Remove obsolete variables (#27)

* Remove obsolete variables for assume role

* Remove obsolete variable from examples

* Fix CI to run in dedicated VPC

* Fix missing providers

* Fix problem in CI with `for_each`

* Update docs

* Fix filters for RAM resource

.github/workflows/master.yml

@@ -19,10 +19,11 @@ jobs:
 
       - name: "make test"
         run: |
-          make test ARGS="-var aws_account_id_hub=${TF_VAR_aws_account_id_hub} -var aws_account_id_satellite=[${TF_VAR_aws_account_id_satellite}]"
+          make test ARGS="-var role_to_assume_hub=${TF_VAR_role_to_assume} -var aws_account_id_hub=${TF_VAR_aws_account_id_hub} -var role_to_assume_satellite=${TF_VAR_role_to_assume} -var aws_account_id_satellite=${TF_VAR_aws_account_id_satellite}"
         env:
           AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          TF_VAR_aws_account_id_hub: ${{ secrets.aws_account_id_hub }}
-          TF_VAR_aws_account_id_satellite: ${{ secrets.aws_account_id_satellite }}
+          TF_VAR_role_to_assume: ${{ secrets.ROLE_TO_ASSUME }}
+          TF_VAR_aws_account_id_hub: ${{ secrets.AWS_ACCOUNT_ID_HUB }}
+          TF_VAR_aws_account_id_satellite: ${{ secrets.AWS_ACCOUNT_ID_SATELLITE }}

.github/workflows/terraform.yml

@@ -40,10 +40,11 @@ jobs:
 
       - name: "make test"
         run: |
-          make test ARGS="-var aws_account_id_hub=${TF_VAR_aws_account_id_hub} -var aws_account_id_satellite=[${TF_VAR_aws_account_id_satellite}]"
+          make test ARGS="-var role_to_assume_hub=${TF_VAR_role_to_assume} -var aws_account_id_hub=${TF_VAR_aws_account_id_hub} -var role_to_assume_satellite=${TF_VAR_role_to_assume} -var aws_account_id_satellite=${TF_VAR_aws_account_id_satellite}"
         env:
           AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          TF_VAR_aws_account_id_hub: ${{ secrets.aws_account_id_hub }}
-          TF_VAR_aws_account_id_satellite: ${{ secrets.aws_account_id_satellite }}
+          TF_VAR_role_to_assume: ${{ secrets.ROLE_TO_ASSUME }}
+          TF_VAR_aws_account_id_hub: ${{ secrets.AWS_ACCOUNT_ID_HUB }}
+          TF_VAR_aws_account_id_satellite: ${{ secrets.AWS_ACCOUNT_ID_SATELLITE }}

Makefile

@@ -11,10 +11,10 @@ TF_MODULES  = $(sort $(dir $(wildcard $(CURRENT_DIR)modules/*/)))
 # -------------------------------------------------------------------------------------------------
 # Container versions
 # -------------------------------------------------------------------------------------------------
-TF_VERSION      = 0.15.5
-TFDOCS_VERSION  = 0.16.0-0.31
-FL_VERSION      = 0.4
-JL_VERSION      = 1.6.0-0.5
+TF_VERSION      = 1.5.7
+TFDOCS_VERSION  = 0.16.0-0.34
+FL_VERSION      = latest-0.8
+JL_VERSION      = 1.6.0-0.14
 
