updated workflows, backend, and test item

.github/workflows/terraform-apply.yml

@@ -1,95 +1,36 @@
-name: Terraform Apply on Merge
+name: Terraform apply (OIDC)
 
-on: 
+on:
   push:
     branches:
-      - main
-    paths:
-      - 'terraform-incubator/**/*.tf'
-
-permissions:
-  contents: read
-  pull-requests: write
+      - main  # or any other branch you want to trigger the deployment
+    paths: 
+      - '**/*.tf'
 
 jobs:
-  changed-files:
-    name: Get changed terraform directories
-    runs-on: ubuntu-latest
-    outputs:
-      project-directory: ${{ steps.project-directory.outputs.directory }}
-      environment-directory: ${{ steps.environment-directory.outputs.directory }}
-      has-environment-changes: ${{ steps.check-changes.outputs.has-environment-changes }}
-      has-project-changes: ${{ steps.check-changes.outputs.has-project-changes }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Get changed files
-        id: changed-files
-        uses: dorny/paths-filter@v2
-        with:
-          filters: |
-            project-change:
-              - 'terraform-incubator/*/project/*.tf'
-            environment-change:
-              - 'terraform-incubator/*/!(project)/*.tf'
-          list-files: json
-
-      - name: List all changed files
-        run: |
-          echo 'project-change: ${{ steps.changed-files.outputs.project-change_files }}'
-          echo 'environment-change: ${{ steps.changed-files.outputs.environment-change_files }}'
-
-      - name: Extract project directory
-        id: project-directory
-        if: ${{ steps.changed-files.outputs['project-change'] == 'true' }}
-        run: |
-          directory=$(dirname "${{ fromJson(steps.changed-files.outputs.project-change_files)[0] }}")
-          echo "Extracted Directory: $directory"
-          echo "::set-output name=directory::$directory"
-
-      - name: Extract environment directory
-        id: environment-directory
-        if: ${{ steps.changed-files.outputs['environment-change'] == 'true' }}
-        run: |
-          directory=$(dirname "${{ fromJson(steps.changed-files.outputs.environment-change_files)[0] }}")
-          echo "Extracted Directory: $directory"
-          echo "::set-output name=directory::$directory"
-
-      - name: Check for conflicting changes
-        id: check-changes
-        run: |
-          echo "::set-output name=has-environment-changes::${{ steps.changed-files.outputs.environment-change_files != '[]' }}"
-          echo "::set-output name=has-project-changes::${{ steps.changed-files.outputs.project-change_files != '[]' }}"
-
-  apply:
-    runs-on: ubuntu-latest
+  terraform-apply:
     name: Terraform Apply
-    needs: [changed-files]
+    runs-on: ubuntu-latest
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.INCUBATOR_AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.INCUBATOR_AWS_SECRET_ACCESS_KEY }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
 
-      - name: Fail on multiple directory changes
-        if: ${{ needs.changed-files.outputs.has-environment-changes == 'true' && needs.changed-files.outputs.has-project-changes == 'true' }}
-        run: |
-          echo "Multiple changed directories detected: Please make changes to environments and projects in separate pull requests."
-          exit 1
-        
-      - name: Terraform apply - Environment
-        if: ${{ needs.changed-files.outputs.environment-directory != '' && (needs.changed-files.outputs.project-directory == '' || needs.changed-files.outputs.has-environment-changes == 'true') }}
-        uses: dflook/terraform-apply@v1
-        with:
-          path: ${{ needs.changed-files.outputs.environment-directory }}
-
-      - name: Terraform apply - Project
-        if: ${{ needs.changed-files.outputs.project-directory != '' && needs.changed-files.outputs.has-environment-changes != 'true' }}
-        uses: dflook/terraform-apply@v1
-        with:
-          path: ${{ needs.changed-files.outputs.project-directory }}
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: configure aws credentials
+      uses: aws-actions/configure-aws-credentials@v3
+      with:
+        role-to-assume: arn:aws:iam::035866691871:role/gha-incubator
+        role-session-name: ghaincubatorsession
+        aws-region: us-west-2
+
+    - name: Terraform Apply
+      uses: dflook/terraform-apply@v1
+      with:
+        path: terraform
+        backend_config_file: terraform/prod.backend.tfvars

.github/workflows/terraform-plan.yaml

@@ -0,0 +1,40 @@
+name: Terraform plan (OIDC)
+on:
+  pull_request:
+    branches:
+      - main  # or any other branch you want to trigger the deployment
+    paths: 
+      - '**/*.tf'
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  terraform-plan:
+    name: Terraform Plan
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+    - name: Clone repo
+      uses: actions/checkout@v4
+
+    - name: configure aws credentials
+      uses: aws-actions/configure-aws-credentials@v3
+      with:
+        role-to-assume: arn:aws:iam::035866691871:role/gha-incubator
+        role-session-name: ghaincubatorsession
+        aws-region: us-west-2
+
+    - name: Terraform Plan
+      uses: dflook/terraform-plan@v1
+      with:
+        path: terraform
+        backend_config_file: terraform/prod.backend.tfvars
+

terraform/backend.tf

@@ -0,0 +1,4 @@
+terraform {
+  backend "s3" {
+  }
+}

terraform/main.tf

@@ -0,0 +1,16 @@
+data "aws_iam_policy_document" "instance_assume_role_policy" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["ec2.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "instance" {
+  name               = "incubator_test_role"
+  path               = "/system/"
+  assume_role_policy = data.aws_iam_policy_document.instance_assume_role_policy.json
+}

terraform/prod.backend.tfvars

@@ -0,0 +1,5 @@
+bucket         = "hfla-incubator-terraform-state"
+key            = "incubator/terraform.tfstate"
+region         = "us-west-2"
+dynamodb_table = "hfla_incubator_terraform_table"
+encrypt        = true