| data "template_file" "requiredTag_policy_rule" { | |
| template = <<POLICY_RULE | |
| { | |
| "if": { | |
| "field": "[concat('tags[', parameters('tagName'), ']')]", | |
| "exists": "false" | |
| }, | |
| "then": { | |
| "effect": "audit" | |
| } |
| locals { | |
| config = { | |
| vm_name_prefix = "mdl" | |
| vm_num_prefix = 1 | |
| vm_role = "asrv" | |
| vm_pool_count = 2 | |
| vm_servers_per_pool = 2 | |
| vm_singleton = false | |
| vm_reserve = true | |
| } |
| terraform { | |
| required_version = "~> 0.13.0" | |
| } | |
| variable "environment_name" { | |
| description = "The environment name." | |
| type = string | |
| validation { | |
| condition = contains(["develop", "stage", "production"], var.environment_name) |
| import "tfplan/v2" as tfplan | |
| import "json" | |
| import "types" | |
| // Parametized not allowed list | |
| param not_allowed_actions default [ | |
| "s3:*", | |
| "s3:GetObject", | |
| "s3:PutObject", | |
| "kms:*", |
| data "azurerm_client_config" "current" {} | |
| variable "keyVaultLocation" { | |
| default = "centralus" | |
| } | |
| variable "azTags" { | |
| default = { | |
| Owner = "me" | |
| Application = "Azure DevOps Terraform Pipelines" | |
| } | |
| } |
Assuming a TFE Workspace has been successfully Applied, perform an API driven workflow to queue a speculative destroy plan (mimicking a terraform plan -destroy).
In other words, a TFE Run that is a destroy, but unable to actually apply it like a speculative plan.
"speculative": true.| resource "random_pet" "name" { | |
| length = 3 | |
| separator = "" | |
| } | |
| resource "azurerm_resource_group" "example" { | |
| name = random_pet.name.id | |
| location = "centralus" | |
| } |
| locals { | |
| tfe_application_name = "tfe" | |
| tfe_application_url = "https://tfe.company.com" | |
| spn_url = "https://some_url.com" | |
| tfe_teams = [ | |
| "app1-team-dev", | |
| "app1-team-admin", | |
| "app2-team-dev", | |
| "app3-team-admin", |
| resource "azurerm_resource_group" "main" { | |
| name = "cardinal-rg" | |
| location = "centralus" | |
| } | |
| resource "azurerm_management_lock" "resource-group-level" { | |
| name = "resource-group-level" | |
| scope = "${azurerm_resource_group.main.id}" | |
| lock_level = "ReadOnly" | |
| notes = "This Resource Group is Read-Only" |
| storage_data_disk { | |
| name = "datadisk0" | |
| lun = 0 | |
| disk_size_gb = 32 | |
| create_option = "Empty" | |
| managed_disk_type = "Standard_LRS" | |
| } | |
| storage_data_disk { | |
| name = "datadisk1" | |
| lun = 1 |