Some finalizing docs

Veetaha · Veetaha · commit 07f671e466ac · 2025-03-21T19:46:26.000Z
diff --git a/.githooks/pre-commit b/.githooks/pre-commit
@@ -9,7 +9,7 @@
 # ln -s ../../.githooks/pre-commit .git/hooks/pre-commit
 # ```
 
-set -euxo pipefail
+set -euo pipefail
 
 function command_exists() {
   bin_name=$(basename "$1")
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -43,6 +43,7 @@ jobs:
         project:
           - asset-account/terraform/stack-set/examples/self-managed
           - asset-account/terraform/stack-set/examples/service-managed
+          - connector/terraform/examples/basic
 
     steps:
       - uses: actions/checkout@v4
diff --git a/.tflint.hcl b/.tflint.hcl
@@ -23,3 +23,8 @@ plugin "azurerm" {
     version = "0.27.0"
     source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
 }
+
+# There is no need to create empty `outputs.tf` or `variables.tf` files.
+rule "terraform_standard_module_structure" {
+  enabled = false
+}
diff --git a/asset-account/terraform/stack-set/.module.toml b/asset-account/terraform/stack-set/.module.toml
@@ -1,5 +1,5 @@
 [module]
 name = "aws-elastio-asset-account-stack-set"
-description = "Terraform module for creating an asset account stack"
+description = "Terraform module for creating the Elastio Asset Account stack"
 type = "terraform"
 version = "0.33.0"
diff --git a/asset-account/terraform/stack-set/README.md b/asset-account/terraform/stack-set/README.md
@@ -28,14 +28,14 @@ module "elastio_asset_account" {
 
 | Name                                                                     | Version |
 | ------------------------------------------------------------------------ | ------- |
-| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | >= 1.0  |
-| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | >= 5.0  |
+| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.0  |
+| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | ~> 5.0  |
 
 ## Providers
 
 | Name                                             | Version |
 | ------------------------------------------------ | ------- |
-| <a name="provider_aws"></a> [aws](#provider_aws) | >= 5.0  |
+| <a name="provider_aws"></a> [aws](#provider_aws) | ~> 5.0  |
 
 ## Modules
 
diff --git a/asset-account/terraform/stack-set/examples/self-managed/outputs.tf b/asset-account/terraform/stack-set/examples/self-managed/outputs.tf
diff --git a/asset-account/terraform/stack-set/examples/self-managed/versions.tf b/asset-account/terraform/stack-set/examples/self-managed/versions.tf
@@ -1,10 +1,10 @@
 terraform {
-  required_version = ">= 1.0"
+  required_version = "~> 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = "~> 5.0"
     }
   }
 }
diff --git a/asset-account/terraform/stack-set/examples/service-managed/outputs.tf b/asset-account/terraform/stack-set/examples/service-managed/outputs.tf
diff --git a/asset-account/terraform/stack-set/examples/service-managed/versions.tf b/asset-account/terraform/stack-set/examples/service-managed/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 1.0"
+  required_version = "~> 1.0"
 }
diff --git a/asset-account/terraform/stack-set/outputs.tf b/asset-account/terraform/stack-set/outputs.tf
@@ -1,4 +1,3 @@
-
 output "stack_set" {
   value       = aws_cloudformation_stack_set.this
   description = <<DESCR
diff --git a/asset-account/terraform/stack-set/versions.tf b/asset-account/terraform/stack-set/versions.tf
@@ -1,10 +1,10 @@
 terraform {
-  required_version = ">= 1.0"
+  required_version = "~> 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = "~> 5.0"
     }
   }
 }
diff --git a/connector/terraform/.module.toml b/connector/terraform/.module.toml
@@ -0,0 +1,5 @@
+[module]
+name = "aws-elastio-connector"
+description = "Terraform module for creating the Elastio Connector Account and Region stacks"
+type = "terraform"
+version = "0.33.0"
diff --git a/connector/terraform/README.md b/connector/terraform/README.md
@@ -1,6 +1,6 @@
-# Elastio Terraform Deployment
+# Elastio Connector Terraform Deployment
 
-This is an example of how you may automate the deployment of the Elastio stack in your AWS account.
+This directory contains terraform modules that you may use to automate the deployment of the Elastio Connector stacks in your AWS accounts.
 
