Update Docker and Linux pipeline configurations

.secrets/main.tf

@@ -0,0 +1,40 @@
+variable "packer_atx_host_ansible_pswd" {
+  type = string
+}
+
+variable "packer_atx_api_usr_pswd" {
+  type = string
+}
+
+locals {
+  secrets = {
+    packer_atx_host_ansible_pswd = var.packer_atx_host_ansible_pswd
+    packer_atx_api_usr_pswd      = var.packer_atx_api_usr_pswd
+  }
+}
+
+resource "aws_kms_ciphertext" "ciphertext_blob" {
+  for_each  = tomap(local.secrets)
+  key_id    = aws_kms_key.oauth_config.key_id
+  plaintext = lookup(local.secrets, each.key)
+}
+
+resource "aws_secretsmanager_secret" "secrets" {
+  for_each = tomap(local.secrets)
+  name     = "/image-pipeline/global/${each.key}"
+}
+
+resource "aws_secretsmanager_secret_version" "secrets" {
+  for_each      = tomap(local.secrets)
+  secret_id     = lookup(aws_secretsmanager_secret.secrets, each.key).id
+  secret_string = jsonencode(lookup(local.secrets, each.key))
+}
+
+terraform {
+  backend "s3" {
+    bucket         = "inf-tfstate-229685449397"
+    key            = "csvd-dev-gov/common/apps/aws-image-pipeline-global-secrets"
+    region         = "us-gov-east-1"
+    dynamodb_table = "tf_remote_state"
+  }
+}

ansible_parameters.tf

@@ -0,0 +1,66 @@
+# Purpose: This file is used to create SSM parameters and Secrets Manager secrets for Ansible parameters.
+resource "aws_kms_key" "image_pipeline_globals" {
+  description = "image-pipeline global parameters and secrets"
+  is_enabled  = true
+}
+
+locals {
+  packer = {
+    aap = {
+      ami = {
+        pipeline_workflow_url = ""
+      }
+    }
+    atx = {
+      host = {
+        ansible_pswd = ""
+        ansible_user = ""
+        action       = ""
+        ipv4         = ""
+        name         = ""
+        osver        = ""
+      }
+      api = {
+        usr_name = ""
+        usr_pswd = ""
+      }
+      inventory = ""
+    }
+  }
+
+  ansible_secrets = {
+    packer_atx_host_ansible_pswd = local.packer.atx.host.ansible_pswd
+    packer_atx_api_usr_pswd      = local.packer.atx.api.usr_pswd
+  }
+
+  ansible_parameters = {
+    packer_aap_ami_pipeline_workflow_url = local.packer.aap.ami.pipeline_workflow_url
+    packer_atx_api_usr_name              = local.packer.atx.api.usr_name
+    packer_atx_host_name                 = local.packer.atx.host.name
+    packer_atx_host_ipv4                 = local.packer.atx.host.ipv4
+    packer_atx_host_osver                = local.packer.atx.host.osver
+    packer_atx_inventory                 = local.packer.atx.inventory
+    packer_atx_host_action               = local.packer.atx.host.action
+    packer_atx_host_ansible_user         = local.packer.atx.host.ansible_user
+  }
+}
+
+
+# Managed Parameters: Parameters not listed in var.nonmanaged_parameters are fully managed by Terraform.
+resource "aws_ssm_parameter" "managed_parameters" {
+  for_each = tomap({ for k, v in local.ssm_parameters : k => v if !contains(var.nonmanaged_parameters, k) })
+  name     = "/image-pipeline/${var.project_name}/${each.key}"
+  type     = "StringList"
+  value    = each.value
+}
+
+resource "aws_secretsmanager_secret" "secrets" {
+  for_each = toset(local.secret_keys)
+  name     = "/image-pipeline/${var.project_name}/${each.key}"
+}
+
+resource "aws_secretsmanager_secret_version" "secrets" {
+  for_each      = toset(local.secret_keys)
+  secret_id     = lookup(aws_secretsmanager_secret.secrets, each.key).id
+  secret_string = jsonencode(lookup(local.secrets, each.key))
+}

docker.tf

@@ -29,12 +29,12 @@ module "ecr-clone" {
 }
 
 module "docker" {
-  source              = "HappyPathway/image-pipeline/aws"
-  project_name        = "pipeline-test"
-  builder_image       = "aws/codebuild/standard:7.0"
-  create_new_role     = true
-  ssh_user            = "ec2-user"
-  terraform_version   = "1.8.5"
+  source            = "HappyPathway/image-pipeline/aws"
+  project_name      = "pipeline-test"
+  builder_image     = "aws/codebuild/standard:7.0"
+  create_new_role   = true
+  ssh_user          = "ec2-user"
+  terraform_version = "1.8.5"
   build_environment_variables = [
     for proxy_var in keys(local.proxy_env_vars) :
     {

linux.tf

@@ -4,12 +4,12 @@ moved {
 }
 
 module "amazon_linux" {
-  source              = "HappyPathway/image-pipeline/aws"
-  project_name        = "linux-image-pipeline"
-  builder_image       = "aws/codebuild/standard:7.0"
-  create_new_role     = true
-  ssh_user            = "ec2-user"
-  terraform_version   = "1.8.5"
+  source            = "HappyPathway/image-pipeline/aws"
+  project_name      = "linux-image-pipeline"
+  builder_image     = "aws/codebuild/standard:7.0"
+  create_new_role   = true
+  ssh_user          = "ec2-user"
+  terraform_version = "1.8.5"
   build_environment_variables = [
     for proxy_var in keys(local.proxy_env_vars) :
     {

rhel.tf

@@ -1,13 +1,13 @@
 
 module "rhel" {
-  source              = "HappyPathway/image-pipeline/aws"
-  project_name        = "rhel-image-pipeline-demo"
-  builder_image       = "aws/codebuild/standard:7.0"
-  create_new_role     = true
-  ssh_user            = "ec2-user"
-  playbook            = "rhel-arm-baseline.yaml"
-  terraform_version   = "1.8.5"
-  troubleshoot        = false
+  source            = "HappyPathway/image-pipeline/aws"
+  project_name      = "rhel-image-pipeline-demo"
+  builder_image     = "aws/codebuild/standard:7.0"
+  create_new_role   = true
+  ssh_user          = "ec2-user"
+  playbook          = "rhel-arm-baseline.yaml"
+  terraform_version = "1.8.5"
+  troubleshoot      = false
   build_environment_variables = [
     for proxy_var in keys(local.proxy_env_vars) : {
       name  = proxy_var

vpc_endpoint.tf

@@ -18,5 +18,5 @@ resource "aws_vpc_endpoint" "endpoint" {
     local.vpc_config.security_group_ids,
     ["sg-0ba8072164c29e11f"]
   )
-  subnet_ids         = local.vpc_config.subnets
+  subnet_ids = local.vpc_config.subnets
 }