Skip to content

Latest commit

 

History

History
203 lines (158 loc) · 11.1 KB

README.md

File metadata and controls

203 lines (158 loc) · 11.1 KB
Raw

AWS CodePipeline CI/CD example

Terraform is an infrastructure-as-code (IaC) tool that helps you create, update, and version your infrastructure in a secure and repeatable manner.

The scope of this pattern is to provide a guide and ready to use terraform configurations to setup validation pipelines with end-to-end tests based on AWS CodePipeline, AWS CodeBuild, AWS CodeCommit and Terraform.

The created pipeline uses the best practices for infrastructure validation and has the below stages

  • validate - This stage focuses on terraform IaC validation tools and commands such as terraform validate, terraform format, tfsec, tflint and checkov
  • plan - This stage creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure.
  • apply - This stage uses the plan created above to provision the infrastructure in the test account.
  • destroy - This stage destroys the infrastructure created in the above stage. Running these four stages ensures the integrity of the terraform configurations.

Directory Structure

|-- CODE_OF_CONDUCT.md
|-- CONTRIBUTING.md
|-- LICENSE
|-- README.md
|-- data.tf
|-- examples
|   `-- terraform.tfvars
|-- locals.tf
|-- main.tf
|-- modules
|   |-- codebuild
|   |   |-- README.md
|   |   |-- main.tf
|   |   |-- outputs.tf
|   |   `-- variables.tf
|   |-- codecommit
|   |   |-- README.md
|   |   |-- data.tf
|   |   |-- main.tf
|   |   |-- outputs.tf
|   |   `-- variables.tf
|   |-- codepipeline
|   |   |-- README.md
|   |   |-- main.tf
|   |   |-- outputs.tf
|   |   `-- variables.tf
|   |-- iam-role
|   |   |-- README.md
|   |   |-- data.tf
|   |   |-- main.tf
|   |   |-- outputs.tf
|   |   `-- variables.tf
|   |-- kms
|   |   |-- README.md
|   |   |-- main.tf
|   |   |-- outputs.tf
|   |   `-- variables.tf
|   `-- s3
|       |-- README.md
|       |-- main.tf
|       |-- outputs.tf
|       `-- variables.tf
|-- templates
|   |-- buildspec_apply.yml
|   |-- buildspec_destroy.yml
|   |-- buildspec_plan.yml
|   |-- buildspec_validate.yml
|   `-- scripts
|       `-- tf_ssp_validation.sh
`-- variables.tf

Installation

Step 1: Clone this repository.

[email protected]:aws-samples/aws-codepipeline-terraform-cicd-samples.git

Note: If you don't have git installed, install git.

Step 2: Update the variables in examples/terraform.tfvars based on your requirement. Make sure you ae updating the variables project_name, environment, source_repo_name, source_repo_branch, create_new_repo, stage_input and build_projects.

  • If you are planning to use an existing terraform CodeCommit repository, then update the variable create_new_repo as false and provide the name of your existing repo under the variable source_repo_name
  • If you are planning to create new terraform CodeCommit repository, then update the variable create_new_repo as true and provide the name of your new repo under the variable source_repo_name

Step 3: Update remote backend configuration as required

Step 4: Configure the AWS Command Line Interface (AWS CLI) where this IaC is being executed. For more information, see Configuring the AWS CLI.

Step 5: Initialize the directory. Run terraform init

Step 6: Start a Terraform run using the command terraform apply

Note: Sample terraform.tfvars are available in the examples directory. You may use the below command if you need to provide this sample tfvars as an input to the apply command.

terraform apply -var-file=./examples/terraform.tfvars

Pre-Requisites

Step 1: You would get source_repo_clone_url_http as an output of the installation step. Clone the repository to your local.

git clone <source_repo_clone_url_http>

Step 2: Clone this repository.

[email protected]:aws-samples/aws-eks-accelerator-for-terraform.git

Note: If you don't have git installed, install git.

Step 3: Copy the templates folder to the AWS CodeCommit sourcecode repository which contains the terraform code to be deployed.

cd examples/ci-cd/aws-codepipeline
cp -r templates $YOUR_CODECOMMIT_REPO_ROOT

Step 4: Update the variables in the template files with appropriate values and push the same.

Step 5: Trigger the pipeline created in the Installation step.

Note1: The IAM Role used by the newly created pipeline is very restrictive and follows the Principle of least privilege. Please update the IAM Policy with the required permissions. Alternatively, use the create_new_role = false option to use an existing IAM role and specify the role name using the variable codepipeline_iam_role_name

Note2: If the create_new_repo flag is set to true, a new blank repository will be created with the name assigned to the variable source_repo_name. Since this repository will not be containing the templates folder specified in Step 3 nor any code files, the initial run of the pipeline will be marked as failed in the Download-Source stage itself.

Note3: If the create_new_repo flag is set to false to use an existing repository, ensure the pre-requisite steps specified in step 3 have been done on the target repository.

Requirements

Name Version
terraform >= 1.0.0

Providers

Name Version
aws >= 4.20.1

Modules

Name Source Version
codebuild_terraform ./modules/codebuild n/a
codecommit_infrastructure_source_repo ./modules/codecommit n/a
codepipeline_iam_role ./modules/iam-role n/a
codepipeline_kms ./modules/kms n/a
codepipeline_terraform ./modules/codepipeline n/a
s3_artifacts_bucket ./modules/s3 n/a

Resources

Name Type
aws_caller_identity.current data source
aws_region.current data source

Inputs

Name Description Type Default Required
build_project_source aws/codebuild/standard:4.0 string "CODEPIPELINE" no
build_projects Tags to be attached to the CodePipeline list(string) n/a yes
builder_compute_type Relative path to the Apply and Destroy build spec file string "BUILD_GENERAL1_SMALL" no
builder_image Docker Image to be used by codebuild string "aws/codebuild/amazonlinux2-x86_64-standard:3.0" no
builder_image_pull_credentials_type Image pull credentials type used by codebuild project string "CODEBUILD" no
builder_type Type of codebuild run environment string "LINUX_CONTAINER" no
codepipeline_iam_role_name Name of the IAM role to be used by the Codepipeline string "codepipeline-role" no
create_new_repo Whether to create a new repository. Values are true or false. Defaulted to true always. bool true no
create_new_role Whether to create a new IAM Role. Values are true or false. Defaulted to true always. bool true no
environment Environment in which the script is run. Eg: dev, prod, etc string n/a yes
project_name Unique name for this project string n/a yes
repo_approvers_arn ARN or ARN pattern for the IAM User/Role/Group that can be used for approving Pull Requests string n/a yes
source_repo_branch Default branch in the Source repo for which CodePipeline needs to be configured string n/a yes
source_repo_name Source repo name of the CodeCommit repository string n/a yes
stage_input Tags to be attached to the CodePipeline list(map(any)) n/a yes

Outputs

Name Description
codebuild_arn The ARN of the Codebuild Project
codebuild_name The Name of the Codebuild Project
codecommit_arn The ARN of the Codecommit repository
codecommit_name The name of the Codecommit repository
codecommit_url The Clone URL of the Codecommit repository
codepipeline_arn The ARN of the CodePipeline
codepipeline_name The Name of the CodePipeline
iam_arn The ARN of the IAM Role used by the CodePipeline
kms_arn The ARN of the KMS key used in the codepipeline
s3_arn The ARN of the S3 Bucket
s3_bucket_name The Name of the S3 Bucket

Security

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.