Move Terraform configuration out of repository

.gitignore

@@ -12,8 +12,8 @@ api/lambdas/get_user_data/get_user_data
 *.bak
 .vscode
 
-# Created by https://www.gitignore.io/api/go,vim,osx,node,emacs,windows,terraform
-# Edit at https://www.gitignore.io/?templates=go,vim,osx,node,emacs,windows,terraform
+# Created by https://www.gitignore.io/api/go,vim,osx,node,emacs,windows
+# Edit at https://www.gitignore.io/?templates=go,vim,osx,node,emacs,windows
 
 ### Emacs ###
 # -*- mode: gitignore; -*-
@@ -198,36 +198,6 @@ Network Trash Folder
 Temporary Items
 .apdisk
 
-### Terraform ###
-# Local .terraform directories
-**/.terraform/*
-
-# .tfstate files
-*.tfstate
-*.tfstate.*
-
-# Crash log files
-crash.log
-
-# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
-# .tfvars files are managed as part of configuration and so should be included in
-# version control.
-#
-# example.tfvars
-
-# Ignore override files as they are usually used to override resources locally and so
-# are not checked in
-override.tf
-override.tf.json
-*_override.tf
-*_override.tf.json
-
-# Include override files you do wish to add to version control using negated pattern
-# !example_override.tf
-
-# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
-# example: *tfplan*
-
 ### Vim ###
 # Swap
 [._]*.s[a-v][a-z]

README.md

@@ -32,7 +32,6 @@ aws s3api create-bucket --bucket <terraform state bucket> --region us-west-2 --c
 
 - go 1.20+
 - node 16.17.0+
-- terraform 1.3.7+
 
 ## Setting Up Your Variable Files
 
@@ -88,103 +87,3 @@ We advise against using environment variables for secrets in AWS Lambda as they
 | OKTA_HOST | The hostname of your Okta instance. We'd recommend using a vanity domain, such as https://singlesignon.example.com. |
 | OKTA_TOKEN | A token from Okta that has the `okta.apps.read` scope. |
 | SETTINGS_PROVIDER | This must be set to 'env' for the Lambda functions to read from the environment. |
-
-# Deploying
-
-These steps assume you created `prod.env` as instructed above.
-
-## First Deploy
-
-You'll need to create a Terraform module which references KeyConjurer. We recommend you do this outside of the KeyConjurer folder itself and check your Terraform configuration into source control. An example module that uses KeyConjurer might look like this:
-
-
-```hcl
-resource "aws_acm_certificate" "api-cert" {
-  domain_name       = "api.keyconjurer.example.com"
-  validation_method = "EMAIL"
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-resource "aws_acm_certificate_validation" "api-cert" {
-  certificate_arn = aws_acm_certificate.api-cert.arn
-}
-
-resource "aws_acm_certificate" "frontend-cert" {
-  domain_name       = "keyconjurer.example.com"
-  validation_method = "EMAIL"
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-resource "aws_acm_certificate_validation" "frontend-cert" {
-  certificate_arn = aws_acm_certificate.frontend-cert.arn
-}
-
-module "keyconjurer-production" {
-  source          = "./Key-Conjurer/terraform/modules/kitchensink"
-  api_cert        = aws_acm_certificate.development-cert.arn
-  api_domain      = aws_acm_certificate.development-cert.domain_name
-  frontend_cert   = aws_acm_certificate.frontend-cert.arn
-  frontend_domain = aws_acm_certificate.frontend-cert.domain_name
-  vpc_id          = "vpc-xxxxxx"
-  subnets         = ["subnet-xxxxxx", "subnet-xxxxxx", "subnet-xxxxxx"]
-  s3_tf_bucket    = "<the bucket you created in step 1>"
-  kms_key_arn     = data.aws_kms_key.development.arn
-
-  lambda_env = {
-    VAULT_ADDR              = ""
-    VAULT_ROLE_NAME         = "
-    VAULT_SECRET_MOUNT_PATH = ""
-    VAULT_SECRET_PATH       = ""
-    VAULT_AWS_AUTH_PATH     = ""
-  }
-
-  lb_security_group_ids = []
-  depends_on = [
-    aws_acm_certificate_validation.frontend-cert
-    aws_acm_certificate_validation.api-cert
-  ]
-}
-```
-
-After modifying `example.env` to your liking, we would recommend renaming this to `prod.env`. You can then deploy KeyConjurer using the following steps:
-
-```
-$ pwd
-/key-conjurer
-$ make build
-$ cd terraform
-/key-conjurer
-$ make upload
-$ /your/key-conjurer/terraform/folder
-$ terraform apply
-```
-
-During your initial deployment, you may need to verify the domain name you've created. This is left as an exercise to the reader; the only thing KeyConjurer requires is _two_ ACM certificates:
-
-1. One for the frontend Cloudfront distribution
-2. One for the Load Balancer.
-
-## Future Deploys
-
-Similar to the above steps:
-
-```
-$ pwd
-/key-conjurer
-$ make build
-$ cd terraform
-/key-conjurer
-$ make upload
-$ /your/key-conjurer/terraform/folder
-$ terraform apply
-```
-
-## Noteworthy Info
-
-* `frontend` serves the CLI tool. This means the binaries created in `cli` need to be uploaded to the same bucket that's used to serve the frontend.
-* KeyConjurer's Terraform will create an ACL by default unless `create_waf_acl` is set to _false_ and a WAF ACL is provided using `waf_acl_id`. This default ACL will **block all connections**.
-* Both a Load Balancer Security Group and a WAF are used to control connections to KeyConjurer. These both need to agree on the IP ranges to allow to KeyConjurer, otherwise you may end up in a situation where a user can access the frontend or use KeyConjurer from the CLI, but not both.

example.env

@@ -5,12 +5,6 @@ tfswitch $TF_VERSION > /dev/null
 
 export RELEASE='prod'
 
-# The backend bucket in terraform/main.tf needs to be set to the same value
-#  because you cannot use a variable for that value in terraform
-export S3_TF_BUCKET_NAME='<S3_TF_BUCKET_NAME>'
-export S3_TF_BUCKET_TAGS="TagSet=[{Key=Name,Value=keyconjurer}]"
-export S3_FRONTEND_BUCKET='<Bucket to Hold UI/CLI binaries>'
-
 export LOGSTASH_ENDPOINT='<LOGSTASH_ENDPOINT>'
 export SECRETS_RETRIEVER='kms_blob'