Skip to content

Commit dc3eb7c

Browse files
author
AWS
committed
Release: 1.7.0
1 parent f8a3a30 commit dc3eb7c

37 files changed

+440
-1053
lines changed

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.6.7
1+
1.7.0

‎main.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -196,8 +196,6 @@ module "aft_ssm_parameters" {
196196
request_processor_function_arn = module.aft_account_request_framework.request_processor_function_arn
197197
control_tower_event_logger_function_arn = module.aft_account_request_framework.control_tower_event_logger_function_arn
198198
invoke_aft_account_provisioning_framework_function_arn = module.aft_account_request_framework.invoke_aft_account_provisioning_framework_function_arn
199-
validate_request_function_arn = module.aft_account_provisioning_framework.validate_request_function_arn
200-
get_account_info_function_arn = module.aft_account_provisioning_framework.get_account_info_function_arn
201199
create_role_function_arn = module.aft_account_provisioning_framework.create_role_function_arn
202200
tag_account_function_arn = module.aft_account_provisioning_framework.tag_account_function_arn
203201
persist_metadata_function_arn = module.aft_account_provisioning_framework.persist_metadata_function_arn

‎modules/aft-account-provisioning-framework/iam.tf‎

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -3,56 +3,6 @@
33
#
44
######### invoke_aft_account_provisioning_framework #########
55

6-
# Validate Request Lambda Permissions
7-
resource "aws_iam_role" "aft_lambda_aft_account_provisioning_framework_validate_request" {
8-
name = "aft-account-provisioning-framework-validate-request-lambda-role"
9-
assume_role_policy = templatefile("${path.module}/iam/trust-policies/lambda.tpl", { none = "none" })
10-
}
11-
12-
resource "aws_iam_role_policy_attachment" "aft_account_provisioning_framework_validate_request" {
13-
count = length(local.lambda_managed_policies)
14-
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_validate_request.name
15-
policy_arn = local.lambda_managed_policies[count.index]
16-
}
17-
18-
resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework_validate_request" {
19-
name = "aft-lambda-invoke-aft-account-provisioning-framework-validate-request-policy"
20-
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_validate_request.id
21-
policy = templatefile("${path.module}/iam/role-policies/lambda-aft-account-provisioning-framework.tpl", {
22-
data_aws_partition_current_partition = data.aws_partition.current.partition
23-
data_aws_region_aft-management_name = data.aws_region.aft_management.name
24-
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft_management.account_id
25-
aft_sns_topic_arn = var.aft_sns_topic_arn
26-
aft_failure_sns_topic_arn = var.aft_failure_sns_topic_arn
27-
aws_kms_key_aft_arn = var.aft_kms_key_arn
28-
})
29-
}
30-
31-
# Get Account Info Lambda Permissions
32-
resource "aws_iam_role" "aft_lambda_aft_account_provisioning_framework_get_account_info" {
33-
name = "aft-account-provisioning-framework-lambda-get-account-info-role"
34-
assume_role_policy = templatefile("${path.module}/iam/trust-policies/lambda.tpl", { none = "none" })
35-
}
36-
37-
resource "aws_iam_role_policy_attachment" "aft_account_provisioning_framework_get_account_info" {
38-
count = length(local.lambda_managed_policies)
39-
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_get_account_info.name
40-
policy_arn = local.lambda_managed_policies[count.index]
41-
}
42-
43-
resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework_get_account_info" {
44-
name = "aft-lambda-invoke-aft-account-provisioning-framework-get-account-info-policy"
45-
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_get_account_info.id
46-
policy = templatefile("${path.module}/iam/role-policies/lambda-aft-account-provisioning-framework.tpl", {
47-
data_aws_partition_current_partition = data.aws_partition.current.partition
48-
data_aws_region_aft-management_name = data.aws_region.aft_management.name
49-
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft_management.account_id
50-
aft_sns_topic_arn = var.aft_sns_topic_arn
51-
aft_failure_sns_topic_arn = var.aft_failure_sns_topic_arn
52-
aws_kms_key_aft_arn = var.aft_kms_key_arn
53-
})
54-
}
55-
566
# Create Role Lambda Permissions
577
resource "aws_iam_role" "aft_lambda_aft_account_provisioning_framework_create_role" {
588
name = "aft-account-provisioning-framework-lambda-create-role-role"

