Migrate CD from Terraform HCP to GitHub Actions by skyfenton · Pull Request #19 · skyfenton/waller

skyfenton · 2025-02-26T07:53:30Z

No description provided.

…github-cd

github-actions · 2025-02-26T08:21:44Z

Terraform plan in terraform

Plan: 65 to add, 0 to change, 0 to destroy. Changes to Outputs.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
 <= read (data resources)

Terraform will perform the following actions:

  # cloudflare_record.api_gateway_record will be created
+   resource "cloudflare_record" "api_gateway_record" {
+       allow_overwrite = false
+       comment         = "CNAME record for the Waller API gateway; Terraform"
+       content         = (known after apply)
+       created_on      = (known after apply)
+       hostname        = (known after apply)
+       id              = (known after apply)
+       metadata        = (known after apply)
+       modified_on     = (known after apply)
+       name            = "waller-api"
+       proxiable       = (known after apply)
+       proxied         = true
+       ttl             = (known after apply)
+       type            = "CNAME"
+       value           = (known after apply)
+       zone_id         = "********************************"
    }

  # module.api_gateway.aws_apigatewayv2_api.this[0] will be created
+   resource "aws_apigatewayv2_api" "this" {
+       api_endpoint                 = (known after apply)
+       api_key_selection_expression = "*************************"
+       arn                          = (known after apply)
+       description                  = "HTTP API Gateway for Waller"
+       disable_execute_api_endpoint = true
+       execution_arn                = (known after apply)
+       id                           = (known after apply)
+       name                         = "waller-api-gateway"
+       protocol_type                = "HTTP"
+       route_selection_expression   = "$request.method $request.path"
+       tags                         = {
+           "terraform-aws-modules" = "apigateway-v2"
        }
+       tags_all                     = {
+           "managed-by"            = "terraform"
+           "project"               = "waller"
+           "terraform-aws-modules" = "apigateway-v2"
        }

+       cors_configuration {
+           allow_headers = [
+               "*",
            ]
+           allow_methods = [
+               "*",
            ]
+           allow_origins = [
+               "*",
            ]
        }
    }

  # module.api_gateway.aws_apigatewayv2_api_mapping.this[0] will be created
+   resource "aws_apigatewayv2_api_mapping" "this" {
+       api_id      = (known after apply)
+       domain_name = (known after apply)
+       id          = (known after apply)
+       stage       = (known after apply)
    }

  # module.api_gateway.aws_apigatewayv2_domain_name.this[0] will be created
+   resource "aws_apigatewayv2_domain_name" "this" {
+       api_mapping_selection_expression = (known after apply)
+       arn                              = (known after apply)
+       domain_name                      = "waller-api.skyfenton.com"
+       id                               = (known after apply)
+       tags_all                         = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }

+       domain_name_configuration {
+           certificate_arn                        = "arn:aws:acm:us-east-1:816069126723:certificate/11bea3d4-dd16-4e69-a678-4ce42174fcef"
+           endpoint_type                          = "REGIONAL"
+           hosted_zone_id                         = (known after apply)
+           ownership_verification_certificate_arn = (known after apply)
+           security_policy                        = "TLS_1_2"
+           target_domain_name                     = (known after apply)
        }
    }

  # module.api_gateway.aws_apigatewayv2_integration.this["GET /jobs/{id}"] will be created
+   resource "aws_apigatewayv2_integration" "this" {
+       api_id                                    = (known after apply)
+       connection_type                           = "INTERNET"
+       id                                        = (known after apply)
+       integration_response_selection_expression = (known after apply)
+       integration_type                          = "AWS_PROXY"
+       integration_uri                           = (known after apply)
+       payload_format_version                    = "2.0"
+       timeout_milliseconds                      = (known after apply)
    }

  # module.api_gateway.aws_apigatewayv2_integration.this["POST /jobs"] will be created
+   resource "aws_apigatewayv2_integration" "this" {
+       api_id                                    = (known after apply)
+       connection_type                           = "INTERNET"
+       id                                        = (known after apply)
+       integration_response_selection_expression = (known after apply)
+       integration_type                          = "AWS_PROXY"
+       integration_uri                           = (known after apply)
+       payload_format_version                    = "2.0"
+       timeout_milliseconds                      = (known after apply)
    }

  # module.api_gateway.aws_apigatewayv2_route.this["GET /jobs/{id}"] will be created
+   resource "aws_apigatewayv2_route" "this" {
+       api_id             = (known after apply)
+       api_key_required   = false
+       authorization_type = "NONE"
+       id                 = (known after apply)
+       route_key          = "**************"
+       target             = (known after apply)
    }

