From 4804a8a4605275a7874eeb08237f0e23f9d394b3 Mon Sep 17 00:00:00 2001
From: David Wilkie <dwilkie@gmail.com>
Date: Sat, 14 Sep 2024 15:02:33 +0700
Subject: [PATCH] WIP

---
 infrastructure/modules/services/docker.tf   |  10 --
 infrastructure/modules/services/iam.tf      | 103 ++++++++++----------
 infrastructure/modules/services/versions.tf |   1 -
 infrastructure/staging/.terraform.lock.hcl  |  32 +++---
 infrastructure/staging/terraform.tf         |  10 ++
 infrastructure/staging/versions.tf          |   4 +-
 6 files changed, 79 insertions(+), 81 deletions(-)

diff --git a/infrastructure/modules/services/docker.tf b/infrastructure/modules/services/docker.tf
index 41f7d95f9..577ec50cb 100644
--- a/infrastructure/modules/services/docker.tf
+++ b/infrastructure/modules/services/docker.tf
@@ -1,13 +1,3 @@
-data "aws_ecr_authorization_token" "token" {}
-
-provider "docker" {
-  registry_auth {
-    address  = split("/", var.app_image)[0]
-    username = data.aws_ecr_authorization_token.token.user_name
-    password = data.aws_ecr_authorization_token.token.password
-  }
-}
-
 resource "docker_image" "this" {
   name = "${var.app_image}:latest"
   build {
diff --git a/infrastructure/modules/services/iam.tf b/infrastructure/modules/services/iam.tf
index 243c382f8..4a8169463 100644
--- a/infrastructure/modules/services/iam.tf
+++ b/infrastructure/modules/services/iam.tf
@@ -1,20 +1,17 @@
 resource "aws_iam_role" "this" {
-  name               = var.identifier
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "lambda.amazonaws.com"
+  name = var.identifier
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "lambda.amazonaws.com"
+        }
       },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
+    ]
+  })
 }
 
 resource "aws_iam_role_policy_attachment" "vpc_access_execution_role" {
@@ -25,44 +22,44 @@ resource "aws_iam_role_policy_attachment" "vpc_access_execution_role" {
 resource "aws_iam_policy" "custom_policy" {
   name = var.identifier
 
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": "ssm:GetParameters",
-      "Resource": [
-        "${var.freeswitch_event_socket_password_parameter.arn}",
-        "${aws_ssm_parameter.application_master_key.arn}",
-        "${var.db_password_parameter.arn}",
-        "${data.aws_ssm_parameter.region_data.arn}"
-      ]
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "sqs:DeleteMessage",
-        "sqs:ReceiveMessage",
-        "sqs:GetQueueAttributes"
-      ],
-      "Resource": [
-        "${aws_sqs_queue.this.arn}"
-      ]
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ecs:DescribeContainerInstances",
-        "ec2:DescribeInstances"
-      ],
-      "Resource": [
-        "*"
-      ]
-    }
-  ]
-}
-EOF
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "ssm:GetParameters",
+        ]
+        Effect = "Allow"
+        Resource = [
+          var.freeswitch_event_socket_password_parameter.arn,
+          aws_ssm_parameter.application_master_key.arn,
+          var.db_password_parameter.arn,
+          data.aws_ssm_parameter.region_data.arn
+        ]
+      },
+      {
+        Action = [
+          "sqs:DeleteMessage",
+          "sqs:ReceiveMessage",
+          "sqs:GetQueueAttributes"
+        ]
+        Effect = "Allow"
+        Resource = [
+          aws_sqs_queue.this.arn
+        ]
+      },
+      {
+        Action = [
+          "ecs:DescribeContainerInstances",
+          "ec2:DescribeInstances"
+        ]
+        Effect = "Allow"
+        Resource = [
+          "*"
+        ]
+      }
+    ]
+  })
 }
 
