Skip to content
Jump to bottom

feat: migrate CSVD patch4 module code from CSVD/terraform-csvd-patch4 #1

Merged
merged 7 commits into from
Jul 8, 2026
Merged

feat: migrate CSVD patch4 module code from CSVD/terraform-csvd-patch4 #1

merged 7 commits into from
Jul 8, 2026
+6,041 −20

Commits on Jul 8, 2026

  1. feat: migrate CSVD patch4 module code from CSVD/terraform-csvd-patch4 

    - Add full module implementation: kms, lambda, logs, outputs, policies,
  rds, roles, sqs, locals, variables
- Add lambda source code: dispatcher, worker, step-result, layer
- Add schema/patch40.sql
- Update data.tf with comprehensive VPC/SG/subnet lookups
- Update versions.tf to require terraform >= 1.0.0 and include archive provider
- Update variables.common.tf: remove duplicate 'tags' variable (now in variables.tf)
- Remove locals.tf.initial stub (replaced by real locals.tf)
    Dave Arnold committed Jul 8, 2026
    Configuration menu
    Copy the full SHA
    27c7f1d View commit details
    Browse the repository at this point in the history

  2. feat: add tags.tf and tags.yml to module

    Dave Arnold committed Jul 8, 2026
    Configuration menu
    Copy the full SHA
    964e551 View commit details
    Browse the repository at this point in the history

  3. refactor: use boc-nts tags module outputs for resource tagging 

    - tags.tf: set legacy_tags = var.tags (replaces account/infra/app var merge)
- locals.tf: replace manual finops_tags + base_tags with module.tags.tags
  and per-resource role via module.tags.finops_roles[role]
- variables.tf: remove finops_project_name and finops_project_number variables
  (finops config now lives in tags.yml)
    Dave Arnold committed Jul 8, 2026
    Configuration menu
    Copy the full SHA
    518da42 View commit details
    Browse the repository at this point in the history

  4. fix: remove double r- prefix from role name locals 

    The aws-iam-role module prepends r- internally, so passing r-name
resulted in r-r-name. Strip the prefix from patch_role_name,
patch_execution_role_name, and patch_execproxy_role_name.
    Dave Arnold committed Jul 8, 2026
    Configuration menu
    Copy the full SHA
    78f3ea2 View commit details
    Browse the repository at this point in the history

  5. style: replace string interpolation with format() org-wide convention 

    - locals.tf: all resource/log group name expressions
- lambda.tf: path.module archive sources and layer source_path
- sqs.tf: policy_id fields and owner ARN identifiers
- policies.tf: all ARN constructions (iam, lambda, logs, rds-db) and org path
- roles.tf: module source git@ format + role_description strings

Also corrects roles.tf module sources from git::https:// to git@ per
terraform-support naming convention.
    Dave Arnold committed Jul 8, 2026
    Configuration menu
    Copy the full SHA
    74ed0ef View commit details
    Browse the repository at this point in the history

  6. fix: wire missing DB env vars into worker and step_result lambdas 

    worker:
  - replace unused RESULTS_QUEUE_URL with input_queue_url (sqs.delete_message)
  - add dbEndpoint, dbUsername, dbDatabase, dbRegion

step_result:
  - add environment block with dbEndpoint, dbUsername, dbDatabase, dbRegion

dispatcher unchanged (no DB access)
    Dave Arnold committed Jul 8, 2026
    Configuration menu
    Copy the full SHA
    21ec4cd View commit details
    Browse the repository at this point in the history

  7. fix: replace hardcoded target role ARN in ec2.py with env vars 

    - Add patch_target_role_name variable (default: r-inf-patch) for the
  cross-account role name that must exist in each target account
- Worker Lambda now passes aws_partition and patch_target_role_name as
  env vars alongside existing DB/queue vars
- ec2.py builds the target ARN dynamically from env vars instead of
  hardcoding partition (aws-us-gov) and role name (r-inf-patch)
    Dave Arnold committed Jul 8, 2026
    Configuration menu
    Copy the full SHA
    f7c1256 View commit details
    Browse the repository at this point in the history