azure-pipelines.yaml

variables:
  - group: ADO-TF-AWS-VPC-Int
  - name: region
    value: 'us-east-2'
  - name: CommaSeparatedListofWorkspaces
    value: "default, Dev, Test, Prod"
  
trigger:
  branches:
    include:
    - main
    exclude:
      - README.md
  
stages:
  - stage: Validate
    displayName: Validate
    jobs:
    - job: init
      displayName: Terraform validate
      pool:
        vmImage: ubuntu-latest
      steps:
      - task: PowerShell@2
        inputs:
          targetType: 'inline'
          script: 'terraform init -backend-config="bucket=terraform-remote-bucket-skundu" -backend-config="key=tf/terraform-workspace-poc/terraform.tfstate" -backend-config="region=$(region)" -backend-config="access_key=$(access_key)" -backend-config="secret_key=$(secret_key)" -no-color'
          workingDirectory: '$(build.sourcesdirectory)'
        displayName: Terraform init
      - task: Bash@3
        inputs:
          targetType: 'inline'
          script: 'pip install checkov'
        displayName: Install checkov
      - task: PowerShell@2
        inputs:
          filePath: 'ListWorkspace.ps1'
          arguments: '-CommaSeparatedListofWorkspaces "$(CommaSeparatedListofWorkspaces)"'
        displayName: Terraform validate
      - task: Bash@3
        inputs:
          targetType: 'inline'
          workingDirectory: $(System.DefaultWorkingDirectory)
          script: 'checkov -d . -o junitxml > scan-result.xml'
        displayName: Checkov source code scan
        continueOnError: true
      - task: PublishTestResults@2
        inputs:
          testResultsFormat: 'JUnit'
          searchFolder: '$(System.DefaultWorkingDirectory)'
          testResultsFiles: '**/*scan-result.xml'
          mergeTestResults: false
          testRunTitle: Terraform source code scan
          failTaskOnFailedTests: false
          publishRunAttachments: true
        displayName: Publish Test Result

  - stage: Dev
    displayName: Dev
    jobs:
      - job: plan
        pool:
          vmImage: ubuntu-latest
        displayName: Terraform plan
        steps:
        - task: Bash@3
          inputs:
            targetType: 'inline'
            script: 'pip install checkov'
          displayName: Install checkov
        - task: PowerShell@2
          inputs:
            targetType: 'inline'
            script: 'terraform init -backend-config="bucket=terraform-remote-bucket-skundu" -backend-config="key=tf/terraform-workspace-poc/terraform.tfstate" -backend-config="region=$(region)" -backend-config="access_key=$(access_key)" -backend-config="secret_key=$(secret_key)" -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: Terraform init
        - task: PowerShell@2
          inputs:
            targetType: 'inline'
            script: 'terraform workspace select Dev -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: "Terraform workspace: Dev"
        - task: PowerShell@2
          inputs:  
            targetType: 'inline'
            script: 'terraform plan -var access_key=$(access_key) -var secret_key=$(secret_key) -out main.tfplan -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: "Terraform plan"
        - task: Bash@3
          inputs:
            targetType: 'inline'
            workingDirectory: $(System.DefaultWorkingDirectory)            
            script: |
                    terraform show -json main.tfplan > main.json
                      checkov -f main.json -o junitxml > Checkov-Plan-Report.xml
          continueOnError: true
          displayName: Checkov plan scan
        - task: PublishTestResults@2
          inputs:
            testResultsFormat: 'JUnit'
            searchFolder: '$(System.DefaultWorkingDirectory)'
            testResultsFiles: '**/*Checkov-Plan-Report.xml'
            mergeTestResults: false
            testRunTitle: Checkov Dev workspace plan scan
            failTaskOnFailedTests: false
            publishRunAttachments: true
          displayName: Publish Test Result
      - job: approve
        dependsOn: plan
        condition: and (succeeded(), ne(variables['Build.Reason'], 'PullRequest'))
        pool: server
        displayName: Wait for approval
        steps:
        - task: ManualValidation@0
          timeoutInMinutes: 15 # task times out in 15 mins
          inputs:
            notifyUsers: skundu.dev@gmail.com