 resource "aws_iam_role_policy_attachment" "custom_policy" {
diff --git a/infrastructure/modules/services/versions.tf b/infrastructure/modules/services/versions.tf
index 7f7f21f60..b433ffb4c 100644
--- a/infrastructure/modules/services/versions.tf
+++ b/infrastructure/modules/services/versions.tf
@@ -4,5 +4,4 @@ terraform {
       source = "kreuzwerker/docker"
     }
   }
-  required_version = ">= 0.13"
 }
diff --git a/infrastructure/staging/.terraform.lock.hcl b/infrastructure/staging/.terraform.lock.hcl
index 57314f78c..8f7817945 100644
--- a/infrastructure/staging/.terraform.lock.hcl
+++ b/infrastructure/staging/.terraform.lock.hcl
@@ -2,24 +2,24 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/aws" {
-  version = "5.55.0"
+  version = "5.67.0"
   hashes = [
-    "h1:vChl08zNYLVzuSzfxz3wp3wNSx+vjwl/jPuyPbg59Ks=",
-    "zh:06fbb1cc4b61b9d6370d391bf7538aa6ef8b60b91c67d125a6be60a70b1d49f0",
-    "zh:1d52acd2184f379433a0fce2c29d5ed8fc7958d6a9d1b403310dcc36b2a3f626",
-    "zh:290bbce092f8836a1db530ac86d933cfea27d52b827639974a81bc48dfba8c34",
-    "zh:3531f2822c2de3ba837381c4ee4816c5b437fd204c07d659526a04d9154a65e8",
-    "zh:56d70db4c8c6c0ec1b665380b87726275f4ab3665b4b78ac86dc90e1010c0fe3",
-    "zh:8251d713c0b2c8c51b6858e51c70d083b484342ff9782a88c39e7eaa966c3da2",
-    "zh:9a7d1f7207e51382a7dd139dfd5786e7e905edf9bf89bbee4b59ad41365e87be",
+    "h1:8wkuQvQiqjjm2+gQepy6xFBfimGoesKz1BPcVKWvED8=",
+    "zh:1259c8106c0a3fc0ed3b3eb814ab88d6a672e678b533f47d1bbbe3107949f43e",
+    "zh:226414049afd6d334cc16ff5d6cef23683620a9b56da67a21422a113d9cce4ab",
+    "zh:3c89b103aea20ef82a84e889abaeb971cb168de8292b61b34b83e807c40085a9",
+    "zh:3dd88e994fb7d7a6c6eafd3c01393274e4f776021176acea2e980f73fbd4acbc",
+    "zh:487e0dda221c84a20a143904c1cee4e63fce6c5c57c21368ea79beee87b108da",
+    "zh:7693bdcec8181aafcbda2c41c35b1386997e2c92b6f011df058009e4c8b300e1",
+    "zh:82679536250420f9e8e6edfd0fa9a1bab99a7f31fe5f049ac7a2e0d8c287b56f",
+    "zh:8685218dae921740083820c52afa66cdf14cf130539da1efd7d9a78bfb6ade64",
     "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:a529c78dfc60063289524690af78794e99a768835b88e27cdfec15bc85439f7c",
-    "zh:b6da1843355db05c5d412126406fd97db2a6ff9edc166b81c1cea2994535b4eb",
-    "zh:bfc08cd23b1556b3287d1b28ac7f12c7d459471d97a0592bf2579ea68d11bae7",
-    "zh:c382088faf05894191636b57861069a21de10a5ff4eb8f7cc122e764ccf7a4a8",
-    "zh:e27f99f389921314ee428b24990d3a829057ce532b2beb33c69387458722edd9",
-    "zh:ef11285eedb45ffc3fb2ecdfefa206e64eb2760a87fff15c44dee42de9703436",
-    "zh:fedc4ebee0d6fe196691127004db5d1ff8bd22e3b667a74026bb92c607589b6c",
+    "zh:9e553a3ec05eedea779d393447fc316689ba6c4d4d8d569b986898e6dbe58fee",
+    "zh:a36c24acd3c75bac8211fefde58c459778021eb871ff8339be1c26ad8fd67ee1",
+    "zh:ce48bd1e35d6f996f1a09d8f99e8084469b7fec5611e67a50a63e96375b87ebe",
+    "zh:d6c76a24205513725269e4783da14be9648e9086fb621496052f4b37d52d785e",
+    "zh:d95a31745affb178ea48fa8e0be94691a8f7507ea55c0d0a4b6e0a8ef6fcb929",
+    "zh:f061ce59fac1bc425c1092e6647ed4bb1b61824416041b46dbf336e01a63ad89",
   ]
 }
 
diff --git a/infrastructure/staging/terraform.tf b/infrastructure/staging/terraform.tf
index b00b2308b..3ef6b9536 100644
--- a/infrastructure/staging/terraform.tf
+++ b/infrastructure/staging/terraform.tf
@@ -16,6 +16,16 @@ provider "aws" {
   alias  = "helium"
 }
 
+data "aws_ecr_authorization_token" "this" {}
+
+provider "docker" {
+  registry_auth {
+    address  = data.aws_ecr_authorization_token.this.proxy_endpoint
+    username = data.aws_ecr_authorization_token.this.user_name
+    password = data.aws_ecr_authorization_token.this.password
+  }
+}
+
 data "terraform_remote_state" "core" {
   backend = "s3"
 
diff --git a/infrastructure/staging/versions.tf b/infrastructure/staging/versions.tf
index 1d23dfe5c..758f8f602 100644
--- a/infrastructure/staging/versions.tf
+++ b/infrastructure/staging/versions.tf
@@ -3,6 +3,8 @@ terraform {
     aws = {
       source = "hashicorp/aws"
     }
+    docker = {
+      source = "kreuzwerker/docker"
+    }
   }
-  required_version = ">= 0.13"
 }