  # module.api_gateway.aws_apigatewayv2_route.this["POST /jobs"] will be created
+   resource "aws_apigatewayv2_route" "this" {
+       api_id             = (known after apply)
+       api_key_required   = false
+       authorization_type = "NONE"
+       id                 = (known after apply)
+       route_key          = "**********"
+       target             = (known after apply)
    }

  # module.api_gateway.aws_apigatewayv2_stage.this[0] will be created
+   resource "aws_apigatewayv2_stage" "this" {
+       api_id        = (known after apply)
+       arn           = (known after apply)
+       auto_deploy   = true
+       deployment_id = (known after apply)
+       execution_arn = (known after apply)
+       id            = (known after apply)
+       invoke_url    = (known after apply)
+       name          = "$default"
+       tags_all      = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }

+       access_log_settings {
+           destination_arn = (known after apply)
+           format          = jsonencode(
                {
+                   context = {
+                       domainName              = "$context.domainName"
+                       error                   = {
+                           message      = "$context.error.message"
+                           responseType = "$context.error.responseType"
                        }
+                       identity                = {
+                           sourceIP = "$context.identity.sourceIp"
                        }
+                       integration             = {
+                           error             = "$context.integration.error"
+                           integrationStatus = "$context.integration.integrationStatus"
                        }
+                       integrationErrorMessage = "$context.integrationErrorMessage"
+                       protocol                = "$context.protocol"
+                       requestId               = "$context.requestId"
+                       requestTime             = "$context.requestTime"
+                       responseLength          = "$context.responseLength"
+                       routeKey                = "$context.routeKey"
+                       stage                   = "$context.stage"
+                       status                  = "$context.status"
                    }
                }
            )
        }

+       default_route_settings {
+           data_trace_enabled       = false
+           detailed_metrics_enabled = true
+           logging_level            = (known after apply)
+           throttling_burst_limit   = 500
+           throttling_rate_limit    = 1000
        }

+       route_settings {
+           data_trace_enabled       = false
+           detailed_metrics_enabled = true
+           logging_level            = (known after apply)
+           route_key                = "**************"
+           throttling_burst_limit   = 500
+           throttling_rate_limit    = 1000
        }
+       route_settings {
+           data_trace_enabled       = false
+           detailed_metrics_enabled = true
+           logging_level            = (known after apply)
+           route_key                = "**********"
+           throttling_burst_limit   = 500
+           throttling_rate_limit    = 1000
        }
    }

  # module.api_gateway.aws_cloudwatch_log_group.this["this"] will be created
+   resource "aws_cloudwatch_log_group" "this" {
+       arn               = (known after apply)
+       id                = (known after apply)
+       log_group_class   = (known after apply)
+       name              = "/aws/apigateway/waller-api-gateway/default"
+       name_prefix       = (known after apply)
+       retention_in_days = 30
+       skip_destroy      = false
+       tags_all          = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
    }

  # module.dynamodb_table.aws_dynamodb_table.this[0] will be created
+   resource "aws_dynamodb_table" "this" {
+       arn              = (known after apply)
+       billing_mode     = "PROVISIONED"
+       hash_key         = "**"
+       id               = (known after apply)
+       name             = "waller"
+       read_capacity    = 5
+       stream_arn       = (known after apply)
+       stream_enabled   = false
+       stream_label     = (known after apply)
+       stream_view_type = (known after apply)
+       tags             = {
+           "Name" = "waller"
        }
+       tags_all         = {
+           "Name"       = "waller"
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
+       write_capacity   = 3

+       attribute {
+           name = "id"
+           type = "S"
        }

+       point_in_time_recovery {
+           enabled = false
        }

+       server_side_encryption {
+           enabled     = false
+           kms_key_arn = (known after apply)
        }

+       timeouts {
+           create = "10m"
+           delete = "10m"
+           update = "60m"
        }

+       ttl {
+           enabled        = false
#            (1 unchanged attribute hidden)
        }
    }

  # module.eventbridge.data.aws_iam_policy_document.lambda[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "lambda" {
+       id            = (known after apply)
+       json          = (known after apply)
+       minified_json = (known after apply)

+       statement {
+           actions   = [
+               "lambda:InvokeFunction",
            ]
+           effect    = "Allow"
+           resources = [
+               (known after apply),
            ]
+           sid       = "LambdaAccess"
        }
    }

