Skip to content

Commit 2cd311c

Browse files
aknyshaknysh
authored
Convert to TF 0.12. Add tests. Add Codefresh test pipeline (#13)
* Convert to TF 0.12. Add tests. Add Codefresh test pipeline * Update outputs
1 parent 0d0a773 commit 2cd311c

24 files changed

+560
-189
lines changed

‎.gitignore

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,10 @@
55
*.tfstate
66
*.tfstate.*
77

8-
# .tfvars files
9-
*.tfvars
10-
118
# IDE files
129
.idea
1310
*.iml
1411

1512
# Build harness files
1613
.build-harness
17-
build-harness
14+
build-harness

‎.travis.yml

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎README.md

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
[![Cloud Posse][logo]](https://cpco.io/homepage)
55

6-
# terraform-aws-s3-bucket [![Build Status](https://travis-ci.org/cloudposse/terraform-aws-s3-bucket.svg?branch=master)](https://travis-ci.org/cloudposse/terraform-aws-s3-bucket) [![Latest Release](https://img.shields.io/github/release/cloudposse/terraform-aws-s3-bucket.svg)](https://github.com/cloudposse/terraform-aws-s3-bucket/releases/latest) [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)
6+
# terraform-aws-s3-bucket [![Codefresh Build Status](https://g.codefresh.io/api/badges/pipeline/cloudposse/terraform-modules%2Fterraform-aws-s3-bucket?type=cf-1)](https://g.codefresh.io/public/accounts/cloudposse/pipelines/5d13993639efa9451b1a2aa4) [![Latest Release](https://img.shields.io/github/release/cloudposse/terraform-aws-s3-bucket.svg)](https://github.com/cloudposse/terraform-aws-s3-bucket/releases/latest) [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)
77

88

99
This module creates an S3 bucket with support of versioning, encryption, ACL and bucket object policy.
@@ -47,16 +47,21 @@ We literally have [*hundreds of terraform modules*][terraform_modules] that are
4747

4848
## Usage
4949

50+
51+
**IMPORTANT:** The `master` branch is used in `source` just as an example. In your code, do not pin to `master` because there may be breaking changes between releases.
52+
Instead pin to the release tag (e.g. `?ref=tags/x.y.z`) of one of our [latest releases](https://github.com/cloudposse/terraform-aws-s3-bucket/releases).
53+
54+
5055
```hcl
5156
module "s3_bucket" {
5257
source = "git::https://github.com/cloudposse/terraform-aws-s3-bucket.git?ref=master"
53-
enabled = "${var.enabled}"
54-
user_enabled = "${var.user_enabled}"
55-
versioning_enabled = "${var.versioning_enabled}"
56-
allowed_bucket_actions = "${var.allowed_bucket_actions}"
57-
name = "${var.name}"
58-
stage = "${var.stage}"
59-
namespace = "${var.namespace}"
58+
enabled = true
59+
user_enabled = true
60+
versioning_enabled = false
61+
allowed_bucket_actions = ["s3:GetObject", "s3:ListBucket", "s3:GetBucketLocation"]
62+
name = "app"
63+
stage = "test"
64+
namespace = "eg"
6065
}
6166
```
6267