 
 # -------------------------------------------------------------------------------------------------
@@ -104,7 +104,46 @@ test: _pull-tf
 		fi; \
 		echo; \
 		echo "------------------------------------------------------------"; \
-		echo "# Terraform plan"; \
+		echo "# Terraform plan (1/2)"; \
+		echo "------------------------------------------------------------"; \
+		if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY --workdir "$${DOCKER_PATH}" hashicorp/terraform:$(TF_VERSION) \
+			plan -target 'module.tgw-satellite.data.aws_route_tables.all' \
+				$(ARGS) \
+				-out=tfplan \
+				; then \
+			echo "OK"; \
+		else \
+			echo "Failed"; \
+			docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" --workdir "$${DOCKER_PATH}" --entrypoint=rm hashicorp/terraform:$(TF_VERSION) -rf .terraform/ || true; \
+			exit 1; \
+		fi; \
+		echo; \
+		echo "------------------------------------------------------------"; \
+		echo "# Terraform apply (1/2)"; \
+		echo "------------------------------------------------------------"; \
+		if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY --workdir "$${DOCKER_PATH}" hashicorp/terraform:$(TF_VERSION) \
+			apply -target 'module.tgw-satellite.data.aws_route_tables.all' \
+				-auto-approve \
+				tfplan \
+				; then \
+			echo "Apply OK"; \
+		else \
+			echo "Apply failed"; \
+			if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY --workdir "$${DOCKER_PATH}" hashicorp/terraform:$(TF_VERSION) \
+				destroy \
+					-auto-approve \
+					$(ARGS) \
+					; then \
+				echo "Destroy OK"; \
+				docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" --workdir "$${DOCKER_PATH}" --entrypoint=rm hashicorp/terraform:$(TF_VERSION) -rf .terraform/ terraform.tfstate terraform.tfstate.backup || true; \
+			else \
+				echo "Destroy failed. You should check for dangling resources."; \
+				exit 1; \
+			fi; \
+		fi; \
+		echo; \
+		echo "------------------------------------------------------------"; \
+		echo "# Terraform plan (2/2)"; \
 		echo "------------------------------------------------------------"; \
 		if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY --workdir "$${DOCKER_PATH}" hashicorp/terraform:$(TF_VERSION) \
 			plan \
@@ -119,7 +158,7 @@ test: _pull-tf
 		fi; \
 		echo; \
 		echo "------------------------------------------------------------"; \
-		echo "# Terraform apply & destroy"; \
+		echo "# Terraform apply (2/2) & destroy"; \
 		echo "------------------------------------------------------------"; \
 		if docker run $$(tty -s && echo "-it" || echo) --rm -v "$(CURRENT_DIR):/t" -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY --workdir "$${DOCKER_PATH}" hashicorp/terraform:$(TF_VERSION) \
 			apply \
@@ -154,7 +193,6 @@ test: _pull-tf
 		fi; \
 	)
 
-
 # -------------------------------------------------------------------------------------------------
 # Helper Targets
 # -------------------------------------------------------------------------------------------------

README.md

@@ -85,15 +85,15 @@ this fact.
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws.hub"></a> [aws.hub](#provider\_aws.hub) | >= 4 |
-| <a name="provider_aws.satellite"></a> [aws.satellite](#provider\_aws.satellite) | >= 4 |
+| <a name="provider_aws.hub"></a> [aws.hub](#provider\_aws.hub) | >= 5 |
+| <a name="provider_aws.satellite"></a> [aws.satellite](#provider\_aws.satellite) | >= 5 |
 
 ## Modules
 
@@ -127,14 +127,12 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_aws_account_id_hub"></a> [aws\_account\_id\_hub](#input\_aws\_account\_id\_hub) | AWS account number containing the TGW hub | `string` | n/a | yes |
-| <a name="input_role_to_assume_hub"></a> [role\_to\_assume\_hub](#input\_role\_to\_assume\_hub) | IAM role name to assume in the AWS account containing the TGW hub (eg. ASSUME-ROLE-HUB) | `string` | n/a | yes |
 | <a name="input_attachment_subnet_filters"></a> [attachment\_subnet\_filters](#input\_attachment\_subnet\_filters) | List of maps selecting the subnet(s) where TGW will be attached | <pre>list(object({<br>    name   = string<br>    values = list(string)<br>  }))</pre> | <pre>[<br>  {<br>    "name": "tag:Name",<br>    "values": [<br>      "*private*"<br>    ]<br>  }<br>]</pre> | no |
 | <a name="input_aws_account_id_satellite"></a> [aws\_account\_id\_satellite](#input\_aws\_account\_id\_satellite) | AWS account number containing the TGW satellite | `string` | `""` | no |
 | <a name="input_hub_destination_cidr_blocks"></a> [hub\_destination\_cidr\_blocks](#input\_hub\_destination\_cidr\_blocks) | List of CIDRs to be routed for the hub | `list(string)` | `[]` | no |
 | <a name="input_private_subnet_filters"></a> [private\_subnet\_filters](#input\_private\_subnet\_filters) | List of maps selecting the subnet(s) which are private | <pre>list(object({<br>    name   = string<br>    values = list(string)<br>  }))</pre> | <pre>[<br>  {<br>    "name": "tag:Name",<br>    "values": [<br>      "*private*"<br>    ]<br>  }<br>]</pre> | no |
 | <a name="input_private_subnets_strict_acl_rules"></a> [private\_subnets\_strict\_acl\_rules](#input\_private\_subnets\_strict\_acl\_rules) | Create additional ACLs for private subnets to restrict inbound traffic only to VPC itself and VPCs paired over TGW | `bool` | `false` | no |
 | <a name="input_ram_resource_association_id"></a> [ram\_resource\_association\_id](#input\_ram\_resource\_association\_id) | Identifier of the Resource Access Manager Resource Association | `string` | `""` | no |
-| <a name="input_role_to_assume_satellite"></a> [role\_to\_assume\_satellite](#input\_role\_to\_assume\_satellite) | IAM role name to assume in the AWS account containing the TGW satellite (eg. ASSUME-ROLE-SATELLITE) | `string` | `""` | no |
 | <a name="input_route_entire_satellite_vpc"></a> [route\_entire\_satellite\_vpc](#input\_route\_entire\_satellite\_vpc) | Boolean flag for toggling the creation of network routes for all the subnets of the satellite VPC | `bool` | `false` | no |
 | <a name="input_route_private_subnets_via_tgw"></a> [route\_private\_subnets\_via\_tgw](#input\_route\_private\_subnets\_via\_tgw) | Use TGW attachment as a default route (0.0.0.0/0) for private subnets. Value `satellite_destination_cidr_block`s will be ignored. | `bool` | `false` | no |
 | <a name="input_satellite_create"></a> [satellite\_create](#input\_satellite\_create) | Boolean flag for toggling the handling of satellite resources | `bool` | `false` | no |

