feat(iam): deploy admin role into prod+dev account

[kolvin]

Changes

• deploy an admin role into prod + dev accounts with trust to -> https://github.com/kolvin/kloud
• create common terragrunt config -> common.hcl
• create aws provider template -> aws_provider.tmpl
• create config file for reusable values
• migrate terragrunt config s3 bucket + DynamoDB lock table

[github-actions]

dev-ci-roles Part # 1

Terragrunt Format and Style 🖌success

Terragrunt Initialization ⚙️success

Terragrunt Validation 🤖success

Validation Output

Success! The configuration is valid.

Terragrunt Plan 📖success

Show Plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

Terraform will perform the following actions:

# aws_iam_role.ci_role["github-ci-admin"] will be created
+ resource "aws_iam_role" "ci_role" {
    + arn                   = (known after apply)
    + assume_role_policy    = jsonencode(
          {
            + Statement = [
                + {
                    + Action    = "sts:AssumeRoleWithWebIdentity"
                    + Condition = {
                        + StringLike = {
                            + "token.actions.githubusercontent.com:sub" = [
                                + "repo:kolvin/kloud:pull_request",
                                + "repo:kolvin/kloud:ref:refs/heads/*",
                                + "repo:kolvin/kloud:ref:refs/tags/*",
                              ]
                          }
                      }
                    + Effect    = "Allow"
                    + Principal = {
                        + Federated = "arn:aws:iam::943824751361:oidc-provider/token.actions.githubusercontent.com"
                      }
                    + Sid       = "TrustPolicy"
                  },
              ]
            + Version   = "2012-10-17"
          }
      )
    + create_date           = (known after apply)
    + force_detach_policies = false
    + id                    = (known after apply)
    + managed_policy_arns   = (known after apply)
    + max_session_duration  = 3600
    + name                  = "github-ci-admin"
    + name_prefix           = (known after apply)
    + path                  = "/"
    + tags_all              = (known after apply)
    + unique_id             = (known after apply)
  }

# aws_iam_role_policy_attachment.ci_managed_policy["github-ci-admin_AdministratorAccess"] will be created
+ resource "aws_iam_role_policy_attachment" "ci_managed_policy" {
    + id         = (known after apply)
    + policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
    + role       = "github-ci-admin"
  }

# aws_iam_role_policy_attachment.ci_managed_policy["github-ci-admin_AmazonS3FullAccess"] will be created
+ resource "aws_iam_role_policy_attachment" "ci_managed_policy" {
    + id         = (known after apply)
    + policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
    + role       = "github-ci-admin"
  }

Plan: 3 to add, 0 to change, 0 to destroy.

Changes to Outputs:
+ role_arns            = [
    + (known after apply),
  ]
+ role_inline_polices  = {}
+ role_managed_polices = {
    + github-ci-admin = [
        + "arn:aws:iam::aws:policy/AdministratorAccess",
        + "arn:aws:iam::aws:policy/AmazonS3FullAccess",
      ]
  }
+ role_names           = [
    + "github-ci-admin",
  ]

Pusher: @kolvin, Action: pull_request, Working Directory: environments/dev/global/, Workflow: dev-ci-roles

[github-actions]

prod-ci-roles Part # 1

Terragrunt Format and Style 🖌success

Terragrunt Initialization ⚙️success

Terragrunt Validation 🤖success

Validation Output

Success! The configuration is valid.

Terragrunt Plan 📖success

Show Plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

Terraform will perform the following actions:

# aws_iam_role.ci_role["github-ci-admin"] will be created
+ resource "aws_iam_role" "ci_role" {
    + arn                   = (known after apply)
    + assume_role_policy    = jsonencode(
          {
            + Statement = [
                + {
                    + Action    = "sts:AssumeRoleWithWebIdentity"
                    + Condition = {
                        + StringLike = {
                            + "token.actions.githubusercontent.com:sub" = [
                                + "repo:kolvin/kloud:pull_request",
                                + "repo:kolvin/kloud:ref:refs/heads/*",
                                + "repo:kolvin/kloud:ref:refs/tags/*",
                              ]
                          }
                      }
                    + Effect    = "Allow"
                    + Principal = {
                        + Federated = "arn:aws:iam::310394544294:oidc-provider/token.actions.githubusercontent.com"
                      }
                    + Sid       = "TrustPolicy"
                  },
              ]
            + Version   = "2012-10-17"
          }
      )
    + create_date           = (known after apply)
    + force_detach_policies = false
    + id                    = (known after apply)
    + managed_policy_arns   = (known after apply)
    + max_session_duration  = 3600
    + name                  = "github-ci-admin"
    + name_prefix           = (known after apply)
    + path                  = "/"
    + tags_all              = (known after apply)
    + unique_id             = (known after apply)
  }

# aws_iam_role_policy_attachment.ci_managed_policy["github-ci-admin_AdministratorAccess"] will be created
+ resource "aws_iam_role_policy_attachment" "ci_managed_policy" {
    + id         = (known after apply)
    + policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
    + role       = "github-ci-admin"
  }

# aws_iam_role_policy_attachment.ci_managed_policy["github-ci-admin_AmazonSQSFullAccess"] will be created
+ resource "aws_iam_role_policy_attachment" "ci_managed_policy" {
    + id         = (known after apply)
    + policy_arn = "arn:aws:iam::aws:policy/AmazonSQSFullAccess"
    + role       = "github-ci-admin"
  }

Plan: 3 to add, 0 to change, 0 to destroy.

Changes to Outputs:
+ role_arns            = [
    + (known after apply),
  ]
+ role_inline_polices  = {}
+ role_managed_polices = {
    + github-ci-admin = [
        + "arn:aws:iam::aws:policy/AdministratorAccess",
        + "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
      ]
  }
+ role_names           = [
    + "github-ci-admin",
  ]

Pusher: @kolvin, Action: pull_request, Working Directory: environments/prod/global/, Workflow: prod-ci-roles

[kolvin-bot]

🎉 This PR is included in version 0.1.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