refactor: extract all hard coded stuff and calculated stuff in locals

Author: Rahul-4480

locals.tf

@@ -1,21 +1,44 @@
 locals {
-  google_oidc_endpoint                     = "https://accounts.google.com"
-  container_port                           = 4141
-  alb_ip_target_type                       = "ip"
-  ecs_container_definations_name           = "atlantis"
-  alb_system_name                          = "atlantis"
-  domain_parts                             = split(".", var.atlantis_url)
-  base_domain                              = join(".", slice(local.domain_parts, length(local.domain_parts) - 2, length(local.domain_parts)))
-  sub_domain                               = join(".", slice(local.domain_parts, 0, length(local.domain_parts) - 2))
-  ecs_task_definition_family               = "atlantis"
-  task_definition_network_mode             = "awsvpc"
-  load_balancer_internal                   = "false"
-  ecs_service_name                         = "atlantis"
-  container_memory_reservation             = 10
-  authenticate_oidc_issuer                 = "https://accounts.google.com"
-  authenticate_oidc_user_info_endpoint     = "https://openidconnect.googleapis.com/v1/userinfo"
-  authenticate_oidc_token_endpoint         = "https://oauth2.googleapis.com/token"
-  authenticate_oidc_authorization_endpoint = "https://accounts.google.com/o/oauth2/v2/auth"
+  google_oidc_endpoint                         = "https://accounts.google.com"
+  container_port                               = 4141
+  alb_ip_target_type                           = "ip"
+  ecs_container_definations_name               = "atlantis"
+  alb_system_name                              = "atlantis"
+  domain_parts                                 = split(".", var.atlantis_url)
+  base_domain                                  = join(".", slice(local.domain_parts, length(local.domain_parts) - 2, length(local.domain_parts)))
+  sub_domain                                   = join(".", slice(local.domain_parts, 0, length(local.domain_parts) - 2))
+  ecs_task_definition_family                   = "atlantis"
+  task_definition_network_mode                 = "awsvpc"
+  load_balancer_internal                       = "false"
+  ecs_service_name                             = "atlantis"
+  container_memory_reservation                 = 10
+  authenticate_oidc_issuer                     = "https://accounts.google.com"
+  authenticate_oidc_user_info_endpoint         = "https://openidconnect.googleapis.com/v1/userinfo"
+  authenticate_oidc_token_endpoint             = "https://oauth2.googleapis.com/token"
+  authenticate_oidc_authorization_endpoint     = "https://accounts.google.com/o/oauth2/v2/auth"
+  ecs_task_assume_policy_actions               = ["sts:AssumeRole"]
+  ecs_task_assume_policy_principal_type        = "Service"
+  ecs_task_assume_policy_principal_identifiers = ["ecs-tasks.amazonaws.com"]
+  acm_certificate_statuses                     = ["ISSUED"]
+  default_desired_count                        = 1
+  target_group_name                            = "atlantis-target-group"
+  target_group_protocol                        = "HTTP"
+  listener_protocol                            = "HTTPS"
+  listener_port                                = 443
+  default_action_type                          = "fixed-response"
+  fixed_response_content_type                  = "application/json"
+  fixed_response_message_body                  = "Unauthorised"
+  fixed_response_status_code                   = 404
+  listener_name                                = "https-listener"
+  listener_priority                            = 10
+  authenticate_oidc_type                       = "authenticate-oidc"
+  authenticate_oidc_scope                      = "openid email"
+  authenticate_oidc_on_unauthenticated_request = "authenticate"
+  forward_action_type                          = "forward"
+  http_listener_priority                       = 1
+  path_pattern_values                          = ["/events"]
+  http_request_method_values                   = ["POST"]
+  create_capacity_provider                     = false
 
   env_variables = [
     {

main.tf

@@ -8,29 +8,28 @@ data "aws_vpc" "selected" {
 }
 
 data "aws_ecs_cluster" "default" {
-  cluster_name = "default"
+  cluster_name = var.ecs_cluster_name
 }
 
 data "aws_iam_policy_document" "ecs_task_assume_policy" {
   statement {
-    actions = ["sts:AssumeRole"]
+    actions = local.ecs_task_assume_policy_actions
     principals {
-      type        = "Service"
-      identifiers = ["ecs-tasks.amazonaws.com"]
+      type        = local.ecs_task_assume_policy_principal_type
+      identifiers = local.ecs_task_assume_policy_principal_identifiers
     }
   }
 }
 
 data "aws_acm_certificate" "base_domain_certificate" {
   domain   = local.base_domain
-  statuses = ["ISSUED"]
+  statuses = local.acm_certificate_statuses
 }
 