 ## Obtain a Personal Access Token (PAT)
 
@@ -18,51 +18,60 @@ First of all, you'll need a secret PAT token to authenticate your Elastio instal
 
 ## Add Elastio to Your Terraform
 
-There is a terraform module under the `module` directory. It deploys all the necessary resources for Elastio to operate. It includes the following:
+There is are several terraform modules that you can use. We'll review all of them below.
 
-- AWS Cloudformation stack named `elastio-account-level-stack`, which is deployed once per AWS account and contains the required IAM resources
-- Elastio Cloud Connector stack deployed by Elastio Portal via a REST API call. It contains Lambda functions, DynamoDB databases, S3 buckets, AWS Batch compute environments and other non-IAM resources.
-- _Optional._ AWS Cloudformation stack named `elastio-nat-provision-lambda` which deploys NAT gateways in the private subnets where Elastio scan job workers run. This is necessary only if you deploy Elastio into private subnets that don't have outbound Internet access already. Alternatively, you can deploy your own NAT gateway if you want to.
+## Installation
 
-Add this terraform module to your terraform project and specify the necessary input variables. Here you'll need to pass the PAT token you [generated earlier](#obtain-a-personal-access-token-pat), specify your Elastio tenant name and the list of regions with VPC/subnet configurations where you want to deploy Elastio.
+[Configure](../../README.md#configuring-the-terraform-modules-registry) the Elastio terraform module registry before adding any Elastio terraform modules to your project.
+
+### `elastio-connector` module
+
+This module provides the easiest way to get started. It resides as the top-level module in this directory. It deploys all the necessary resources for Elastio to operate in a single module for the entire AWS account and covers many regions.
+
+Add this terraform module to your terraform project and specify the necessary input variables. Here you'll need to pass the PAT token you [generated earlier](#obtain-a-personal-access-token-pat).
 
 > [!IMPORTANT]
 > Make sure `curl` of version _at least_ `7.76.0` is installed on the machine that runs the terraform deployment (`terraform apply`). The provided terraform module uses a `local-exec` provisioner that uses `curl` to do a REST API call to Elastio Portal.
 
-Here is an example usage of the module
+Here is the basic example usage of the module that deploys Elastio Connectors in several regions allowing you to scan your assets in these regions.
 
 ```tf
-provider "aws" {}
-provider "http" {}
+module "elastio_connectors" {
+  source  = "terraform.cloudsmith.io/public/elastio-connector/aws"
+  version = "0.33.0"
+
+  elastio_tenant = var.elastio_tenant
+  elastio_pat    = var.elastio_pat
 
-module "elastio" {
-  source = "./module"
-  elastio_pat = "{pat_token_from_elastio_portal}"
-  elastio_tenant = "mycompany.app.elastio.com"
   elastio_cloud_connectors = [
     {
-      region = "us-east-2"
-      vpc_id = "vpc-0001"
-      subnet_ids = [
-        "subnet-0001",
-        "subnet-0002"
-      ]
+      region = "us-east-1"
     },
     {
-      region = "us-east-1"
-      vpc_id = "vpc-0002"
-      subnet_ids = [
-        "subnet-0003",
-        "subnet-0004",
-      ]
+      region = "us-east-2",
     }
-
-    # Other optional configuration tweaks. See `module/variables.tf` for more info
-    # iam_resource_names_prefix = "prefix"
   ]
-
-  # This input is optional. Here you can specify the version of the NAT provisioning stack.
-  # If you don't need it, just omit this input variable.
-  elastio_nat_provision_stack = "v5"
 }
 ```
+
+You can find the full version of this example in [`examples/basic`](./examples/basic).
+
+This module deploys the following three modules internally, that you can deploy individually if a finer grained control over the deployment is required. You may use them, for example, if you need to deploy regional stacks in separate terraform projects instead of using a single one that deploys all regions.
+
+### `elastio-connector-account` module
+
+Creates an AWS Cloudformation stack named `elastio-account-level-stack`, which is deployed once per AWS account and contains the required IAM resources (roles, policies, etc.) for Elastio Connector to operate in the same account.
+
+See [`modules/account`](./modules/account) directory for details.
+
+### `elastio-connector-region` module
+
+Deploys the Elastio Cloud Connector stack via a REST API call to the Elastio Portal. The final stack contains Lambda functions, DynamoDB databases, S3 buckets, AWS Batch compute environments and other non-IAM resources.
+
+See [`modules/region`](./modules/region) directory for details.
+
+### `elastio-nat-provision` module
+
+_Optional._ AWS Cloudformation stack named `elastio-nat-provision-lambda` which deploys NAT gateways in the private subnets where Elastio scan job workers run. This is necessary only if you deploy Elastio into private subnets that don't have outbound Internet access already. Alternatively, you can deploy your own NAT gateway if you want to.
+
+See [`modules/nat-provision`](./modules/nat-provision) directory for details.
diff --git a/connector/terraform/examples/basic/main.tf b/connector/terraform/examples/basic/main.tf
@@ -1,4 +1,3 @@
-
 module "elastio_connectors" {
   source = "../../"
 
