed 's/\.json$//' | base64 )
          echo "files=$files" >> $GITHUB_OUTPUT
      - name: Remove Default VPC
        run: |
          readarray -t accounts <<< "$(echo "${{ steps.new_account.outputs.files }}" | base64 --decode)"
          if [[ ! -z ${accounts} ]]; then
          for i in "${accounts[@]}"; do
          environments=$(jq -r '.environments[].name' "environments/${i}.json")
          for env in $environments; do
          key="${i}-${env}"
          account_number=$(echo "$ENVIRONMENT_MANAGEMENT" | jq -r ".account_ids[\"$key\"]")
          bash ./scripts/internal/remove-default-vpc/remove_default_vpc_new_account.sh $account_number
          done
          done
          else
          echo "[+] There were no AWS member accounts to process"
          fi   
      - name: Slack failure notification
        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
        with:
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        if: ${{ failure() }}
  secure-baselines:
    runs-on: ubuntu-latest
    if: github.event.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    needs: [delegate-access]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@97f030cf6dc0b4f5e0da352c7bca9cca34579800 # v3.1.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: get new account(s)
        id: new_account
        run: |
          files=$(git diff --name-only --diff-filter=AM @^ -- 'environments/*.json' | uniq | sed 's#environments/##' | sed 's/\.json$//' | base64 )
          echo "files=$files" >> $GITHUB_OUTPUT
      - name: Run secure baselines
        run: |
          readarray -t accounts <<< "$(echo "${{ steps.new_account.outputs.files }}" | base64 --decode)"
          if [[ ! -z ${accounts} ]]
          then
          for i in "${accounts[@]}"
          do
          echo "[+] Running secure baseline for account ${i}"
          bash scripts/terraform-init.sh terraform/environments/bootstrap/secure-baselines
          bash scripts/setup-baseline.sh terraform/environments/bootstrap/secure-baselines "${i}" plan
          bash scripts/setup-baseline.sh terraform/environments/bootstrap/secure-baselines "${i}" apply
          done
          else
          echo "[+] There were no AWS member accounts to process"
          fi
      - name: Slack failure notification
        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
        with:
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        if: ${{ failure() }}
  single-sign-on:
    runs-on: ubuntu-latest
    if: github.event.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    needs: [provision-workspaces, delegate-access]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@97f030cf6dc0b4f5e0da352c7bca9cca34579800 # v3.1.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: get new account(s)
        id: new_account
        run: |
          files=$(git diff --name-only --diff-filter=AM @^ -- 'environments/*.json' | uniq | sed 's#environments/##' | sed 's/\.json$//' | base64 )
          echo "files=$files" >> $GITHUB_OUTPUT
      - name: Run single sign on
        run: |
          readarray -t accounts <<< "$(echo "${{ steps.new_account.outputs.files }}" | base64 --decode)"
          if [[ ! -z ${accounts} ]]
          then
          for i in "${accounts[@]}"
          do
          echo "[+] Running single sign on baseline for account ${i}"
          bash scripts/terraform-init.sh terraform/environments/bootstrap/single-sign-on
          bash scripts/setup-baseline.sh terraform/environments/bootstrap/single-sign-on "${i}" plan
          bash scripts/setup-baseline.sh terraform/environments/bootstrap/single-sign-on "${i}" apply
          done
          else
          echo "[+] There were no AWS member accounts to process"
          fi
      - name: Slack failure notification
        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
        with:
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        if: ${{ failure() }}
  member-bootstrap:
    runs-on: ubuntu-latest
    if: github.event.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    needs: [single-sign-on]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@97f030cf6dc0b4f5e0da352c7bca9cca34579800 # v3.1.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: get new account(s)
        id: new_account
        run: |
          files=$(git diff --name-only --diff-filter=AM @^ -- 'environments/*.json' | uniq | sed 's#environments/##' | sed 's/\.json$//' | base64 )
          echo "files=$files" >> $GITHUB_OUTPUT
      - name: Run secure baselines
        run: |
          readarray -t accounts <<< "$(echo "${{ steps.new_account.outputs.files }}" | base64 --decode)"
          if [[ ! -z ${accounts} ]]
          then
          for i in "${accounts[@]}"
          do
          echo "[+] Running secure baseline for account ${i}"
          bash scripts/terraform-init.sh terraform/environments/bootstrap/member-bootstrap
          bash scripts/setup-baseline.sh terraform/environments/bootstrap/member-bootstrap "${i}" plan
          bash scripts/setup-baseline.sh terraform/environments/bootstrap/member-bootstrap "${i}" apply
          done
          else
          echo "[+] There were no AWS member accounts to process"
          fi
      - name: Slack failure notification
        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
        with:
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        if: ${{ failure() }}