data.tf

@@ -103,4 +103,6 @@ data "aws_ram_resource_share" "this" {
 
   name           = var.transit_gateway_hub_name
   resource_owner = "SELF"
+
+  resource_share_status = "ACTIVE"
 }

examples/satellite-all/README.md

@@ -3,7 +3,10 @@
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
 
-No requirements.
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5 |
 
 ## Providers
 
@@ -13,7 +16,8 @@ No providers.
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_tgw-satellite-all"></a> [tgw-satellite-all](#module\_tgw-satellite-all) | ../../ | n/a |
+| <a name="module_tgw"></a> [tgw](#module\_tgw) | github.com/flaconi/terraform-aws-transit-gateway-hub.git | v1.6.0 |
+| <a name="module_tgw-satellite"></a> [tgw-satellite](#module\_tgw-satellite) | ../../ | n/a |
 
 ## Resources
 
@@ -24,7 +28,7 @@ No resources.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_aws_account_id_hub"></a> [aws\_account\_id\_hub](#input\_aws\_account\_id\_hub) | AWS account number containing the TGW hub | `string` | n/a | yes |
-| <a name="input_aws_account_id_satellite"></a> [aws\_account\_id\_satellite](#input\_aws\_account\_id\_satellite) | List of AWS account numbers representing the satellites of the TGW | `list(string)` | n/a | yes |
+| <a name="input_aws_account_id_satellite"></a> [aws\_account\_id\_satellite](#input\_aws\_account\_id\_satellite) | AWS account ID representing the satellites of the TGW | `string` | n/a | yes |
 | <a name="input_role_to_assume_hub"></a> [role\_to\_assume\_hub](#input\_role\_to\_assume\_hub) | IAM role name to assume in the AWS account containing the TGW hub (eg. ASSUME-ROLE-HUB) | `string` | n/a | yes |
 | <a name="input_role_to_assume_satellite"></a> [role\_to\_assume\_satellite](#input\_role\_to\_assume\_satellite) | IAM role name to assume in the AWS account containing the TGW satellite (eg. ASSUME-ROLE-SATELLITE) | `string` | n/a | yes |
 | <a name="input_attachment_subnet_filters"></a> [attachment\_subnet\_filters](#input\_attachment\_subnet\_filters) | List of maps selecting the subnet(s) where TGW will be attached | <pre>list(object({<br>    name   = string<br>    values = list(string)<br>  }))</pre> | <pre>[<br>  {<br>    "name": "tag:Name",<br>    "values": [<br>      "*private*"<br>    ]<br>  }<br>]</pre> | no |

