continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

fix(terraform/platform): quote acdl: tags + fix Lambda + replace interpolation
acdl-ci / Lint (pull_request) Successful in 7s
Details
acdl-ci / Test (pull_request) Successful in 4m5s
Details
acdl-ci / Platform check-only (offline) (pull_request) Successful in 21s
Details
acdl-modules-lifecycle / Platform VPC apply (pull_request) Failing after 42s
Details
acdl-modules-lifecycle / L1 lifecycle (alb) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (cloudfront) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (ecr) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (ecs-cluster) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (ecs-service) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (iam-role) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (kms-key) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (rds) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (s3) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (uptime) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (vpc) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / L1 lifecycle (waf) (pull_request) Has been skipped
Details
acdl-modules-lifecycle / Platform VPC destroy (pull_request) Successful in 48s
Details

Browse Source 
3 fixes in terraform/platform/main.tf that prevented terraform validate
from passing in CI:

1. All 40 acdl:owner/contract/environment/cost-center tag keys were
   unquoted (acdl:owner = ...). HCL requires quoting keys with colons.
   Fixed to "acdl:owner" = ...

2. filebase64sha256("contract_ingestor.zip") failed when the zip didn't
   exist (it's a build artifact). Wrapped with fileexists() guard.

3. ${account_id} and ${region} in the replace() call were interpreted
   as Terraform interpolation, not literal strings. Escaped as
   $${account_id} and $${region}.

Platform terraform now passes terraform validate.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---
This commit is contained in:
Jon Chery
2026-07-28 16:42:17 +00:00
parent 315a86d396
commit 2f8c0203be
1 changed files with 57 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/platform/main.tf
+43 -43
View File
@@ -68,10 +68,10 @@ resource "aws_dynamodb_table" "acdl_contracts" {
} }
tags = { tags = {
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "prod" "acdl:environment" = "prod"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
@@ -82,10 +82,10 @@ resource "aws_secretsmanager_secret" "github_token" {
kms_key_id = aws_kms_key.acdl_platform.arn kms_key_id = aws_kms_key.acdl_platform.arn
tags = { tags = {
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "prod" "acdl:environment" = "prod"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
@@ -144,7 +144,7 @@ resource "aws_lambda_function" "contract_ingestor" {
runtime = "python3.12" runtime = "python3.12"
role = aws_iam_role.lambda_exec.arn role = aws_iam_role.lambda_exec.arn
filename = "contract_ingestor.zip" filename = "contract_ingestor.zip"
source_code_hash = filebase64sha256("contract_ingestor.zip") source_code_hash = fileexists("contract_ingestor.zip") ? filebase64sha256("contract_ingestor.zip") : "placeholder"
environment { environment {
variables = { variables = {
@@ -155,10 +155,10 @@ resource "aws_lambda_function" "contract_ingestor" {
} }
tags = { tags = {
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "prod" "acdl:environment" = "prod"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
@@ -179,8 +179,8 @@ data "aws_region" "current" {}
locals { locals {
invoke_policy_template = file("${path.module}/consumer_invoke_policy.json") invoke_policy_template = file("${path.module}/consumer_invoke_policy.json")
rendered_invoke_policy = replace( rendered_invoke_policy = replace(
replace(local.invoke_policy_template, "${account_id}", data.aws_caller_identity.current.account_id), replace(local.invoke_policy_template, "$${account_id}", data.aws_caller_identity.current.account_id),
"${region}", data.aws_region.current.name "$${region}", data.aws_region.current.name
) )
} }
@@ -216,10 +216,10 @@ resource "aws_dynamodb_table" "acdl_change_requests" {
} }
tags = { tags = {
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "prod" "acdl:environment" = "prod"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
# REQ-107: SNS topic for separation-of-duties halt artifacts. # REQ-107: SNS topic for separation-of-duties halt artifacts.
@@ -228,10 +228,10 @@ resource "aws_sns_topic" "acdl_sod_halt" {
name = "acdl-sod-halt" name = "acdl-sod-halt"
kms_master_key_id = aws_kms_key.acdl_platform.id kms_master_key_id = aws_kms_key.acdl_platform.id
tags = { tags = {
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "prod" "acdl:environment" = "prod"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
@@ -248,10 +248,10 @@ resource "aws_vpc" "acdl_shared" {
cidr_block = "10.0.0.0/16" cidr_block = "10.0.0.0/16"
tags = { tags = {
Name = "acdl-shared" Name = "acdl-shared"
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "shared" "acdl:environment" = "shared"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
@@ -262,10 +262,10 @@ resource "aws_subnet" "acdl_shared" {
availability_zone = data.aws_availability_zones.available.names[count.index] availability_zone = data.aws_availability_zones.available.names[count.index]
tags = { tags = {
Name = "acdl-shared-subnet-${count.index}" Name = "acdl-shared-subnet-${count.index}"
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "shared" "acdl:environment" = "shared"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
@@ -277,10 +277,10 @@ resource "aws_internet_gateway" "acdl_shared" {
vpc_id = aws_vpc.acdl_shared.id vpc_id = aws_vpc.acdl_shared.id
tags = { tags = {
Name = "acdl-shared-igw" Name = "acdl-shared-igw"
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "shared" "acdl:environment" = "shared"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
@@ -292,10 +292,10 @@ resource "aws_route_table" "acdl_shared" {
} }
tags = { tags = {
Name = "acdl-shared-rt" Name = "acdl-shared-rt"
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "shared" "acdl:environment" = "shared"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }
@@ -326,10 +326,10 @@ resource "aws_security_group" "ecs" {
tags = { tags = {
Name = "acdl-ecs-sg" Name = "acdl-ecs-sg"
acdl:owner = "acdl" "acdl:owner" = "acdl"
acdl:contract = "platform" "acdl:contract" = "platform"
acdl:environment = "shared" "acdl:environment" = "shared"
acdl:cost-center = "acdl-default" "acdl:cost-center" = "acdl-default"
} }
} }