@@ -13,6 +12,4 @@ module "elastio_connectors" {
       region = "us-east-2",
     }
   ]
-
-  elastio_nat_provision_stack = "v5"
 }
diff --git a/connector/terraform/examples/basic/variables.tf b/connector/terraform/examples/basic/variables.tf
@@ -10,30 +10,3 @@ variable "elastio_tenant" {
   type        = string
   nullable    = false
 }
-
-variable "elastio_cloud_connectors" {
-  description = <<DESCR
-    List of regions where Cloud Connectors are to be deployed, VPC and subnet(s) to use,
-    and other regional configurations (mostly for regulatory compliance).
-  DESCR
-
-  type = list(object({
-    region     = string
-    vpc_id     = optional(string)
-    subnet_ids = optional(list(string))
-
-    s3_access_logging = optional(object({
-      target_bucket = string
-      target_prefix = optional(string)
-
-      # Can be one of the following:
-      # - SimplePrefix
-      # - PartitionedPrefix:EventTime
-      # - PartitionedPrefix:DeliveryTime
-      target_object_key_format = optional(string)
-    }))
-  }))
-
-  nullable = false
-  default  = []
-}
diff --git a/connector/terraform/examples/basic/versions.tf b/connector/terraform/examples/basic/versions.tf
@@ -0,0 +1,3 @@
+terraform {
+  required_version = "~> 1.0"
+}
diff --git a/connector/terraform/modules/account/.module.toml b/connector/terraform/modules/account/.module.toml
@@ -0,0 +1,5 @@
+[module]
+name = "aws-elastio-connector-account"
+description = "Terraform module for creating the Elastio Connector Account stack"
+type = "terraform"
+version = "0.33.0"
diff --git a/connector/terraform/modules/account/README.md b/connector/terraform/modules/account/README.md
@@ -0,0 +1,18 @@
+# `elastio-connector-account` module
+
+Deploys an AWS Cloudformation stack named `elastio-account-level-stack`, which is deployed once per AWS account and contains the required IAM resources (roles, policies, etc.) for Elastio Connector to operate in the same account.
+
+See the [`elastio-connector` module implementation](../../main.tf) for an example of how this module should be used.
+
+## Installation
+
+[Configure](../../README.md#configuring-the-terraform-modules-registry) the Elastio terraform module registry, and add this to your project:
+
+```tf
+module "elastio_connector_account" {
+  source  = "terraform.cloudsmith.io/public/elastio-conenctor-account/aws"
+  version = "0.33.0"
+
+  // Provide input parameters
+}
+```
diff --git a/connector/terraform/modules/nat-provision/.module.toml b/connector/terraform/modules/nat-provision/.module.toml
@@ -0,0 +1,5 @@
+[module]
+name = "aws-elastio-nat-provision"
+description = "Terraform module for creating the Elastio NAT Provision stack"
+type = "terraform"
+version = "0.33.0"
diff --git a/connector/terraform/modules/nat-provision/README.md b/connector/terraform/modules/nat-provision/README.md
@@ -0,0 +1,18 @@
+# `elastio-nat-provision` module
+
+Creates an AWS Cloudformation stack named `elastio-nat-provision-lambda` which deploys NAT gateways in the private subnets where Elastio scan job workers run. This is necessary only if you deploy Elastio into private subnets that don't have outbound Internet access already. Alternatively, you can deploy your own NAT gateway if you want to.
+
+See the [`elastio-connector` module implementation](../../main.tf) for an example of how this module should be used.
+
+## Installation
+
+[Configure](../../README.md#configuring-the-terraform-modules-registry) the Elastio terraform module registry, and add this to your project:
+
+```tf
+module "elastio_nat_provision" {
+  source  = "terraform.cloudsmith.io/public/elastio-nat-provision/aws"
+  version = "0.33.0"
+
+  // Provide input parameters
+}
+```
diff --git a/connector/terraform/modules/nat-provision/outputs.tf b/connector/terraform/modules/nat-provision/outputs.tf
diff --git a/connector/terraform/modules/region/.module.toml b/connector/terraform/modules/region/.module.toml
@@ -0,0 +1,5 @@
+[module]
+name = "aws-elastio-connector-region"
+description = "Terraform module for creating the Elastio Connector Region stack"
+type = "terraform"
+version = "0.33.0"
diff --git a/connector/terraform/modules/region/README.md b/connector/terraform/modules/region/README.md
@@ -0,0 +1,18 @@
+# `elastio-connector-region` module
+
+Deploys the Elastio Cloud Connector stack via a REST API call to the Elastio Portal. The final stack contains Lambda functions, DynamoDB databases, S3 buckets, AWS Batch compute environments and other non-IAM resources.
+
+See the [`elastio-connector` module implementation](../../main.tf) for an example of how this module should be used.
+
+## Installation
+
+[Configure](../../README.md#configuring-the-terraform-modules-registry) the Elastio terraform module registry, and add this to your project:
+
+```tf
+module "elastio_connector_region" {
+  source  = "terraform.cloudsmith.io/public/elastio-connector-region/aws"
+  version = "0.33.0"
+
+  // Provide input parameters
+}
+```
diff --git a/connector/terraform/modules/region/outputs.tf b/connector/terraform/modules/region/outputs.tf
diff --git a/connector/terraform/providers.tf b/connector/terraform/providers.tf
diff --git a/connector/terraform/versions.tf b/connector/terraform/versions.tf
@@ -0,0 +1,19 @@
+terraform {
+  required_version = "~> 1.0"
+
+  required_providers {
+    # It's used by child modules
+    # tflint-ignore: terraform_unused_required_providers
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+
+    # It's used by child modules
+    # tflint-ignore: terraform_unused_required_providers
+    http = {
+      source  = "hashicorp/http"
+      version = "~> 3.0"
+    }
+  }
+}

