Skip to content

Latest commit

 

History

History
236 lines (225 loc) · 42.5 KB

terraform.md

File metadata and controls

236 lines (225 loc) · 42.5 KB

Requirements

Name Version
terraform >= 0.13.0
aws >= 2.0
random >= 2.0

Providers

Name Version
aws >= 2.0
random >= 2.0

Modules

Name Source Version
ecs_web_app cloudposse/ecs-web-app/aws 0.60.0
github_webhooks cloudposse/repository-webhooks/github 0.12.0
ssh_key_pair cloudposse/ssm-tls-ssh-key-pair/aws 0.10.0
this cloudposse/label/null 0.25.0

Resources

Name Type
aws_iam_role_policy_attachment.default resource
aws_route53_record.default resource
aws_security_group_rule.egress_http resource
aws_security_group_rule.egress_https resource
aws_security_group_rule.egress_tcp_dns resource
aws_security_group_rule.egress_udp_dns resource
aws_ssm_parameter.atlantis_atlantis_url resource
aws_ssm_parameter.atlantis_cognito_user_pool_arn resource
aws_ssm_parameter.atlantis_cognito_user_pool_client_id resource
aws_ssm_parameter.atlantis_cognito_user_pool_domain resource
aws_ssm_parameter.atlantis_gh_team_whitelist resource
aws_ssm_parameter.atlantis_gh_token resource
aws_ssm_parameter.atlantis_gh_user resource
aws_ssm_parameter.atlantis_gh_webhook_secret resource
aws_ssm_parameter.atlantis_iam_role_arn resource
aws_ssm_parameter.atlantis_log_level resource
aws_ssm_parameter.atlantis_oidc_client_id resource
aws_ssm_parameter.atlantis_oidc_client_secret resource
aws_ssm_parameter.atlantis_port resource
aws_ssm_parameter.atlantis_repo_config resource
aws_ssm_parameter.atlantis_repo_whitelist resource
aws_ssm_parameter.atlantis_wake_word resource
aws_ssm_parameter.github_webhooks_token resource
random_string.atlantis_gh_webhook_secret resource
aws_kms_key.chamber_kms_key data source
aws_ssm_parameter.atlantis_cognito_user_pool_arn data source
aws_ssm_parameter.atlantis_cognito_user_pool_client_id data source
aws_ssm_parameter.atlantis_cognito_user_pool_domain data source
aws_ssm_parameter.atlantis_gh_token data source
aws_ssm_parameter.atlantis_oidc_client_id data source
aws_ssm_parameter.atlantis_oidc_client_secret data source
aws_ssm_parameter.github_webhooks_token data source

