Setting up Terraform and GitHub

Publish Terraform templates

Publish the Terraform template defined by the application in GitHub to enable version control, collaboration, and centralized storage.

Before you begin

Role required: Terraform admin

Procedure

Create a GitHub repository dedicated to your Terraform templates.

Save the following codes in a separate file.

File name: awsaccount.tf

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~>5.0"
    }
  }
}

provider "aws" {
  region = var.region
}

resource "aws_organizations_account" "account" {
  email = var.root_email
  name = var.account_name
  tags = var.tags
  parent_id = var.parent_id
  close_on_deletion=var.close_delete
  create_govcloud=var.gov_cloud
}

resource "aws_budgets_budget" "cost" {
  name  = join("-", ["SN-CAM-Monthly-Budget", aws_organizations_account.account.id])
  count = var.monthly_budget > 0 ? 1 : 0
  budget_type  = "COST"
  limit_amount = var.monthly_budget
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  cost_filter {
    name = "LinkedAccount"
    values = [
      aws_organizations_account.account.id
    ]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = [var.root_email, var.notification_email]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 85
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = [var.root_email, var.notification_email]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = [var.root_email, var.notification_email]
  }
}

File name: variables.tf

variable "region" {
  type = string
  default = "us-east-1"
}

variable "account_name" {
  type = string
  description = "(Required) Account Name"
}

variable "root_email" {
  type = string
  description = "(Required) Account Email"
}

variable tags{
  type = map(string)
  description = "(Required) Tags for the resource"
}

variable "close_delete" {
  type = bool
  description = "Close Account on deletion"
  default = true
}

variable "gov_cloud" {
  type = bool
  description = "Gov Cloud Account"
  default = false
}

variable "parent_id" {
  type = string
  description = "(Required) Account Parent Organizational Unit"
}

variable monthly_budget {
  type = number
  default = 0
}

variable notification_email {
  type = string
  description = "Additional email where Budget Notifications are to be sent"
}

Push the Terraform files to the remote repository.
Make a note of the location or URL once the template is stored in the GitHub.

This template is then referenced in Terraform Cloud and the ServiceNow instance to automate the creation of a subscription account.

Important:

Don’t modify the template as the variables are closely connected to the application.

Create a Terraform organization for Cloud Account Management in Cloud Workspace

Integrate with Terraform Cloud/Terraform Enterprise to organize accounts, define workflows, enforce security, improve collaboration, and enhance scalability.

Before you begin

Role required: Terraform admin

Attributes required for this setup:

AWS Access Key
AWS Secret Key

Make sure you have access to Terraform Cloud or Terraform Enterprise to perform the following procedure.

Procedure

Log in and navigate to the Terraform Cloud (https://app.terraform.io/session) or Terraform Enterprise portal ( https://<tfe_server_url>/api/v1).
Select the user name or organization name.
In the modal window, enter a unique org name and other details.
Select Create Organization.
Note:
- After a new organization is created, you’ll receive confirmation within the platform. You can manage your organization settings, add members, and configure workspaces within your newly created organization.
- To see to the official Terraform documentation:
  
  Terraform Cloud: https://developer.hashicorp.com/terraform/cloud-docs/users-teams-organizations/organizations
  
  Terraform Enterprise: https://developer.hashicorp.com/terraform/cloud-docs/users-teams-organizations/organizations
In Terraform org, navigate to Settings > Variable set > Create variable set.

A variable set is a collection of variables shareable across multiple workspaces.
Provide a descriptive name like AWS credentials.
Select the appropriate scope (organization or a workspace).
Create two variable sets within the Variables section as follows:
- Key: AWS_ACCESS_KEY_ID and Value: <AWS access key>
- Key: AWS_SECRET_ACCESS_KEY and Value: <AWS secret key>
  Note:
  Select as Sensitive to restrict the visibility of credentials to unauthorized personnel with Terraform access.
For more details on variable sets, see https://developer.hashicorp.com/terraform/tutorials/cloud-get-started/cloud-create-variable-set#.

Integrate Terraform Cloud with GitHub

Integrate GitHub with Terraform to link workspaces to repositories, enabling version control, change tracking, and rollbacks.

Before you begin

Role required: Terraform admin or DevOps team member

Procedure

Go to the Terraform org created for this application.
Navigate to Settings > Providers.
Select Add a VCS provider.
From the GitHub drop-down list, choose a GitHub.com (Custom).
Select the link Register a new OAuth Application.
Select Register application.
Copy the client ID.
Select Generate a new client secret and copy the generated Client Secret.
Go back to the Terraform console where the Add a VCS provider page is open and paste both Client ID and Client Secret.
Select Connect and continue.
Select Authorize.

Note:
Follow the platform-specific instructions to authorize Terraform Cloud to access your GitHub repository.
For more details, see the official documentation: https://developer.hashicorp.com/terraform/cloud-docs/vcs/Github-enterprise.
On the Advance Settings page, select Skip and finish.

What to do next

Make a note of the OAuth Token ID and share it with the ServiceNow admin.

Create Terraform API token

Generating API tokens with limited permissions enhances security, enables fine-grained control, facilitates automation, and provides temporary access within your Terraform organization.

Before you begin

Role required: Terraform admin

Procedure

Log in to the Terraform console.
Select Account Settings from the user profile.
Select Tokens and then select Create an API token.
Enter Description.
Set the Expiration date.

Note:
The expiration date should align with the security standards of your company.
Select Generate token.
Share the following details with the ServiceNow admin to register in the ServiceNow instance:
- VCS Identifier or the GitHub repository location, where you have stored the Terraform template, for example: https://github.com/<your_repository>/cam-create-aws-account.
- Terraform Organization Name
- Terraform OAuth Token ID
- Terraform API Key Token
- Terraform URL

What to do next

Setting up Cloud Account Management in Cloud Workspace

Add members to the group

Set up Terraform API key in ServiceNow.

Set up scan configuration for data visualization.