Github Actions — Terraform — CI/CD Multiple Accounts AWS

name: Terraform - Multiple AWS Accounts on: workflow_dispatch: inputs: action: description: 'Action to perform (apply or destroy)' required: true default: 'apply' aws_account: description: 'AWS Account to deploy to (shared, network, production, stage, develop)' required: true terraform_version: description: 'Version of Terraform to use' required: true default: '1.8.0' jobs: plan: runs-on: ubuntu-latest permissions: actions: read issues: write id-token: write # This is required for requesting the JWT contents: write # This is required for actions/checkout timeout-minutes: 5 steps: - name: Checkout Code uses: actions/checkout@v2 - name: Configure AWS Credentials if: ${{ github.event.inputs.aws_account == 'network' }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN_NETWORK }} aws-region: us-east-1 - name: Configure AWS Credentials if: ${{ github.event.inputs.aws_account == 'prod' }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN_PROD }} aws-region: us-east-1 - name: Configure AWS Credentials if: ${{ github.event.inputs.aws_account == 'stage' }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN_STAGE }} aws-region: us-east-1 - name: Configure AWS Credentials if: ${{ github.event.inputs.aws_account == 'develop' }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: arn:aws:iam::000000000:role/TESTE-GITHUB-ACTIONS aws-region: us-east-1 aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - name: Install TFLint run: | curl -L https://github.com/terraform-linters/tflint/releases/latest/download/tflint_linux_amd64.zip -o tflint.zip unzip tflint.zip sudo mv tflint /usr/local/bin/ rm tflint.zip - name: Lint Terraform files run: tflint - name: Setup Terraform uses: hashicorp/setup-terraform@v3 with: terraform_version: ${{ github.event.inputs.terraform_version }} env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: us-east-1 - name: Initialize Terraform run: terraform init -reconfigure - name: Plan Terraform changes run: terraform plan -out=tfplan - name: Cache Terraform files uses: actions/cache@v2 with: path: | .terraform .terraform.lock.hcl key: ${{ runner.os }}-terraform-${{ hashFiles('**/*.tf') }} - name: Upload Terraform plan uses: actions/upload-artifact@v2 with: name: tfplan path: tfplan approval: needs: plan runs-on: ubuntu-latest permissions: actions: read issues: write id-token: write # This is required for requesting the JWT contents: write # This is required for actions/checkout steps: - name: Request Manual Approval uses: trstringer/manual-approval@v1 with: secret: ${{ secrets.GITHUB_TOKEN }} approvers: alerabello minimum-approvals: 1 additional-approved-words: 'Approve, Approved, approve, approved' timeout-minutes: 10 deploy: needs: approval runs-on: ubuntu-latest permissions: id-token: write # This is required for requesting the JWT contents: write # This is required for actions/checkout timeout-minutes: 20 steps: - name: Checkout Code uses: actions/checkout@v2 - name: Configure AWS Credentials if: ${{ github.event.inputs.aws_account == 'network' }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN_NETWORK }} aws-region: us-east-1 - name: Configure AWS Credentials if: ${{ github.event.inputs.aws_account == 'prod' }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN_PROD }} aws-region: us-east-1 - name: Configure AWS Credentials if: ${{ github.event.inputs.aws_account == 'stage' }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN_STAGE }} aws-region: us-east-1 - name: Configure AWS Credentials if: ${{ github.event.inputs.aws_account == 'develop' }} uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: arn:aws:iam::000000000:role/TESTE-GITHUB-ACTIONS aws-region: us-east-1 aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - name: Setup Terraform uses: hashicorp/setup-terraform@v3 with: terraform_version: ${{ github.event.inputs.terraform_version }} - name: Download repository artifact uses: actions/download-artifact@v2 with: name: tfplan path: ./tfplan - name: Move Terraform plan run: mv ./tfplan/tfplan ./tfplan.tfplan - name: Initialize Terraform run: terraform init -reconfigure - name: Apply or Destroy Terraform run: | if [ "${{ github.event.inputs.action }}" == "apply" ]; then terraform apply -auto-approve ./tfplan.tfplan elif [ "${{ github.event.inputs.action }}" == "destroy" ]; then terraform destroy -auto-approve else echo "Invalid action specified: ${{ github.event.inputs.action }}" exit 1 fi