218 terraform lockfiles use s3 not dynamodb (#219)

* Use S3 native state locking instead of DynamoDB (#218)

Replace the deprecated dynamodb_table backend parameter with
use_lockfile = true, drop the DynamoDB statement from the live
IncubatorTfPlanSecretsRead policy, and remove the lock-table setup
from CONTRIBUTING.md and the pre-work issue template.

The backend.tf comment makes the terraform-plan/apply workflows
trigger, since they only filter on **/*.tf.

* Clarify changes migrating lockfiles to s3 from dynamodb

Continues #218

Author: here

.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md

@@ -35,9 +35,8 @@ As a new member on the HfLA devops-security team, fill in the following fields a
     - [ ] [Generating user access keys](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#generating-access-keys-for-aws-cli)
 - [ ] Complete the instructions in [AWS Documentation](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-install.html) and choose your operating system to install AWS CLI. 
 - [ ] Complete the instruction in [AWS Documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-short-term.html) to setup the AWS CLI.
-- [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket and DynamoDB table.
-  - [ ] Create the S3 bucket
-  - [ ] Create the DynamoDB table
+- [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket.
+- [ ] Create the S3 bucket
 - [ ] Install Terraform locally by following the instructions of the installation guide mentioned in [Installing Terraform](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform)
 - [ ] Install Terraform Docs locally by following the instructions of the installation guide mentioned in [Installing Terraform docs](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform-docs)
 - [ ] Complete the instructions in [Clone the repository](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#clone-the-repository)
@@ -78,7 +77,7 @@ Note: You must be authenticated to your AWS account via the CLI for the next com
 If you are unable to authenticate from your local machine using the CLI, post in the #ops channel in Slack so that the team can help you get unblocked.
 - [ ] Execute the command `terraform init` to initialize terraform in the directory. Address any failures that arise (if any).
 - [ ] Execute the command `terraform plan` this will output a plan replicating the same IAM resources as the devops security account. Address any failures that arise (if any).
-- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security. All of the resources created here incur zero cost except for the Dynamo DB installation, which should remain in the free tier. **
+- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security.  All of the resources created here incur zero cost.
   - [ ] **If you have cost concerns, Run a Terraform Destroy to take down all of the resources you created (don't worry, you can recreate them just as quickly). If you create resources outside of what's described in this issue, you may incur charges.**
 - [ ] Update the README using Terraform Docs to document changes
   - [ ] ```terraform-docs -c .terraform.docs.yml .```

CONTRIBUTING.md

@@ -154,22 +154,6 @@ aws s3api put-bucket-encryption --bucket USERNAME-hfla-ops-terraform-state --ser
 }'
 ```
 
-#### Set up DynamoDB to store the backend state
-
-- Create table `hfla_ops_terraform_table`
-- Set partition key to `LockID` with a type of `string`
-- Choose on-demand capacity
-
-You can create the table from the AWS UI, CloudShell, or from the CLI using the following command:
-
-```bash
-aws dynamodb create-table \
-    --table-name hfla_ops_terraform_table \
-    --attribute-definitions AttributeName=LockID,AttributeType=S \
-    --key-schema AttributeName=LockID,KeyType=HASH \
-    --billing-mode PAY_PER_REQUEST
-```
-
 <sub>[Back to Top](#)</sub>
 ***
 
@@ -248,7 +232,7 @@ After creating a backend state, create a `backend.tfvars` file in the `terraform
 bucket         = "USERNAME-hfla-ops-terraform-state"
 key            = "devops-security/terraform.tfstate"
 region         = "us-west-2"
-dynamodb_table = "hfla_ops_terraform_table"
+use_lockfile   = true
 encrypt        = true
 ```
 

terraform/aws-custom-policies/tf-plan-scoped.json

@@ -25,20 +25,6 @@
         "arn:aws:s3:::hfla-ops-terraform-state",
         "arn:aws:s3:::hfla-ops-terraform-state/*"
       ]
-    },
-    {
-      "Sid": "AllowDynamoDBLockTableAccessForTerraformPlan",
-      "Effect": "Allow",
-      "Action": [
-        "dynamodb:PutItem",
-        "dynamodb:DeleteItem",
-        "dynamodb:GetItem",
-        "dynamodb:UpdateItem",
-        "dynamodb:DescribeTable"
-      ],
-      "Resource": [
-        "arn:aws:dynamodb:us-west-2:035866691871:table/hfla_ops_terraform_table"
-      ]
     }
   ]
 }

terraform/backend.tf

@@ -4,6 +4,7 @@ terraform {
   // CI silently upgraded itself -- state has been written by 1.7 through 1.16.
   // This line alone chooses the CI Terraform version.
   required_version = "~> 1.16.0"
+  // Locking config lives in terraform/prod.backend.tfvars (use_lockfile).
   backend "s3" {
   }
   required_providers {

terraform/prod.backend.tfvars

@@ -1,5 +1,5 @@
 bucket         = "hfla-ops-terraform-state"
 key            = "devops-security/terraform.tfstate"
 region         = "us-west-2"
-dynamodb_table = "hfla_ops_terraform_table"
+use_lockfile   = true
 encrypt        = true