Initial commit

.github/workflows/terraform-security-check.yml

@@ -0,0 +1,17 @@
+name: 'Terraform Security'
+
+on:
+  workflow_dispatch: 
+  # pull_request:
+  # push:
+  #   branches:
+  #     - main
+  #     - develop
+
+jobs:
+  terraform:
+    name: 'Terraform Security Scan'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: triat/[email protected]

.github/workflows/terraform-validate.yml

@@ -0,0 +1,31 @@
+name: "Terraform Validation"
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - develop
+
+jobs:
+  terraform:
+    name: "Terraform Syntax Check"
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Setup Terraform
+      uses: hashicorp/[email protected]
+      with:
+        terraform_version: 1.1.7
+
+    - name: Terraform Format Check
+      run: terraform fmt -check -recursive
+
+    - name: Terraform Init
+      run: terraform init
+
+    - name: Terraform Validate
+      run: terraform validate

.gitignore

@@ -0,0 +1,42 @@
+# https://github.com/github/gitignore/blob/main/Terraform.gitignore
+
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version 
+# control as they are data points which are potentially sensitive and subject 
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Ignore transient lock info files created by terraform apply
+.terraform.tfstate.lock.info
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Lock
+.terraform.lock.hcl

README.md

@@ -0,0 +1,104 @@
+# terraform-template
+
+Terraform project template for deploying infrastructure across multiple environments and regions, following best practices with modular structure and automated syntax checks (GitHub Actions)
+
+## Repo structure
+
+```
+terraform-template/                   # Root directory of the Terraform template repository
+├── README.md                         # Project documentation and overview
+├── environments                      # Directory containing environment-specific configurations for different deployments
+│   ├── demo-azure-vm                 # Environment folder for provisioning Azure VM resources using the demo-azure-vm module
+│   │   ├── dev                       # Development environment configuration for the demo-azure-vm setup
+│   │   │   └── east-us               # Azure region-specific configuration for the dev environment (East US region)
+│   │   │       ├── README.md         # Documentation for the dev environment setup in East US region
+│   │   │       ├── main.tf           # Main Terraform configuration for provisioning resources in the dev environment
+│   │   │       ├── output.tf         # Outputs for the dev environment (e.g., VM IP address)
+│   │   │       └── variables.tf      # Variables specific to the dev environment (e.g., VM size, location)
+│   │   └── staging                   # Staging environment folder for demo-azure-vm
+│   │       ├── east-us               # Staging environment configuration for East US region
+│   │       │   ├── README.md         # Documentation for the staging environment setup in East US region
+│   │       │   ├── main.tf           # Main Terraform configuration for staging resources in East US
+│   │       │   ├── output.tf         # Outputs for the staging environment
+│   │       │   └── variables.tf      # Variables specific to the staging environment (East US)
+│   │       └── southeastasia         # Staging environment configuration for Southeast Asia region
+│   │           ├── README.md         # Documentation for the staging environment setup in Southeast Asia region
+│   │           ├── main.tf           # Main Terraform configuration for staging resources in Southeast Asia
+│   │           ├── output.tf         # Outputs for the staging environment (Southeast Asia)
+│   │           └── variables.tf      # Variables specific to the staging environment (Southeast Asia)
+│   └── production                    # Production environment folder for demo-azure-vm
+│       └── east-us                   # Production environment configuration for East US region
+│   └── demo-message                  # Environment folder for deploying resources using the demo-message module
+│       ├── dev                       # Development environment configuration for demo-message setup
+│       │   └── east-us               # Region-specific configuration for the dev environment (East US region)
+│       │       ├── backend.tf        # Backend configuration for managing Terraform state
+│       │       ├── main.tf           # Main Terraform configuration for deploying demo-message resources
