diff --git a/README.md b/README.md
index 8b5dcfc23fcb4f63ec6eea81d811278c5e24d743..a5ada76c636a0a7c1cb15541f4945aa19bd1a83b 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ container startup, these configurations can be used to start subsequent containe
* `data` - contains the configuration data for mapping and integration components.
* `conf` - contains Secure Agent runtime configuration files.
1. `infaagent.ini` - contains the registration information for the secure agent(this will be populated by Secure Agent during start up).
- 2. `proxy.ini` - proxy configurations for Secure Agent, if running behind a [proxy](https://kb.informatica.com/howto/6/pages/20/512361.aspx) server.
+ 2. `proxy.ini` - proxy configurations for Secure Agent, if running behind a [proxy](https://docs.informatica.com/integration-cloud/cloud-platform/current-version/administrator/runtime-environments/secure-agents/configuring-a-proxy-to-exclude-non-proxy-hosts.html) server.
Following ports(among others) in Secure Agents can be mapped to host for externalized control.
* `7080` - Process Engine shutdown port.
@@ -112,16 +112,28 @@ Secure Agent containers are deployed in following tiers in interop/AWS account.
| prod | us-east-2(Ohio)|
-## Terraform
+## CI/CD and Terraform
* Infrastructure is available as code in terraform.
* Before disposing and create a new instance of Informatica Secure Agent, existing live connections to various targets(for e.g. databases)
should be reviewed and terminated. Due to this reason this is not part of CI/CD pipeline and can be executed as per necessity.
* Various configurations can be overridden using `-var=`, see [variables.tf](./terraform/variables.tf) for available parameters.
-```
+See Terraform doc on [variables](https://www.terraform.io/docs/configuration/variables.html) to see how to pass command line arguments.
+* Secure Agent Docker images are tagged using the value, `git-${CI_COMMIT_SHA:0:8}`, and push to ECR registry in `us-east-1`. The same
+image can be used for production set up.
+
+### Credentials in Terraform
+* It's recommended that to avoid having Informatica credentials in bash history, all the variables can be defined in a `*.tfvars`
+file and pass to terraform using `-var-file` argument to terraform.
+
+```shell script
$ cd terraform
$ terraform init
$ terraform validate
-$ terraform plan -out agent.tfplan
+$ terraform plan -out agent.tfplan \
+ -var="aws_shared_cred_file=<aws-credentials-file>" \
+ -var="aws_profile=<aws-profile>" \
+ -var="informatica_username=<informatica-username>" \
+ -var="informatica_password=<informatica-password>" \
+ -var="image_name=265723766240.dkr.ecr.us-east-1.amazonaws.com/enterprise-integrations/iics_secure_agent:<tag>"
$ terraform apply "agent.tfplan"
-```
-* See Terraform doc on [variables](https://www.terraform.io/docs/configuration/variables.html) to see how to pass command line arguments.