Inputs

Name Description Type Default Required
additional_tag_map Additional key-value pairs to add to each map in tags_as_list_of_maps. Not added to tags or id.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.		 map(string) {} no
alb_arn_suffix The ARN suffix of the ALB string n/a yes
alb_dns_name DNS name of ALB string n/a yes
alb_ingress_authenticated_hosts Authenticated hosts to match in Hosts header (a maximum of 1 can be defined) list(string) [] no
alb_ingress_authenticated_listener_arns A list of authenticated ALB listener ARNs to attach ALB listener rules to list(string) [] no
alb_ingress_authenticated_listener_arns_count The number of authenticated ARNs in alb_ingress_authenticated_listener_arns. This is necessary to work around a limitation in Terraform where counts cannot be computed number 0 no
alb_ingress_authenticated_paths Authenticated path pattern to match (a maximum of 1 can be defined) list(string) 
[
  "/*"
]
 no
alb_ingress_listener_authenticated_priority The priority for the rules with authentication, between 1 and 50000 (1 being highest priority). Must be different from alb_ingress_listener_unauthenticated_priority since a listener can't have multiple rules with the same priority number 100 no
alb_ingress_listener_unauthenticated_priority The priority for the rules without authentication, between 1 and 50000 (1 being highest priority). Must be different from alb_ingress_listener_authenticated_priority since a listener can't have multiple rules with the same priority number 50 no
alb_ingress_unauthenticated_hosts Unauthenticated hosts to match in Hosts header (a maximum of 1 can be defined) list(string) [] no
alb_ingress_unauthenticated_listener_arns A list of unauthenticated ALB listener ARNs to attach ALB listener rules to list(string) [] no
alb_ingress_unauthenticated_listener_arns_count The number of unauthenticated ARNs in alb_ingress_unauthenticated_listener_arns. This is necessary to work around a limitation in Terraform where counts cannot be computed number 0 no
alb_ingress_unauthenticated_paths Unauthenticated path pattern to match (a maximum of 1 can be defined) list(string) 
[
  "/events"
]
 no
alb_security_group Security group of the ALB string n/a yes
alb_target_group_alarms_alarm_actions A list of ARNs (i.e. SNS Topic ARN) to execute when ALB Target Group alarms transition into an ALARM state from any other state. list(string) [] no
alb_target_group_alarms_enabled A boolean to enable/disable CloudWatch Alarms for ALB Target metrics bool false no
alb_target_group_alarms_insufficient_data_actions A list of ARNs (i.e. SNS Topic ARN) to execute when ALB Target Group alarms transition into an INSUFFICIENT_DATA state from any other state. list(string) [] no
alb_target_group_alarms_ok_actions A list of ARNs (i.e. SNS Topic ARN) to execute when ALB Target Group alarms transition into an OK state from any other state. list(string) [] no
alb_zone_id The ID of the zone in which ALB is provisioned string n/a yes
atlantis_gh_team_whitelist Atlantis GitHub team whitelist string "" no
atlantis_gh_user Atlantis GitHub user string n/a yes
atlantis_gh_webhook_secret Atlantis GitHub webhook secret string "" no
atlantis_log_level Atlantis log level string "info" no
atlantis_port Atlantis container port number 4141 no
atlantis_repo_config Path to atlantis server-side repo config file (https://www.runatlantis.io/docs/server-side-repo-config.html) string "atlantis-repo-config.yaml" no
atlantis_repo_whitelist Whitelist of repositories Atlantis will accept webhooks from list(string) [] no
atlantis_url_format Template for the Atlantis URL which is populated with the hostname string "https://%s" no
atlantis_wake_word Wake world for atlantis string "atlantis" no
atlantis_webhook_format Template for the Atlantis webhook URL which is populated with the hostname string "https://%s/events" no
attributes ID element. Additional attributes (e.g. workers or cluster) to add to id,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the delimiter
and treated as a single ID element.		 list(string) [] no
authentication_cognito_user_pool_arn Cognito User Pool ARN string "" no
authentication_cognito_user_pool_arn_ssm_name SSM param name to lookup authentication_cognito_user_pool_arn if not provided string "" no
authentication_cognito_user_pool_client_id Cognito User Pool Client ID string "" no
authentication_cognito_user_pool_client_id_ssm_name SSM param name to lookup authentication_cognito_user_pool_client_id if not provided string "" no