‎modules/aft-account-provisioning-framework/lambda.tf‎

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,6 @@
11
# Copyright Amazon.com, Inc. or its affiliates. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33
#
4-
### VALIDATE REQUEST FUNCTION
5-
6-
resource "aws_lambda_function" "validate_request" {
7-
filename = var.provisioning_framework_archive_path
8-
function_name = "aft-account-provisioning-framework-validate-request"
9-
description = "AFT account provisioning framework - validate_request"
10-
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_validate_request.arn
11-
handler = "aft_account_provisioning_framework_validate_request.lambda_handler"
12-
source_code_hash = var.provisioning_framework_archive_hash
13-
memory_size = 1024
14-
runtime = "python3.8"
15-
timeout = 300
16-
layers = [var.aft_common_layer_arn]
17-
18-
vpc_config {
19-
subnet_ids = var.aft_vpc_private_subnets
20-
security_group_ids = var.aft_vpc_default_sg
21-
}
22-
}
23-
24-
resource "aws_cloudwatch_log_group" "validate_request" {
25-
name = "/aws/lambda/${aws_lambda_function.validate_request.function_name}"
26-
retention_in_days = var.cloudwatch_log_group_retention
27-
}
28-
29-
### GET ACCOUNT INFO FUNCTION
30-
31-
32-
resource "aws_lambda_function" "get_account_info" {
33-
filename = var.provisioning_framework_archive_path
34-
function_name = "aft-account-provisioning-framework-get-account-info"
35-
description = "AFT account provisioning framework - get_account_info"
36-
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_get_account_info.arn
37-
handler = "aft_account_provisioning_framework_get_account_info.lambda_handler"
38-
source_code_hash = var.provisioning_framework_archive_hash
39-
memory_size = 1024
40-
runtime = "python3.8"
41-
timeout = 300
42-
layers = [var.aft_common_layer_arn]
43-
44-
vpc_config {
45-
subnet_ids = var.aft_vpc_private_subnets
46-
security_group_ids = var.aft_vpc_default_sg
47-
}
48-
}
49-
50-
resource "aws_cloudwatch_log_group" "get_account_info" {
51-
name = "/aws/lambda/${aws_lambda_function.get_account_info.function_name}"
52-
retention_in_days = var.cloudwatch_log_group_retention
53-
}
544

555
### CREATE ROLE FUNCTION
566

‎modules/aft-account-provisioning-framework/outputs.tf‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,6 @@ output "state_machine_arn" {
55
value = aws_sfn_state_machine.aft_account_provisioning_framework_sfn.arn
66
}
77

8-
output "validate_request_function_arn" {
9-
value = aws_lambda_function.validate_request.arn
10-
}
11-
output "get_account_info_function_arn" {
12-
value = aws_lambda_function.get_account_info.arn
13-
}
148
output "create_role_function_arn" {
159
value = aws_lambda_function.create_role.arn
1610
}

‎modules/aft-account-provisioning-framework/states.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,6 @@ locals {
55
state_machine_source = "${path.module}/states/aft_account_provisioning_framework.asl.json"
66
replacements_map = {
77
current_partition = data.aws_partition.current.partition
8-
validate_request_function_name = aws_lambda_function.validate_request.function_name
9-
get_account_info_function_name = aws_lambda_function.get_account_info.function_name
108
create_role_function_name = aws_lambda_function.create_role.function_name
119
tag_account_function_name = aws_lambda_function.tag_account.function_name
1210
persist_metadata_function_name = aws_lambda_function.persist_metadata.function_name

‎modules/aft-account-provisioning-framework/states/aft_account_provisioning_framework.asl.json‎

Lines changed: 1 addition & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,6 @@
11
{
2-
"StartAt": "aft_account_provisioning_framework_validate",
2+
"StartAt": "aft_account_provisioning_framework_persist_metadata",
33
"States": {
4-
"aft_account_provisioning_framework_validate": {
5-
"Next": "aft_account_provisioning_framework_get_account_info",
6-
"Type": "Task",
7-
"Resource": "arn:${current_partition}:states:::lambda:invoke",
8-
"ResultPath": "$.validated",
9-
"ResultSelector": {"Success.$":"$.Payload"},
10-
"Parameters": {
11-
"FunctionName": "${validate_request_function_name}",
12-
"Payload": {
13-
"job_name.$": "$$.Execution.Name",
14-
"payload.$": "$",
15-
"action": "validate"
16-
}
17-
},
18-
"Catch": [
19-
{
20-
"ErrorEquals": ["States.ALL"],
21-
"Next": "aft_account_provisioning_framework_notify_error"
22-
}
23-
]
24-
},
25-
"aft_account_provisioning_framework_get_account_info": {
26-
"Next": "aft_account_provisioning_framework_persist_metadata",
27-
"Type": "Task",
28-
"Resource": "arn:${current_partition}:states:::lambda:invoke",
29-
"ResultPath": "$.account_info",
30-
"ResultSelector": {"account.$":"$.Payload"},
31-
"Parameters": {
32-
"FunctionName": "${get_account_info_function_name}",
33-
"Payload": {
34-
"job_name.$": "$$.Execution.Name",
35-
"payload.$": "$",
36-
"action": "get_account_info"
37-
}
38-
},
39-
"Catch": [
40-
{
41-
"ErrorEquals": ["States.ALL"],
42-
"Next": "aft_account_provisioning_framework_notify_error"
43-
}
44-
]
45-
},
464
"aft_account_provisioning_framework_persist_metadata": {
475
"Next": "aft_account_provisioning_framework_create_role",
486
"Type": "Task",

