diff --git a/deployment/terraform/how-to-remove-terrform-state-lock.txt b/deployment/terraform/how-to-remove-terrform-state-lock.txt deleted file mode 100644 index 5815df88..00000000 --- a/deployment/terraform/how-to-remove-terrform-state-lock.txt +++ /dev/null @@ -1,57 +0,0 @@ -1. Install terraform -$ brew tap hashicorp/tap -$ brew install hashicorp/tap/terraform - -2. Install aws-vault -See https://github.com/99designs/aws-vault#installing -On a mac -$ brew install --cask aws-vault - -3. Ensure you have an ~/.aws/config file with the required profile (eg cyber-dojo-beta) -It will look like this... -[profile cyber-dojo-beta] -sso_start_url = https://merkely.awsapps.com/start -sso_region = eu-north-1 -sso_account_id = 244531986313 -sso_role_name = AdministratorAccess -region = eu-central-1 -output = json - -4. Do an aws-vault login -$ aws-vault exec -d 8h cyber-dojo-beta - -If you do not have enough permissions you will get this error message: - -Opening the SSO authorization page in your default browser (use Ctrl-C to abort) -https://device.sso.eu-north-1.amazonaws.com/?user_code=FXZC-DCWQ -aws-vault: error: login: operation error SSO: GetRoleCredentials, https response error - StatusCode: 403, - RequestID: 2810674b-0316-4e68-91fe-6f5d6bfb7c7d, api error - ForbiddenException: No access - -5. cd to the ./deployment/terraform directory inside the repo in question -$ cd ./deployment/terraform - -6. Download tf.sh wrapper -$ curl https://releases.fivexl.io/tf/v0.2.1/tf.sh --output tf.sh && chmod +x ./tf.sh - -7. run this command: -$ ./tf.sh force-unlock - -You can find state lock ID in the CI error message: -Error: Error acquiring the state lock - -Error message: ConditionalCheckFailedException: The conditional request -failed -Lock Info: - ID: c9cc5264-88ee-46ec-4507-ba929c37b97e - Path: terraform-state-9d7e951c290ec5bbe6506e0ddb064808764bc636/terraform/saver/main.tfstate - Operation: OperationTypeApply - Who: runner@fv-az1108-930 - Version: 1.4.5 - Created: 2023-10-23 12:36:51.178192343 +0000 UTC - -So in this case the command would be: - -$ ./tf.sh force-unlock c9cc5264-88ee-46ec-4507-ba929c37b97e - diff --git a/deployment/terraform/tf.sh b/deployment/terraform/tf.sh deleted file mode 100755 index e0fc08b9..00000000 --- a/deployment/terraform/tf.sh +++ /dev/null @@ -1,144 +0,0 @@ -#!/usr/bin/env bash - -set -e - -TF_PARALLELISM=${TF_PARALLELISM:-10} -TF_STATE_BUCKET=${TF_STATE_BUCKET:-} -TF_STATE_DYNAMODB_TABLE=${TF_STATE_DYNAMODB_TABLE:-} -TF_TERRAFORM_EXECUTABLE=${TF_TERRAFORM_EXECUTABLE:-terraform} -TF_ENVIRONMENT_ID=${TF_ENVIRONMENT_ID:-} -TF_AUTO_APPLY_SAVED_PLAN=${TF_AUTO_APPLY_SAVED_PLAN:-} -TF_VAR_terraform_state_location=${TF_VAR_terraform_state_location:-} -TF_SKIP_BACKEND_INIT=${TF_SKIP_BACKEND_INIT:-} - -# Local tf.sh.env -if [ -f tf.sh.env ]; then - # Load default Environment Variables - echo "Set default from tf.sh.env" - export $(cat tf.sh.env | grep -v '#' | awk '/=/ {print $1}') -fi - -if [ -z "${TF_STATE_PATH}" ]; then TF_STATE_PATH=${TF_STATE_PATH:-}; fi -if [ -z "${TF_STATE_FILE_NAME}" ]; then TF_STATE_FILE_NAME=${TF_STATE_FILE_NAME:-main.tfstate}; fi -if [ -z "${TF_DATA_DIR_PER_ENV}" ]; then TF_DATA_DIR_PER_ENV=${TF_DATA_DIR_PER_ENV:-true}; fi -if [ -z "${HASH_COMMAND}" ]; then HASH_COMMAND=${HASH_COMMAND:-sha1sum}; fi - -# Set terraform version -[ -e ./.terraform_executable ] && export TF_TERRAFORM_EXECUTABLE="$(cat .terraform_executable)" - -if [ "$#" -eq 0 ] || [ "$*" == "-h" ] || [ "$*" == "-h" ]; then - echo "This is a Terraform wrapper to dynamically pick different state files for different environment" - echo "Wrapper will attempt to pick defaults and setup a correct bucket" - echo "All script argumetns will be passed to Terraform" - echo "" - echo "WARNING: If we are applying changes, do not ask for interactive approval" - echo "" - echo "Example:" - echo "tf plan" - echo "tf plan -destroy" - echo "tf apply" - echo "tf apply -destroy" - echo "" - echo "tf will indentify your env based on current AWS account id and region" - echo "" - echo "For apply saved plan please set TF_AUTO_APPLY_SAVED_PLAN variable with any value" - echo "Example:" - echo "TF_AUTO_APPLY_SAVED_PLAN=true ./tf.sh apply plan.tfplan" - echo "" - echo "WARNING: This plan will be applied without any confirmation" - echo "" - exit 0 -fi - -if [ -z "${AWS_DEFAULT_REGION}" ]; then - echo "Define env variable