diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 126baa5..2bd6426 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -7,29 +7,29 @@ on:
jobs:
pre-commit-checks:
name: Pre-commit checks
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- name: Checkout
- uses: actions/checkout@v2
+ uses: actions/checkout@v4
- name: Terraform min/max versions
id: minMax
- uses: clowdhaus/terraform-min-max@v1.0.4
+ uses: clowdhaus/terraform-min-max@v1.3.2
- name: Pre-commit Terraform ${{ steps.minMax.outputs.maxVersion }}
- uses: clowdhaus/terraform-composite-actions/pre-commit@v1.4.1
+ uses: clowdhaus/terraform-composite-actions/pre-commit@v1.11.1
with:
terraform-version: ${{ steps.minMax.outputs.maxVersion }}
- terraform-docs-version: v0.16.0
+ terraform-docs-version: v0.20.0
validate-examples:
name: Validate examples
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
defaults:
run:
shell: bash
working-directory: examples
steps:
- - uses: hashicorp/setup-terraform@v1
+ - uses: hashicorp/setup-terraform@v3
- name: Checkout
- uses: actions/checkout@v2
+ uses: actions/checkout@v4
- name: Check examples
env:
EXAMPLES: simple
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index e1e02b2..4c5d86a 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -5,8 +5,8 @@ on:
name: release-please
jobs:
release-please:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
steps:
- - uses: google-github-actions/release-please-action@v3
+ - uses: google-github-actions/release-please-action@v4
with:
release-type: terraform-module
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index fdb20e0..f8ff3fb 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
repos:
- repo: https://github.com/antonbabenko/pre-commit-terraform
- rev: v1.62.3
+ rev: v1.99.0
hooks:
- id: terraform_fmt
- id: terraform_docs
diff --git a/.tflint.hcl b/.tflint.hcl
index 714b601..4325f26 100644
--- a/.tflint.hcl
+++ b/.tflint.hcl
@@ -1,5 +1,5 @@
config {
- module = false
+ call_module_type = "none"
force = false
disabled_by_default = false
}
diff --git a/README.md b/README.md
index 75ce0b8..46f5a6b 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ See [the official document](https://www.terraform.io/docs/backends/types/s3.html
- Starting from v1.0, this module requires [Terraform Provider for AWS](https://github.com/terraform-providers/terraform-provider-aws) v4.0 or later. [Version 1.0 Upgrade Guide](./docs/upgrade-1.0.md) described the recommended procedure after the upgrade.
-
+
## Requirements
| Name | Version |
@@ -96,6 +96,7 @@ See [the official document](https://www.terraform.io/docs/backends/types/s3.html
| Name | Description | Type | Required |
|------|-------------|------|:--------:|
+| [create\_dynamodb\_table](#input\_create\_dynamodb\_table) | Whether or not to create the DynamoDB table for state locking (it's deprecated for Terraform 1.11+). | `bool` | no |
| [dynamodb\_deletion\_protection\_enabled](#input\_dynamodb\_deletion\_protection\_enabled) | Whether or not to enable deletion protection on the DynamoDB table | `bool` | no |
| [dynamodb\_enable\_server\_side\_encryption](#input\_dynamodb\_enable\_server\_side\_encryption) | Whether or not to enable encryption at rest using an AWS managed KMS customer master key (CMK) | `bool` | no |
| [dynamodb\_table\_billing\_mode](#input\_dynamodb\_table\_billing\_mode) | Controls how you are charged for read and write throughput and how you manage capacity. | `string` | no |
@@ -112,8 +113,8 @@ See [the official document](https://www.terraform.io/docs/backends/types/s3.html