Original file line number	Diff line number	Diff line change
`@@ -23,3 +23,8 @@ plugin "azurerm" {`
`23`	`23`	`version = "0.27.0"`
`24`	`24`	`source = "github.com/terraform-linters/tflint-ruleset-azurerm"`
`25`	`25`	`}`
	`26`	`+`
	`27`	+# There is no need to create empty `outputs.tf` or `variables.tf` files.
	`28`	`+rule "terraform_standard_module_structure" {`
	`29`	`+ enabled = false`
	`30`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -1,10 +1,10 @@`
`1`	`1`	`terraform {`
`2`		`- required_version = ">= 1.0"`
	`2`	`+ required_version = "~> 1.0"`
`3`	`3`
`4`	`4`	`required_providers {`
`5`	`5`	`aws = {`
`6`	`6`	`source = "hashicorp/aws"`
`7`		`- version = ">= 5.0"`
	`7`	`+ version = "~> 5.0"`
`8`	`8`	`}`
`9`	`9`	`}`
`10`	`10`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,3 @@`
`1`	`1`	`terraform {`
`2`		`- required_version = ">= 1.0"`
	`2`	`+ required_version = "~> 1.0"`
`3`	`3`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,3 @@`
`1`		`-`
`2`	`1`	`output "stack_set" {`
`3`	`2`	`value = aws_cloudformation_stack_set.this`
`4`	`3`	`description = <<DESCR`