Initial commit 0.12.17

.env

@@ -0,0 +1,4 @@
+TF_VAR_aws_profile=asics-digital
+AWS_PROFILE=asics-digital
+AWS_DEFAULT_REGION=us-east-1
+AWS_SDK_LOAD_CONFIG=1

.envrc

@@ -0,0 +1,31 @@
+# shellcheck shell=bash
+if [[ -f .env ]]; then
+  dotenv
+fi 
+
+
+# auth against Vault if configured
+if has vault; then
+  if [[ "$VAULT_ADDR" && "$VAULT_AUTH_GITHUB_TOKEN" ]]; then
+    log_status "vault: are we already authenticated?"
+    vault token lookup -format=json > /dev/null && vault token renew -format=json > /dev/null
+
+    if [[ "$?" == "0" ]]; then
+      log_status "vault: authenticated with existing token!"
+    else
+      log_status "vault: authenticate, since our token could not be refreshed"
+      vault login -method=github -no-print
+      log_status "vault: authenticated with new token!"
+    fi
+  fi
+fi
+
+function get_vault_kv {
+  vault_path=$1
+  vault_key=${2:-value}
+  if [[ "$VAULT_ADDR" ]]; then
+    VAULT_KV=$(curl -s -H "X-Vault-Token: $(cat ~/.vault-token )" -X GET $VAULT_ADDR/v1/${vault_path} | jq -r .data.${vault_key})
+  fi
+}
+
+# vim: set et fenc=utf-8 ff=unix ft=sh sts=2 sw=2 ts=2 :

.terraform-version

@@ -0,0 +1 @@
+0.12.17

iam.tf

@@ -47,23 +47,23 @@ data "aws_iam_policy_document" "assume_role_pganalyze_task" {
 }
 
 resource "aws_iam_role" "pganalyze_task" {
-  count              = "${local.service_count}"
+  count              = local.service_count
   name               = "tf-pganalyze-${var.task_identifier}-ecsTaskRole"
   path               = "/"
-  assume_role_policy = "${data.aws_iam_policy_document.assume_role_pganalyze_task.json}"
+  assume_role_policy = data.aws_iam_policy_document.assume_role_pganalyze_task.json
 }
 
 resource "aws_iam_role_policy" "pganalyze_ecs_task" {
-  count  = "${local.service_count}"
+  count  = local.service_count
   name   = "tf-pganalyze-${var.task_identifier}-ecsTaskPolicy"
-  role   = "${aws_iam_role.pganalyze_task.id}"
-  policy = "${data.aws_iam_policy_document.pganalyze_task_policy.json}"
+  role   = aws_iam_role.pganalyze_task[0].id
+  policy = data.aws_iam_policy_document.pganalyze_task_policy.json
 }
 
 # ecsServiceRole for pganalyze
 
 resource "aws_iam_role" "ecsServiceRole" {
-  count = "${local.service_count}"
+  count = local.service_count
   name  = "tf-pganalyze-${var.task_identifier}-ecsSvcRole"
 
   assume_role_policy = <<EOF
@@ -82,10 +82,12 @@ resource "aws_iam_role" "ecsServiceRole" {
   ]
 }
 EOF
+
 }
 
 resource "aws_iam_role_policy_attachment" "attach-ecsServiceRole" {
-  count      = "${local.service_count}"
-  role       = "${aws_iam_role.ecsServiceRole.name}"
+  count      = local.service_count
+  role       = aws_iam_role.ecsServiceRole[0].name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole"
 }
+

main.tf

@@ -1,47 +1,45 @@
 locals {
-  "service_count" = "${length(var.pga_api_key) > 0 ? 1 : 0}"
+  service_count = length(var.pga_api_key) > 0 ? 1 : 0
 }
 
 data "aws_ecs_cluster" "ecs" {
-  cluster_name = "${var.ecs_cluster}"
+  cluster_name = var.ecs_cluster
 }
 
-data "aws_region" "current" {
-  current = true
-}
+data "aws_region" "current" {}
 
 data "template_file" "pganalyze" {
-  template = "${file("${path.module}/files/pganalyze.json")}"
+  template = file("${path.module}/files/pganalyze.json")
 
-  vars {
-    task_identifier       = "${var.task_identifier}"
+  vars = {
+    task_identifier       = var.task_identifier
     db_url                = "postgres://${var.db_username}:${var.db_password}@${var.rds_endpoint}/${var.db_name}"
-    image                 = "${var.docker_image}"
-    pga_api_key           = "${var.pga_api_key}"
-    aws_instance_id       = "${var.aws_instance_id}" # we can almost certainly derive this
-    aws_region            = "${data.aws_region.current.name}"
-    awslogs_group         = "${var.log_group}"
-    awslogs_region        = "${data.aws_region.current.name}"
+    image                 = var.docker_image
+    pga_api_key           = var.pga_api_key
+    aws_instance_id       = var.aws_instance_id # we can almost certainly derive this
+    aws_region            = data.aws_region.current.name
+    awslogs_group         = var.log_group
+    awslogs_region        = data.aws_region.current.name
     awslogs_stream_prefix = "tf"
   }
 }
 
 resource "aws_ecs_task_definition" "pganalyze" {
-  count                 = "${local.service_count}"
+  count                 = local.service_count
   family                = "pganalyze-${var.env}-${var.task_identifier}"
-  container_definitions = "${data.template_file.pganalyze.rendered}"
+  container_definitions = data.template_file.pganalyze.rendered
   network_mode          = "bridge"
-  task_role_arn         = "${aws_iam_role.pganalyze_task.arn}"
+  task_role_arn         = aws_iam_role.pganalyze_task[0].arn
 }
 
 resource "aws_ecs_service" "pganalyze" {
-  count           = "${local.service_count}"
+  count           = local.service_count
   name            = "pganalyze-${var.env}-${var.task_identifier}"
-  cluster         = "${data.aws_ecs_cluster.ecs.id}"
-  task_definition = "${aws_ecs_task_definition.pganalyze.arn}"
+  cluster         = data.aws_ecs_cluster.ecs.id
+  task_definition = aws_ecs_task_definition.pganalyze[0].arn
   desired_count   = 1
 
-  placement_strategy {
+  ordered_placement_strategy {
     type  = "binpack"
     field = "memory"
   }

variables.tf

@@ -43,3 +43,4 @@ variable "rds_endpoint" {
 variable "log_group" {
   description = "CloudWatch Log Group that will receive collector logs (must exist already)"
 }
+

versions.tf

@@ -0,0 +1,4 @@
+
+terraform {
+  required_version = ">= 0.12"
+}