This repository contains rather complete infrastructure configurations where Terragrunt is used to manage infrastructure for Acme Corporation.

This code is very close to the one produced by modules.tf - open-source infrastructure as code generator from visual diagrams created with Cloudcraft.co.

Acme has several environments (prod, staging and dev) entirely separated by AWS accounts.

Infrastructure in each environment consists of multiple layers (autoscaling, alb, vpc, ...) where each layer is configured using one of Terraform AWS modules with arguments specified in terraform.tfvars in layer's directory.

Terragrunt is used to work with Terraform configurations which allows to orchestrate dependent layers, update arguments dynamically and keep configurations DRY.

Primary AWS region for all environments is eu-central-1 (Frankfurt):

• acme-prod - Production configurations (AWS account - 111111111111)

• acme-staging - Staging configurations (AWS account - 444444444444)

• acme-master - Master AWS account (333333333333) contains:

  • AWS Organizations
  • IAM entities (users, groups)
  • ECR repositories
  • Route53 zones

• Terraform 0.11
• Terragrunt 0.18 or newer
• Terraform Docs
• pre-commit hooks to keep Terraform formatting and documentation up-to-date
• tfvars-annotations to process & update annotations in tfvars files
• direnv to automatically set correct environment variables per AWS account as specified in .envrc (optional)

If you are using Mac you can install all dependencies using Homebrew:

$ brew install terraform terraform-docs terragrunt pre-commit direnv
$ brew install https://raw.githubusercontent.com/antonbabenko/tfvars-annotations/master/HomebrewFormula/tfvars-annotations.rb

Acme has dedicated AWS account where IAM users, groups and roles are managed. This AWS account is used as a jump account, where IAM users are logged in and then they assume role in other AWS account.

AWS access credentials should be set using environment variables:

$ export AWS_DEFAULT_REGION=eu-central-1
$ export AWS_ACCESS_KEY_ID=...
$ export AWS_SECRET_ACCESS_KEY=...

aws-vault, vaulted or other tool can be used to manage your AWS credentials securely locally and switch roles.

Go to directory for the environment and region you want to work with:

$ cd acme-staging/eu-central-1

Initialize the dependencies (download providers and modules). This command is enough to run once:

$ terragrunt init

To create infrastructure in all layers in a single region:

$ terragrunt apply-all

Alternatively, you can create infrastructure in a single layer (eg, vpc):

$ cd vpc
$ terragrunt apply

See official Terragrunt documentation for all available commands and features.

This project is created and maintained by Anton Babenko.

This work is licensed under MIT License. See LICENSE for full details.

Copyright (c) 2019 Anton Babenko