  # module.eventbridge.aws_iam_policy.lambda[0] will be created
+   resource "aws_iam_policy" "lambda" {
+       arn              = (known after apply)
+       attachment_count = (known after apply)
+       id               = (known after apply)
+       name             = "default-lambda"
+       name_prefix      = (known after apply)
+       path             = "/"
+       policy           = (known after apply)
+       policy_id        = (known after apply)
+       tags             = {
+           "Name" = "default-lambda"
        }
+       tags_all         = {
+           "Name"       = "default-lambda"
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
    }

  # module.eventbridge.aws_iam_policy_attachment.lambda[0] will be created
+   resource "aws_iam_policy_attachment" "lambda" {
+       id         = (known after apply)
+       name       = "default-lambda"
+       policy_arn = (known after apply)
+       roles      = [
+           "default",
        ]
    }

  # module.eventbridge.aws_iam_role.eventbridge[0] will be created
+   resource "aws_iam_role" "eventbridge" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRole"
+                       Effect    = "Allow"
+                       Principal = {
+                           Service = [
+                               "scheduler.amazonaws.com",
+                               "events.amazonaws.com",
                            ]
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = true
+       id                    = (known after apply)
+       managed_policy_arns   = (known after apply)
+       max_session_duration  = 3600
+       name                  = "default"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags                  = {
+           "Name" = "default"
        }
+       tags_all              = {
+           "Name"       = "default"
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
+       unique_id             = (known after apply)

+       inline_policy (known after apply)
    }

  # module.eventbridge.aws_scheduler_schedule.this["lambda-cron"] will be created
+   resource "aws_scheduler_schedule" "this" {
+       arn                          = (known after apply)
+       description                  = "Trigger for a Lambda"
+       group_name                   = (known after apply)
+       id                           = (known after apply)
+       name                         = "lambda-cron-schedule"
+       name_prefix                  = (known after apply)
+       schedule_expression          = "rate(30 minutes)"
+       schedule_expression_timezone = "Europe/London"
+       state                        = "ENABLED"

+       flexible_time_window {
+           mode = "OFF"
        }

+       target {
+           arn      = (known after apply)
+           input    = jsonencode(
                {
+                   job = "cron-by-rate"
                }
            )
+           role_arn = (known after apply)

+           retry_policy {
+               maximum_event_age_in_seconds = 300
+               maximum_retry_attempts       = 3
            }
        }
    }

  # module.expire_objects_lambda.data.aws_iam_policy_document.logs[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "logs" {
+       id            = (known after apply)
+       json          = (known after apply)
+       minified_json = (known after apply)

+       statement {
+           actions   = [
+               "logs:CreateLogGroup",
+               "logs:CreateLogStream",
+               "logs:PutLogEvents",
            ]
+           effect    = "Allow"
+           resources = [
+               (known after apply),
+               (known after apply),
            ]
        }
    }

  # module.expire_objects_lambda.aws_cloudwatch_log_group.lambda[0] will be created
+   resource "aws_cloudwatch_log_group" "lambda" {
+       arn               = (known after apply)
+       id                = (known after apply)
+       log_group_class   = (known after apply)
+       name              = "/aws/lambda/expire-waller-images"
+       name_prefix       = (known after apply)
+       retention_in_days = 0
+       skip_destroy      = false
+       tags_all          = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
    }

  # module.expire_objects_lambda.aws_iam_role.lambda[0] will be created
+   resource "aws_iam_role" "lambda" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRole"
+                       Effect    = "Allow"
+                       Principal = {
+                           Service = [
+                               "scheduler.amazonaws.com",
+                               "lambda.amazonaws.com",
                            ]
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = true
+       id                    = (known after apply)
+       managed_policy_arns   = (known after apply)
+       max_session_duration  = 3600
+       name                  = "expire-waller-images"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
+       unique_id             = (known after apply)

+       inline_policy (known after apply)
    }

  # module.expire_objects_lambda.aws_iam_role_policy.additional_jsons[0] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "expire-waller-images-0"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = "s3:GetObject"
+                       Effect   = "Allow"
+                       Resource = "arn:aws:s3:::waller-images/*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "expire-waller-images"
    }

  # module.expire_objects_lambda.aws_iam_role_policy.additional_jsons[1] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "expire-waller-images-1"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = "s3:DeleteObject"
+                       Effect   = "Allow"
+                       Resource = "arn:aws:s3:::waller-images/*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "expire-waller-images"
    }

  # module.expire_objects_lambda.aws_iam_role_policy.additional_jsons[2] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "expire-waller-images-2"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = [
+                           "dynamodb:Scan",
+                           "dynamodb:GetItem",
                        ]
+                       Effect   = "Allow"
+                       Resource = "arn:aws:dynamodb:*:*:table/waller"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "expire-waller-images"
    }

