chore: test new role CI/CD

.github/workflows/ci.yml

@@ -10,12 +10,20 @@ jobs:
   run-terraform:
     name: 'Run Terraform'
     runs-on: ubuntu-latest
+    env:
+      TF_VAR_aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
+      TF_VAR_thumbprint: ${{ secrets.THUMBPRINT }}
+      TF_VAR_github_app_repo: ${{ secrets.GH_APP_REPO }}
+      TF_VAR_github_iac_repo: ${{ secrets.GH_IAC_REPO }}
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ''
+          role-to-assume: 'arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/tf_role'
           aws-region: us-east-2
 
       - name: Setup Terraform

README.md

@@ -1 +1,76 @@
-# CD Pipeline deployment of devops-create-image-nest-api project
+# CD Pipeline deployment of devops-create-image-nest-api project
+
+## Prerequisites
+
+**AWS CLI**
+
+- You need an AWS account
+- You need to install AWS CLI
+https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+
+**AWS SSO**
+
+```bash
+aws sso configure
+aws sso login --profile {$profileName}
+```
+
+## Sensitive data
+
+For the `thumbprint` run the command below
+
+```bash
+echo | openssl s_client -servername token.actions.githubusercontent.com -connect token.actions.githubusercontent.com:443 2>/dev/null | openssl x509 -fingerprint -noout | sed 's/SHA1 Fingerprint=//' | tr -d ':'
+```
+
+```bash
+cp secret.tfvars.sample secret.tfvars
+```
+
+Edit `secret.tfvars` and add your Github repository
+
+```hcl
+aws_account_id  = "{AWS Account ID}"
+thumbprint      = "{SHA1 Fingerprint}"
+gh_iac_repo     = "repo:{username}/{repo}:ref:refs/heads/{branch}"
+gh_app_repo     = "repo:{username}/{repo}:ref:refs/heads/{branch}"
+```
+
+Run the command to check if everything is ok
+
+```bash
+terraform plan -var-file=secret.tfvars
+```
+
+These steps are only for running Terraform locally.
+
+We also need to store these variables in Github Secrets.
+You can create them in the Github UI: 
+`https://github.com/{user}/{repo}/settings/secrets/actions`
+![alt text](assets/gh_secrets.png)
+
+## Creating the role for the Terraform CLI on AWS
+
+Now we need to apply the changes locally, and get the ARN of the role that we will use in the next step.
+
+```bash
+terraform apply -var-file=secret.tfvars
+```
+
+Type `yes` to apply the changes.
+
+Go to your AWS console and open the IAM console.
+On Roles, click in the new role that was created `tf_role` and copy the ARN.
+
+![alt text](assets/tf_role.png)
+
+Now we need to create a Github Secret with the ARN of the role, and the name `ARN_TF_ROLE`.
+You can follow the same steps as in the previous section.
+
+## Deployment
+
+```bash
+terraform init
+terraform plan
+terraform apply
+```

iam.tf

@@ -1,18 +1,47 @@
-# Step 1: Create an IAM identity provider for GitHub
 resource "aws_iam_openid_connect_provider" "openid_connect_provider" {
   url = "https://token.actions.githubusercontent.com"
   client_id_list = [
     "sts.amazonaws.com",
   ]
   thumbprint_list = [
-    "959CB2B52B4AD201A593847ABCA32FF48F838C2E",
+    var.thumbprint,
   ]
   tags = {
     IaC = "True"
   }
 }
 
-# Step 2: Create an IAM role for the ECR repository
+resource "aws_iam_role" "tf_role" {
+  name = "tf_role"
+
+  assume_role_policy = jsonencode({
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": "sts:AssumeRoleWithWebIdentity",
+            "Principal": {
+                "Federated": "arn:aws:iam::${var.aws_account_id}:oidc-provider/token.actions.githubusercontent.com"
+            },
+            "Condition": {
+                "StringEquals": {
+                    "token.actions.githubusercontent.com:aud": [
+                        "sts.amazonaws.com"
+                    ],
+                    "token.actions.githubusercontent.com:sub": [
+                        var.github_iac_repo
+                    ]
+                }
+            }
+        }
+    ]
+  })
+
+  tags = {
+    IaC = "True"
+  }
+}
+
 resource "aws_iam_role" "ecr_role" {
   name = "ecr_role"
 
@@ -23,27 +52,25 @@ resource "aws_iam_role" "ecr_role" {
             "Effect": "Allow",
             "Action": "sts:AssumeRoleWithWebIdentity",
             "Principal": {
-                "Federated": "arn:aws:iam::381492262362:oidc-provider/token.actions.githubusercontent.com"
+                "Federated": "arn:aws:iam::${var.aws_account_id}:oidc-provider/token.actions.githubusercontent.com"
             },
             "Condition": {
                 "StringEquals": {
                     "token.actions.githubusercontent.com:aud": [
                         "sts.amazonaws.com"
                     ],
                     "token.actions.githubusercontent.com:sub": [
-                        "repo:rcmonteiro/devops-create-image-nest-api:ref:refs/heads/main"
+                        var.github_app_repo
                     ]
                 }
             }
         }
     ]
   })
 
-  # Step 3: Attach the AmazonEC2ContainerRegistryPowerUser managed policy to the IAM role
   inline_policy {
     name = "ecr-app-permission"
 
-    # Step 5: Insert the Statement for the apprunner and IAM
     policy = jsonencode({
       "Version": "2012-10-17",
       "Statement": [
@@ -83,7 +110,6 @@ resource "aws_iam_role" "ecr_role" {
   }
 }
 
-# Step 4: Create an IAM role for the App Runner
 resource "aws_iam_role" "app_runner_role" {
   name = "app_runner_role"
 

secret.tfvars.sample

@@ -0,0 +1,4 @@
+aws_account_id  = "{AWS Account ID}"
+thumbprint      = "{SHA1 Fingerprint}"
+gh_iac_repo     = "repo:{username}/{repo}:ref:refs/heads/{branch}"
+gh_app_repo     = "repo:{username}/{repo}:ref:refs/heads/{branch}"

variables.tf

@@ -0,0 +1,23 @@
+variable "aws_account_id" {
+  description = "AWS Account ID"
+  type        = string
+  sensitive   = true
+}
+
+variable "thumbprint" {
+  description = "SHA1 Fingerprint"
+  type        = string
+  sensitive   = true
+}
+
+variable "github_iac_repo" {
+  description = "Github repository, e.g. repo:{username}/{repo}:ref:refs/heads/{branch}"
+  type        = string
+  sensitive   = true
+}
+
+variable "github_app_repo" {
+  description = "Github repository, e.g. repo:{username}/{repo}:ref:refs/heads/{branch}"
+  type        = string
+  sensitive   = true
+}