CFN for terraform State and Locks

terraform.cfn.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >
  wolfeidau: Terraform state and locks infrastructure
Parameters:
  Environment:
    Type: String
    Default: dev

Outputs:
  TerraformLockTableName:
    Value: !Ref TerraformLockTable
  TerraformStateBucketName:
    Value: !Ref TerraformStateBucket

Resources:
  TerraformStateBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled

  TerraformStateBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref TerraformStateBucket
      PolicyDocument:
        Statement:
          - Sid: AllowSSLRequestsOnly
            Effect: Deny
            Principal: "*"
            Action:
              - s3:*
            Resource:
              - Fn::Sub: arn:aws:s3:::${TerraformStateBucket}/*
              - Fn::Sub: arn:aws:s3:::${TerraformStateBucket}
            Condition:
              Bool:
                aws:SecureTransport: false

  TerraformLockTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: LockID
          AttributeType: S
      KeySchema:
        - AttributeName: LockID
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      SSESpecification:
        SSEEnabled: true

  TerraformStateBucketParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::Sub: /config/${Environment}/terraform_state_bucket
      Type: String
      Value:
        Ref: TerraformStateBucket

  TerraformLockTableParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::Sub: /config/${Environment}/terraform_lock_table
      Type: String
      Value:
        Ref: TerraformLockTable