QPPSE-629: Added tf code for terraform state bucket.

infrastructure/terraform/terraform-state-bucket/main.tf

@@ -0,0 +1,22 @@
+terraform {
+    required_providers {
+        aws = {
+            source = "hashicorp/aws"
+            version = "=4.67.0"
+        }
+    }
+    required_version = "1.0.0"
+}
+
+provider "aws" {
+    region = "us-east-1"
+}
+
+terraform {
+  backend "s3" {
+    bucket  = "qppsf-conversion-tool-tf-state"
+    key     = "qppsf/conversion-tool-tf-state-bucket.tfstate"
+    region  = "us-east-1"
+    encrypt = "true"
+  }
+}

infrastructure/terraform/terraform-state-bucket/state-bucket.tf

@@ -0,0 +1,73 @@
+resource "aws_s3_bucket" "terraform-state-bucket" {
+  bucket = "qppsf-conversion-tool-tf-state"
+
+  tags = {
+    "Name"                = "qppsf-conversion-tool-tf-state"
+    "qpp:owner"           = var.owner
+    "qpp:environment"     = var.environment
+    "qpp:Name"            = "qppsf-ct"
+    "qpp:pagerduty-email" = var.pagerduty_email
+    "qpp:sensitivity"     = var.sensitivity
+    "qpp:application"     = "qppsf-ct"
+    "qpp:description"     = "Conversion-Tools Terraform State Bucket"
+    "qpp-cross-acc-s3-replication" = "us-east-1"
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "terraform-state-bucket_public_block" {
+  bucket = aws_s3_bucket.terraform-state-bucket.id
+
+  restrict_public_buckets = true
+  ignore_public_acls      = true
+  block_public_acls       = true
+  block_public_policy     = true
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "terraform-state-bucket_encryption" {
+  bucket = aws_s3_bucket.terraform-state-bucket.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm     = "AES256"
+    }
+    bucket_key_enabled = false
+  }
+}
+
+resource "aws_s3_bucket_versioning" "terraform-state-bucket_versioning" {
+  bucket = aws_s3_bucket.terraform-state-bucket.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_policy" "terraform-state-bucket_bucket_policy" {
+  bucket = aws_s3_bucket.terraform-state-bucket.id
+  policy = data.aws_iam_policy_document.terraform-state-bucket_bucket_policy.json
+}
+
+data "aws_iam_policy_document" "terraform-state-bucket_bucket_policy" {
+  statement {
+    sid    = "AllowSSLRequestsOnly"
+    effect = "Deny"
+    principals {
+      type = "*"
+      identifiers = ["*"]
+    }
+
+    actions = [
+      "s3:*",
+    ]
+
+    resources = [
+      aws_s3_bucket.terraform-state-bucket.arn,
+      "${aws_s3_bucket.terraform-state-bucket.arn}/*",
+    ]
+
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values = ["false"]
+    }
+  }
+}

infrastructure/terraform/terraform-state-bucket/variables.tf

@@ -0,0 +1,44 @@
+variable "region" {
+  description = "The AWS region to use"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "project_name" {
+  description = "Team or Project"
+  type        = string
+  default     = "qppsf-ct"
+}
+
+variable "environment" {
+  description = "Name of the Environment"
+  type        = string
+  default     = "common"
+}
+
+variable "owner" {
+  description = "Resource Owner"
+  type        = string
+  default     = "qpp-final-scoring-devops@semanticbits.com"
+}
+
+variable "pagerduty_email" {
+  description = "Team pagerduty notifications email endpoint"
+  type        = string
+  default     = "qpp-final-scoring-devops@semanticbits.com"
+}
+
+variable "application" {
+  type        = string
+  default     = "qpp-conversion-tools"
+}
+
+variable "sensitivity" {
+  type        = string
+  default     = "confidential"
+}
+
+variable "git-origin" {
+  type        = string
+  default     = "https://https://github.com/CMSgov/qpp-conversion-tool.git"
+}