fix: dynamodb terraform lock table (#101)

soerenmartius · web-flow · commit 4759f464584e · 2024-03-18T12:36:54.000+01:00
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -65,22 +65,22 @@ jobs:
         if: steps.list.outputs.stdout
         id: init
         run: |
-          terramate run --changed -- terraform init
+          terramate run -C stacks --changed -- terraform init
 
       - name: Create Terraform plan on changed stacks
         if: steps.list.outputs.stdout
         id: plan
-        run: terramate run --changed -- terraform plan -lock-timeout=5m -out out.tfplan
+        run: terramate run -C stacks --changed -- terraform plan -lock-timeout=5m -out out.tfplan
 
       - name: Apply planned changes on changed stacks
         id: apply
         if: steps.list.outputs.stdout
-        run: terramate run --changed --cloud-sync-deployment --cloud-sync-terraform-plan-file=out.tfplan -- terraform apply -input=false -auto-approve -lock-timeout=5m out.tfplan
+        run: terramate run -C stacks --changed --cloud-sync-deployment --cloud-sync-terraform-plan-file=out.tfplan -- terraform apply -input=false -auto-approve -lock-timeout=5m out.tfplan
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: Run drift detection
         if: steps.list.outputs.stdout && ! cancelled() && steps.apply.outcome != 'skipped'
-        run: terramate run --changed --cloud-sync-drift-status --cloud-sync-terraform-plan-file=drift.tfplan -- terraform plan -out drift.tfplan -detailed-exitcode
+        run: terramate run -C stacks --changed --cloud-sync-drift-status --cloud-sync-terraform-plan-file=drift.tfplan -- terraform plan -out drift.tfplan -detailed-exitcode
         env:
           GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/drift-detection.yml b/.github/workflows/drift-detection.yml
@@ -56,10 +56,10 @@ jobs:
 
       - name: Run Terraform init on all stacks
         id: init
-        run: terramate run -- terraform init
+        run: terramate run -C stacks -- terraform init
 
       - name: Run drift detection
         id: drift
-        run: terramate run --cloud-sync-drift-status --cloud-sync-terraform-plan-file=drift.tfplan --continue-on-error -- terraform plan -out drift.tfplan -detailed-exitcode -lock=false
+        run: terramate run -C stacks --cloud-sync-drift-status --cloud-sync-terraform-plan-file=drift.tfplan --continue-on-error -- terraform plan -out drift.tfplan -detailed-exitcode -lock=false
         env:
           GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
@@ -87,16 +87,16 @@ jobs:
 
       - name: Initialize Terraform in changed stacks
         if: steps.list.outputs.stdout
-        run: terramate run --parallel 1 --changed -- terraform init -lock-timeout=5m
+        run: terramate run -C stacks --parallel 1 --changed -- terraform init -lock-timeout=5m
 
       - name: Validate Terraform configuration in changed stacks
         if: steps.list.outputs.stdout
-        run: terramate run --parallel 5  --changed -- terraform validate
+        run: terramate run -C stacks --parallel 5  --changed -- terraform validate
 
       - name: Plan Terraform changes in changed stacks
         if: steps.list.outputs.stdout
         run: |
-          terramate run --parallel 5 --changed --cloud-sync-preview --cloud-sync-terraform-plan-file=out.tfplan --debug-preview-url preview_url.txt --continue-on-error -- terraform plan -out out.tfplan -detailed-exitcode -lock=false
+          terramate run -C stacks --parallel 5 --changed --cloud-sync-preview --cloud-sync-terraform-plan-file=out.tfplan --debug-preview-url preview_url.txt --continue-on-error -- terraform plan -out out.tfplan -detailed-exitcode -lock=false
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
@@ -119,7 +119,7 @@ jobs:
           echo >>pr-comment.txt "#### Terraform Plan"
           echo >>pr-comment.txt
           echo >>pr-comment.txt '```terraform'
-          terramate run --changed -- terraform show -no-color out.tfplan |& dd bs=1024 count=248 >>pr-comment.txt
+          terramate run -C stacks --changed -- terraform show -no-color out.tfplan |& dd bs=1024 count=248 >>pr-comment.txt
           [ "${PIPESTATUS[0]}" == "141" ] && sed -i 's/#### Terraform Plan/#### :warning: Terraform Plan truncated: please check console output :warning:/' pr-comment.txt
           echo >>pr-comment.txt '```'
           cat pr-comment.txt >>$GITHUB_STEP_SUMMARY
diff --git a/_bootstrap/oidc-aws-github/stack.tm.hcl b/_bootstrap/oidc-aws-github/stack.tm.hcl
@@ -2,6 +2,5 @@ stack {
   name        = "oidc-aws-github"
   description = "Configure GitHub Actions as an IAM OIDC identity provider in AWS."
   id          = "7d22b8e6-0e02-4815-995b-1cd34c826c95"
-
-  tags = ["no-backend"]
+  tags        = ["no-backend"]
 }
diff --git a/_bootstrap/terraform-state-bucket/_main.tf b/_bootstrap/terraform-state-bucket/_main.tf
@@ -28,7 +28,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "state-bucket" {
 }
 resource "aws_dynamodb_table" "terraform-lock" {
   hash_key      = "LockID"
-  name          = "terraform_state"
+  name          = "terraform-lock"
   read_capacity = 5
   tags = {
     "Name" = "DynamoDB Terraform State Lock Table"
diff --git a/_bootstrap/terraform-state-bucket/config.tm.hcl b/_bootstrap/terraform-state-bucket/config.tm.hcl
@@ -35,7 +35,7 @@ generate_hcl "_main.tf" {
     }
 
