upgrades terraform to v0.12

terraform/.terraform-version

@@ -1 +1 @@
-0.11.8
+v0.12.12

terraform/data.tf

@@ -29,3 +29,29 @@ data "aws_iam_policy_document" "lambda_apigw_assume_role" {
     }
   }
 }
+
+data "aws_iam_policy_document" "email-bucket" {
+  version = "2012-10-17"
+  statement {
+    sid     = "AllowSESPuts"
+    actions = ["s3:PutObject"]
+    principals {
+      type        = "Service"
+      identifiers = ["ses.amazonaws.com"]
+    }
+
+    resources = [
+      "arn:aws:s3:::speakforme-emails/*"
+    ]
+
+    // TODO: Hoping the value is an accountID and can be referred to using
+    // local variable
+    condition {
+      test     = "StringEquals"
+      variable = "aws:Referer"
+      values = [
+        "531324969672"
+      ]
+    }
+  }
+}

terraform/dns.tf

@@ -1,144 +1,132 @@
-resource "aws_route53_zone" "speakforme-in" {
-  name = "speakforme.in"
+resource "aws_route53_zone" "campaign-domain" {
+  name = "${var.campaign-domain}"
 
-  tags {
-    Environment = "production"
+  tags = {
+    Environment = "${var.campaign-env}"
     terraform   = true
   }
 }
 
 resource "aws_route53_record" "campaign-a" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
-  name    = "campaign.speakforme.in"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
+  name    = "${var.campaign-a-domain}"
   type    = "A"
   ttl     = "300"
-  records = ["34.199.252.2"]
-}
-
-locals {
-  postal-server-ip = "18.211.250.184"
+  records = "${var.campaign-a-ip}"
 }
 
 resource "aws_route53_record" "postal-mx-a" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "mx.postal"
   type    = "A"
   ttl     = "300"
-  records = ["${local.postal-server-ip}"]
+  records = "${var.postal-server-ip}"
 }
 
 resource "aws_route53_record" "postal-a" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "postal"
   type    = "A"
   ttl     = "300"
-  records = ["${local.postal-server-ip}"]
+  records = "${var.postal-server-ip}"
 }
 
 resource "aws_route53_record" "postal-rp-a" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "rp.postal"
   type    = "A"
   ttl     = "300"
-  records = ["${local.postal-server-ip}"]
+  records = "${var.postal-server-ip}"
 }
 
 resource "aws_route53_record" "postal-sf-a" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "sf.postal"
   type    = "A"
   ttl     = "300"
-  records = ["${local.postal-server-ip}"]
+  records = "${var.postal-server-ip}"
 }
 
 resource "aws_route53_record" "storage-a" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "storage"
   type    = "A"
   ttl     = "300"
-  records = ["35.153.240.239"]
+  records = "${var.storage-a-ip}"
 }
 
 resource "aws_route53_record" "speakforme-a" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "speakforme.in"
   type    = "A"
   ttl     = "300"
-  records = ["104.198.14.52"]
+  records = "${var.speakforme-a-ip}"
 }
 
 // CNAME Records
 
 resource "aws_route53_record" "beta-cname" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "beta"
   type    = "CNAME"
   ttl     = "1800"
-  records = ["speakforme.github.io."]
+  records = "${var.beta-cname}"
 }
 
 resource "aws_route53_record" "netlify-cname" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "netlify"
   type    = "CNAME"
   ttl     = "1800"
-  records = ["speakforme.netlify.com."]
+  records = "${var.netlify-cname}"
 }
 
 resource "aws_route53_record" "psrp-email-cname" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "psrp.email"
   type    = "CNAME"
   ttl     = "1800"
-  records = ["rp.postal.speakforme.in."]
+  records = "${var.psrp-email-cname}"
 }
 
 resource "aws_route53_record" "psrp-cname" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "psrp"
   type    = "CNAME"
   ttl     = "1800"
-  records = ["rp.postal.speakforme.in."]
+  records = "${var.psrp-cname}"
 }
 
 resource "aws_route53_record" "www" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
   name    = "www"
   type    = "CNAME"
   ttl     = "1800"
-  records = ["speakforme.netlify.com."]
+  records = "${var.www-cname}"
 }
 
 // MX Records
 resource "aws_route53_record" "email-mx" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
-  name    = "email"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
+  name    = "${var.email-mx-name}"
   type    = "MX"
   ttl     = "60"
-
-  records = [
-    "10 inbound-smtp.eu-west-1.amazonaws.com.",
-  ]
+  records = "${var.email-mx-record}"
 }
 
 resource "aws_route53_record" "routes-mx" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
-  name    = "routes"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
+  name    = "${var.routes-mx-name}"
   type    = "MX"
   ttl     = "1800"
-
-  records = [
-    "10 mx.postal.speakforme.in.",
-  ]
+  records = "${var.routes-mx-record}"
 }
 