examples/satellite-all/main.tf

@@ -1,6 +1,17 @@
-# The Transit Gateway (hub) has already been created in AWS, as a fixture for
-# this test case due to not being able to use 'depends_on' on Terraform modules
-module "tgw-satellite-all" {
+module "tgw" {
+  source = "github.com/flaconi/terraform-aws-transit-gateway-hub.git?ref=v1.6.0"
+
+  providers = {
+    aws = aws.hub
+  }
+
+  name = var.transit_gateway_hub_name
+
+  aws_account_id_hub       = var.aws_account_id_hub
+  aws_account_id_satellite = [var.aws_account_id_satellite]
+}
+
+module "tgw-satellite" {
   source = "../../"
 
   providers = {
@@ -11,10 +22,7 @@ module "tgw-satellite-all" {
   satellite_create = var.satellite_create
 
   aws_account_id_hub       = var.aws_account_id_hub
-  aws_account_id_satellite = local.aws_account_id_satellite
-
-  role_to_assume_hub       = var.role_to_assume_hub
-  role_to_assume_satellite = var.role_to_assume_satellite
+  aws_account_id_satellite = var.aws_account_id_satellite
 
   vpc_name_to_attach = var.vpc_name_to_attach
 
@@ -30,4 +38,6 @@ module "tgw-satellite-all" {
   route_private_subnets_via_tgw = var.route_private_subnets_via_tgw
 
   private_subnet_filters = var.private_subnet_filters
+
+  depends_on = [module.tgw]
 }

examples/satellite-all/providers.tf

@@ -2,7 +2,7 @@ provider "aws" {
   alias  = "satellite"
   region = "eu-central-1"
   assume_role {
-    role_arn     = "arn:aws:iam::${local.aws_account_id_satellite}:role/${var.role_to_assume_satellite}"
+    role_arn     = "arn:aws:iam::${var.aws_account_id_satellite}:role/${var.role_to_assume_satellite}"
     session_name = "tf-tgw-module-satellite"
   }
 }

examples/satellite-all/variables.auto.tfvars

@@ -1,9 +1,6 @@
 satellite_create = true
 
-role_to_assume_hub       = "ASSUME-ENG-CI"
-role_to_assume_satellite = "ASSUME-ENG-CI"
-
-vpc_name_to_attach = "default"
+vpc_name_to_attach = "ci-tgw"
 
 satellite_destination_cidr_blocks = ["208.67.222.222/32", "208.67.220.220/32"]
 hub_destination_cidr_blocks       = ["8.8.4.4/32", "8.8.8.8/32"]
@@ -19,7 +16,7 @@ attachment_subnet_filters = [
   }
 ]
 
-transit_gateway_hub_name = "test-tgw-fixture"
+transit_gateway_hub_name = "test-tgw-satellite-all"
 
 route_entire_satellite_vpc = true
 

examples/satellite-all/variables.tf

@@ -4,23 +4,23 @@ variable "satellite_create" {
   type        = bool
 }
 
-variable "aws_account_id_hub" {
-  description = "AWS account number containing the TGW hub"
+variable "aws_account_id_satellite" {
+  description = "AWS account ID representing the satellites of the TGW"
   type        = string
 }
 
-variable "aws_account_id_satellite" {
-  description = "List of AWS account numbers representing the satellites of the TGW"
-  type        = list(string)
+variable "role_to_assume_satellite" {
+  description = "IAM role name to assume in the AWS account containing the TGW satellite (eg. ASSUME-ROLE-SATELLITE)"
+  type        = string
 }
 
-variable "role_to_assume_hub" {
-  description = "IAM role name to assume in the AWS account containing the TGW hub (eg. ASSUME-ROLE-HUB)"
+variable "aws_account_id_hub" {
+  description = "AWS account number containing the TGW hub"
   type        = string
 }
 
-variable "role_to_assume_satellite" {
-  description = "IAM role name to assume in the AWS account containing the TGW satellite (eg. ASSUME-ROLE-SATELLITE)"
+variable "role_to_assume_hub" {
+  description = "IAM role name to assume in the AWS account containing the TGW hub (eg. ASSUME-ROLE-HUB)"
   type        = string
 }
 

examples/satellite-all/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5"
+    }
+  }
+  required_version = ">= 1.0"
+}

examples/satellite-default-route-all/README.md

@@ -3,7 +3,10 @@
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
 
-No requirements.
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5 |
 
 ## Providers
 
@@ -13,7 +16,8 @@ No providers.
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_tgw-satellite-default-route-all"></a> [tgw-satellite-default-route-all](#module\_tgw-satellite-default-route-all) | ../../ | n/a |
+| <a name="module_tgw"></a> [tgw](#module\_tgw) | github.com/flaconi/terraform-aws-transit-gateway-hub.git | v1.6.0 |
+| <a name="module_tgw-satellite"></a> [tgw-satellite](#module\_tgw-satellite) | ../../ | n/a |
 
