GitHub Action: atmos-terraform-drift-remediation

This Github Action is used to remediate drift

Introduction

This action is used for drift remediation.

There is another companion action github-action-atmos-terraform-drift-detection.

Usage

Workflow example

In this example drift will be remediated when user sets label apply to an issue.

name: github-action-atmos-terraform-drift-remediation
run-name: github-action-atmos-terraform-drift-remediation

on:
  issues:
    types:
      - labeled
      - closed

permissions:
  id-token: write
  contents: read

jobs:
  remediate-drift:
    runs-on: ubuntu-latest
    name: github-action-atmos-terraform-drift-remediation
    if: |
      github.event.action == 'labeled' &&
      contains(join(github.event.issue.labels.*.name, ','), 'apply')
    steps:
      - name: github-action-atmos-terraform-drift-remediation
        uses: cloudposse/github-action-atmos-terraform-drift-remediation@v1
        with:
          issue-number: ${{ github.event.issue.number }}
          action: remediate
          atmos-config-path: "${{ github.workspace }}/rootfs/usr/local/etc/atmos/"
          terraform-plan-role: "arn:aws:iam::111111111111:role/acme-core-gbl-identity-gitops"
          terraform-state-bucket: "acme-core-ue2-auto-gitops"
          terraform-state-role: "arn:aws:iam::999999999999:role/acme-core-ue2-auto-gitops-gha"
          terraform-state-table: "acme-core-ue2-auto-gitops"
          aws-region: "us-east-2"

  discard-drift:
    runs-on: ubuntu-latest
    name: github-action-atmos-terraform-drift-remediation
    if: |
      github.event.action == 'closed' &&
      !contains(join(github.event.issue.labels.*.name, ','), 'remediated')
    steps:
      - name: github-action-atmos-terraform-drift-remediation
        uses: cloudposse/github-action-atmos-terraform-drift-remediation@v1
        with:
          issue-number: ${{ github.event.issue.number }}
          action: discard

Inputs

Name	Description	Default	Required
action	Drift remediation action. One of ['remediate', 'discard']	remediate	false
atmos-config-path	The path to the folder where atmos.yaml file is located	.	false
atmos-version	Atmos version to use for vendoring. Default 'latest'	latest	false
aws-region	AWS region for assuming identity.	us-east-1	false
debug	Enable action debug mode. Default: 'false'	false	false
issue-number	Issue Number	N/A	true
terraform-apply-role	The AWS role to be used to apply Terraform. Required for action 'remediate'.	N/A	false
terraform-state-bucket	The S3 Bucket where the planfiles are stored. Required for action 'remediate'.	N/A	false
terraform-state-role	The AWS role to be used to retrieve the planfile from AWS. Required for action 'remediate'.	N/A	false
terraform-state-table	The DynamoDB table where planfile metadata is stored. Required for action 'remediate'.	N/A	false
terraform-version	The version of Terraform CLI to install. Instead of full version string you can also specify constraint string starting with "<" (for example <1.13.0) to install the latest version satisfying the constraint. A value of latest will install the latest version of Terraform CLI. Defaults to latest.	latest	false
token	Used to pull node distributions for Atmos from Cloud Posse's GitHub repository. Since there's a default, this is typically not supplied by the user. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.	${{ github.server_url == 'https://github.com' && github.token || '' }}	false