Skip to content
Open

Dev #21

Show file tree
Hide file tree
Changes from 12 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 70 additions & 0 deletions Jenkinsfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
pipeline {
agent any
tools {
terraform 'terraform-latest' // Must match the name you set in Manage Jenkins -> Tools
}

parameters {
choice(name: 'ACTION', choices: ['apply', 'destroy'], description: 'Choose whether to apply or destroy the Terraform EKS module')
}

environment {
TF_DIR = 'eks-install'
AWS_DEFAULT_REGION = 'ap-south-1'

// This pulls the two "Secret text" credentials you already created in Jenkins
// using the exact IDs shown in your screenshot ('accesskey' and 'secretaccesskey')
AWS_ACCESS_KEY_ID = credentials('accesskey')
AWS_SECRET_ACCESS_KEY = credentials('secretaccesskey')
}

stages {
stage('Checkout Code') {
steps {
checkout scm
}
}

stage('Terraform Init') {
steps {
dir("${env.TF_DIR}") {
sh 'terraform init'
}
}
}

stage('Terraform Plan') {
steps {
dir("${env.TF_DIR}") {
sh "terraform plan ${params.ACTION == 'destroy' ? '-destroy' : ''} -out=tfplan"
}
}
}

stage('Manual Approval') {
steps {
input message: "Review plan for folder '${env.TF_DIR}'. Proceed with ${params.ACTION}?", ok: 'Proceed'
}
}

stage('Terraform Execute') {
steps {
dir("${env.TF_DIR}") {
script {
if (params.ACTION == 'apply') {
sh 'terraform apply -auto-approve tfplan'
} else if (params.ACTION == 'destroy') {
sh 'terraform apply -destroy -auto-approve'
}
}
}
}
}
}

post {
always {
cleanWs() // Cleans up workspace after execution
}
}
}
3 changes: 1 addition & 2 deletions eks-install/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,7 @@ terraform {
bucket = "demo-terraform-eks-state-s3-bucket"
key = "terraform.tfstate"
region = "us-west-2"
dynamodb_table = "terraform-eks-state-locks"
encrypt = true
use_lockfile = true

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n 'required_version|terraform init|use_lockfile|s3:(GetObject|PutObject|DeleteObject)' \
  eks-install Jenkinsfile

Repository: iam-veeramalla/ultimate-devops-project-aws

Length of output: 285


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '--- repository files around relevant paths ---\n'
git ls-files | rg '(^|/)Jenkinsfile$|(^|/)eks-install/main\.tf$|terraform|tflock|s3|bucket' || true

printf '\n--- eks-install/main.tf ---\n'
cat -n eks-install/main.tf

printf '\n--- Jenkinsfile relevant lines ---\n'
sed -n '1,120p' Jenkinsfile | cat -n

printf '\n--- Terraform backend occurrences ---\n'
rg -n 'terraform[^;]*(backend|state|lockfile|bucket|key|region|dynamodb|sse|access_key|secret_key|profile)|backend\(' -S .

Repository: iam-veeramalla/ultimate-devops-project-aws

Length of output: 271


🌐 Web query:

Terraform S3 backend use_lockfile flag documentation GetObject PutObject DeleteObject permissions .tflock

💡 Result:

When you enable native S3 state locking in the Terraform S3 backend by setting the use_lockfile argument to true, Terraform utilizes a lock file with a.tflock suffix (e.g., path/to/key.tflock) to manage concurrency [1][2][3]. Because Terraform must create, access, and subsequently delete this lock file to manage the locking lifecycle, you must grant specific IAM permissions for the.tflock object [2][3][4]. Required Permissions If use_lockfile is set to true, the following permissions are required specifically for the lock file resource [1][5][6]: s3:GetObject s3:PutObject s3:DeleteObject These permissions must be applied to the ARN corresponding to the lock file, such as arn:aws:s3:::mybucket/path/to/my/key.tflock [1][6]. Key Distinction It is important to note that the state file itself (the.tfstate file) does not require the s3:DeleteObject permission, as Terraform does not delete the state file during standard operations [2][6][4]. The s3:DeleteObject permission is strictly required for the.tflock file because Terraform actively deletes it to release the lock once an operation completes [2][3][4]. Failure to include s3:DeleteObject for the lock file will result in errors when Terraform attempts to release the lock [2][4][7].

Citations:


Pin and validate the Terraform locking contract.

use_lockfile requires a Terraform CLI that supports the S3 use_lockfile argument, but Jenkinsfile invokes an unpinned terraform init and this module has no Terraform version constraint. Also ensure the Jenkins credentials can access terraform.tfstate.tflock with s3:GetObject, s3:PutObject, and s3:DeleteObject; S3 locking depends on those lockfile operations.

Add a compatible required_version constraint and validate the Jenkins agent/iam policy before relying on this lock.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@eks-install/main.tf` at line 13, Add a compatible Terraform required_version
constraint in the module containing use_lockfile, and pin the Jenkins Terraform
CLI to a version satisfying that constraint before running terraform init.
Update or validate the Jenkins AWS credentials policy to grant s3:GetObject,
s3:PutObject, and s3:DeleteObject for terraform.tfstate.tflock, preserving the
existing state permissions.

}
}

Expand Down
8 changes: 4 additions & 4 deletions eks-install/variables.tf
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
variable "region" {
description = "AWS region"
type = string
default = "us-west-2"
default = "ap-south-1"
}

variable "vpc_cidr" {
Expand All @@ -13,7 +13,7 @@ variable "vpc_cidr" {
variable "availability_zones" {
description = "Availability zones"
type = list(string)
default = ["us-west-2a", "us-west-2b", "us-west-2c"]
default = ["ap-south-1a", "ap-south-1b", "ap-south-1c"]
}

variable "private_subnet_cidrs" {
Expand Down Expand Up @@ -53,10 +53,10 @@ variable "node_groups" {
}))
default = {
general = {
instance_types = ["t3.medium"]
instance_types = ["c7i-flex.large"]
capacity_type = "ON_DEMAND"
scaling_config = {
desired_size = 2
desired_size = 1
max_size = 4
min_size = 1
}
Expand Down