OpenTacoで複数のAWSアカウントにリソースをデプロイしてみる

├── ./.github
│   └── ./.github/workflows/digger-workflow.yml
├── ./digger.yml
├── ./prod
│   └── ./prod/main.tf
├──  ./stg
│   └── ./stg/main.tf
└──  ./README.md

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "6.28.0"
    }
  }
  backend "s3" {
    bucket = "terraform-state-XXXXXX"
    key    = "digger/quickstart-actions-aws/terraform/state"
    region = "ap-northeast-1"
  }
}

provider "aws" {
  region = "us-east-1" # Replace with your desired AWS region
}

resource "aws_vpc" "vpc_network" {
  cidr_block = "10.0.0.0/16"
  tags = {
    Name = "terraform-network"
  }
}

resource "aws_subnet" "vpc_subnet" {
  vpc_id                  = aws_vpc.vpc_network.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = true

  tags = {
    Name = "terraform-subnet"
  }
}

resource "aws_security_group" "security_group" {
  vpc_id      = aws_vpc.vpc_network.id
  name_prefix = "terraform-"
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "vm_instance" {
  ami                    = "ami-05c13eab67c5d8861" # us-east-1 Amazon Linux 2023 AMI 2023.2.20231030.1 x86_64 HVM kernel-6.1
  instance_type          = "t2.micro"
  subnet_id              = aws_subnet.vpc_subnet.id
  vpc_security_group_ids = [aws_security_group.security_group.id]
  tags = {
    Name = "terraform-instance"
  }
}

projects:
- name: production
  dir: prod
  aws_role_to_assume:
      command: "arn:aws:iam::1234567890:role/github-actions-role"
- name: staging
  dir: stg
  aws_role_to_assume:
      command: "arn:aws:iam::2345678901:role/github-actions-role"

name: Digger Workflow

on:
  workflow_dispatch:
    inputs:
      spec:
        required: true
      run_name:
        required: false

run-name: '${{inputs.run_name}}'

jobs:
  digger-job:
    runs-on: ubuntu-latest
    permissions:
      contents: write      # required to merge PRs
      actions: write       # required for plan persistence
      id-token: write      # required for workload-identity-federation
      pull-requests: write # required to post PR comments
      issues: read         # required to check if PR number is an issue or not
      statuses: write      # required to validate combined PR status

    steps:
      - uses: actions/checkout@v4
      - name: ${{ fromJSON(github.event.inputs.spec).job_id }}
        run: echo "job id ${{ fromJSON(github.event.inputs.spec).job_id }}"
      - uses: diggerhq/digger@vLatest
        with:
          digger-spec: ${{ inputs.spec }}
          setup-aws: false
          setup-terraform: true
          terraform-version: 1.14.3
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

$ aws ec2 describe-instances --profile prod --query 'Reservations[*].Instances[*].[InstanceId,State.Name,InstanceType]' --output table
------------------------------------------------
|               DescribeInstances              |
+----------------------+----------+------------+
|  i-01XXXXXXXXXXX |  running |  t2.micro  |
+----------------------+----------+------------+
$ aws ec2 describe-instances --profile stg --query 'Reservations[*].Instances[*].[InstanceId,State.Name,InstanceType]' --output table
------------------------------------------------
|               DescribeInstances              |
+----------------------+----------+------------+
|  i-09XXXXXXXXXXX |  running |  t2.micro  |
+----------------------+----------+------------+