authentication_cognito_user_pool_domain Cognito User Pool Domain. The User Pool Domain should be set to the domain prefix (xxx) instead of full domain (https://xxx.auth.us-west-2.amazoncognito.com) string "" no
authentication_cognito_user_pool_domain_ssm_name SSM param name to lookup authentication_cognito_user_pool_domain if not provided string "" no
authentication_oidc_authorization_endpoint OIDC Authorization Endpoint string "" no
authentication_oidc_client_id OIDC Client ID string "" no
authentication_oidc_client_id_ssm_name SSM param name to lookup authentication_oidc_client_id if not provided string "" no
authentication_oidc_client_secret OIDC Client Secret string "" no
authentication_oidc_client_secret_ssm_name SSM param name to lookup authentication_oidc_client_secret if not provided string "" no
authentication_oidc_issuer OIDC Issuer string "" no
authentication_oidc_token_endpoint OIDC Token Endpoint string "" no
authentication_oidc_user_info_endpoint OIDC User Info Endpoint string "" no
authentication_type Authentication type. Supported values are COGNITO and OIDC string "" no
autoscaling_enabled A boolean to enable/disable Autoscaling policy for ECS Service bool false no
autoscaling_max_capacity Atlantis maximum tasks to run number 1 no
autoscaling_min_capacity Atlantis minimum tasks to run number 1 no
branch Atlantis branch of the GitHub repository, e.g. master string "master" no
build_timeout How long in minutes, from 5 to 480 (8 hours), for AWS CodeBuild to wait until timing out any related build that does not get marked as completed. number 10 no
chamber_format Format to store parameters in SSM, for consumption with chamber string "/%s/%s" no
chamber_service SSM parameter service name for use with chamber. This is used in chamber_format where /$chamber_service/$parameter would be the default. string "atlantis" no
codepipeline_enabled A boolean to enable/disable AWS Codepipeline and ECR bool false no
codepipeline_s3_bucket_force_destroy A boolean that indicates all objects should be deleted from the CodePipeline artifact store S3 bucket so that the bucket can be destroyed without error bool false no
container_cpu Atlantis CPUs per task number 256 no
container_memory Atlantis memory per task number 512 no
container_repo_credentials Container repository credentials; required when using a private repo. This map currently supports a single key; "credentialsParameter", which should be the ARN of a Secrets Manager's secret holding the credentials map(string) null no
context Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as null to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.		 any 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
 no
default_backend_image ECS default (bootstrap) image string "cloudposse/default-backend:0.1.2" no
delimiter Delimiter to be used between ID elements.
Defaults to - (hyphen). Set to "" to use no delimiter at all.		 string null no
descriptor_formats Describe additional descriptors to be output in the descriptors output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
{<br> format = string<br> labels = list(string)<br>}
(Type is any so the map values can later be enhanced to provide additional options.)
format is a Terraform format string to be passed to the format() function.
labels is a list of labels, in order, to pass to format() function.
Label values will be normalized before being passed to format() so they will be
identical to how they appear in id.
Default is {} (descriptors output will be empty).		 any {} no
desired_count Atlantis desired number of tasks number 1 no
ecs_alarms_cpu_utilization_high_alarm_actions A list of ARNs (i.e. SNS Topic ARN) to notify on CPU Utilization High Alarm action list(string) [] no
ecs_alarms_cpu_utilization_high_ok_actions A list of ARNs (i.e. SNS Topic ARN) to notify on CPU Utilization High OK action list(string) [] no
ecs_alarms_cpu_utilization_low_alarm_actions A list of ARNs (i.e. SNS Topic ARN) to notify on CPU Utilization Low Alarm action list(string) [] no
ecs_alarms_cpu_utilization_low_ok_actions A list of ARNs (i.e. SNS Topic ARN) to notify on CPU Utilization Low OK action list(string) [] no
ecs_alarms_enabled A boolean to enable/disable CloudWatch Alarms for ECS Service metrics bool false no
ecs_alarms_memory_utilization_high_alarm_actions A list of ARNs (i.e. SNS Topic ARN) to notify on Memory Utilization High Alarm action list(string) [] no
ecs_alarms_memory_utilization_high_ok_actions A list of ARNs (i.e. SNS Topic ARN) to notify on Memory Utilization High OK action list(string) [] no
ecs_alarms_memory_utilization_low_alarm_actions A list of ARNs (i.e. SNS Topic ARN) to notify on Memory Utilization Low Alarm action list(string) [] no