            instructions: 'Please validate the build configuration and resume'
            onTimeout: 'reject'
      - job: apply
        dependsOn: approve
        pool:
          vmImage: ubuntu-latest
        displayName: Terraform apply
        steps:
        - task: PowerShell@2
          inputs:
            targetType: 'inline'
            script: 'terraform init -backend-config="bucket=terraform-remote-bucket-skundu" -backend-config="key=tf/terraform-workspace-poc/terraform.tfstate" -backend-config="region=$(region)" -backend-config="access_key=$(access_key)" -backend-config="secret_key=$(secret_key)" -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: Terraform init
        - task: PowerShell@2
          inputs:
            targetType: 'inline'
            script: 'terraform workspace select Dev -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: "Terraform workspace: Dev"
        - task: PowerShell@2
          inputs:  
            targetType: 'inline'
            script: 'terraform apply -var region=$(region) -var access_key=$(access_key) -var secret_key=$(secret_key) --auto-approve -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: "Terraform apply"
  - stage: Test
    displayName: Test
    jobs:
      - job: plan
        pool:
          vmImage: ubuntu-latest
        displayName: Terraform plan
        steps:
        - task: Bash@3
          inputs:
            targetType: 'inline'
            script: 'pip install checkov'
          displayName: Install checkov
        - task: PowerShell@2
          inputs:
            targetType: 'inline'
            script: 'terraform init -backend-config="bucket=terraform-remote-bucket-skundu" -backend-config="key=tf/terraform-workspace-poc/terraform.tfstate" -backend-config="region=$(region)" -backend-config="access_key=$(access_key)" -backend-config="secret_key=$(secret_key)" -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: Terraform init
        - task: PowerShell@2
          inputs:
            targetType: 'inline'
            script: 'terraform workspace select Test -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: "Terraform workspace: Test"
        - task: PowerShell@2
          inputs:  
            targetType: 'inline'
            script: 'terraform plan -var access_key=$(access_key) -var secret_key=$(secret_key) -out main.tfplan -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: "Terraform plan"
        - task: Bash@3
          inputs:
            targetType: 'inline'
            workingDirectory: $(System.DefaultWorkingDirectory)            
            script: |
                    terraform show -json main.tfplan > main.json
                      checkov -f main.json -o junitxml > Checkov-Plan-Report.xml
          continueOnError: true
          displayName: Checkov plan scan
        - task: PublishTestResults@2
          inputs:
            testResultsFormat: 'JUnit'
            searchFolder: '$(System.DefaultWorkingDirectory)'
            testResultsFiles: '**/*Checkov-Plan-Report.xml'
            mergeTestResults: false
            testRunTitle: Checkov Test workspace plan scan
            failTaskOnFailedTests: false
            publishRunAttachments: true
          displayName: Publish Test Result
      - job: approve
        dependsOn: plan
        condition: and (succeeded(), ne(variables['Build.Reason'], 'PullRequest'))
        pool: server
        displayName: Wait for approval
        steps:
          - task: ManualValidation@0
            timeoutInMinutes: 15 # task times out in 15 mins
            inputs:
              notifyUsers: skundu.dev@gmail.com
              instructions: 'Please validate the build configuration and resume'
              onTimeout: 'reject'
      - job: apply
        dependsOn: approve
        pool:
            vmImage: ubuntu-latest
        displayName: Terraform apply
        steps:
          - task: PowerShell@2
            inputs:
              targetType: 'inline'
              script: 'terraform init -backend-config="bucket=terraform-remote-bucket-skundu" -backend-config="key=tf/terraform-workspace-poc/terraform.tfstate" -backend-config="region=$(region)" -backend-config="access_key=$(access_key)" -backend-config="secret_key=$(secret_key)" -no-color'
              workingDirectory: '$(build.sourcesdirectory)'
            displayName: Terraform init
          - task: PowerShell@2