 ## Resources
 
@@ -24,7 +28,7 @@ No resources.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_aws_account_id_hub"></a> [aws\_account\_id\_hub](#input\_aws\_account\_id\_hub) | AWS account number containing the TGW hub | `string` | n/a | yes |
-| <a name="input_aws_account_id_satellite"></a> [aws\_account\_id\_satellite](#input\_aws\_account\_id\_satellite) | List of AWS account numbers representing the satellites of the TGW | `list(string)` | n/a | yes |
+| <a name="input_aws_account_id_satellite"></a> [aws\_account\_id\_satellite](#input\_aws\_account\_id\_satellite) | AWS account ID representing the satellites of the TGW | `string` | n/a | yes |
 | <a name="input_role_to_assume_hub"></a> [role\_to\_assume\_hub](#input\_role\_to\_assume\_hub) | IAM role name to assume in the AWS account containing the TGW hub (eg. ASSUME-ROLE-HUB) | `string` | n/a | yes |
 | <a name="input_role_to_assume_satellite"></a> [role\_to\_assume\_satellite](#input\_role\_to\_assume\_satellite) | IAM role name to assume in the AWS account containing the TGW satellite (eg. ASSUME-ROLE-SATELLITE) | `string` | n/a | yes |
 | <a name="input_attachment_subnet_filters"></a> [attachment\_subnet\_filters](#input\_attachment\_subnet\_filters) | List of maps selecting the subnet(s) where TGW will be attached | <pre>list(object({<br>    name   = string<br>    values = list(string)<br>  }))</pre> | <pre>[<br>  {<br>    "name": "tag:Name",<br>    "values": [<br>      "*private*"<br>    ]<br>  }<br>]</pre> | no |

examples/satellite-default-route-all/main.tf

@@ -1,6 +1,17 @@
-# The Transit Gateway (hub) has already been created in AWS, as a fixture for
-# this test case due to not being able to use 'depends_on' on Terraform modules
-module "tgw-satellite-default-route-all" {
+module "tgw" {
+  source = "github.com/flaconi/terraform-aws-transit-gateway-hub.git?ref=v1.6.0"
+
+  providers = {
+    aws = aws.hub
+  }
+
+  name = var.transit_gateway_hub_name
+
+  aws_account_id_hub       = var.aws_account_id_hub
+  aws_account_id_satellite = [var.aws_account_id_satellite]
+}
+
+module "tgw-satellite" {
   source = "../../"
 
   providers = {
@@ -11,10 +22,7 @@ module "tgw-satellite-default-route-all" {
   satellite_create = var.satellite_create
 
   aws_account_id_hub       = var.aws_account_id_hub
-  aws_account_id_satellite = local.aws_account_id_satellite
-
-  role_to_assume_hub       = var.role_to_assume_hub
-  role_to_assume_satellite = var.role_to_assume_satellite
+  aws_account_id_satellite = var.aws_account_id_satellite
 
   vpc_name_to_attach = var.vpc_name_to_attach
 
@@ -30,4 +38,6 @@ module "tgw-satellite-default-route-all" {
   route_private_subnets_via_tgw = var.route_private_subnets_via_tgw
 
   private_subnet_filters = var.private_subnet_filters
+
+  depends_on = [module.tgw]
 }

examples/satellite-default-route-all/providers.tf

@@ -2,7 +2,7 @@ provider "aws" {
   alias  = "satellite"
   region = "eu-central-1"
   assume_role {
-    role_arn     = "arn:aws:iam::${local.aws_account_id_satellite}:role/${var.role_to_assume_satellite}"
+    role_arn     = "arn:aws:iam::${var.aws_account_id_satellite}:role/${var.role_to_assume_satellite}"
     session_name = "tf-tgw-module-satellite"
   }
 }