BAU: Ensure Proxy resources only deployed in dev

Author: whi-tw

ci/terraform/account-management/mm-api-dev-access.tf

@@ -140,7 +140,14 @@ resource "aws_instance" "developer_proxy" {
   iam_instance_profile = aws_iam_instance_profile.developer_proxy_profile[count.index].name
 
   user_data_replace_on_change = true
-  user_data                   = <<-EOT
+
+  # TL;DR of user data:
+  # - Update and upgrade packages
+  # - Install nginx
+  # - Write nginx proxy config to /etc/nginx/conf.d/api-proxy.conf
+  # - Remove `ssm-user` user's sudo access
+  # - Enable and start nginx
+  user_data = <<-EOT
     #cloud-config
     package_update: true
     package_upgrade: true
@@ -208,6 +215,9 @@ resource "aws_instance" "developer_proxy" {
 }
 
 locals {
+  # ssm, ssmmessages, ec2messages, logs are required for SSM session manager
+  # execute-api is required for nginx to connect to the API Gateway
+  # s3 is required for `dnf` to access the package repositories
   required_vpc_interface_endpoints = local.is_dev ? ["ssm", "ssmmessages", "ec2messages", "execute-api", "logs"] : []
   required_vpc_gateway_endpoints   = local.is_dev ? ["s3"] : []
 }

ci/terraform/modules/is-this-the-primary-environment/README.md

@@ -38,5 +38,6 @@ which could lead to inconsistencies.
 | Name | Description |
 |------|-------------|
 | <a name="output_is_primary_environment"></a> [is\_primary\_environment](#output\_is\_primary\_environment) | true if this environment is the primary environment in this account:region else false |
+| <a name="output_is_primary_environment_with_coresident_dev"></a> [is\_primary\_environment\_with\_coresident\_dev](#output\_is\_primary\_environment\_with\_coresident\_dev) | true if this environment is a primary environment with a coresident dev environment in this account:region else false |
 <!-- END_TF_DOCS -->
 <!-- prettier-ignore-end -->

ci/terraform/modules/is-this-the-primary-environment/main.tf

@@ -22,10 +22,17 @@ variable "environment" {
 }
 
 locals {
-  primary_environment_names = ["production", "staging", "dev", "build"]
+  primary_environment_with_coresident_dev_names = ["dev", "build"]
+  primary_environment_names                     = concat(local.primary_environment_with_coresident_dev_names, ["production", "staging"])
 }
 
 output "is_primary_environment" {
   value       = contains(local.primary_environment_names, var.environment)
   description = "true if this environment is the primary environment in this account:region else false"
 }
+
+output "is_primary_environment_with_coresident_dev" {
+  # This is true if the environment is a primary environment and there is a dev environment in this account:region
+  value       = contains(local.primary_environment_with_coresident_dev_names, var.environment) ? true : false
+  description = "true if this environment is a primary environment with a coresident dev environment in this account:region else false"
+}

ci/terraform/shared/session-manager.tf

@@ -1,5 +1,5 @@
 locals {
-  session_manager_resource_count = module.primary_environment.is_primary_environment ? 1 : 0
+  session_manager_resource_count = module.primary_environment.is_primary_environment_with_coresident_dev ? 1 : 0
 }
 data "aws_iam_policy_document" "ssm_kms_access" {
   count = local.session_manager_resource_count