Terraform Multi-Account, Env & User AWS Template

Photo by Daniel Eledut on Unsplash

The goal of this template is to create universal modules that can be used multiple times for the AWS Infrastructure with multiple environments. In addition, the Terraform state and lock is managed centrally for each environment using the remote backend (S3-Bucket and DynamoDB). This ensures parallel work on the Infrastructure.

Disclaimer

This template was created in collaboration with Jan Degen and with the help of publicly accessible platforms such a terraform.io and stackoverflow.

Prerequisites

1. Pull template from GitHub.
2. Create AWS-IAM-Roles in each of environment which have deployment privileges to deploy in their respective accounts. These roles must have account’s AWS ID as their trusted entity.

• arn:aws:iam::x:role/Terraform

You should have at least two AWS accounts/profiles

Initial Setup

Please note, that the initial setup should only be done the first time the structure is being setup on the AWS account. Once this setup has been completed, it is not necessary to repeat the initial setup.

After you have setup the backend, you can start with the creation and deployments of the infrastructure.

Setup AWS

Setup all AWS profiles in .aws/config and .aws/credentials

Init Provider For Remote Backend

Go to /terraform-aws-template/terraform/remote-backend/provider.tf and add following attributes:

Init Remote Backend

run following commands:

cd /terraform-aws-template/terraform/remote-backend
terraform init
terraform apply

Copy the output generated as part of terraform apply into a file named backend-config.hcl and save it in /terraform-aws-template/terraform/infrastructure. This file will act as backend configuration for rest of your infrastructure.

Add profile name from .aws/credentials for you account in backend-config.hcl

Init Remote Backend Config and Environments

run following commands:

cd /terraform-aws-template/terraform/infrastructure
terraform init -backend-config=backend-config.hcl
terraform workspace new <env-name>

Init Environment Variables

go to /terraform-aws-template/terraform/infrastructure/env_vars and add to <env-name>.tfvars all project and environments required variables.

Deployment

The process for deploying infrastructure for all accounts is the same:

cd /terraform-aws-template/terraform/infrastructure
terraform workspace select <env-name>
terraform plan -var-file="env_vars/<env-name>.tfvars
terraform apply -var-file="env_vars/<env-name>.tfvars

Development

1. Infrastructure /terraform-aws-template/terraform/infrastructure/

• there you can initialize the source of module and provide required variables

2. Modules terraform-aws-template/modules/

• there you can define module resource creation

Module 00_generic

This module contains AWS Services that are required repeatedly when creating other modules. Like IAM-Roles, Policies, Bucket, …

Random.tf Class

With the help of random.tf, a four-digit alphanumeric string is generated for the unique identifier of the AWS Services that created via Terraform.

Summary

• create modules withing the modules directory
• separate creation of components
• call the module within the infrastructure directory
• add environments variables to tfvars-file located in env_vars
• manage AWS infrastructure by multiple users through remote backend
• manage multiple environments through environments variables and workspace

Try it out, explore it and have fun.