  # module.expire_objects_lambda.aws_iam_role_policy.additional_jsons[3] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "expire-waller-images-3"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = [
+                           "dynamodb:UpdateItem",
+                           "dynamodb:PutItem",
+                           "dynamodb:BatchWriteItem",
                        ]
+                       Effect   = "Allow"
+                       Resource = "arn:aws:dynamodb:*:*:table/waller"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "expire-waller-images"
    }

  # module.expire_objects_lambda.aws_iam_role_policy.logs[0] will be created
+   resource "aws_iam_role_policy" "logs" {
+       id          = (known after apply)
+       name        = "expire-waller-images-logs"
+       name_prefix = (known after apply)
+       policy      = (known after apply)
+       role        = "expire-waller-images"
    }

  # module.expire_objects_lambda.aws_lambda_function.this[0] will be created
+   resource "aws_lambda_function" "this" {
+       architectures                  = (known after apply)
+       arn                            = (known after apply)
+       code_sha256                    = (known after apply)
+       description                    = "Handles expiring old files in waller bucket via cron job"
+       filename                       = "builds/b1efe1ae2989e7161cfb18e6dc288c786031ced5bf812f9a01d98af29b0c0083.zip"
+       function_name                  = "expire-waller-images"
+       handler                        = "index.lambda_handler"
+       id                             = (known after apply)
+       invoke_arn                     = (known after apply)
+       last_modified                  = (known after apply)
+       memory_size                    = 128
+       package_type                   = "Zip"
+       publish                        = true
+       qualified_arn                  = (known after apply)
+       qualified_invoke_arn           = (known after apply)
+       reserved_concurrent_executions = -1
+       role                           = (known after apply)
+       runtime                        = "python3.12"
+       signing_job_arn                = (known after apply)
+       signing_profile_version_arn    = (known after apply)
+       skip_destroy                   = false
+       source_code_hash               = (known after apply)
+       source_code_size               = (known after apply)
+       tags                           = {
+           "terraform-aws-modules" = "lambda"
        }
+       tags_all                       = {
+           "managed-by"            = "terraform"
+           "project"               = "waller"
+           "terraform-aws-modules" = "lambda"
        }
+       timeout                        = 3
+       version                        = (known after apply)

+       environment {
+           variables = (known after apply)
        }

+       ephemeral_storage {
+           size = 512
        }

+       logging_config {
+           log_format = "Text"
+           log_group  = (known after apply)
        }

+       tracing_config (known after apply)
    }

  # module.expire_objects_lambda.aws_lambda_permission.current_version_triggers["ScanAmiRule"] will be created
+   resource "aws_lambda_permission" "current_version_triggers" {
+       action              = "lambda:InvokeFunction"
+       function_name       = "expire-waller-images"
+       id                  = (known after apply)
+       principal           = "scheduler.amazonaws.com"
+       qualifier           = (known after apply)
+       source_arn          = (known after apply)
+       statement_id        = (known after apply)
+       statement_id_prefix = "***********"
    }

  # module.expire_objects_lambda.aws_lambda_permission.unqualified_alias_triggers["ScanAmiRule"] will be created
+   resource "aws_lambda_permission" "unqualified_alias_triggers" {
+       action              = "lambda:InvokeFunction"
+       function_name       = "expire-waller-images"
+       id                  = (known after apply)
+       principal           = "scheduler.amazonaws.com"
+       source_arn          = (known after apply)
+       statement_id        = (known after apply)
+       statement_id_prefix = "***********"
    }

  # module.expire_objects_lambda.local_file.archive_plan[0] will be created
+   resource "local_file" "archive_plan" {
+       content              = jsonencode(
            {
+               artifacts_dir = "builds"
+               build_plan    = [
+                   [
+                       [
+                           "zip",
+                           "/github/workspace/python-backend/functions/delete/expire",
+                           null,
                        ],
                    ],
                ]
+               filename      = "builds/b1efe1ae2989e7161cfb18e6dc288c786031ced5bf812f9a01d98af29b0c0083.zip"
+               runtime       = "python3.12"
            }
        )
+       content_base64sha256 = (known after apply)
+       content_base64sha512 = (known after apply)
+       content_md5          = (known after apply)
+       content_sha1         = (known after apply)
+       content_sha256       = (known after apply)
+       content_sha512       = (known after apply)
+       directory_permission = "0755"
+       file_permission      = "0644"
+       filename             = "builds/b1efe1ae2989e7161cfb18e6dc288c786031ced5bf812f9a01d98af29b0c0083.plan.json"
+       id                   = (known after apply)
    }

