From 1c2e90c96414dbbb1c5c33325a050a96a572fad7 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 21 Oct 2026 16:43:18 -0700 Subject: [PATCH 1/2] Use S3 native state locking instead of DynamoDB (#218) Replace the deprecated dynamodb_table backend parameter with use_lockfile = true, drop the DynamoDB statement from the live IncubatorTfPlanSecretsRead policy, and remove the lock-table setup from CONTRIBUTING.md and the pre-work issue template. The backend.tf comment makes the terraform-plan/apply workflows trigger, since they only filter on **/*.tf. --- .../pre-work-template-devops-security.md | 6 ++---- CONTRIBUTING.md | 18 +----------------- .../aws-custom-policies/tf-plan-scoped.json | 14 -------------- terraform/backend.tf | 2 ++ terraform/prod.backend.tfvars | 2 +- 5 files changed, 6 insertions(+), 36 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md b/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md index 7816d21..464eefa 100644 --- a/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md +++ b/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md @@ -35,9 +35,7 @@ As a new member on the HfLA devops-security team, fill in the following fields a - [ ] [Generating user access keys](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#generating-access-keys-for-aws-cli) - [ ] Complete the instructions in [AWS Documentation](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-install.html) and choose your operating system to install AWS CLI. - [ ] Complete the instruction in [AWS Documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-short-term.html) to setup the AWS CLI. -- [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket and DynamoDB table. - - [ ] Create the S3 bucket - - [ ] Create the DynamoDB table +- [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket. - [ ] Install Terraform locally by following the instructions of the installation guide mentioned in [Installing Terraform](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform) - [ ] Install Terraform Docs locally by following the instructions of the installation guide mentioned in [Installing Terraform docs](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform-docs) - [ ] Complete the instructions in [Clone the repository](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#clone-the-repository) @@ -78,7 +76,7 @@ Note: You must be authenticated to your AWS account via the CLI for the next com If you are unable to authenticate from your local machine using the CLI, post in the #ops channel in Slack so that the team can help you get unblocked. - [ ] Execute the command `terraform init` to initialize terraform in the directory. Address any failures that arise (if any). - [ ] Execute the command `terraform plan` this will output a plan replicating the same IAM resources as the devops security account. Address any failures that arise (if any). -- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security. All of the resources created here incur zero cost except for the Dynamo DB installation, which should remain in the free tier. ** +- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security. ** - [ ] **If you have cost concerns, Run a Terraform Destroy to take down all of the resources you created (don't worry, you can recreate them just as quickly). If you create resources outside of what's described in this issue, you may incur charges.** - [ ] Update the README using Terraform Docs to document changes - [ ] ```terraform-docs -c .terraform.docs.yml .``` diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e9796b1..235fa17 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -154,22 +154,6 @@ aws s3api put-bucket-encryption --bucket USERNAME-hfla-ops-terraform-state --ser }' ``` -#### Set up DynamoDB to store the backend state - -- Create table `hfla_ops_terraform_table` -- Set partition key to `LockID` with a type of `string` -- Choose on-demand capacity - -You can create the table from the AWS UI, CloudShell, or from the CLI using the following command: - -```bash -aws dynamodb create-table \ - --table-name hfla_ops_terraform_table \ - --attribute-definitions AttributeName=LockID,AttributeType=S \ - --key-schema AttributeName=LockID,KeyType=HASH \ - --billing-mode PAY_PER_REQUEST -``` - [Back to Top](#) *** @@ -248,7 +232,7 @@ After creating a backend state, create a `backend.tfvars` file in the `terraform bucket = "USERNAME-hfla-ops-terraform-state" key = "devops-security/terraform.tfstate" region = "us-west-2" -dynamodb_table = "hfla_ops_terraform_table" +use_lockfile = true encrypt = true ``` diff --git a/terraform/aws-custom-policies/tf-plan-scoped.json b/terraform/aws-custom-policies/tf-plan-scoped.json index b476dcf..5bb6404 100644 --- a/terraform/aws-custom-policies/tf-plan-scoped.json +++ b/terraform/aws-custom-policies/tf-plan-scoped.json @@ -25,20 +25,6 @@ "arn:aws:s3:::hfla-ops-terraform-state", "arn:aws:s3:::hfla-ops-terraform-state/*" ] - }, - { - "Sid": "AllowDynamoDBLockTableAccessForTerraformPlan", - "Effect": "Allow", - "Action": [ - "dynamodb:PutItem", - "dynamodb:DeleteItem", - "dynamodb:GetItem", - "dynamodb:UpdateItem", - "dynamodb:DescribeTable" - ], - "Resource": [ - "arn:aws:dynamodb:us-west-2:035866691871:table/hfla_ops_terraform_table" - ] } ] } diff --git a/terraform/backend.tf b/terraform/backend.tf index b02f4fb..7fdce29 100644 --- a/terraform/backend.tf +++ b/terraform/backend.tf @@ -4,6 +4,8 @@ terraform { // CI silently upgraded itself -- state has been written by 1.7 through 1.16. // This line alone chooses the CI Terraform version. required_version = "~> 1.16.0" + // Empty on purpose: bucket, key and use_lockfile (S3-native state locking) come from + // prod.backend.tfvars via backend_config_file. backend "s3" { } required_providers { diff --git a/terraform/prod.backend.tfvars b/terraform/prod.backend.tfvars index 995edf6..7d25399 100644 --- a/terraform/prod.backend.tfvars +++ b/terraform/prod.backend.tfvars @@ -1,5 +1,5 @@ bucket = "hfla-ops-terraform-state" key = "devops-security/terraform.tfstate" region = "us-west-2" -dynamodb_table = "hfla_ops_terraform_table" +use_lockfile = true encrypt = true \ No newline at end of file From 5982a081361391b6d9d629a3fcca39f068bd7dae Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 21 Oct 2026 16:52:40 -0700 Subject: [PATCH 2/2] Clarify changes migrating lockfiles to s3 from dynamodb Continues #218 --- .github/ISSUE_TEMPLATE/pre-work-template-devops-security.md | 3 ++- terraform/backend.tf | 3 +-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md b/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md index 464eefa..05bfa63 100644 --- a/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md +++ b/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md @@ -36,6 +36,7 @@ As a new member on the HfLA devops-security team, fill in the following fields a - [ ] Complete the instructions in [AWS Documentation](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-install.html) and choose your operating system to install AWS CLI. - [ ] Complete the instruction in [AWS Documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-short-term.html) to setup the AWS CLI. - [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket. +- [ ] Create the S3 bucket - [ ] Install Terraform locally by following the instructions of the installation guide mentioned in [Installing Terraform](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform) - [ ] Install Terraform Docs locally by following the instructions of the installation guide mentioned in [Installing Terraform docs](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform-docs) - [ ] Complete the instructions in [Clone the repository](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#clone-the-repository) @@ -76,7 +77,7 @@ Note: You must be authenticated to your AWS account via the CLI for the next com If you are unable to authenticate from your local machine using the CLI, post in the #ops channel in Slack so that the team can help you get unblocked. - [ ] Execute the command `terraform init` to initialize terraform in the directory. Address any failures that arise (if any). - [ ] Execute the command `terraform plan` this will output a plan replicating the same IAM resources as the devops security account. Address any failures that arise (if any). -- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security. ** +- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security. All of the resources created here incur zero cost. - [ ] **If you have cost concerns, Run a Terraform Destroy to take down all of the resources you created (don't worry, you can recreate them just as quickly). If you create resources outside of what's described in this issue, you may incur charges.** - [ ] Update the README using Terraform Docs to document changes - [ ] ```terraform-docs -c .terraform.docs.yml .``` diff --git a/terraform/backend.tf b/terraform/backend.tf index 7fdce29..cae7150 100644 --- a/terraform/backend.tf +++ b/terraform/backend.tf @@ -4,8 +4,7 @@ terraform { // CI silently upgraded itself -- state has been written by 1.7 through 1.16. // This line alone chooses the CI Terraform version. required_version = "~> 1.16.0" - // Empty on purpose: bucket, key and use_lockfile (S3-native state locking) come from - // prod.backend.tfvars via backend_config_file. + // Locking config lives in terraform/prod.backend.tfvars (use_lockfile). backend "s3" { } required_providers {