+│       │       ├── output.tf         # Outputs for the dev environment (e.g., message service IP address)
+│       │       └── variables.tf      # Variables specific to the dev environment (e.g., service names, ports)
+│       ├── production                # Production environment folder for demo-message
+│       │   └── east-us               # Production environment configuration for East US region
+│       └── staging                   # Staging environment folder for demo-message
+│           └── east-us               # Staging environment configuration for East US region
+├── modules                           # Directory containing reusable Terraform modules
+│   ├── demo-azure-vm                 # Module for provisioning an Azure VM
+│   │   ├── README.md                 # Documentation for the demo-azure-vm module
+│   │   ├── main.tf                   # Main configuration for provisioning an Azure VM
+│   │   ├── outputs.tf                # Outputs from the demo-azure-vm module (e.g., public IP, VM ID)
+│   │   ├── providers.tf              # Provider configuration (Azure provider setup)
+│   │   ├── ssh.tf                    # SSH-related configuration for Azure VM access (e.g., public keys)
+│   │   └── variables.tf              # Module-specific variables (e.g., VM size, admin credentials)
+│   └── demo-message                  # Module for a simple message service deployment
+│       ├── main.tf                   # Main configuration for deploying a demo message service
+│       ├── outputs.tf                # Outputs from the demo-message module (e.g., service endpoints)
+│       └── variables.tf              # Variables for configuring the demo-message module
+└── utils                             # Utility scripts and configurations for managing infrastructure
+    └── deploy-something              # Placeholder utility for deploying additional resources
+        └── main.tf                   # Main configuration for the utility (e.g., simple automation tasks)
+```
+
+## Demo content
+
+This demonstrates how modules, multiple environments, and shared resources work. In your real project, you can refer to this demo code and structure, and then delete the demo module when it is no longer needed.
+
+### Module
+
+These are the demo modules:
+
+- [modules/demo-message](./modules/demo-message/)
+- [modules/demo-azure-vm](./modules/demo-azure-vm/)
+
+### Use demo-message module
+
+These demos use the same [modules/demo-message](./modules/demo-message/) above with difference variablesF
+
+- [environments/demo-message/dev/](./environments/demo-message/dev/)
+  ```
+  cd environments/demo-message/dev/east-us
+  terraform init
+  terraform plan
+  terraform apply
+  ```
+- [environments/demo-message/staging/](./environments/demo-message/staging/)
+  ```
+  cd environments/demo-message/staging/east-us
+  terraform init
+  terraform plan
+  terraform apply
+  ```
+- [environments/demo-message/production/](./environments/demo-message/production/)
+  ```
+  cd environments/demo-message/production/east-us
+  terraform init
+  terraform plan
+  terraform apply
+  ```
+
+### Use demo-azure-vm module
+
+- TODO: Add document
+
+## How to use the template?
+
+- Create a new repo from this template.
+- Add the code for your appropriate use case.
+- Optionally, delete the demo module/code when it is no longer needed to keep the repo clean.

environments/demo-azure-vm/dev/east-us/README.md

@@ -0,0 +1,35 @@
+## Deploy
+
+```bash
+terraform init -upgrade
+
+terraform plan
+
+terraform apply
+```
+
+## Result
+
+- You can find the output information in the console
+
+```
+key_data = "xxxxxyyyyyzzzztttt generated-by-azure"
+private_key_data = "zzzzzzzzzzzzzzzz"
+public_ip_address = "x.y.z.t"
+resource_group_name = "ENV-rg-some-thing"
+```
+
+## Connect to the VM
+
+```bash
+# Save the private key *.pem
+mkdir ssh_key
+cd ssh_key
+vi azure-vm-private-key.pem
+
+# It is required that your private key files are NOT accessible by others.
+chmod 600 azure-vm-private-key.pem
+
+# Now SSH
+ssh -i azure-vm-private-key.pem [email protected]
+```

environments/demo-azure-vm/dev/east-us/main.tf

@@ -0,0 +1,8 @@
+module "demo_azure_vm" {
+  source                     = "../../../../modules/demo-azure-vm"
+  resource_group_location    = var.resource_group_location
+  vm_size                    = var.vm_size
+  resource_group_name_prefix = var.resource_group_name_prefix
+  username                   = var.username
+  vm_hostname                = var.vm_hostname
+}