@@ -80,22 +85,22 @@ Available targets:
8085
| Name | Description | Type | Default | Required |
8186
|------|-------------|:----:|:-----:|:-----:|
8287
| acl | The canned ACL to apply. We recommend `private` to avoid exposing sensitive information | string | `private` | no |
83-
| allow_encrypted_uploads_only | Set to `true` to prevent uploads of unencrypted objects to S3 bucket | string | `false` | no |
84-
| allowed_bucket_actions | List of actions the user is permitted to perform on the S3 bucket | list | `<list>` | no |
85-
| attributes | Additional attributes (e.g. `1`) | list | `<list>` | no |
88+
| allow_encrypted_uploads_only | Set to `true` to prevent uploads of unencrypted objects to S3 bucket | bool | `false` | no |
89+
| allowed_bucket_actions | List of actions the user is permitted to perform on the S3 bucket | list(string) | `<list>` | no |
90+
| attributes | Additional attributes (e.g. `1`) | list(string) | `<list>` | no |
8691
| delimiter | Delimiter to be used between `namespace`, `stage`, `name` and `attributes` | string | `-` | no |
87-
| enabled | Set to `false` to prevent the module from creating any resources | string | `true` | no |
88-
| force_destroy | A boolean string that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | string | `false` | no |
92+
| enabled | Set to `false` to prevent the module from creating any resources | bool | `true` | no |
93+
| force_destroy | A boolean string that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable | bool | `false` | no |
8994
| kms_master_key_id | The AWS KMS master key ID used for the `SSE-KMS` encryption. This can only be used when you set the value of `sse_algorithm` as `aws:kms`. The default aws/s3 AWS KMS master key is used if this element is absent while the `sse_algorithm` is `aws:kms` | string | `` | no |
90-
| name | Name (e.g. `app` or `db`) | string | - | yes |
91-
| namespace | Namespace (e.g. `eg` or `cp`) | string | - | yes |
92-
| policy | A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. | string | `` | no |
93-
| region | If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee. | string | `` | no |
95+
| name | Name (e.g. `app` or `cluster`) | string | - | yes |
96+
| namespace | Namespace (e.g. `eg` or `cp`) | string | `` | no |
97+
| policy | A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy | string | `` | no |
98+
| region | If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee | string | `` | no |
9499
| sse_algorithm | The server-side encryption algorithm to use. Valid values are `AES256` and `aws:kms` | string | `AES256` | no |
95-
| stage | Stage (e.g. `prod`, `dev`, `staging`) | string | - | yes |
96-
| tags | Additional tags (e.g. `{ BusinessUnit = "XYZ" }` | map | `<map>` | no |
97-
| user_enabled | Set to `true` to create an S3 user with permission to access the bucket | string | `false` | no |
98-
| versioning_enabled | A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket. | string | `false` | no |
100+
| stage | Stage (e.g. `prod`, `dev`, `staging`) | string | `` | no |
101+
| tags | Additional tags (e.g. `{ BusinessUnit = "XYZ" }` | map(string) | `<map>` | no |
102+
| user_enabled | Set to `true` to create an IAM user with permission to access the bucket | bool | `false` | no |
103+
| versioning_enabled | A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket | bool | `false` | no |
99104

100105
## Outputs
101106

‎README.yaml

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@ github_repo: cloudposse/terraform-aws-s3-bucket
3333

3434
# Badges to display
3535
badges:
36-
- name: "Build Status"
37-
image: "https://travis-ci.org/cloudposse/terraform-aws-s3-bucket.svg?branch=master"
38-
url: "https://travis-ci.org/cloudposse/terraform-aws-s3-bucket"
36+
- name: "Codefresh Build Status"
37+
image: "https://g.codefresh.io/api/badges/pipeline/cloudposse/terraform-modules%2Fterraform-aws-s3-bucket?type=cf-1"
38+
url: "https://g.codefresh.io/public/accounts/cloudposse/pipelines/5d13993639efa9451b1a2aa4"
3939
- name: "Latest Release"
4040
image: "https://img.shields.io/github/release/cloudposse/terraform-aws-s3-bucket.svg"
4141
url: "https://github.com/cloudposse/terraform-aws-s3-bucket/releases/latest"
@@ -68,23 +68,23 @@ related:
6868
description: |-
6969
This module creates an S3 bucket with support of versioning, encryption, ACL and bucket object policy.
7070
If `user_enabled` variable is set to `true`, the module will provision a basic IAM user with permissions to access the bucket.
71-
71+
7272
This basic IAM system user is suitable for CI/CD systems (_e.g._ TravisCI, CircleCI) or systems which are *external* to AWS that cannot leverage [AWS IAM Instance Profiles](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html).
73-
73+
7474
We do not recommend creating IAM users this way for any other purpose.
7575
7676
# How to use this project
7777
usage: |-
7878
```hcl
7979
module "s3_bucket" {
8080
source = "git::https://github.com/cloudposse/terraform-aws-s3-bucket.git?ref=master"
81-
enabled = "${var.enabled}"
82-
user_enabled = "${var.user_enabled}"
83-
versioning_enabled = "${var.versioning_enabled}"
84-
allowed_bucket_actions = "${var.allowed_bucket_actions}"
85-
name = "${var.name}"
86-
stage = "${var.stage}"
87-
namespace = "${var.namespace}"
81+
enabled = true
82+
user_enabled = true
83+
versioning_enabled = false
84+
allowed_bucket_actions = ["s3:GetObject", "s3:ListBucket", "s3:GetBucketLocation"]
85+
name = "app"
86+
stage = "test"
87+
namespace = "eg"
8888
}
8989
```
9090