ecs_alarms_memory_utilization_low_ok_actions A list of ARNs (i.e. SNS Topic ARN) to notify on Memory Utilization Low OK action list(string) [] no
ecs_cluster_arn ARN of the ECS cluster to deploy Atlantis string n/a yes
ecs_cluster_name Name of the ECS cluster to deploy Atlantis string n/a yes
enabled Set to false to prevent the module from creating any resources bool null no
environment ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' string null no
github_oauth_token GitHub OAuth token. If not provided the token is looked up from SSM string "" no
github_oauth_token_ssm_name SSM param name to lookup github_oauth_token if not provided string "" no
github_webhooks_token GitHub OAuth Token with permissions to create webhooks. If not provided the token is looked up from SSM string "" no
github_webhooks_token_ssm_name SSM param name to lookup github_webhooks_token if not provided string "" no
healthcheck_path Healthcheck path string "/healthz" no
hostname Atlantis URL string "" no
id_length_limit Limit id to this many characters (minimum 6).
Set to 0 for unlimited length.
Set to null for keep the existing setting, which defaults to 0.
Does not affect id_full.		 number null no
kms_key_id KMS key ID used to encrypt SSM SecureString parameters string "" no
label_key_case Controls the letter case of the tags keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the tags input.
Possible values: lower, title, upper.
Default value: title.		 string null no
label_order The order in which the labels (ID elements) appear in the id.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.		 list(string) null no
label_value_case Controls the letter case of ID elements (labels) as included in id,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the tags input.
Possible values: lower, title, upper and none (no transformation).
Set this to title and set delimiter to "" to yield Pascal Case IDs.
Default value: lower.		 string null no
labels_as_tags Set of labels (ID elements) to include as tags in the tags output.
Default is to include all labels.
Tags with empty values will not be included in the tags output.
Set to [] to suppress all generated tags.
Notes:
The value of the name tag, if included, will be the id, not the name.
Unlike other null-label inputs, the initial setting of labels_as_tags cannot be
changed in later chained modules. Attempts to change it will be silently ignored.		 set(string) 
[
  "default"
]
 no
launch_type The ECS launch type (valid options: FARGATE or EC2) string "FARGATE" no
name ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a tag.
The "name" tag is set to the full id string. There is no tag with the value of the name input.		 string null no
namespace ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique string null no
overwrite_ssm_parameter Whether to overwrite an existing SSM parameter bool true no
parent_zone_id The zone ID where the DNS record for the short_name will be written string "" no
policy_arn Permission to grant to atlantis server string "arn:aws:iam::aws:policy/AdministratorAccess" no
private_subnet_ids The private subnet IDs list(string) [] no
regex_replace_chars Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits.		 string null no
region AWS Region for S3 bucket string n/a yes
repo_name GitHub repository name of the atlantis to be built and deployed to ECS. string n/a yes
repo_owner GitHub organization containing the Atlantis repository string n/a yes
security_group_ids Additional Security Group IDs to allow into ECS Service. list(string) [] no
short_name Alantis short DNS name (e.g. atlantis) string "atlantis" no
ssh_private_key_name Atlantis SSH private key name string "atlantis_ssh_private_key" no
ssh_public_key_name Atlantis SSH public key name string "atlantis_ssh_public_key" no
stage ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' string null no
tags Additional tags (e.g. {'BusinessUnit': 'XYZ'}).
Neither the tag keys nor the tag values will be modified by this module.		 map(string) {} no
tenant ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for string null no
use_alb_security_group A flag to enable/disable adding the ingress rule to the ALB security group bool true no
vpc_id VPC ID for the ECS Cluster string n/a yes
webhook_enabled Set to false to prevent the module from creating any webhook resources bool true no
webhook_events A list of events which should trigger the webhook. list(string) 
[
  "issue_comment",
  "pull_request",
  "pull_request_review",
  "pull_request_review_comment",
  "push"
]
 no
webhook_secret_length GitHub webhook secret length number 32 no