 data "aws_route53_zone" "zone" {
   name = local.base_domain
 }
 
-
 module "ecs_deployment" {
   source  = "infraspecdev/ecs-deployment/aws"
   version = "3.0.1"
@@ -63,11 +62,11 @@ module "ecs_deployment" {
   }
   service = {
     name          = local.ecs_service_name
-    desired_count = var.ecs_service_desired_count != null ? var.ecs_service_desired_count : 1
+    desired_count = var.ecs_service_desired_count != null ? var.ecs_service_desired_count : local.default_desired_count
     load_balancer = [{
       container_name = local.ecs_container_definations_name
       container_port = local.container_port
-      target_group   = "atlantis-target-group"
+      target_group   = local.target_group_name
     }]
 
     network_configuration = {
@@ -86,25 +85,25 @@ module "ecs_deployment" {
       atlantis-target-group = {
         name        = format("%s-%s-ip", local.alb_system_name, terraform.workspace)
         port        = local.container_port
-        protocol    = "HTTP"
+        protocol    = local.target_group_protocol
         target_type = local.alb_ip_target_type
       }
     }
 
     listeners = {
       https-listener = {
-        protocol        = "HTTPS"
-        port            = 443
+        protocol        = local.listener_protocol
+        port            = local.listener_port
         certificate_arn = data.aws_acm_certificate.base_domain_certificate.arn
 
         default_action = [
           {
-            type         = "fixed-response"
-            target_group = "atlantis-target-group"
+            type         = local.default_action_type
+            target_group = local.target_group_name
             fixed_response = {
-              content_type = "application/json"
-              message_body = "Unauthorised"
-              status_code  = 404
+              content_type = local.fixed_response_content_type
+              message_body = local.fixed_response_message_body
+              status_code  = local.fixed_response_status_code
             }
           }
         ]
@@ -113,8 +112,8 @@ module "ecs_deployment" {
 
     listener_rules = {
       https-listener-rules = {
-        listener = "https-listener"
-        priority = 10
+        listener = local.listener_name
+        priority = local.listener_priority
 
         condition = [
           {
@@ -126,39 +125,39 @@ module "ecs_deployment" {
 
         action = [
           {
-            type = "authenticate-oidc"
+            type = local.authenticate_oidc_type
 
             authenticate_oidc = {
               authorization_endpoint     = local.authenticate_oidc_authorization_endpoint
               token_endpoint             = local.authenticate_oidc_token_endpoint
               user_info_endpoint         = local.authenticate_oidc_user_info_endpoint
               issuer                     = local.authenticate_oidc_issuer
               session_cookie_name        = format("TOKEN-OIDC-%s", data.aws_ssm_parameter.environment["ATLANTIS_GOOGLE_CLIENT_ID"].value)
-              scope                      = "openid email"
-              on_unauthenticated_request = "authenticate"
+              scope                      = local.authenticate_oidc_scope
+              on_unauthenticated_request = local.authenticate_oidc_on_unauthenticated_request
               client_id                  = data.aws_ssm_parameter.environment["ATLANTIS_GOOGLE_CLIENT_ID"].value
               client_secret              = data.aws_ssm_parameter.environment["ATLANTIS_GOOGLE_CLIENT_SECRET"].value
             }
           },
           {
-            target_group = "atlantis-target-group"
-            type         = "forward"
+            target_group = local.target_group_name
+            type         = local.forward_action_type
           }
         ]
       },
       http-listener-rules = {
-        listener = "https-listener"
-        priority = 1
+        listener = local.listener_name
+        priority = local.http_listener_priority
 
         condition = [
           {
             path_pattern = {
-              values = ["/events"]
+              values = local.path_pattern_values
             }
           },
           {
             http_request_method = {
-              values = ["POST"]
+              values = local.http_request_method_values
             }
           },
           {
@@ -170,13 +169,13 @@ module "ecs_deployment" {
 
         action = [
           {
-            target_group = "atlantis-target-group"
-            type         = "forward"
+            target_group = local.target_group_name
+            type         = local.forward_action_type
           }
         ]
       }
     }
   }
 
-  create_capacity_provider = false
+  create_capacity_provider = local.create_capacity_provider
 }

variables.tf

@@ -49,9 +49,17 @@ variable "atlantis_gh_user" {
 variable "thumbprint_list" {
   description = "The thumbprint of the OIDC provider"
   type        = list(string)
+  default     = ["e252aa6e92432f32cbc1b182056627c239652678"]
 }
 
 variable "atlantis_docker_image" {
   description = "The Docker image to use for the Atlantis server"
   type        = string
+  default     = "ghcr.io/runatlantis/atlantis:v0.23.1"
+}
+
+variable "ecs_cluster_name" {
+  description = "The name of the ECS cluster"
+  type        = string
+  default     = "default"
 }