  # module.expire_objects_lambda.null_resource.archive[0] will be created
+   resource "null_resource" "archive" {
+       id       = (known after apply)
+       triggers = {
+           "filename"  = "builds/b1efe1ae2989e7161cfb18e6dc288c786031ced5bf812f9a01d98af29b0c0083.zip"
+           "timestamp" = "1740563289006028000"
        }
    }

  # module.get_item_lambda.data.aws_iam_policy_document.logs[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "logs" {
+       id            = (known after apply)
+       json          = (known after apply)
+       minified_json = (known after apply)

+       statement {
+           actions   = [
+               "logs:CreateLogGroup",
+               "logs:CreateLogStream",
+               "logs:PutLogEvents",
            ]
+           effect    = "Allow"
+           resources = [
+               (known after apply),
+               (known after apply),
            ]
        }
    }

  # module.get_item_lambda.aws_cloudwatch_log_group.lambda[0] will be created
+   resource "aws_cloudwatch_log_group" "lambda" {
+       arn               = (known after apply)
+       id                = (known after apply)
+       log_group_class   = (known after apply)
+       name              = "/aws/lambda/waller-get"
+       name_prefix       = (known after apply)
+       retention_in_days = 0
+       skip_destroy      = false
+       tags_all          = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
    }

  # module.get_item_lambda.aws_iam_role.lambda[0] will be created
+   resource "aws_iam_role" "lambda" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRole"
+                       Effect    = "Allow"
+                       Principal = {
+                           Service = "lambda.amazonaws.com"
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = true
+       id                    = (known after apply)
+       managed_policy_arns   = (known after apply)
+       max_session_duration  = 3600
+       name                  = "waller-get"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
+       unique_id             = (known after apply)

+       inline_policy (known after apply)
    }

  # module.get_item_lambda.aws_iam_role_policy.additional_jsons[0] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "waller-get-0"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = "s3:GetObject"
+                       Effect   = "Allow"
+                       Resource = "arn:aws:s3:::waller-images/*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "waller-get"
    }

  # module.get_item_lambda.aws_iam_role_policy.additional_jsons[1] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "waller-get-1"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = [
+                           "dynamodb:Scan",
+                           "dynamodb:GetItem",
                        ]
+                       Effect   = "Allow"
+                       Resource = "arn:aws:dynamodb:*:*:table/waller"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "waller-get"
    }

  # module.get_item_lambda.aws_iam_role_policy.logs[0] will be created
+   resource "aws_iam_role_policy" "logs" {
+       id          = (known after apply)
+       name        = "waller-get-logs"
+       name_prefix = (known after apply)
+       policy      = (known after apply)
+       role        = "waller-get"
    }

  # module.get_item_lambda.aws_lambda_function.this[0] will be created
+   resource "aws_lambda_function" "this" {
+       architectures                  = (known after apply)
+       arn                            = (known after apply)
+       code_sha256                    = (known after apply)
+       description                    = "Get job status for Waller"
+       filename                       = "builds/2c6a9586842428a01e013bab833dd9c0f1cae9a48f0551badfbd5ace8890cc50.zip"
+       function_name                  = "waller-get"
+       handler                        = "index.lambda_handler"
+       id                             = (known after apply)
+       invoke_arn                     = (known after apply)
+       last_modified                  = (known after apply)
+       memory_size                    = 128
+       package_type                   = "Zip"
+       publish                        = true
+       qualified_arn                  = (known after apply)
+       qualified_invoke_arn           = (known after apply)
+       reserved_concurrent_executions = -1
+       role                           = (known after apply)
+       runtime                        = "python3.12"
+       signing_job_arn                = (known after apply)
+       signing_profile_version_arn    = (known after apply)
+       skip_destroy                   = false
+       source_code_hash               = (known after apply)
+       source_code_size               = (known after apply)
+       tags                           = {
+           "terraform-aws-modules" = "lambda"
        }
+       tags_all                       = {
+           "managed-by"            = "terraform"
+           "project"               = "waller"
+           "terraform-aws-modules" = "lambda"
        }
+       timeout                        = 3
+       version                        = (known after apply)

+       environment {
+           variables = (known after apply)
        }

+       ephemeral_storage {
+           size = 512
        }

+       logging_config {
+           log_format = "Text"
+           log_group  = (known after apply)
        }

+       tracing_config (known after apply)
    }

  # module.get_item_lambda.aws_lambda_permission.current_version_triggers["AllowExecutionFromAPIGateway"] will be created
+   resource "aws_lambda_permission" "current_version_triggers" {
+       action              = "lambda:InvokeFunction"
+       function_name       = "waller-get"
+       id                  = (known after apply)
+       principal           = "apigateway.amazonaws.com"
+       qualifier           = (known after apply)
+       source_arn          = (known after apply)
+       statement_id        = (known after apply)
+       statement_id_prefix = "****************************"
    }