‎codefresh/test.yml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
version: '1.0'
2+
3+
stages:
4+
- Prepare
5+
- Test
6+
7+
steps:
8+
wait:
9+
title: Wait
10+
stage: Prepare
11+
image: codefresh/cli:latest
12+
commands:
13+
- codefresh get builds --pipeline=${{CF_REPO_NAME}} --status running --limit 1000 -o json | jq --arg id ${{CF_BUILD_ID}} -ser 'flatten|.[-1].id==$id'
14+
retry:
15+
maxAttempts: 10
16+
delay: 20
17+
exponentialFactor: 1.1
18+
19+
main_clone:
20+
title: "Clone repository"
21+
type: git-clone
22+
stage: Prepare
23+
description: "Initialize"
24+
repo: ${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}
25+
git: CF-default
26+
revision: ${{CF_REVISION}}
27+
28+
clean_init:
29+
title: Prepare build-harness and test-harness
30+
image: ${{TEST_IMAGE}}
31+
stage: Prepare
32+
commands:
33+
- cf_export PATH="/usr/local/terraform/0.12/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
34+
- make init
35+
- git -C build-harness checkout master
36+
- make -C test/ clean init TEST_HARNESS_BRANCH=master
37+
- make -C test/src clean init
38+
- find . -type d -name '.terraform' | xargs rm -rf
39+
- find . -type f -name 'terraform.tfstate*' -exec rm -f {} \;
40+
41+
test:
42+
type: "parallel"
43+
title: "Run tests"
44+
description: "Run all tests in parallel"
45+
stage: Test
46+
steps:
47+
test_readme_lint:
48+
title: "Test README.md updated"
49+
stage: "Test"
50+
image: ${{TEST_IMAGE}}
51+
description: Test "readme/lint"
52+
commands:
53+
- make readme/lint
54+
55+
test_module:
56+
title: Test module with bats
57+
image: ${{TEST_IMAGE}}
58+
stage: Test
59+
commands:
60+
- make -C test/ module
61+
62+
test_examples_complete:
63+
title: Test "examples/complete" with bats
64+
image: ${{TEST_IMAGE}}
65+
stage: Test
66+
commands:
67+
- make -C test/ examples/complete
68+
69+
test_examples_complete_terratest:
70+
title: Test "examples/complete" with terratest
71+
image: ${{TEST_IMAGE}}
72+
stage: Test
73+
commands:
74+
- make -C test/src