AWS_DEFAULT_REGION (should be your region name, ex us-east-1) and try again" - exit 1 -fi - -if [ -z "${TF_ENVIRONMENT_ID}" ]; then - if [ -z $(which aws) ]; then - echo "aws cli is required to identify environment id. https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html" - exit 1 - fi - export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) - if [ -z "${AWS_ACCOUNT_ID}" ]; then - echo "Can't determine aws account id by running 'aws sts get-caller-identity'. Please make sure that you have valid credentials and try again" - echo "Or provide your own TF_ENVIRONMENT_ID" - exit 1 - fi - export TF_ENVIRONMENT_ID="${AWS_ACCOUNT_ID}-${AWS_DEFAULT_REGION}" - echo "Based on aws config assuming TF_ENVIRONMENT_ID=${TF_ENVIRONMENT_ID}" -else - echo "Using user provided TF_ENVIRONMENT_ID=${TF_ENVIRONMENT_ID}" -fi - -# Enable TF_DATA_DIR_PER_ENV -[ "${TF_DATA_DIR_PER_ENV}" == "true" ] && export TF_DATA_DIR=".terraform.${TF_ENVIRONMENT_ID}" - -if [ -z "${TF_STATE_BUCKET}" ]; then - # Use hashed environment id to avoid account id/region disclosure via S3 DNS name - # in this way it is hard to predict the bucket name and attacker won't be able to - # setup buckets in advance to capture your state file - HASHED_ENVIRONMENT_ID=$(echo -n ${TF_ENVIRONMENT_ID} | "${HASH_COMMAND}" | awk '{print $1}') - export TF_STATE_BUCKET="terraform-state-${HASHED_ENVIRONMENT_ID}" -fi - -if [ -z "${TF_STATE_DYNAMODB_TABLE}" ]; then - HASHED_ENVIRONMENT_ID=$(echo -n ${TF_ENVIRONMENT_ID} | "${HASH_COMMAND}" | awk '{print $1}') - export TF_STATE_DYNAMODB_TABLE="terraform-state-${HASHED_ENVIRONMENT_ID}" -fi - -if [ -z "${TF_STATE_PATH}" ]; then - # Check if we are in git repo - GIT_REPO_TEST=$(git rev-parse --git-dir 2>/dev/null || true) - if [ -z "${GIT_REPO_TEST}" ]; then - echo "tf expects you to run inside git repo since it will be using git repo name as part of the state" - exit 1 - fi - - # Try to get remote repo name - # we can't use just local repo name because jenkins pipelines - # clone repos to directories with abracadabra names which are not the same - # as actual repo name - if [ ! -z "$(git config --get remote.origin.url)" ]; then - REPO_NAME=$(basename -s .git $(git config --get remote.origin.url)) - echo "Using remote repo name \"${REPO_NAME}\" as a part of Terraform state path" - else - # If there are no remote repo then fall back to local repo directory name - REPO_NAME=$(basename $(git rev-parse --show-toplevel)) - echo "Can not find remote repo name. Using local repo name \"${REPO_NAME}\" as a part of Terraform state path" - fi - export TF_STATE_PATH="terraform/${REPO_NAME}/${TF_STATE_FILE_NAME}" -fi - -if [ -z "${TF_VAR_terraform_state_location}" ]; then - # Set terraform variable terraform_state_location for tags - export TF_VAR_terraform_state_location="s3://${TF_STATE_BUCKET}/${TF_STATE_PATH}" -fi - -echo "Using remote state s3://${TF_STATE_BUCKET}/${TF_STATE_PATH}" -echo "Using lock table ${TF_STATE_DYNAMODB_TABLE}" - -set -x - -# Allow to skip terraform init with new backend -if [ -z "${TF_SKIP_BACKEND_INIT}" ]; then - ${TF_TERRAFORM_EXECUTABLE} init -backend-config "key=${TF_STATE_PATH}" -backend-config "bucket=${TF_STATE_BUCKET}" -backend-config "region=${AWS_DEFAULT_REGION}" -backend-config "dynamodb_table=${TF_STATE_DYNAMODB_TABLE}" -backend-config "encrypt=true" -else - echo "Skipping terraform backend initialization.." -fi - -# figure out which env file to use -if [ -e ./${TF_ENVIRONMENT_ID}.tfvars ]; then - # If we are not applying saving plan, add -var-file - if [ -z "${TF_AUTO_APPLY_SAVED_PLAN}" ]; then - export TF_CLI_ARGS_plan="-var-file=./${TF_ENVIRONMENT_ID}.tfvars" - export TF_CLI_ARGS_import="-var-file=./${TF_ENVIRONMENT_ID}.tfvars" - export TF_CLI_ARGS_destroy="-var-file=./${TF_ENVIRONMENT_ID}.tfvars" - export TF_CLI_ARGS_refresh="-var-file=./${TF_ENVIRONMENT_ID}.tfvars" - # If we are applying changes, do not ask for interactive approval. Work for any apply commands (-destroy, -refresh-only and etc) - export TF_CLI_ARGS_apply="-var-file=./${TF_ENVIRONMENT_ID}.tfvars -auto-approve" - fi -fi - -${TF_TERRAFORM_EXECUTABLE} $* \ No newline at end of file diff --git a/deployment/terraform/tf.sh.env b/deployment/terraform/tf.sh.env deleted file mode 100644 index 28e42324..00000000 --- a/deployment/terraform/tf.sh.env +++ /dev/null @@ -1 +0,0 @@ -TF_STATE_FILE_NAME=differ.tfstate \ No newline at end of file