Terraform Cloud Private Modules Registry

Code which manages configuration and life-cycle of all the Terraform Cloud module in the private registry. It is designed to be used from a dedicated VCS-Driven Terraform Cloud workspace that would provision and manage the configuration using Terraform code (IaC).

Permissions

To manage the module in the private registry from that code, provide a token from an account with manage modules access. Alternatively, you can use a token from a team with that access instead of a user token.

To manage the GitHub resources, provide a token from an account or a GitHub App with appropriate permissions. It should have:

• Read access to metadata
• Read and write access to administration, members and code

To read secrets from Hashicorp Vault Secrets, provide a client ID and a key from a service principals with the secret reader role.

Authentication

Terraform Cloud

The Terraform Cloud provider requires a Terraform Cloud/Enterprise API token in order to manage resources.

• Set the TFE_TOKEN environment variable: The provider can read the TFE_TOKEN environment variable and the token stored there to authenticate. Refer to Managing Variables documentation for more details.

GitHub

The GitHub provider requires a GitHub App installation in order to manage resources.

• Set the GITHUB_APP_ID, GITHUB_APP_INSTALLATION_ID, GITHUB_APP_PEM_FILE, and GITHUB_OWNER environment variables. The provider can read the GITHUB_APP_ID, GITHUB_APP_INSTALLATION_ID, GITHUB_APP_PEM_FILE, and GITHUB_OWNER environment variables to authenticate.

Because strings with new lines is not support:
use "\\n" within the pem_file argument to replace new line
use "\n" within the GITHUB_APP_PEM_FILE environment variables to replace new line

Hashicorp Vault Secrets Authentication

The Hashicorp Vault Secrets provider requires a service principal client ID and a key in order to manage resources.

• Set the HCP_CLIENT_ID environment variable: The provider can read the HCP_CLIENT_ID environment variable and the client ID stored there to authenticate. Refer to Managing Variables documentation for more details.

• Set the HCP_CLIENT_SECRET environment variable: The provider can read the HCP_CLIENT_SECRET environment variable and the client ID stored there to authenticate. Refer to Managing Variables documentation for more details.

Features

• Manages configuration and life-cycle of GitHub resources:
  • Repository
  • Branch protection
  • Teams
  • Secret
• Manages configuration and life-cycle of Terraform Cloud resources:
  • Private module registry
  • Private module registry test environment variable

Documentation

Requirements

The following requirements are needed by this module:

• terraform (> 1.6.0)

• github (~>5.44)

• hcp (~>0.76)

• tfe (~>0.51)

Modules

No modules.

Required Inputs

The following input variables are required:

module_names

Description: (Required) A list of module names to published.

Type: list(string)

oauth_client_name

Description: (Required) The name of the OAuth client.

Type: string

organization_name

Description: (Required) The name of the Terraform Cloud organization.

Type: string

tfc_api_token

Description: (Required) The tfc_api_token is a block with the following:
secret_app : (Optional) The name of the Hashicorp Vault Secrets application where the secret can be found in and can only be used if value is not used.
secret_name : (Optional) The Hashicorp Vault Secrets secret name where the TFC_API_TOKEN with permission to managed modules can be found in and can only be used if value is not used.
value : (Optional) The TFC_API_TOKEN with permission to managed modules and can only be used if secret_app and secret_name are not used.

Type:

object({
    secret_app  = optional(string, null)
    secret_name = optional(string, null)
    value       = optional(string, null)
  })

Optional Inputs

The following input variables are optional (have default values):

github_enviromnent_variables

Description: (Optional) The github_enviromnent_variables is a list of object block with the following:
name : (Required) The environment variable name required to authenticate with GitHub API.
secret_app : (Optional) The name of the Hashicorp Vault Secrets application where the secret can be found in and can only be used if value is not used.
secret_name : (Optional) The Hashicorp Vault Secrets secret name where the environment variable can be found in and can only be used if value is not used.
value : (Optional) The environment variable value required to authenticate with GitHub API and can only be used if secret_app and secret_name are not used.

Type:

list(object({
    name        = string
    secret_app  = optional(string, null)
    secret_name = optional(string, null)
    value       = optional(string, null)
  }))

Default: null

teams

Description: (Optional) The teams is a list of object block with the following:
name : (Required) The name of the team which will have access to every Terraform module.
create : (Optional) Whether to create the team.
description : (Optional) A description of the team.
permission : (Optional) The permissions of team members regarding the repository. Valid values are pull, triage, push, maintain, admin.

Type:

list(object({
    name        = string
    create      = optional(bool, false)
    description = optional(string, null)
    permission  = optional(string, "pull")
  }))

Default: null

Resources

The following resources are used by this module:

• github_actions_secret.tfc_api_token (resource)
• github_branch_protection.this (resource)
• github_repository.this (resource)
• github_team.this (resource)
• github_team_repository.this (resource)
• terraform_data.github_module_variables (resource)
• tfe_registry_module.this (resource)
• github_team.this (data source)
• hcp_vault_secrets_secret.github_module_variables (data source)
• hcp_vault_secrets_secret.tfc_api_token (data source)
• tfe_oauth_client.client (data source)

Outputs

The following outputs are exported:

full_name

Description: A string of the form "orgname/reponame".

git_clone_url

Description: URL that can be provided to git clone to clone the repository anonymously via the git protocol.

html_url

Description: URL to the repository on the web.

http_clone_url

Description: URL that can be provided to git clone to clone the repository via HTTPS.

node_id

Description: GraphQL global node id for use with v4 API.

primary_language

Description: The primary language used in the repository.

repo_id

Description: GitHub ID for the repository.

repository

Description: Repositories within your GitHub organization.

ssh_clone_url

Description: URL that can be provided to git clone to clone the repository via SSH.

svn_url

Description: URL that can be provided to svn checkout to check out the repository via GitHub's Subversion protocol emulation.

---

This GitHub repository is manage through Terraform Code from TerraformCloud-Foundation repository.