‎modules/aft-code-repositories/buildspecs/ct-aft-account-provisioning-customizations.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ phases:
4949
echo "Installing Terraform"
5050
curl -o terraform_${TF_VERSION}_linux_amd64.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip
5151
unzip -o terraform_${TF_VERSION}_linux_amd64.zip && mv terraform /usr/bin
52-
terraform --version
52+
terraform -no-color --version
5353
cd $DEFAULT_PATH/terraform
5454
for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D region=$TF_BACKEND_REGION -D provider_region=$CT_MGMT_REGION -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN >> ./$(basename $f .jinja).tf; done
5555
for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
@@ -58,7 +58,7 @@ phases:
5858
export AWS_ACCESS_KEY_ID=$(echo ${JSON} | jq --raw-output ".Credentials[\"AccessKeyId\"]")
5959
export AWS_SECRET_ACCESS_KEY=$(echo ${JSON} | jq --raw-output ".Credentials[\"SecretAccessKey\"]")
6060
export AWS_SESSION_TOKEN=$(echo ${JSON} | jq --raw-output ".Credentials[\"SessionToken\"]")
61-
terraform init
61+
terraform init -no-color
6262
else
6363
TF_BACKEND_REGION=$(aws ssm get-parameter --name "/aft/config/oss-backend/primary-region" --query "Parameter.Value" --output text)
6464
TF_ORG_NAME=$(aws ssm get-parameter --name "/aft/config/terraform/org-name" --query "Parameter.Value" --output text)
@@ -78,7 +78,7 @@ phases:
7878
commands:
7979
- |
8080
if [ $TF_DISTRIBUTION = "oss" ]; then
81-
terraform apply --auto-approve
81+
terraform apply -no-color --auto-approve
8282
fi
8383
post_build:
8484
commands:

‎modules/aft-code-repositories/buildspecs/ct-aft-account-request.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ phases:
5858
export AWS_ACCESS_KEY_ID=$(echo ${JSON} | jq --raw-output ".Credentials[\"AccessKeyId\"]")
5959
export AWS_SECRET_ACCESS_KEY=$(echo ${JSON} | jq --raw-output ".Credentials[\"SecretAccessKey\"]")
6060
export AWS_SESSION_TOKEN=$(echo ${JSON} | jq --raw-output ".Credentials[\"SessionToken\"]")
61-
terraform init
61+
terraform init -no-color
6262
else
6363
TF_ORG_NAME=$(aws ssm get-parameter --name "/aft/config/terraform/org-name" --query "Parameter.Value" --output text)
6464
TF_TOKEN=$(aws ssm get-parameter --name "/aft/config/terraform/token" --with-decryption --query "Parameter.Value" --output text)
@@ -77,7 +77,7 @@ phases:
7777
commands:
7878
- |
7979
if [ $TF_DISTRIBUTION = "oss" ]; then
80-
terraform apply --auto-approve
80+
terraform apply -no-color --auto-approve
8181
fi
8282
post_build:
8383
commands:

‎modules/aft-customizations/buildspecs/aft-account-customizations-terraform.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,16 +106,16 @@ phases:
106106
mkdir -p /opt/aft/bin
107107
unzip -q -o terraform_${TF_VERSION}_linux_amd64.zip
108108
mv terraform /opt/aft/bin
109-
/opt/aft/bin/terraform --version
109+
/opt/aft/bin/terraform -no-color --version
110110
111111
cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
112112
for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID >> ./$(basename $f .jinja).tf; done
113113
for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
114114
115115
cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
116116
export AWS_PROFILE=aft-management-admin
117-
/opt/aft/bin/terraform init
118-
/opt/aft/bin/terraform apply --auto-approve
117+
/opt/aft/bin/terraform init -no-color
118+
/opt/aft/bin/terraform apply -no-color --auto-approve
119119
else
120120
TF_BACKEND_REGION=$(aws ssm get-parameter --name "/aft/config/oss-backend/primary-region" --query "Parameter.Value" --output text)
121121
TF_ORG_NAME=$(aws ssm get-parameter --name "/aft/config/terraform/org-name" --query "Parameter.Value" --output text)
@@ -140,7 +140,7 @@ phases:
140140
if [[ ! -z "$CUSTOMIZATION" ]]; then
141141
export PYTHONPATH="$DEFAULT_PATH/aws-aft-core-framework/sources/aft-lambda-layer:$PYTHONPATH"
142142
export AWS_PROFILE=aft-management
143-
python3 $DEFAULT_PATH/aws-aft-core-framework/sources/aft-lambda-layer/aft_common/report_metrics.py --codebuild-name "aft-account-customizations" --codebuild-status $CODEBUILD_BUILD_SUCCEEDING
143+
python3 $DEFAULT_PATH/aws-aft-core-framework/sources/aft-lambda-layer/aft_common/metrics.py --codebuild-name "aft-account-customizations" --codebuild-status $CODEBUILD_BUILD_SUCCEEDING
144144
unset AWS_PROFILE
145145
fi
146146
- |

0 commit comments

Comments
 (0)