Arquivos base para Automação Multi-account AWS com GitLab e Terraform

.gitlab-ci.yml

stages:
  - validate
  - plan
  - apply

variables:
  AWS_REGION: "us-east-1"
  ROLE_ARN: "arn:aws:iam::YOUR_ACCOUNT_ID:role/YOUR_ROLE_NAME"

default:
  image:
    name: hashicorp/terraform:latest
    entrypoint: [""]

.aws_auth: &aws_auth
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: gitlab.com
  before_script:
    - apk add --no-cache aws-cli
    - |
      CREDS=$(aws sts assume-role-with-web-identity \
        --role-arn $ROLE_ARN \
        --role-session-name gitlab-ci-session \
        --web-identity-token $GITLAB_OIDC_TOKEN \
        --region $AWS_REGION \
        --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
        --output text)
      export AWS_ACCESS_KEY_ID=$(echo $CREDS | awk '{print $1}')
      export AWS_SECRET_ACCESS_KEY=$(echo $CREDS | awk '{print $2}')
      export AWS_SESSION_TOKEN=$(echo $CREDS | awk '{print $3}')

terraform_validate:
  <<: *aws_auth
  stage: validate
  script:
    - terraform init -backend=false
    - terraform validate
  only:
    - main

terraform_plan:
  <<: *aws_auth
  stage: plan
  script:
    - terraform init
    - terraform plan
  only:
    - main

terraform_apply:
  <<: *aws_auth
  stage: apply
  script:
    - terraform init
    - terraform apply -auto-approve
  when: manual
  only:
    - main

main.tf

terraform {
  backend "s3" {
    bucket  = "YOUR_STATE_BUCKET"
    key     = "stacksets/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.region
}

role-teste.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Role Teste com permissao de leitura em todos os S3"

Resources:
  RoleTeste:
    Type: AWS::IAM::Role
    Properties:
      RoleName: Teste
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::YOUR_ACCOUNT_ID:root"
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

stackset-role-teste.tf

resource "aws_cloudformation_stack_set" "role_teste" {
  name             = "stackset-role-teste"
  description      = "Cria a role Teste com leitura de S3 em todas as contas da OU"
  permission_model = "SERVICE_MANAGED"

  auto_deployment {
    enabled                          = true
    retain_stacks_on_account_removal = false
  }

  template_body = file("${path.module}/templates/role-teste.yaml")

  capabilities = ["CAPABILITY_NAMED_IAM"]

  tags = {
    ManagedBy = "Terraform"
    StackSet  = "role-teste"
  }
}

resource "aws_cloudformation_stack_set_instance" "role_teste" {
  for_each = toset(var.regions)

  stack_set_name = aws_cloudformation_stack_set.role_teste.name
  region         = each.value

  deployment_targets {
    organizational_unit_ids = var.target_ou_ids
  }

  operation_preferences {
    failure_tolerance_count = 1
    max_concurrent_count    = 5
  }
}

variables.tf

variable "region" {
  type        = string
  description = "Região principal do provider"
  default     = "us-east-1"
}

variable "target_ou_ids" {
  type        = list(string)
  description = "OUs onde os StackSets serão deployados"
  default     = ["YOUR_OU_OR_ROOT_ID"]
}

variable "regions" {
  type        = list(string)
  description = "Regiões de deploy dos StackSets"
  default     = ["us-east-1"]
}