Outputs

Name Description
alb_ingress_target_group_arn ALB Target Group ARN
alb_ingress_target_group_arn_suffix ALB Target Group ARN suffix
alb_ingress_target_group_name ALB Target Group name
atlantis_ssh_public_key Atlantis SSH Public Key
atlantis_url The URL endpoint for the atlantis server
atlantis_webhook_url atlantis webhook URL
codebuild_badge_url The URL of the build badge when badge_enabled is enabled
codebuild_cache_bucket_arn CodeBuild cache S3 bucket ARN
codebuild_cache_bucket_name CodeBuild cache S3 bucket name
codebuild_project_id CodeBuild project ID
codebuild_project_name CodeBuild project name
codebuild_role_arn CodeBuild IAM Role ARN
codebuild_role_id CodeBuild IAM Role ID
codepipeline_arn CodePipeline ARN
codepipeline_id CodePipeline ID
codepipeline_webhook_id The CodePipeline webhook's ID
codepipeline_webhook_url The CodePipeline webhook's URL. POST events to this endpoint to trigger the target
container_definition_json JSON encoded list of container definitions for use with other terraform resources such as aws_ecs_task_definition
container_definition_json_map JSON encoded container definitions for use with other terraform resources such as aws_ecs_task_definition
ecr_registry_id Registry ID
ecr_repository_name Repository name
ecr_repository_url Repository URL
ecs_alarms_cpu_utilization_high_cloudwatch_metric_alarm_arn ECS CPU utilization high CloudWatch metric alarm ARN
ecs_alarms_cpu_utilization_high_cloudwatch_metric_alarm_id ECS CPU utilization high CloudWatch metric alarm ID
ecs_alarms_cpu_utilization_low_cloudwatch_metric_alarm_arn ECS CPU utilization low CloudWatch metric alarm ARN
ecs_alarms_cpu_utilization_low_cloudwatch_metric_alarm_id ECS CPU utilization low CloudWatch metric alarm ID
ecs_alarms_memory_utilization_high_cloudwatch_metric_alarm_arn ECS Memory utilization high CloudWatch metric alarm ARN
ecs_alarms_memory_utilization_high_cloudwatch_metric_alarm_id ECS Memory utilization high CloudWatch metric alarm ID
ecs_alarms_memory_utilization_low_cloudwatch_metric_alarm_arn ECS Memory utilization low CloudWatch metric alarm ARN
ecs_alarms_memory_utilization_low_cloudwatch_metric_alarm_id ECS Memory utilization low CloudWatch metric alarm ID
ecs_cloudwatch_autoscaling_scale_down_policy_arn ARN of the scale down policy
ecs_cloudwatch_autoscaling_scale_up_policy_arn ARN of the scale up policy
ecs_exec_role_policy_id The ECS service role policy ID, in the form of role_name:role_policy_name
ecs_exec_role_policy_name ECS service role name
ecs_service_name ECS Service name
ecs_service_role_arn ECS Service role ARN
ecs_service_security_group_id Security Group ID of the ECS task
ecs_task_definition_family ECS task definition family
ecs_task_definition_revision ECS task definition revision
ecs_task_exec_role_arn ECS Task exec role ARN
ecs_task_exec_role_name ECS Task role name
ecs_task_role_arn ECS Task role ARN
ecs_task_role_id ECS Task role id
ecs_task_role_name ECS Task role name
httpcode_elb_5xx_count_cloudwatch_metric_alarm_arn ALB 5xx count CloudWatch metric alarm ARN
httpcode_elb_5xx_count_cloudwatch_metric_alarm_id ALB 5xx count CloudWatch metric alarm ID
httpcode_target_3xx_count_cloudwatch_metric_alarm_arn ALB Target Group 3xx count CloudWatch metric alarm ARN
httpcode_target_3xx_count_cloudwatch_metric_alarm_id ALB Target Group 3xx count CloudWatch metric alarm ID
httpcode_target_4xx_count_cloudwatch_metric_alarm_arn ALB Target Group 4xx count CloudWatch metric alarm ARN
httpcode_target_4xx_count_cloudwatch_metric_alarm_id ALB Target Group 4xx count CloudWatch metric alarm ID
httpcode_target_5xx_count_cloudwatch_metric_alarm_arn ALB Target Group 5xx count CloudWatch metric alarm ARN
httpcode_target_5xx_count_cloudwatch_metric_alarm_id ALB Target Group 5xx count CloudWatch metric alarm ID
target_response_time_average_cloudwatch_metric_alarm_arn ALB Target Group response time average CloudWatch metric alarm ARN
target_response_time_average_cloudwatch_metric_alarm_id ALB Target Group response time average CloudWatch metric alarm ID