  # module.get_item_lambda.aws_lambda_permission.unqualified_alias_triggers["AllowExecutionFromAPIGateway"] will be created
+   resource "aws_lambda_permission" "unqualified_alias_triggers" {
+       action              = "lambda:InvokeFunction"
+       function_name       = "waller-get"
+       id                  = (known after apply)
+       principal           = "apigateway.amazonaws.com"
+       source_arn          = (known after apply)
+       statement_id        = (known after apply)
+       statement_id_prefix = "****************************"
    }

  # module.get_item_lambda.local_file.archive_plan[0] will be created
+   resource "local_file" "archive_plan" {
+       content              = jsonencode(
            {
+               artifacts_dir = "builds"
+               build_plan    = [
+                   [
+                       [
+                           "zip",
+                           "/github/workspace/python-backend/functions/get/src",
+                           null,
                        ],
                    ],
                ]
+               filename      = "builds/2c6a9586842428a01e013bab833dd9c0f1cae9a48f0551badfbd5ace8890cc50.zip"
+               runtime       = "python3.12"
            }
        )
+       content_base64sha256 = (known after apply)
+       content_base64sha512 = (known after apply)
+       content_md5          = (known after apply)
+       content_sha1         = (known after apply)
+       content_sha256       = (known after apply)
+       content_sha512       = (known after apply)
+       directory_permission = "0755"
+       file_permission      = "0644"
+       filename             = "builds/2c6a9586842428a01e013bab833dd9c0f1cae9a48f0551badfbd5ace8890cc50.plan.json"
+       id                   = (known after apply)
    }

  # module.get_item_lambda.null_resource.archive[0] will be created
+   resource "null_resource" "archive" {
+       id       = (known after apply)
+       triggers = {
+           "filename"  = "builds/2c6a9586842428a01e013bab833dd9c0f1cae9a48f0551badfbd5ace8890cc50.zip"
+           "timestamp" = "1740563288971505000"
        }
    }

  # module.inference_image.aws_ecr_lifecycle_policy.this[0] will be created
+   resource "aws_ecr_lifecycle_policy" "this" {
+       id          = (known after apply)
+       policy      = jsonencode(
            {
+               rules = [
+                   {
+                       action       = {
+                           type = "expire"
                        }
+                       description  = "Keep only the last 2 images"
+                       rulePriority = 1
+                       selection    = {
+                           countNumber = 2
+                           countType   = "imageCountMoreThan"
+                           tagStatus   = "any"
                        }
                    },
                ]
            }
        )
+       registry_id = (known after apply)
+       repository  = (known after apply)
    }

  # module.inference_image.aws_ecr_repository.this[0] will be created
+   resource "aws_ecr_repository" "this" {
+       arn                  = (known after apply)
+       force_delete         = true
+       id                   = (known after apply)
+       image_tag_mutability = "MUTABLE"
+       name                 = "waller-inference"
+       registry_id          = (known after apply)
+       repository_url       = (known after apply)
+       tags_all             = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }

+       image_scanning_configuration {
+           scan_on_push = false
        }
    }

  # module.inference_image.docker_image.this will be created
+   resource "docker_image" "this" {
+       force_remove = true
+       id           = (known after apply)
+       image_id     = (known after apply)
+       keep_locally = false
+       name         = (known after apply)
+       repo_digest  = (known after apply)
+       triggers     = {
+           "dir_sha" = "8c6ff42a7401dd18e35d90d98c55709d0ae138b5"
        }

+       build {
+           cache_from     = []
+           context        = "/github/workspace/python-backend/functions/infer"
+           dockerfile     = "Dockerfile"
+           extra_hosts    = []
+           platform       = "linux/amd64"
+           remove         = true
+           security_opt   = []
+           tag            = []
#            (10 unchanged attributes hidden)
        }
    }

  # module.inference_image.docker_registry_image.this will be created
+   resource "docker_registry_image" "this" {
+       id                   = (known after apply)
+       insecure_skip_verify = false
+       keep_remotely        = false
+       name                 = (known after apply)
+       sha256_digest        = (known after apply)
+       triggers             = {
+           "dir_sha" = "8c6ff42a7401dd18e35d90d98c55709d0ae138b5"
        }
    }

  # module.inference_lambda.data.aws_iam_policy_document.logs[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "logs" {
+       id            = (known after apply)
+       json          = (known after apply)
+       minified_json = (known after apply)