environments/demo-azure-vm/dev/east-us/output.tf

@@ -0,0 +1,15 @@
+output "resource_group_name" {
+  value = module.demo_azure_vm.resource_group_name
+}
+
+output "public_ip_address" {
+  value = module.demo_azure_vm.public_ip_address
+}
+
+output "key_data" {
+  value = module.demo_azure_vm.key_data
+}
+
+output "private_key_data" {
+  value = module.demo_azure_vm.private_key_data
+}

environments/demo-azure-vm/dev/east-us/variables.tf

@@ -0,0 +1,29 @@
+variable "resource_group_location" {
+  type        = string
+  default     = "eastus"
+  description = "Location of the resource group."
+}
+
+variable "resource_group_name_prefix" {
+  type        = string
+  default     = "DEV-rg"
+  description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
+}
+
+variable "username" {
+  type        = string
+  description = "The username for the local account that will be created on the new VM."
+  default     = "azureadmin"
+}
+
+variable "vm_size" {
+  type        = string
+  description = "vm_size"
+  default     = "Standard_DS1_v2"
+}
+
+variable "vm_hostname" {
+  type        = string
+  description = "vm_hostname"
+  default     = "dev-azurevm"
+}

environments/demo-azure-vm/production/east-us/README.md

@@ -0,0 +1,35 @@
+## Deploy
+
+```bash
+terraform init -upgrade
+
+terraform plan
+
+terraform apply
+```
+
+## Result
+
+- You can find the output information in the console
+
+```
+key_data = "xxxxxyyyyyzzzztttt generated-by-azure"
+private_key_data = "zzzzzzzzzzzzzzzz"
+public_ip_address = "x.y.z.t"
+resource_group_name = "ENV-rg-some-thing"
+```
+
+## Connect to the VM
+
+```bash
+# Save the private key *.pem
+mkdir ssh_key
+cd ssh_key
+vi azure-vm-private-key.pem
+
+# It is required that your private key files are NOT accessible by others.
+chmod 600 azure-vm-private-key.pem
+
+# Now SSH
+ssh -i azure-vm-private-key.pem [email protected]
+```

environments/demo-azure-vm/production/east-us/main.tf

@@ -0,0 +1,8 @@
+module "demo_azure_vm" {
+  source                     = "../../../../modules/demo-azure-vm"
+  resource_group_location    = var.resource_group_location
+  vm_size                    = var.vm_size
+  resource_group_name_prefix = var.resource_group_name_prefix
+  username                   = var.username
+  vm_hostname                = var.vm_hostname
+}

environments/demo-azure-vm/production/east-us/output.tf

@@ -0,0 +1,15 @@
+output "resource_group_name" {
+  value = module.demo_azure_vm.resource_group_name
+}
+
+output "public_ip_address" {
+  value = module.demo_azure_vm.public_ip_address
+}
+
+output "key_data" {
+  value = module.demo_azure_vm.key_data
+}
+
+output "private_key_data" {
+  value = module.demo_azure_vm.private_key_data
+}

environments/demo-azure-vm/production/east-us/variables.tf

@@ -0,0 +1,29 @@
+variable "resource_group_location" {
+  type        = string
+  default     = "eastus"
+  description = "Location of the resource group."
+}
+
+variable "resource_group_name_prefix" {
+  type        = string
+  default     = "PROD-rg"
+  description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
+}
+
+variable "username" {
+  type        = string
+  description = "The username for the local account that will be created on the new VM."
+  default     = "azureadmin"
+}
+
+variable "vm_size" {
+  type        = string
+  description = "vm_size"
+  default     = "Standard_DS1_v2"
+}
+
+variable "vm_hostname" {
+  type        = string
+  description = "vm_hostname"
+  default     = "prod-azurevm"
+}