‎docs/terraform.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,22 @@
33
| Name | Description | Type | Default | Required |
44
|------|-------------|:----:|:-----:|:-----:|
55
| acl | The canned ACL to apply. We recommend `private` to avoid exposing sensitive information | string | `private` | no |
6-
| allow_encrypted_uploads_only | Set to `true` to prevent uploads of unencrypted objects to S3 bucket | string | `false` | no |
7-
| allowed_bucket_actions | List of actions the user is permitted to perform on the S3 bucket | list | `<list>` | no |
8-
| attributes | Additional attributes (e.g. `1`) | list | `<list>` | no |
6+
| allow_encrypted_uploads_only | Set to `true` to prevent uploads of unencrypted objects to S3 bucket | bool | `false` | no |
7+
| allowed_bucket_actions | List of actions the user is permitted to perform on the S3 bucket | list(string) | `<list>` | no |
8+
| attributes | Additional attributes (e.g. `1`) | list(string) | `<list>` | no |
99
| delimiter | Delimiter to be used between `namespace`, `stage`, `name` and `attributes` | string | `-` | no |
10-
| enabled | Set to `false` to prevent the module from creating any resources | string | `true` | no |
11-
| force_destroy | A boolean string that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | string | `false` | no |
10+
| enabled | Set to `false` to prevent the module from creating any resources | bool | `true` | no |
11+
| force_destroy | A boolean string that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable | bool | `false` | no |
1212
| kms_master_key_id | The AWS KMS master key ID used for the `SSE-KMS` encryption. This can only be used when you set the value of `sse_algorithm` as `aws:kms`. The default aws/s3 AWS KMS master key is used if this element is absent while the `sse_algorithm` is `aws:kms` | string | `` | no |
13-
| name | Name (e.g. `app` or `db`) | string | - | yes |
14-
| namespace | Namespace (e.g. `eg` or `cp`) | string | - | yes |
15-
| policy | A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. | string | `` | no |
16-
| region | If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee. | string | `` | no |
13+
| name | Name (e.g. `app` or `cluster`) | string | - | yes |
14+
| namespace | Namespace (e.g. `eg` or `cp`) | string | `` | no |
15+
| policy | A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy | string | `` | no |
16+
| region | If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee | string | `` | no |
1717
| sse_algorithm | The server-side encryption algorithm to use. Valid values are `AES256` and `aws:kms` | string | `AES256` | no |
18-
| stage | Stage (e.g. `prod`, `dev`, `staging`) | string | - | yes |
19-
| tags | Additional tags (e.g. `{ BusinessUnit = "XYZ" }` | map | `<map>` | no |
20-
| user_enabled | Set to `true` to create an S3 user with permission to access the bucket | string | `false` | no |
21-
| versioning_enabled | A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket. | string | `false` | no |
18+
| stage | Stage (e.g. `prod`, `dev`, `staging`) | string | `` | no |
19+
| tags | Additional tags (e.g. `{ BusinessUnit = "XYZ" }` | map(string) | `<map>` | no |
20+
| user_enabled | Set to `true` to create an IAM user with permission to access the bucket | bool | `false` | no |
21+
| versioning_enabled | A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket | bool | `false` | no |
2222

2323
## Outputs
2424

‎examples/basic/main.tf

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎examples/basic/outputs.tf

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎examples/complete/fixtures.us-west-1.tfvars

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
region = "us-west-1"
2+
3+
namespace = "eg"
4+
5+
stage = "test"
6+
7+
name = "s3-test"
8+
9+
acl = "private"
10+
11+
force_destroy = true
12+
13+
versioning_enabled = false
14+
15+
allow_encrypted_uploads_only = true
16+
17+
allowed_bucket_actions = ["s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:GetBucketLocation", "s3:AbortMultipartUpload"]

‎examples/complete/main.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
provider "aws" {
2+
region = var.region
3+
}
4+
5+
module "s3_bucket" {
6+
source = "../../"
7+
8+
enabled = true
9+
user_enabled = true
10+
region = var.region
11+
namespace = var.namespace
12+
stage = var.stage
13+
name = var.name
14+
acl = var.acl
15+
force_destroy = var.force_destroy
16+
versioning_enabled = var.versioning_enabled
17+
allow_encrypted_uploads_only = var.allow_encrypted_uploads_only
18+
allowed_bucket_actions = var.allowed_bucket_actions
19+
}

0 commit comments

Comments
 (0)