Terraform AWS Harness CCM

Terraform to configure your AWS account for use with Harness CCM.

Can be used as a module or a starting point for your own automation.

Authentication

This module creates AWS resources. To set up authentication to your AWS account please see the AWS provider documentation.

Usage

Master Payer Accounts

When creating a role in your master payer account for granting Harness access to your CUR, be sure and set s3_bucket_arn to the bucket that holds your CUR and enable_billing to true:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.0"
    }
  }
}

provider "aws" {}

module "ccm-billing" {
  source                = "harness-community/harness-ccm/aws"
  version               = "0.1.4"

  external_id             = "harness:891928451355:<your harness account id>"

  s3_bucket_arn           = "arn:aws:s3:::<s3 bucket name with cur data>"
  enable_billing          = true

  enable_commitment_read  = true
  enable_commitment_write = true
}

To enable the commitment orchestrator feature, set enable_commitment_read to get visibility on your commitments and enable_commitment_write to enable making purchases through Harness.

Member Accounts

When creating roles in member accounts, for non billing access, just set the specific features you want to enable:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.0"
    }
  }
}

provider "aws" {}

module "ccm-member" {
  source                = "harness-community/harness-ccm/aws"
  version               = "0.1.4"
  
  external_id             = "harness:891928451355:<your harness account id>"

  enable_events           = true
  enable_optimization     = true
  # enable view access for governance dry runs
  enable_governance       = true

  # enable write access for governance enforcements
  governance_policy_arn = [
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
  ]
}

For example, if you want to enable Harness recommendations and ec2/ebs/rds dashboards, set enable_events to true. If you want to enable autostopping, set enable_optimization to true. If you want to enable asset governance read access, set enable_governance to true.

If you want to add any other policies to the Harness role (maybe you want to enable more actions to be used with asset governance), you can pass them with governance_policy_arn.

Fine-Grain Permissions

Optionally we have included fine-grain policies for autostopping which list out specific IAM actions needed based on your target resource type.

You can set these with enable_autostopping_elb, enable_autostopping_ec2, and enable_autostopping_asg_rds_lambda

CMK EBS Volumes

When EBS volumes are encrypted using customer-managed keys using KMS, AutoStopping will not be able to start the instances with just the default permissions. Additional permissions are required to enable KMS decryption. To get KMS encrypted volumes to work with AutoStopping, the following changes must be performed:

• Permissions added to IAM Role to allow kms actions
• Tag KMS Keys - Add a harness.io/allowForAutoStopping:true tag to the KMS keys

To enable these permissions, set the variable.

Requirements

Name	Version
aws	>= 4.0

Providers

Name	Version
aws	>= 4.0

Modules

No modules.

Resources

Name	Type
aws_iam_policy.autostopping_asg_ecs_rds	resource
aws_iam_policy.autostopping_base	resource
aws_iam_policy.autostopping_cmk_ebs	resource
aws_iam_policy.autostopping_ec2	resource
aws_iam_policy.autostopping_elb	resource
aws_iam_policy.harness_billingmonitoring	resource
aws_iam_policy.harness_commitment	resource
aws_iam_policy.harness_eventsmonitoring	resource
aws_iam_policy.harness_getrole	resource
aws_iam_policy.harness_optimsation	resource
aws_iam_policy.harness_optimsationlambda	resource
aws_iam_policy.harness_secret_access	resource
aws_iam_role.harness_ce	resource
aws_iam_role.harness_ce_lambda	resource
aws_iam_role_policy_attachment.autostopping_asg_ecs_rds	resource
aws_iam_role_policy_attachment.autostopping_base	resource
aws_iam_role_policy_attachment.autostopping_cmk_ebs	resource
aws_iam_role_policy_attachment.autostopping_ec2	resource
aws_iam_role_policy_attachment.autostopping_elb	resource
aws_iam_role_policy_attachment.harness_ce_billingmonitoring	resource
aws_iam_role_policy_attachment.harness_ce_commitment	resource
aws_iam_role_policy_attachment.harness_ce_eventsmonitoring	resource
aws_iam_role_policy_attachment.harness_ce_getrole	resource
aws_iam_role_policy_attachment.harness_ce_governance	resource
aws_iam_role_policy_attachment.harness_ce_governance_enforce	resource
aws_iam_role_policy_attachment.harness_ce_lambda_optimsationlambda	resource
aws_iam_role_policy_attachment.harness_ce_optimsation	resource
aws_iam_role_policy_attachment.harness_secret_access	resource
aws_iam_policy_document.autostopping_asg_ecs_rds	data source
aws_iam_policy_document.autostopping_base	data source
aws_iam_policy_document.autostopping_cmk_ebs	data source
aws_iam_policy_document.autostopping_ec2	data source
aws_iam_policy_document.autostopping_elb	data source
aws_iam_policy_document.harness_billingmonitoring	data source
aws_iam_policy_document.harness_ce	data source
aws_iam_policy_document.harness_ce_lambda	data source
aws_iam_policy_document.harness_commitment	data source
aws_iam_policy_document.harness_eventsmonitoring	data source
aws_iam_policy_document.harness_getrole	data source
aws_iam_policy_document.harness_optimsation	data source
aws_iam_policy_document.harness_optimsationlambda	data source
aws_iam_policy_document.harness_secret_access	data source

Inputs

Name	Description	Type	Default	Required
additional_external_ids	Additional external ids to allow	list(string)	[]	no
aws_account_id	Source AWS account ID, this is Harness' AWS account. If using Harness in SMP mode, set your account ID here	string	"891928451355"	no
enable_autostopping_asg_ecs_rds	Enable AutoStopping permissions for ASG, ECS and RDS	bool	false	no
enable_autostopping_ec2	Enable AutoStopping permissions for EC2	bool	false	no
enable_autostopping_elb	Enable AutoStopping permissions for ELB	bool	false	no
enable_billing	Enable AWS Cost Visibility	bool	false	no
enable_cmk_ebs	Enable CMK KMS permissions for EBS	bool	false	no
enable_commitment_read	Enable AWS Commitment Orchestrator Read	bool	false	no
enable_commitment_write	Enable AWS Commitment Orchestrator Write	bool	false	no
enable_events	Enable AWS Resource Management	bool	false	no
enable_governance	Enable AWS Asset Governance	bool	false	no
enable_optimization	Enable AWS Optimization by Auto-Stopping	bool	false	no
external_id	External ID given in the harness UI: harness:<aws_account_id>:	string	n/a	yes
governance_policy_arns	Policy arns to give role access to enforce governance	list(string)	[]	no
prefix	A string to add to all resources to add uniqueness	string	""	no
s3_bucket_arn	S3 Arn for the bucket that holds your CUR	string	""	no
s3_bucket_name	S3 bucket name for the bucket that Harness uses to store and analyze your CUR	string	"ce-customer-billing-data-prod"	no
secrets	List of secrets that harness should have access to	list(string)	[]	no

Outputs

Name	Description
cross_account_role	n/a
external_id	n/a

References

Harness CCM AWS Setup Guide

Harness CCM CloudFormation Template