terraform.tf.j2

terraform {
  required_version = "{{terraform.terraform_version}}"

  backend "s3" {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/dataworks-aws-data-egress.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }

  required_providers {
    aws = {
      version = "4.53.0"
    }
  }
}

// Get AWS Account ID for credentials in use
data "aws_caller_identity" "current" {}

data "aws_region" "current" {}
data "aws_availability_zones" "available" {}

data "aws_ec2_managed_prefix_list" "list" {
  name = "dwp-*-aws-cidrs-*"
}

data "aws_secretsmanager_secret_version" "terraform_secrets" {
  provider  = aws.management_dns
  secret_id = "/concourse/dataworks/terraform"
}

locals {
  name        = "dataworks-aws-data-egress"
  environment = terraform.workspace == "default" ? "development" : terraform.workspace

  # Configured as per Tagging doc requirements https://engineering.dwp.gov.uk/policies/hcs-cloud-hosting-policies/resource-identification-tagging/
  # Also required as per Tenable documentation https://engineering.dwp.gov.uk/products/gold-images/agents/tenable/
  hcs_environment = {
    development    = "Dev"
    qa             = "Test"
    integration    = "Stage"
    preprod        = "Stage"
    production     = "Production"
    management     = "SP_Tooling"
    management-dev = "DT_Tooling"
  }

  account = {
    {%- for key, value in accounts.items() %}
      {{key}} = "{{value}}"
    {%- endfor %}
  }

  tags = {
    Name            = "dataworks-aws-data-egress"
    DWX_Environment = local.environment
    DWX_Application = "dataworks-aws-data-egress"
    Persistence     = "Ignore"
    AutoShutdown    = "False"
  }

  common_tags = {
    {%- for key, value in common_tags.items() %}
      {{key}} = "{{value}}"
    {%- endfor %}
    DWX_Environment = local.environment
    DWX_Application = local.name
  }

  cidr_block = {
  {%- for environment, ranges in cidr_block.items() %}
      {{ environment }} = {
        {%- for key, value in ranges.items() %}
          {{ key }} = "{{ value }}"{% endfor %}
      } {%- endfor %}
  }

    data_egress_ecs_friendly_name = "data-egress-ecs-cluster"
    cluster_name              = replace(local.data_egress_ecs_friendly_name, "-ecs-cluster", "")
    cw_agent_log_group_name_data_egress_ecs = "/app/${local.data_egress_ecs_friendly_name}"
    data_egress_friendly_name = "data-egress-cluster"

    opsmi = {
     {%- for environment, ranges in opsmi.items() %}
         {{ environment }} = {
           {%- for key, value in ranges.items() %}
             {{ key }} = "{{ value }}"{% endfor %}
         } {%- endfor %}
     }

    oneservice = {
     {%- for environment, ranges in oneservice.items() %}
         {{ environment }} = {
           {%- for key, value in ranges.items() %}
             {{ key }} = "{{ value }}"{% endfor %}
         } {%- endfor %}
     }

    data_egress = {
     {%- for environment, ranges in data_egress.items() %}
         {{ environment }} = {
           {%- for key, value in ranges.items() %}
             {{ key }} = "{{ value }}"{% endfor %}
         } {%- endfor %}
     }

     pdm_rtg = {
     {%- for environment,contents in pdm_rtg.items() %}
         {{ environment }} = {
           {%- for key, value in contents.items() %}
             {{ key }} = "{{ value }}"{% endfor %}
         } {%- endfor %}
     }

     htme_incr_rtg = {
     {%- for environment,contents in htme_incr_rtg.items() %}
         {{ environment }} = {
           {%- for key, value in contents.items() %}
             {{ key }} = "{{ value }}"{% endfor %}
         } {%- endfor %}
     }

     htme_full_rtg = {
     {%- for environment,contents in htme_full_rtg.items() %}
         {{ environment }} = {
           {%- for key, value in contents.items() %}
             {{ key }} = "{{ value }}"{% endfor %}
         } {%- endfor %}
     }
}

data "terraform_remote_state" "common" {
  backend   = "s3"
  workspace = terraform.workspace

  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/common.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }
}

data "terraform_remote_state" "certificate_authority" {
  backend   = "s3"
  workspace = terraform.workspace