     resource "aws_dynamodb_table" "terraform-lock" {
-      name           = "terraform_state"
+      name           = tm_try(global.terraform.backend.dyanmodb_table, "terraform_state")
       read_capacity  = 5
       write_capacity = 5
       hash_key       = "LockID"
diff --git a/config.tm.hcl b/config.tm.hcl
@@ -3,8 +3,9 @@ globals "terraform" {
 }
 
 globals "terraform" "backend" {
-  bucket = "terramate-example-terraform-state-backend"
-  region = "us-east-1"
+  bucket         = "terramate-example-terraform-state-backend"
+  dyanmodb_table = "terraform-lock"
+  region         = "us-east-1"
 }
 
 globals "aws" "oidc" {
diff --git a/imports/backend.tm.hcl b/imports/backend.tm.hcl
@@ -8,7 +8,7 @@ generate_hcl "_backend.tf" {
         bucket         = global.terraform.backend.bucket
         key            = "terraform/stacks/by-id/${terramate.stack.id}/terraform.tfstate"
         encrypt        = true
-        dynamodb_table = tm_try(global.terraform.backend.dynamo_table, "terraform-lock")
+        dynamodb_table = tm_try(global.terraform.backend.dyanmodb_table, "terraform-lock")
       }
     }
   }
diff --git a/terramate.tm.hcl b/terramate.tm.hcl
@@ -1,9 +1,7 @@
 terramate {
   config {
-    experiments = [
-      "scripts", # Enable Terramate Scripts
-    ]
 
+    # Configure the namespace of your Terramate Cloud organization
     cloud {
       organization = "terramate-demo"
     }
@@ -14,18 +12,24 @@ terramate {
 
       # Optionally disable git safe guards
       # Learn more: https://terramate.io/docs/cli/orchestration/safeguards
-      check_remote      = false
-      check_untracked   = false
-      check_uncommitted = false
+      # check_remote      = false
+      # check_untracked   = false
+      # check_uncommitted = false
     }
 
     run {
       env {
         TF_PLUGIN_CACHE_DIR = "${terramate.root.path.fs.absolute}/.tf_plugin_cache_dir"
       }
+
       # Optionally disable code generation safe guard
       # Learn more: https://terramate.io/docs/cli/orchestration/safeguards
       # check_gen_code = true
     }
+
+    # Enable Terramate Scripts
+    experiments = [
+      "scripts",
+    ]
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -2,6 +2,5 @@ stack {`
`2`	`2`	`name = "oidc-aws-github"`
`3`	`3`	`description = "Configure GitHub Actions as an IAM OIDC identity provider in AWS."`
`4`	`4`	`id = "7d22b8e6-0e02-4815-995b-1cd34c826c95"`
`5`		`-`
`6`		`- tags = ["no-backend"]`
	`5`	`+ tags = ["no-backend"]`
`7`	`6`	`}`
Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "state-bucket" {`
`28`	`28`	`}`
`29`	`29`	`resource "aws_dynamodb_table" "terraform-lock" {`
`30`	`30`	`hash_key = "LockID"`
`31`		`- name = "terraform_state"`
	`31`	`+ name = "terraform-lock"`
`32`	`32`	`read_capacity = 5`
`33`	`33`	`tags = {`
`34`	`34`	`"Name" = "DynamoDB Terraform State Lock Table"`
Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ generate_hcl "_main.tf" {`
`35`	`35`	`}`
`36`	`36`
`37`	`37`	`resource "aws_dynamodb_table" "terraform-lock" {`
`38`		`- name = "terraform_state"`
	`38`	`+ name = tm_try(global.terraform.backend.dyanmodb_table, "terraform_state")`
`39`	`39`	`read_capacity = 5`
`40`	`40`	`write_capacity = 5`
`41`	`41`	`hash_key = "LockID"`
Original file line number	Diff line number	Diff line change
`@@ -3,8 +3,9 @@ globals "terraform" {`
`3`	`3`	`}`
`4`	`4`
`5`	`5`	`globals "terraform" "backend" {`
`6`		`- bucket = "terramate-example-terraform-state-backend"`
`7`		`- region = "us-east-1"`
	`6`	`+ bucket = "terramate-example-terraform-state-backend"`
	`7`	`+ dyanmodb_table = "terraform-lock"`
	`8`	`+ region = "us-east-1"`
`8`	`9`	`}`
`9`	`10`
`10`	`11`	`globals "aws" "oidc" {`
Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,7 @@ generate_hcl "_backend.tf" {`
`8`	`8`	`bucket = global.terraform.backend.bucket`
`9`	`9`	`key = "terraform/stacks/by-id/${terramate.stack.id}/terraform.tfstate"`
`10`	`10`	`encrypt = true`
`11`		`- dynamodb_table = tm_try(global.terraform.backend.dynamo_table, "terraform-lock")`
	`11`	`+ dynamodb_table = tm_try(global.terraform.backend.dyanmodb_table, "terraform-lock")`
`12`	`12`	`}`
`13`	`13`	`}`
`14`	`14`	`}`