+       statement {
+           actions   = [
+               "logs:CreateLogGroup",
+               "logs:CreateLogStream",
+               "logs:PutLogEvents",
            ]
+           effect    = "Allow"
+           resources = [
+               (known after apply),
+               (known after apply),
            ]
        }
    }

  # module.inference_lambda.aws_cloudwatch_log_group.lambda[0] will be created
+   resource "aws_cloudwatch_log_group" "lambda" {
+       arn               = (known after apply)
+       id                = (known after apply)
+       log_group_class   = (known after apply)
+       name              = "/aws/lambda/waller-inference"
+       name_prefix       = (known after apply)
+       retention_in_days = 0
+       skip_destroy      = false
+       tags_all          = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
    }

  # module.inference_lambda.aws_iam_role.lambda[0] will be created
+   resource "aws_iam_role" "lambda" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRole"
+                       Effect    = "Allow"
+                       Principal = {
+                           Service = "lambda.amazonaws.com"
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = true
+       id                    = (known after apply)
+       managed_policy_arns   = (known after apply)
+       max_session_duration  = 3600
+       name                  = "waller-inference"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
+       unique_id             = (known after apply)

+       inline_policy (known after apply)
    }

  # module.inference_lambda.aws_iam_role_policy.additional_jsons[0] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "waller-inference-0"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = "s3:GetObject"
+                       Effect   = "Allow"
+                       Resource = "arn:aws:s3:::waller-images/*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "waller-inference"
    }

  # module.inference_lambda.aws_iam_role_policy.additional_jsons[1] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "waller-inference-1"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = "s3:PutObject"
+                       Effect   = "Allow"
+                       Resource = "arn:aws:s3:::waller-images/*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "waller-inference"
    }

  # module.inference_lambda.aws_iam_role_policy.additional_jsons[2] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "waller-inference-2"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = "s3:DeleteObject"
+                       Effect   = "Allow"
+                       Resource = "arn:aws:s3:::waller-images/*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "waller-inference"
    }

  # module.inference_lambda.aws_iam_role_policy.additional_jsons[3] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "waller-inference-3"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = [
+                           "dynamodb:UpdateItem",
+                           "dynamodb:PutItem",
+                           "dynamodb:BatchWriteItem",
                        ]
+                       Effect   = "Allow"
+                       Resource = "arn:aws:dynamodb:*:*:table/waller"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       role        = "waller-inference"
    }

  # module.inference_lambda.aws_iam_role_policy.logs[0] will be created
+   resource "aws_iam_role_policy" "logs" {
+       id          = (known after apply)
+       name        = "waller-inference-logs"
+       name_prefix = (known after apply)
+       policy      = (known after apply)
+       role        = "waller-inference"
    }

  # module.inference_lambda.aws_lambda_function.this[0] will be created
+   resource "aws_lambda_function" "this" {
+       architectures                  = [
+           "x86_64",
        ]
+       arn                            = (known after apply)
+       code_sha256                    = (known after apply)
+       description                    = "Runs inference on queued images in Waller bucket"
+       function_name                  = "waller-inference"
+       id                             = (known after apply)
+       image_uri                      = (known after apply)
+       invoke_arn                     = (known after apply)
+       last_modified                  = (known after apply)
+       memory_size                    = 2048
+       package_type                   = "Image"
+       publish                        = false
+       qualified_arn                  = (known after apply)
+       qualified_invoke_arn           = (known after apply)
+       reserved_concurrent_executions = -1
+       role                           = (known after apply)
+       signing_job_arn                = (known after apply)
+       signing_profile_version_arn    = (known after apply)
+       skip_destroy                   = false
+       source_code_hash               = (known after apply)
+       source_code_size               = (known after apply)
+       tags                           = {
+           "terraform-aws-modules" = "lambda"
        }
+       tags_all                       = {
+           "managed-by"            = "terraform"
+           "project"               = "waller"
+           "terraform-aws-modules" = "lambda"
        }
+       timeout                        = 90
+       version                        = (known after apply)

+       environment {
+           variables = (known after apply)
        }

+       ephemeral_storage {
+           size = 512
        }

+       logging_config {
+           log_format = "Text"
+           log_group  = (known after apply)
        }

+       tracing_config (known after apply)
    }

  # module.inference_lambda.aws_lambda_function_event_invoke_config.this["current_version"] will be created
+   resource "aws_lambda_function_event_invoke_config" "this" {
+       function_name                = "waller-inference"
+       id                           = (known after apply)
+       maximum_event_age_in_seconds = 120
+       maximum_retry_attempts       = 0
+       qualifier                    = (known after apply)
    }