+
 resource "aws_route53_record" "speakforme-mx" {
-  zone_id = "${aws_route53_zone.speakforme-in.id}"
-  name    = "speakforme.in"
+  zone_id = "${aws_route53_zone.campaign-domain.id}"
+  name    = "${var.speakforme-mx-name}"
   type    = "MX"
   ttl     = "1800"
-
-  records = [
-    "10 mx.postal.speakforme.in.",
-  ]
+  records = "${var.speakforme-mx-record}"
 }

terraform/dynamodb.tf

@@ -12,7 +12,7 @@ resource "aws_dynamodb_table" "email-counters" {
     type = "S"
   }
 
-  tags {
+  tags = {
     Name      = "email-counters"
     terraform = "true"
   }
@@ -48,7 +48,7 @@ resource "aws_dynamodb_table" "email-subscriptions" {
     projection_type = "KEYS_ONLY"
   }
 
-  tags {
+  tags = {
     Name      = "email-subscriptions"
     terraform = "true"
   }

terraform/lambda.tf

@@ -13,7 +13,7 @@ resource "aws_lambda_function" "store-and-ack" {
 
   // Finishes in under 2seconds usually
   timeout          = 5
-  source_code_hash = "${base64sha256(file(data.archive_file.email-receipt-lambda.output_path))}"
+  source_code_hash = "${filebase64sha256(data.archive_file.email-receipt-lambda.output_path)}"
 }
 
 data "archive_file" "unsubscribe-lambda" {
@@ -28,5 +28,5 @@ resource "aws_lambda_function" "unsubscribe" {
   role             = "${aws_iam_role.unsubscribe-lambda.arn}"
   handler          = "index.handler"
   runtime          = "nodejs8.10"
-  source_code_hash = "${base64sha256(file(data.archive_file.unsubscribe-lambda.output_path))}"
+  source_code_hash = "${filebase64sha256(data.archive_file.unsubscribe-lambda.output_path)}"
 }

terraform/provider.tf

@@ -1,18 +1,18 @@
 provider "aws" {
   region  = "eu-west-1"
-  version = "~> 1.37"
+  version = "~> 2.43.0"
   profile = "speakforme"
 }
 
 provider "aws" {
   alias   = "mumbai"
   region  = "ap-south-1"
-  version = "~> 1.37"
+  version = "~> 2.43.0"
   profile = "speakforme"
 }
 
 terraform {
-  version = "~> 0.11.8"
+  required_version = "~> v0.12.12"
 
   backend "s3" {
     bucket  = "speakforme-infrastructure"

terraform/s3.tf

@@ -1,13 +1,13 @@
 // This bucket is in ap-south-1
 resource "aws_s3_bucket" "infrastructure" {
-  bucket   = "speakforme-infrastructure"
+  bucket   = "${var.infrastructure-bucket}"
   provider = "aws.mumbai"
 
   acl = "private"
 
-  tags {
-    Name        = "speakforme-infrastructure"
-    environment = "production"
+  tags = {
+    Name        = "${var.infrastructure-bucket}"
+    environment = "${var.campaign-env}"
     terraform   = true
   }
 
@@ -26,7 +26,7 @@ resource "aws_s3_bucket" "infrastructure" {
 
 // This bucket is in eu-west-1
 resource "aws_s3_bucket" "emails" {
-  bucket = "speakforme-emails"
+  bucket = "${var.email-bucket}"
 
   acl = "private"
 
@@ -44,31 +44,9 @@ resource "aws_s3_bucket" "emails" {
     }
   }
 
-  policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "AllowSESPuts",
-            "Effect": "Allow",
-            "Principal": {
-                "Service": "ses.amazonaws.com"
-            },
-            "Action": "s3:PutObject",
-            "Resource": "arn:aws:s3:::speakforme-emails/*",
-            "Condition": {
-                "StringEquals": {
-                    "aws:Referer": "531324969672"
-                }
-            }
-        }
-    ]
-}
-EOF
-
-  tags {
-    Name        = "speakforme-emails"
-    environment = "production"
+  tags = {
+    Name        = "${var.email-bucket}"
+    environment = "${var.campaign-env}"
     terraform   = true
   }
 
@@ -84,3 +62,8 @@ EOF
     prevent_destroy = true
   }
 }
+
+resource "aws_s3_bucket_policy" "email-bucket" {
+  bucket = "${aws_s3_bucket.emails.id}"
+  policy = "${data.aws_iam_policy_document.email-bucket.json}"
+}

terraform/ses.tf

@@ -10,18 +10,18 @@ resource "aws_ses_receipt_rule" "store-and-acknowledge" {
   // Emails must be bcc'd to this email address
   recipients = [
     // This supports bcc+(campaign-target-code) as well
-    "bcc@email.speakforme.in",
+    "bcc@${var.email-mx-name}.${var.campaign-domain}",
 
     // This is just so that we can verify this in SES as a sending email address
-    "info@email.speakforme.in",
+    "info@${var.email-mx-name}.${var.campaign-domain}",
   ]
 
   // We don't need no AV scans
   scan_enabled = false
 
   // Store Then Process
   s3_action {
-    bucket_name = "speakforme-emails"
+    bucket_name = "${var.email-bucket}"
     position    = 1
   }