This will create a end to end AWS pipeline deployment. The code will create the following:

• S3 backend for aviatrix resources
• CodeCommit repo to store aviatrix terraform code. The will also output the username, password and https git clone url to clone the repo to your local machine
• Creation of a SG, private subnet, route table for codebuild. EIP for NAT gw.
• CodeBuild projects for terraform plan and apply, creation and deletion of NAT gateway during deployment
• CodePipeline (with manual approval to prevent auto-apply) to deploy avaitrix resources

• Aviatrix controller deployed and accounts onboarded
• Docker hub account https://hub.docker.com/ (A docker image with terraform preinstalled will be used in the codebuild phase)
• AWS secrets

For docker credentials and aviatrix controller credentials

• Docker secrets

• Once you create an account in docker hub, create a secret in AWS secrets manager with the username and password you used on docker hub

• Obtain the arn of the secret you just created

• Aviatrix controller secrets

• Create a secret key AVIATRIX_CONTROLLER_IP with the name controller_ip. The value is the private IP of the controller.

These will be used as environment variables to login to the controller later during the build stage

• Create a secret key AVIATRIX_PASSWORD with the name controller_password

The following variables are required:

• Download the code, fill out the variable values in terraform.tfvars and then do:

terraform init
terraform plan
terraform apply

Successful completion of the above step would also create a file called backend.tf under the directory use-for-tfstate

git clone <output of repo_clone_url>

Use the username and password from the output values

Copy the backend.tf file from the directory use-for-tfstate to the cloned repo. This will be used as the S3 backend for aviatrix resources

Add code to the repo

Sample main.tf

module "aws_transit" {
  source  = "terraform-aviatrix-modules/mc-transit/aviatrix"
  version = "2.1.3"

  cloud         = "aws"
  region        = "eu-west-3"
  cidr          = "10.1.0.0/23"
  account       = "aws-acc"
}

Push the code to the repo and the pipeline will automatically trigger in a few minutes. If everything is OK, the pipeline would stop just before the last stage (terraform apply -auto-approve) and would send an email to the user to manually approve the change

After manual approval, the pipeline would proceed to deploy the resources and finish successfully

A completed pipeline would look like this:

PS: I reused the base code related to codebuild/pipeline from https://github.com/davoclock/aws-cicd-pipeline and modified it to use AWS codecommit as the source and use AWS secret manager to set environmental vars in the buildspec yml files. I added an approval stage to use SNS notifications to alert the user. I also added additional codebuild projects to create and delete NAT gateway and corresponding codepipeline stages during the workflow.