| [kms\_key\_deletion\_window\_in\_days](#input\_kms\_key\_deletion\_window\_in\_days) | Duration in days after which the key is deleted after destruction of the resource, must be between 7 and 30 days. | `number` | no |
| [kms\_key\_description](#input\_kms\_key\_description) | The description of the key as viewed in AWS console. | `string` | no |
| [kms\_key\_enable\_key\_rotation](#input\_kms\_key\_enable\_key\_rotation) | Specifies whether key rotation is enabled. | `bool` | no |
-| [noncurrent\_version\_expiration](#input\_noncurrent\_version\_expiration) | Specifies when noncurrent object versions expire. See the aws\_s3\_bucket document for detail. | object({
days = number
}) | no |
-| [noncurrent\_version\_transitions](#input\_noncurrent\_version\_transitions) | Specifies when noncurrent object versions transitions. See the aws\_s3\_bucket document for detail. | list(object({
days = number
storage_class = string
})) | no |
+| [noncurrent\_version\_expiration](#input\_noncurrent\_version\_expiration) | Specifies when noncurrent object versions expire. See the aws\_s3\_bucket document for detail. | object({
days = number
}) | no |
+| [noncurrent\_version\_transitions](#input\_noncurrent\_version\_transitions) | Specifies when noncurrent object versions transitions. See the aws\_s3\_bucket document for detail. | list(object({
days = number
storage_class = string
})) | no |
| [override\_iam\_policy\_name](#input\_override\_iam\_policy\_name) | override iam policy name to disable policy\_prefix and create policy with static name | `bool` | no |
| [override\_iam\_role\_name](#input\_override\_iam\_role\_name) | override iam role name to disable role\_prefix and create role with static name | `bool` | no |
| [override\_s3\_bucket\_name](#input\_override\_s3\_bucket\_name) | override s3 bucket name to disable bucket\_prefix and create bucket with static name | `bool` | no |
@@ -126,6 +127,7 @@ See [the official document](https://www.terraform.io/docs/backends/types/s3.html
| [s3\_logging\_target\_prefix](#input\_s3\_logging\_target\_prefix) | The prefix to apply on bucket logs, e.g "logs/". | `string` | no |
| [state\_bucket\_prefix](#input\_state\_bucket\_prefix) | Creates a unique state bucket name beginning with the specified prefix. | `string` | no |
| [tags](#input\_tags) | A mapping of tags to assign to resources. | `map(string)` | no |
+| [terraform\_iam\_policy\_add\_lockfile\_permissions](#input\_terraform\_iam\_policy\_add\_lockfile\_permissions) | Whether to add permissions for the S3 lockfile (recommended for Terraform 1.11+). | `bool` | no |
| [terraform\_iam\_policy\_create](#input\_terraform\_iam\_policy\_create) | Specifies whether to terraform IAM policy is created. | `bool` | no |
| [terraform\_iam\_policy\_name](#input\_terraform\_iam\_policy\_name) | If override\_terraform\_iam\_policy\_name is true, use this policy name instead of dynamic name with policy\_prefix | `string` | no |
| [terraform\_iam\_policy\_name\_prefix](#input\_terraform\_iam\_policy\_name\_prefix) | Creates a unique name beginning with the specified prefix. | `string` | no |
@@ -141,4 +143,4 @@ See [the official document](https://www.terraform.io/docs/backends/types/s3.html
| [replica\_bucket](#output\_replica\_bucket) | The S3 bucket to replicate the state S3 bucket. |
| [state\_bucket](#output\_state\_bucket) | The S3 bucket to store the remote state file. |
| [terraform\_iam\_policy](#output\_terraform\_iam\_policy) | The IAM Policy to access remote state environment. |
-
+
diff --git a/dynamo.tf b/dynamo.tf
index f3f626d..8038f9d 100644
--- a/dynamo.tf
+++ b/dynamo.tf
@@ -10,6 +10,8 @@ locals {
}
resource "aws_dynamodb_table" "lock" {
+ count = var.create_dynamodb_table ? 1 : 0
