Merge pull request #244 from silinternational/feature/appconfig

add AppConfig resources for 040-id-broker module

.gitignore

@@ -4,3 +4,4 @@
 *.env
 google-auth.json
 .terraform/
+.terraform.lock.hcl

terraform/000-core/main.tf

@@ -93,3 +93,26 @@ resource "aws_acm_certificate_validation" "idp" {
   certificate_arn         = aws_acm_certificate.idp[0].arn
   validation_record_fqdns = [cloudflare_record.idp-verification[0].hostname]
 }
+
+resource "aws_appconfig_application" "this" {
+  count = var.appconfig_app_name == "" ? 0 : 1
+
+  name = var.appconfig_app_name
+}
+
+resource "aws_appconfig_environment" "this" {
+  count = var.appconfig_app_name == "" ? 0 : 1
+
+  name           = var.app_env
+  application_id = one(aws_appconfig_application.this[*].id)
+}
+
+resource "aws_appconfig_deployment_strategy" "this" {
+  count = var.appconfig_app_name == "" ? 0 : 1
+
+  name                           = "immediate"
+  deployment_duration_in_minutes = 0
+  growth_factor                  = 100
+  growth_type                    = "LINEAR"
+  replicate_to                   = "NONE"
+}

terraform/000-core/outputs.tf

@@ -45,3 +45,16 @@ output "ecsServiceRole_arn" {
   value = module.ecscluster.ecsServiceRole_arn
 }
 
+
+/*
+ * AppConfig outputs
+ */
+output "app_id" {
+  description = "AppConfig application ID"
+  value       = one(aws_appconfig_application.this[*].id)
+}
+
+output "env_id" {
+  description = "AppConfig environment ID"
+  value       = one(aws_appconfig_environment.this[*].environment_id)
+}

terraform/000-core/vars.tf

@@ -20,3 +20,20 @@ variable "create_cd_user" {
   default     = true
 }
 
+
+/*
+ * Optional variables
+ */
+
+variable "app_env" {
+  description = "The abbreviated version of the environment used for naming resources, typically either stg or prod. Default: 'prod'"
+  type        = string
+  default     = "prod"
+}
+
+variable "appconfig_app_name" {
+  type        = string
+  description = "The application name in AppConfig. If not specified, no AppConfig resources will be created."
+  default     = ""
+}
+

terraform/040-id-broker/main.tf

@@ -1,6 +1,8 @@
 locals {
   aws_account = data.aws_caller_identity.this.account_id
   aws_region  = data.aws_region.current.name
+  cfg_id      = one(aws_appconfig_configuration_profile.this[*].configuration_profile_id)
+  config_id   = local.cfg_id == null ? "" : local.cfg_id
 }
 
 /*
@@ -79,6 +81,9 @@ locals {
   subdomain_with_region = "${var.subdomain}-${local.aws_region}"
 
   task_def = templatefile("${path.module}/task-definition.json", {
+    app_id                                     = var.app_id
+    env_id                                     = var.env_id
+    config_id                                  = local.config_id
     api_access_keys                            = local.api_access_keys
     abandoned_user_abandoned_period            = var.abandoned_user_abandoned_period
     abandoned_user_best_practice_url           = var.abandoned_user_best_practice_url
@@ -202,13 +207,17 @@ module "ecsservice" {
   tg_arn             = aws_alb_target_group.broker.arn
   lb_container_name  = "web"
   lb_container_port  = "80"
+  task_role_arn      = one(aws_iam_role.app_config[*].arn)
 }
 
 /*
  * Create ECS service
  */
 locals {
   task_def_cron = templatefile("${path.module}/task-definition.json", {
+    app_id                                     = var.app_id
+    env_id                                     = var.env_id
+    config_id                                  = local.config_id
     api_access_keys                            = local.api_access_keys
     abandoned_user_abandoned_period            = var.abandoned_user_abandoned_period
     abandoned_user_best_practice_url           = var.abandoned_user_best_practice_url
@@ -421,6 +430,73 @@ data "cloudflare_zone" "domain" {
 }
 
 
+/*
+ * Create role for access to AppConfig
+ */
+resource "aws_iam_role" "app_config" {
+  count = var.app_id == "" ? 0 : 1
+
+  name = "appconfig-${var.idp_name}-${var.app_name}-${var.app_env}-${local.aws_region}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "ECSAssumeRoleAppConfig"
+        Effect = "Allow"
+        Principal = {
+          Service = [
+            "ecs-tasks.amazonaws.com",
+          ]
+        }
+        Action = "sts:AssumeRole"
+        Condition = {
+          ArnLike = {
+            "aws:SourceArn" = "arn:aws:ecs:${local.aws_region}:${local.aws_account}:*"
+          }
+          StringEquals = {
+            "aws:SourceAccount" = local.aws_account
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "app_config" {
+  count = var.app_id == "" ? 0 : 1
+
+  name = "app_config"
+  role = one(aws_iam_role.app_config[*].id)
+  policy = jsonencode(
+    {
+      Version = "2012-10-17"
+      Statement = [
+        {
+          Sid    = "AppConfig"
+          Effect = "Allow"
+          Action = [
+            "appconfig:GetLatestConfiguration",
+            "appconfig:StartConfigurationSession",
+          ]
+          Resource = "arn:aws:appconfig:${local.aws_region}:${local.aws_account}:application/${var.app_id}/environment/${var.env_id}/configuration/${local.config_id}"
+        }
+      ]
+  })
+}
+
+
+/*
+ * Create AppConfig configuration profile
+ */
+resource "aws_appconfig_configuration_profile" "this" {
+  count = var.app_id == "" ? 0 : 1
+
+  application_id = var.app_id
+  name           = "${var.app_name}-${var.app_env}"
+  location_uri   = "hosted"
+}
+
 /*
  * AWS data
  */

terraform/040-id-broker/task-definition.json

@@ -21,6 +21,22 @@
     "ulimits": null,
     "dockerSecurityOptions": null,
     "environment": [
+      {
+        "name": "APP_ID",
+        "value": "${app_id}"
+      },
+      {
+        "name": "AWS_REGION",
+        "value": "${aws_region}"
+      },
+      {
+        "name": "ENV_ID",
+        "value": "${env_id}"
+      },
+      {
+        "name": "CONFIG_ID",
+        "value": "${config_id}"
+      },
       {
         "name": "ABANDONED_USER_abandonedPeriod",
         "value": "${abandoned_user_abandoned_period}"

terraform/040-id-broker/vars.tf

@@ -25,7 +25,7 @@ variable "app_name" {
 }
 
 variable "aws_region" {
-  description = "This is deprecated. The region is more reliably determined from the aws_region data source."
+  description = "This is not used. The region is more reliably determined from the aws_region data source."
   type        = string
   default     = ""
 }
@@ -580,3 +580,15 @@ variable "vpc_id" {
 variable "wildcard_cert_arn" {
   type = string
 }
+
+variable "app_id" {
+  description = "AppConfig application ID"
+  type        = string
+  default     = ""
+}
+
+variable "env_id" {
+  description = "AppConfig environment ID"
+  type        = string
+  default     = ""
+}