  # module.inference_lambda.aws_lambda_function_event_invoke_config.this["unqualified_alias"] will be created
+   resource "aws_lambda_function_event_invoke_config" "this" {
+       function_name                = "waller-inference"
+       id                           = (known after apply)
+       maximum_event_age_in_seconds = 120
+       maximum_retry_attempts       = 0
    }

  # module.s3_notifications.aws_lambda_permission.allow["inference_lambda"] will be created
+   resource "aws_lambda_permission" "allow" {
+       action              = "lambda:InvokeFunction"
+       function_name       = "waller-inference"
+       id                  = (known after apply)
+       principal           = "s3.amazonaws.com"
+       source_arn          = (known after apply)
+       statement_id        = (known after apply)
+       statement_id_prefix = "********************************"
    }

  # module.s3_notifications.aws_s3_bucket_notification.this[0] will be created
+   resource "aws_s3_bucket_notification" "this" {
+       bucket      = (known after apply)
+       eventbridge = false
+       id          = (known after apply)

+       lambda_function {
+           events              = [
+               "s3:ObjectCreated:*",
            ]
+           filter_prefix       = "queued/"
+           id                  = "inference_lambda"
+           lambda_function_arn = (known after apply)
        }
    }

  # module.upload_lambda.data.aws_iam_policy_document.logs[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "logs" {
+       id            = (known after apply)
+       json          = (known after apply)
+       minified_json = (known after apply)

+       statement {
+           actions   = [
+               "logs:CreateLogGroup",
+               "logs:CreateLogStream",
+               "logs:PutLogEvents",
            ]
+           effect    = "Allow"
+           resources = [
+               (known after apply),
+               (known after apply),
            ]
        }
    }

  # module.upload_lambda.aws_cloudwatch_log_group.lambda[0] will be created
+   resource "aws_cloudwatch_log_group" "lambda" {
+       arn               = (known after apply)
+       id                = (known after apply)
+       log_group_class   = (known after apply)
+       name              = "/aws/lambda/waller-upload"
+       name_prefix       = (known after apply)
+       retention_in_days = 0
+       skip_destroy      = false
+       tags_all          = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
    }

  # module.upload_lambda.aws_iam_role.lambda[0] will be created
+   resource "aws_iam_role" "lambda" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRole"
+                       Effect    = "Allow"
+                       Principal = {
+                           Service = "lambda.amazonaws.com"
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = true
+       id                    = (known after apply)
+       managed_policy_arns   = (known after apply)
+       max_session_duration  = 3600
+       name                  = "waller-upload"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = {
+           "managed-by" = "terraform"
+           "project"    = "waller"
        }
+       unique_id             = (known after apply)

+       inline_policy (known after apply)
    }

  # module.upload_lambda.aws_iam_role_policy.additional_jsons[0] will be created
+   resource "aws_iam_role_policy" "additional_jsons" {
+       id          = (known after apply)
+       name        = "waller-upload-0"
+       name_prefix = (known after apply)
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
Plan is too large to fit in a PR comment. See the full plan in the workflow log.

📝 Plan generated in Create terraform plan #7

skyfenton added 6 commits February 26, 2025 07:52

Refactor variables to separate keys

9d8f572

Create terraform plan CD job

b041516

Merge branch 'github-cd' of https://github.com/skyfenton/waller into …

984cfbe

…github-cd

Fix path

6eac106

Actually fix path possibly

7ea2b9a

Regenerate lock file

20742c3

skyfenton added 2 commits February 26, 2025 09:20

Refactor api_address to use strings vs. object

0589573

Use production environment in CD job

6537856

skyfenton had a problem deploying to production February 26, 2025 09:20 — with GitHub Actions Failure

Try extracting all variables and secrets with step

e6f1e7b

skyfenton had a problem deploying to production February 26, 2025 09:38 — with GitHub Actions Failure

Force add all vars

34dfc8d

skyfenton deployed to production February 26, 2025 09:47 — with GitHub Actions Active

skyfenton changed the title ~~Refactor tf variables to separate keys~~ Migrate CD from Terraform HCP to GitHub Actions Feb 26, 2025

Navigation Menu

Migrate CD from Terraform HCP to GitHub Actions - #19

Migrate CD from Terraform HCP to GitHub Actions#19
skyfenton wants to merge 10 commits into
mainfrom
github-cd

skyfenton commented Feb 26, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 26, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

skyfenton commented Feb 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Feb 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

skyfenton commented Feb 26, 2025 •

edited

Loading

github-actions Bot commented Feb 26, 2025 •

edited

Loading