+
name = var.dynamodb_table_name
billing_mode = var.dynamodb_table_billing_mode
hash_key = local.lock_key_id
diff --git a/examples/simple-terraform-1-11/main.tf b/examples/simple-terraform-1-11/main.tf
new file mode 100644
index 0000000..1a18030
--- /dev/null
+++ b/examples/simple-terraform-1-11/main.tf
@@ -0,0 +1,42 @@
+terraform {
+ required_version = ">= 0.15"
+
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = ">= 4.0.0"
+ }
+ }
+}
+
+provider "aws" {
+ region = var.region
+}
+
+provider "aws" {
+ alias = "replica"
+ region = var.replica_region
+}
+
+module "remote_state" {
+ source = "../../"
+
+ # Do not create the DynamoDB lock table
+ create_dynamodb_table = false
+ # Instead, add S3 lock file permissions to the IAM policy
+ terraform_iam_policy_add_lockfile_permissions = true
+
+ providers = {
+ aws = aws
+ aws.replica = aws.replica
+ }
+}
+
+resource "aws_iam_user" "terraform" {
+ name = "TerraformUser"
+}
+
+resource "aws_iam_user_policy_attachment" "remote_state_access" {
+ user = aws_iam_user.terraform.name
+ policy_arn = module.remote_state.terraform_iam_policy.arn
+}
diff --git a/examples/simple-terraform-1-11/outputs.tf b/examples/simple-terraform-1-11/outputs.tf
new file mode 100644
index 0000000..50fbfa6
--- /dev/null
+++ b/examples/simple-terraform-1-11/outputs.tf
@@ -0,0 +1,9 @@
+output "kms_key" {
+ description = "The KMS customer master key to encrypt state buckets."
+ value = module.remote_state.kms_key.key_id
+}
+
+output "state_bucket" {
+ description = "The S3 bucket to store the remote state file."
+ value = module.remote_state.state_bucket.bucket
+}
diff --git a/examples/simple-terraform-1-11/variables.tf b/examples/simple-terraform-1-11/variables.tf
new file mode 100644
index 0000000..2c796de
--- /dev/null
+++ b/examples/simple-terraform-1-11/variables.tf
@@ -0,0 +1,11 @@
+variable "region" {
+ description = "The AWS region in which resources are set up."
+ type = string
+ default = "us-east-1"
+}
+
+variable "replica_region" {
+ description = "The AWS region to which the state bucket is replicated."
+ type = string
+ default = "us-west-1"
+}
diff --git a/migrations.tf b/migrations.tf
index 36af1bb..f7c69c2 100644
--- a/migrations.tf
+++ b/migrations.tf
@@ -1,5 +1,5 @@
# --------------------------------------------------------------------------------------------------
-# Migrations to 0.7.0
+# Migrations
# --------------------------------------------------------------------------------------------------
moved {
@@ -22,3 +22,7 @@ moved {
to = aws_s3_bucket_policy.replica_force_ssl[0]
}
+moved {
+ from = aws_dynamodb_table.lock
+ to = aws_dynamodb_table.lock[0]
+}
diff --git a/outputs.tf b/outputs.tf
index bd4bb8d..f7184cc 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -20,7 +20,7 @@ output "replica_bucket" {
output "dynamodb_table" {
description = "The DynamoDB table to manage lock states."
- value = aws_dynamodb_table.lock
+ value = var.create_dynamodb_table ? aws_dynamodb_table.lock[0] : null
}
output "kms_key_replica" {
diff --git a/policy.tf b/policy.tf
index 294d770..f3a9306 100644
--- a/policy.tf
+++ b/policy.tf
@@ -7,55 +7,62 @@
# https://github.com/nozaq/terraform-aws-remote-state-s3-backend/issues/74
#---------------------------------------------------------------------------------------------------
-resource "aws_iam_policy" "terraform" {
+data "aws_iam_policy_document" "terraform" {
count = var.terraform_iam_policy_create ? 1 : 0
- name_prefix = var.override_terraform_iam_policy_name ? null : var.terraform_iam_policy_name_prefix
- name = var.override_terraform_iam_policy_name ? var.terraform_iam_policy_name : null
- policy = <