  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/aws-certificate-authority.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }
}

data "terraform_remote_state" "crypto" {
  backend   = "s3"
  workspace = local.crypto_workspace[local.management_account[local.environment]]
  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/aws-crypto.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }
}

data "terraform_remote_state" "aws_sdx" {
  backend   = "s3"
  workspace = terraform.workspace
  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/aws-sdx.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }
}

data "terraform_remote_state" "mgmt_ca" {
  backend   = "s3"
  workspace = local.management_account[local.environment]

  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/aws-certificate-authority.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"

  }
  }

data "terraform_remote_state" "management" {
  backend   = "s3"
  workspace = local.management_infra_account[local.environment]

  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/management.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }
}

data "terraform_remote_state" "snapshot_sender" {
  backend   = "s3"
  workspace = terraform.workspace

  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/aws-snapshot-sender.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }
}

data "terraform_remote_state" "internal_compute" {
  backend   = "s3"
  workspace = terraform.workspace

  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/aws-internal-compute.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }
}

data "terraform_remote_state" "data_ingress" {
  backend   = "s3"
  workspace = terraform.workspace

  config = {
    bucket         = "{{terraform.state_file_bucket}}"
    key            = "terraform/dataworks/dataworks-aws-data-ingress.tfstate"
    region         = "{{terraform.state_file_region}}"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:{{terraform.state_file_region}}:{{terraform.state_file_account}}:key/{{terraform.state_file_kms_key}}"
    dynamodb_table = "remote_state_locks"
  }
}

data "aws_secretsmanager_secret" "rtg_secret_full_collections" {
  name = local.secret_name_for_rtg_full_collections
}

data "aws_secretsmanager_secret_version" "rtg_secret_full_collections" {
  secret_id = data.aws_secretsmanager_secret.rtg_secret_full_collections.id
}

data "aws_secretsmanager_secret" "rtg_secret_incremental_collections" {
  name = local.secret_name_for_rtg_incremental_collections
}

data "aws_secretsmanager_secret_version" "rtg_secret_incremental_collections" {
  secret_id = data.aws_secretsmanager_secret.rtg_secret_incremental_collections.id
}

data "aws_secretsmanager_secret" "rtg_secret_pdm_queries" {
  name = local.secret_name_for_pdm_queries
}

data "aws_secretsmanager_secret_version" "rtg_secret_pdm_queries" {
  secret_id = data.aws_secretsmanager_secret.rtg_secret_pdm_queries.id
}

data "aws_secretsmanager_secret" "secret_for_ris_collections" {
  name = local.secret_name_for_ris_collections
}

data "aws_secretsmanager_secret_version" "secret_for_ris_collections" {
  secret_id = data.aws_secretsmanager_secret.secret_for_ris_collections.id
}

provider "aws" {
  region  = var.region

  default_tags {
    tags = {
      Application      = "DataWorks"                              # As per our definition on ServiceNow
      Function         = "Data and Analytics"                     # As per our definition on ServiceNow
      Environment      = local.hcs_environment[local.environment] # Set up locals as per Tagging doc requirements https://engineering.dwp.gov.uk/policies/hcs-cloud-hosting-policies/resource-identification-tagging/
      Business-Project = "PRJ0022507"                             # This seems to replace costcode as per the doc https://engineering.dwp.gov.uk/policies/hcs-cloud-hosting-policies/resource-identification-tagging/
    }
  }

  assume_role {
    role_arn = "arn:aws:iam::${lookup(local.account, local.environment)}:role/${var.assume_role}"
  }
}

provider "aws" {
  alias   = "management_dns"
  region  = var.region

  default_tags {
    tags = {
      Application      = "DataWorks"                              # As per our definition on ServiceNow
      Function         = "Data and Analytics"                     # As per our definition on ServiceNow
      Environment      = local.hcs_environment[local.environment] # Set up locals as per Tagging doc requirements https://engineering.dwp.gov.uk/policies/hcs-cloud-hosting-policies/resource-identification-tagging/
      Business-Project = "PRJ0022507"                             # This seems to replace costcode as per the doc https://engineering.dwp.gov.uk/policies/hcs-cloud-hosting-policies/resource-identification-tagging/
    }
  }

  assume_role {
    role_arn = "arn:aws:iam::${local.account[local.management_account[local.environment]]}:role/${var.assume_role}"
  }
}