Skip to content

Instantly share code, notes, and snippets.

@wolfeidau
Created August 1, 2023 01:07
Show Gist options
  • Save wolfeidau/bd80db221a83357b9327e2072f155ba4 to your computer and use it in GitHub Desktop.
Save wolfeidau/bd80db221a83357b9327e2072f155ba4 to your computer and use it in GitHub Desktop.
CFN for terraform State and Locks
AWSTemplateFormatVersion: 2010-09-09
Description: >
wolfeidau: Terraform state and locks infrastructure
Parameters:
Environment:
Type: String
Default: dev
Outputs:
TerraformLockTableName:
Value: !Ref TerraformLockTable
TerraformStateBucketName:
Value: !Ref TerraformStateBucket
Resources:
TerraformStateBucket:
Type: AWS::S3::Bucket
Properties:
AccessControl: Private
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: AES256
VersioningConfiguration:
Status: Enabled
TerraformStateBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref TerraformStateBucket
PolicyDocument:
Statement:
- Sid: AllowSSLRequestsOnly
Effect: Deny
Principal: "*"
Action:
- s3:*
Resource:
- Fn::Sub: arn:aws:s3:::${TerraformStateBucket}/*
- Fn::Sub: arn:aws:s3:::${TerraformStateBucket}
Condition:
Bool:
aws:SecureTransport: false
TerraformLockTable:
Type: AWS::DynamoDB::Table
Properties:
AttributeDefinitions:
- AttributeName: LockID
AttributeType: S
KeySchema:
- AttributeName: LockID
KeyType: HASH
ProvisionedThroughput:
ReadCapacityUnits: 5
WriteCapacityUnits: 5
SSESpecification:
SSEEnabled: true
TerraformStateBucketParam:
Type: AWS::SSM::Parameter
Properties:
Name:
Fn::Sub: /config/${Environment}/terraform_state_bucket
Type: String
Value:
Ref: TerraformStateBucket
TerraformLockTableParam:
Type: AWS::SSM::Parameter
Properties:
Name:
Fn::Sub: /config/${Environment}/terraform_lock_table
Type: String
Value:
Ref: TerraformLockTable
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment