You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/2.0/docs/library/concepts/modules.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,13 +10,13 @@ Let’s look at an example module. The [rds module](/reference/modules/terraform
10
10
11
11
The module deploys a key element of an overall RDS deployment, but it's not a _complete_ RDS deployment. That's because the `rds` module does not include backup policies using AWS Backup (for disaster recovery), or RDS Proxy (to pool database connections), or CloudWatch alarms (to alert you when something goes wrong). These missing pieces are best thought of as building block modules themselves. Gruntwork has modules for `backup-plan`, `backup-vault`, and `rds-proxy` that can all be used in combination with the `rds` module.
12
12
13
-
To see how Gruntwork gives you an off-the-shelf overall deployment with all the elements included, see [Service Modules](./service-modules).
13
+
To see how Gruntwork gives you an off-the-shelf overall deployment with all the elements included, see [Service Modules](/2.0/docs/library/concepts/service-modules).
14
14
15
15
## Modules are optimized for control
16
16
17
17
A module is designed to be small, narrow in scope, and highly reusable, like a building block. Modules give you _control_, but they may not give you _convenience_. You can use the building block modules for all kinds of use cases (high control), but if you want to deploy a complete piece of infrastructure, you still have to do the work of assembling the right modules (low convenience).
18
18
19
-
To learn how you can optimize for convenience, see [Service Modules](./service-modules).
19
+
To learn how you can optimize for convenience, see [Service Modules](/2.0/docs/library/concepts/service-modules).
20
20
21
21
To learn more about the overall thought process behind building block modules versus service modules, see [Introducing: The Gruntwork Module, Service, and Architecture Catalogs](https://blog.gruntwork.io/introducing-the-gruntwork-module-service-and-architecture-catalogs-eb3a21b99f70).
22
22
@@ -26,7 +26,7 @@ Building block modules are fairly generic by design, so you won't typically depl
26
26
27
27
For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster.
28
28
29
-
We recommend our [Service Catalog](./service-modules) for common use cases, but our full module catalog is available if you have a more complex use case.
29
+
We recommend our [Service Catalog](/2.0/docs/library/concepts/service-modules) for common use cases, but our full module catalog is available if you have a more complex use case.
Copy file name to clipboardExpand all lines: docs/2.0/docs/library/concepts/overview.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,11 +14,11 @@ Gruntwork IaC Library contains two types of modules:
14
14
15
15
"Building block" modules (which we call simply **modules**) are "infrastructure building blocks" authored by Gruntwork and written in OpenTofu configuration files. They capture a singular best-practice pattern for specific pieces of infrastructure and are designed to be both limited in scope and highly reusable. They typically represent one part of a use case you want to accomplish. For example, the `vpc-flow-logs` module does not create a VPC, it only adds the VPC Flow Logs functionality to an existing VPC.
16
16
17
-
To learn more, refer to [Modules](./modules)
17
+
To learn more, refer to [Modules](/2.0/docs/library/concepts/modules)
18
18
19
19
### Service modules
20
20
21
21
**Service modules** are opinionated combinations of "building block" modules described above. They are designed to be used "off the shelf" with no need to assemble a collection of “building block” modules on your own. They typically represent a full use case to solve a business problem on their own. For example, the `vpc` service module deploys a VPC, VPC Flow Logs, and Network ACLs. If you agree with the opinions embedded in a service module, they’re the fastest way to deploy production-grade infrastructure.
22
22
23
-
To learn more, refer to [Service Modules](./service-modules)
23
+
To learn more, refer to [Service Modules](/2.0/docs/library/concepts/service-modules)
Copy file name to clipboardExpand all lines: docs/2.0/docs/library/concepts/service-modules.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
# Service Modules
2
2
3
-
Service modules are combinations of [modules](./modules) covering a wide variety of use cases, including CI/CD, networking, container orchestration (EKS, ECS), and more.
3
+
Service modules are combinations of [modules](/2.0/docs/library/concepts/modules) covering a wide variety of use cases, including CI/CD, networking, container orchestration (EKS, ECS), and more.
4
4
5
5
Service modules are usually written in Terraform, represent a full use case, and are designed to be used "off the shelf."
6
6
@@ -16,15 +16,15 @@ Whereas "building block" modules are optimized for control, service modules are
16
16
17
17
A service module reflects a complete Gruntwork opinion on how you should run a piece of infrastructure. Using a service module gives you the convenience of a single Terraform module that does everything you need, with Gruntwork maintaining the code.
18
18
19
-
If you do not agree with our opinions, you can either [customize the module](/2.0/docs/library/tutorials/customizing-modules), or sacrifice convenience in favor of control and build your own module, possibly out of our [building block modules](./modules).
19
+
If you do not agree with our opinions, you can either [customize the module](/2.0/docs/library/tutorials/customizing-modules), or sacrifice convenience in favor of control and build your own module, possibly out of our [building block modules](/2.0/docs/library/concepts/modules).
20
20
21
21
## When to use a service module
22
22
23
23
Using a service module can save you time because Gruntwork has already pieced together individual building block modules and tested that they correctly reference each other.
24
24
25
25
For example, the [eks-cluster service module](/reference/services/app-orchestration/amazon-eks) combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on.
26
26
27
-
If you need more flexibility than our services provide, then you can combine modules from our [module catalog](./modules#where-to-find-the-building-block-modules), your own modules, or open source modules to meet your specific use case.
27
+
If you need more flexibility than our services provide, then you can combine modules from our [module catalog](/2.0/docs/library/concepts/modules#where-to-find-the-building-block-modules), your own modules, or open source modules to meet your specific use case.
28
28
29
29
CIS customers also have access to the [terraform-aws-cis-service-catalog git repo](https://github.com/gruntwork-io/terraform-aws-service-catalog) to help ensure conformity to the [CIS AWS Foundations Benchmark](https://gruntwork.io/achieve-compliance/).
30
30
@@ -40,4 +40,4 @@ To browse the service catalog, see the [Library Reference](/library/reference) a
40
40
41
41
## How service modules are updated
42
42
43
-
When [building block modules are updated](./modules#how-modules-are-updated), we propagate those updates to the service catalog. Keep in mind that there is sometimes a delay between when a "building block" module is updated and when that update is reflected in the service catalog.
43
+
When [building block modules are updated](/2.0/docs/library/concepts/modules#how-modules-are-updated), we propagate those updates to the service catalog. Keep in mind that there is sometimes a delay between when a "building block" module is updated and when that update is reflected in the service catalog.
Copy file name to clipboardExpand all lines: docs/2.0/docs/library/guides/versioning.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -119,4 +119,4 @@ inputs = {
119
119
</TabItem>
120
120
</Tabs>
121
121
122
-
Once you start using versioned modules, it’s important to keep the modules up to date. Refer to the [Updating Modules](./updating-modules) guide to learn more.
122
+
Once you start using versioned modules, it’s important to keep the modules up to date. Refer to the [Updating Modules](/2.0/docs/library/guides/updating-modules) guide to learn more.
Copy file name to clipboardExpand all lines: docs/2.0/docs/overview/concepts/devopsfoundations.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ When you set up a new DevOps component, you also have access to guidance from Gr
16
16
17
17
There are several DevOps components available today:
18
18
19
-
*[Infrastructure-Live](./infrastructure-live.md): An opinionated structure for IaC repositories that includes a set of best practices for how to structure your OpenTofu code to keep things DRY at enterprise scale.
19
+
*[Infrastructure-Live](/2.0/docs/overview/concepts/infrastructure-live.md): An opinionated structure for IaC repositories that includes a set of best practices for how to structure your OpenTofu code to keep things DRY at enterprise scale.
20
20
*[Pipelines](/2.0/docs/pipelines/concepts/overview.md): A complete CI/CD pipeline for infrastructure code, a set of best practices for how to structure your OpenTofu code, and a set of scripts for managing the pipeline.
21
21
*[Account Factory](/2.0/docs/accountfactory/concepts/): A set of automated workflows to provision new AWS accounts and apply compliance, security and infrastructure baselines to enforce business rules across many accounts.
22
22
*[Patcher](/2.0/docs/patcher/concepts/): Identify out of date modules across your repositories and create pull requests that both updates versions and automatically refactors code to get through breaking changes without developer intervention.
Copy file name to clipboardExpand all lines: docs/2.0/docs/overview/getting-started/link-github-id.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,7 @@ Once you’ve linked your account, the notice on the home page will disappear an
26
26
27
27
## Next Steps
28
28
29
-
Now that you've completed setting up your Gruntwork account, return to the [DevOps Foundations Getting Started Checklist](./index.md) to continue setting up your DevOps Foundations.
29
+
Now that you've completed setting up your Gruntwork account, return to the [DevOps Foundations Getting Started Checklist](/2.0/docs/overview/getting-started/index.md) to continue setting up your DevOps Foundations.
Copy file name to clipboardExpand all lines: docs/2.0/docs/pipelines/architecture/audit-logs.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
# Audit logs
2
2
3
-
Gruntwork Pipelines provides an audit log of which GitHub user performed _what_ operation in your AWS accounts as a result of a [Pipelines Action](./actions.md).
3
+
Gruntwork Pipelines provides an audit log of which GitHub user performed _what_ operation in your AWS accounts as a result of a [Pipelines Action](/2.0/docs/pipelines/architecture/actions.md).
4
4
5
5
Accessing AWS environments from a CI/CD system is commonly done by assuming temporary credentials using [OpenID Connect (OIDC)](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services). Usage of shared credentials complicates the task of maintaining an accurate log of who did what in your AWS accounts. Gruntwork Pipelines solves this issue by leveraging [AWS CloudTrail](https://aws.amazon.com/cloudtrail/) and a naming scheme based on context from the triggering Pipelines Action in GitHub. This setup associates every single API operation performed by Gruntwork Pipelines with a GitHub username and a pull request or branch. This allows your security team to quickly triage access related issues and perform analytics on usage patterns of individual users from your version control system in your AWS accounts.
6
6
@@ -12,7 +12,7 @@ Gruntwork Pipelines provides an audit log of which user performed what action in
12
12
13
13
Logs are available for all operations performed in every AWS account by Gruntwork Pipelines. Gruntwork Pipelines takes advantage of [AWS STS](https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html) session names to clearly label all sessions with the GitHub user who requested the change and the pull request or branch that triggered the change.
14
14
15
-
The `userIdentity` field in each CloudTrail event associated with API calls performed by Pipelines [Actions](./actions.md) will contain the session name. For example, if the GitHub user `SomeUserInYourOrg` made a pull request that was the 123rd pull request in your repository, an associated CloudTrail event would have information that looked like the following in the `userIdentity` field.
15
+
The `userIdentity` field in each CloudTrail event associated with API calls performed by Pipelines [Actions](/2.0/docs/pipelines/architecture/actions.md) will contain the session name. For example, if the GitHub user `SomeUserInYourOrg` made a pull request that was the 123rd pull request in your repository, an associated CloudTrail event would have information that looked like the following in the `userIdentity` field.
16
16
17
17
```json
18
18
{
@@ -51,7 +51,7 @@ Combined with a [query service](#querying-data), you can use data from CloudTrai
51
51
52
52
### Who gets logged
53
53
54
-
Pipelines uses a naming scheme that combines the GitHub user who triggered the Pipelines [Action](./actions.md) and the pull request or branch from which the action was initiated. Pipelines will set the AWS STS session name according to the following format: `<GitHubUserName>-via-GWPipelines@(PR-<PullRequestNumber>|<branch name>)`.
54
+
Pipelines uses a naming scheme that combines the GitHub user who triggered the Pipelines [Action](/2.0/docs/pipelines/architecture/actions.md) and the pull request or branch from which the action was initiated. Pipelines will set the AWS STS session name according to the following format: `<GitHubUserName>-via-GWPipelines@(PR-<PullRequestNumber>|<branch name>)`.
55
55
56
56
Pipelines runs Pipelines Actions when a pull request is opened, updated, re-opened, or merged to the deploy branch (e.g., main). The naming scheme will use different values for pull request events and pushes to the deploy branch (e.g. merged PRs).
Copy file name to clipboardExpand all lines: docs/2.0/docs/pipelines/guides/updating-pipelines.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,4 +14,4 @@ Due to our integration with [Dependabot](https://docs.github.com/en/code-securit
14
14
15
15
## Updating Customized Workflows
16
16
17
-
Note that if you follow the instructions under [Extending Pipelines](./extending-pipelines.md), you may have incurred greater burden in maintaining updates to your customized workflows. If you decide to fork the [pipelines-workflows](https://github.com/gruntwork-io/pipelines-workflows) repository to customize your workflows, you will need to manually update your workflows to include the latest changes from the upstream repository. This can be done by following the instructions in the [GitHub documentation](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/syncing-a-fork), as long as you have not made changes that conflict with the upstream repository.
17
+
Note that if you follow the instructions under [Extending Pipelines](/2.0/docs/pipelines/guides/extending-pipelines.md), you may have incurred greater burden in maintaining updates to your customized workflows. If you decide to fork the [pipelines-workflows](https://github.com/gruntwork-io/pipelines-workflows) repository to customize your workflows, you will need to manually update your workflows to include the latest changes from the upstream repository. This can be done by following the instructions in the [GitHub documentation](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/syncing-a-fork), as long as you have not made changes that conflict with the upstream repository.
Gruntwork provides two mechanisms to achieve this authentication: a [GitHub App](./viagithubapp.md) and a strategy of using CI Users (aka [Machine Users](./viamachineusers.md)) for generating/installing personal access tokens for pipelines to use.
11
+
Gruntwork provides two mechanisms to achieve this authentication: a [GitHub App](/2.0/docs/pipelines/installation/viagithubapp.md) and a strategy of using CI Users (aka [Machine Users](/2.0/docs/pipelines/installation/viamachineusers.md)) for generating/installing personal access tokens for pipelines to use.
12
12
13
13
Broadly the two approaches achieve the same result and core pipelines functionality will work with either mechanism. There are, however, some features and benefits only available with authenticating using the GitHub app and as such it is our recommended approach. As we roll out new features to pipelines we endeavor to ensure they are available to both authentication mechanisms. However, we do anticipate that the list of features that are GitHub App exclusive will grow over time.
0 commit comments