            inputs:
              targetType: 'inline'
              script: 'terraform workspace select Test -no-color'
              workingDirectory: '$(build.sourcesdirectory)'
            displayName: "Terraform workspace: Test"
          - task: PowerShell@2
            inputs:  
              targetType: 'inline'
              script: 'terraform apply -var region=$(region) -var access_key=$(access_key) -var secret_key=$(secret_key) --auto-approve -no-color'
              workingDirectory: '$(build.sourcesdirectory)'
            displayName: "Terraform apply"
  - stage: Prod
    displayName: Prod
    jobs:
      - job: plan
        pool:
          vmImage: ubuntu-latest
        displayName: Terraform plan
        steps:
        - task: Bash@3
          inputs:
            targetType: 'inline'
            script: 'pip install checkov'
          displayName: Install checkov
        - task: PowerShell@2
          inputs:
            targetType: 'inline'
            script: 'terraform init -backend-config="bucket=terraform-remote-bucket-skundu" -backend-config="key=tf/terraform-workspace-poc/terraform.tfstate" -backend-config="region=$(region)" -backend-config="access_key=$(access_key)" -backend-config="secret_key=$(secret_key)" -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: Terraform init
        - task: PowerShell@2
          inputs:
            targetType: 'inline'
            script: 'terraform workspace select Prod -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: "Terraform workspace: Prod"
        - task: PowerShell@2
          inputs:  
            targetType: 'inline'
            script: 'terraform plan -var access_key=$(access_key) -var secret_key=$(secret_key) -out main.tfplan -no-color'
            workingDirectory: '$(build.sourcesdirectory)'
          displayName: "Terraform plan"
        - task: Bash@3
          inputs:
            targetType: 'inline'
            workingDirectory: $(System.DefaultWorkingDirectory)            
            script: |
                    terraform show -json main.tfplan > main.json
                      checkov -f main.json -o junitxml > Checkov-Plan-Report.xml
          continueOnError: true
          displayName: Checkov plan scan
        - task: PublishTestResults@2
          inputs:
            testResultsFormat: 'JUnit'
            searchFolder: '$(System.DefaultWorkingDirectory)'
            testResultsFiles: '**/*Checkov-Plan-Report.xml'
            mergeTestResults: false
            testRunTitle: Checkov Prod workspace plan scan
            failTaskOnFailedTests: false
            publishRunAttachments: true
          displayName: Publish Test Result
      - job: approve
        dependsOn: plan
        condition: and (succeeded(), ne(variables['Build.Reason'], 'PullRequest'))
        pool: server
        displayName: Wait for approval
        steps:
          - task: ManualValidation@0
            timeoutInMinutes: 15 # task times out in 15 mins
            inputs:
              notifyUsers: skundu.dev@gmail.com
              instructions: 'Please validate the build configuration and resume'
              onTimeout: 'reject'
      - job: apply
        dependsOn: approve
        pool:
            vmImage: ubuntu-latest
        displayName: Terraform apply
        steps:
          - task: PowerShell@2
            inputs:
              targetType: 'inline'
              script: 'terraform init -backend-config="bucket=terraform-remote-bucket-skundu" -backend-config="key=tf/terraform-workspace-poc/terraform.tfstate" -backend-config="region=$(region)" -backend-config="access_key=$(access_key)" -backend-config="secret_key=$(secret_key)" -no-color'
              workingDirectory: '$(build.sourcesdirectory)'
            displayName: Terraform init
          - task: PowerShell@2
            inputs:
              targetType: 'inline'
              script: 'terraform workspace select Prod -no-color'
              workingDirectory: '$(build.sourcesdirectory)'
            displayName: "Terraform workspace: Prod"
          - task: PowerShell@2
            inputs:  
              targetType: 'inline'
              script: 'terraform apply -var region=$(region) -var access_key=$(access_key) -var secret_key=$(secret_key) --auto-approve -no-color'
              workingDirectory: '$(build.sourcesdirectory)'
            displayName: "Terraform apply"