\ No newline at end of file
+```
\ No newline at end of file
diff --git a/terraform/ecr.tf b/terraform/ecr.tf
deleted file mode 100644
index dcf7ae4f3ec1df604e125f5613eca688f25e1df0..0000000000000000000000000000000000000000
--- a/terraform/ecr.tf
+++ /dev/null
@@ -1,6 +0,0 @@
-# this repository is being used by
-# .gitlab-ci.yml to publish the image
-resource "aws_ecr_repository" "foo" {
- name = var.ecr_repository_name
- tags = var.ecr_repository_tags
-}
\ No newline at end of file
diff --git a/terraform/ecs.tf b/terraform/ecs.tf
index 4031ae97b2cbff0f0a37a5461e1205e11294dcc9..ec0773d5df29b0680f9550b0e064c3c2bdcb1be7 100644
--- a/terraform/ecs.tf
+++ b/terraform/ecs.tf
@@ -1,14 +1,16 @@
data "template_file" "container" {
template = file("./templates/container.tpl")
vars = {
- container_name = var.container_name
- image_name = var.image_name
- fargate_cpu = var.fargate_cpu
- fargate_memory = var.fargate_memory
- app_port1 = var.container_app_port[0]
- app_port2 = var.container_app_port[1]
- app_port3 = var.container_app_port[2]
- network_mode = var.container_network_mode
+ container_name = var.container_name
+ image_name = var.image_name
+ fargate_cpu = var.fargate_cpu
+ fargate_memory = var.fargate_memory
+ app_port1 = var.container_app_port[0]
+ app_port2 = var.container_app_port[1]
+ app_port3 = var.container_app_port[2]
+ network_mode = var.container_network_mode
+ informatica_username = var.informatica_username
+ informatica_password = var.informatica_password
}
}
diff --git a/terraform/provider.tf b/terraform/provider.tf
index cceb810c04a0db753540abd900fd02332b35788c..62ce47614f18cedec51b84ceeadf2a711de117c1 100644
--- a/terraform/provider.tf
+++ b/terraform/provider.tf
@@ -1,7 +1,5 @@
provider "aws" {
- access_key = var.aws_access_key
- secret_key = var.aws_secret_key
- region = var.aws_region
- allowed_account_ids = [
- var.aws_account_id]
+ region = var.aws_region
+ shared_credentials_file = var.aws_shared_cred_file
+ profile = var.aws_profile
}
\ No newline at end of file
diff --git a/terraform/templates/container.tpl b/terraform/templates/container.tpl
index f63dc8a4b2fc5b1ef3192ac33ca7ecf23ebc68a8..660198c050b87489730f49ce2ef7fd70806eabb0 100644
--- a/terraform/templates/container.tpl
+++ b/terraform/templates/container.tpl
@@ -18,6 +18,16 @@
"containerPort": ${app_port3},
"hostPort": ${app_port3}
}
+ ],
+ "environment": [
+ {
+ "name": "INFORMATICA_USER",
+ "value": "${informatica_username}"
+ },
+ {
+ "name": "INFORMATICA_PASSWORD",
+ "value": "${informatica_password}"
+ }
]
}
]
\ No newline at end of file
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 82a388921e233d4777ece2c921c77d0a27445222..007d69dfda8102f2c5f0090c03b5c27b07757220 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -1,11 +1,10 @@
-variable "aws_access_key" {}
-variable "aws_secret_key" {}
-variable "aws_account_id" {
- default = "265723766240"
+variable "aws_shared_cred_file" {}
+variable "aws_profile" {
+ default = "default"
}
variable "aws_region" {
- default = "us-east-1"
# test tier
+ default = "us-east-1"
}
variable "vpc_tags" {
@@ -32,11 +31,13 @@ variable "security_group" {
}
}
+# see git tagging in .gitlab-ci.yml for image name.
variable "image_name" {
- default = "265723766240.dkr.ecr.us-east-1.amazonaws.com/enterprise-integrations/iics_secure_agent"
+ description = "Secure Agent image name publish by .gitlab-ci.yml."
}
variable "container_name" {
+ description = "Container name for Secure Agent image."
default = "iics-secure-agent-test"
}
variable "container_network_mode" {
@@ -59,12 +60,12 @@ variable "container_count" {
# https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-cpu-memory-error.html
# see Secure Agent resource requirements for these numbers.
variable "fargate_cpu" {
- # 1 vCPU = 1024 CPU units
- default = "4096"
+ # 1 vCPU = 1024 CPU units
+ default = "4096"
}
variable "fargate_memory" {
- # in MiB
- default = "8192"
+ # in MiB
+ default = "8192"
}
# ecs
@@ -88,14 +89,5 @@ variable "ecs_service_name" {
default = "iics-agent-service"
}
-variable "ecr_repository_name" {
- default = "265723766240.dkr.ecr.us-east-1.amazonaws.com/enterprise-integrations/iics_secure_agent"
-}
-
-variable "ecr_repository_tags" {
- type = map(string)
- default = {
- Name = "iics-agent-repository"
- tier = "test"
- }
-}
\ No newline at end of file
+variable "informatica_username" {}
+variable "informatica_password" {}
\ No newline at end of file