bitovi/Bitovi Github Actions Commons repo
Deploy anything you want with this action. Contains multiple Terraform modules to give you what you are looking for.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Jan 27, 2026
- License
- MIT
Pinned Snippet
uses: bitovi/github-actions-commons@a6b570a9e649d217d906d7046251074beb6554ab # v2.0.9tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| checkout | Specifies if this action should checkout the code | no | true |
| bitops_skip_run | Will run the setup of the BitOps environment and exit. Only usefull to debug startup scripts. | no | false |
| bitops_code_only | Will run only the generation phase of BitOps, where the Terraform and Ansible code is built. | no | — |
| bitops_code_store | Store BitOps code as a GitHub artifact | no | — |
| bitops_extra_env_vars | Variables to be passed to BitOps as Docker extra vars. Format should be `-e KEY1=VALUE1 -e KEY2=VALUE2` | no | — |
| bitops_extra_env_vars_file | .env file to pass to BitOps Docker run. Usefull for long variables. | no | — |
| tf_stack_destroy | Set to "true" to Destroy the stack through Terraform. | no | — |
| tf_state_file_name | Change this to be anything you want to. Carefull to be consistent here. A missing file could trigger recreation, or stepping over destruction of non-defined objects. | no | — |
| tf_state_file_name_append | Append a string to the tf-state-file. Setting this to `unique` will generate `tf-state-aws-unique`. Can co-exist with the tf_state_file_name variable. | no | — |
| tf_state_bucket | AWS S3 bucket to use for Terraform state. Defaults to `${org}-${repo}-{branch}-tf-state` | no | — |
| tf_state_bucket_destroy | Force purge and deletion of S3 bucket defined. Any file contained there will be destroyed. `tf_stack_destroy` must also be `true` | no | — |
| tf_state_bucket_provider | Bucket provider for tfstate storage. | no | aws |
| tf_targets | A list of targets to create before the full stack creation. | no | — |
| ansible_skip | Skip Ansible execution after Terraform excecution. | no | — |
| ansible_ssh_to_private_ip | Make Ansible connect to the private IP of the instance. Only usefull if using a hosted runner in the same network. | no | — |
| ansible_start_docker_timeout | Ammount of time in seconds it takes Ansible to mark as failed the startup of docker. Defaults to `300` | no | — |
| gh_deployment_input_terraform | Folder to store Terraform files to be included during Terraform execution. | no | — |
| gh_deployment_input_ansible | Folder where a whole Ansible structure is expected. If missing bitops.config.yaml a default will be generated. | no | — |
| gh_deployment_input_ansible_playbook | Main playbook to be looked for. | no | playbook.yml |
| gh_deployment_input_ansible_extra_vars_file | Relative path to file from project root to Ansible vars file to be applied. | no | — |
| gh_deployment_action_input_ansible_extra_vars_file | Relative path to file from project root to Ansible vars file to be applied into the Action Ansible execution. | no | — |
| gh_deployment_input_helm_charts | Relative path to the folder from project containing Helm charts to be installed. Could be uncompressed or compressed (.tgz) files. | no | — |
| gh_action_repo | URL of calling repo | no | — |
| gh_action_input_terraform | Folder to store Terraform files to be included during Terraform execution. | no | — |
| gh_action_input_ansible | Folder where a whole Ansible structure is expected. If missing bitops.config.yaml a default will be generated. | no | — |
| gh_action_input_ansible_playbook | Main playbook to be looked for. | no | playbook.yml |
| gh_action_input_helm_charts | Relative path to the folder from action containing Helm charts to be installed. Could be uncompressed or compressed (.tgz) files. | no | — |
| aws_access_key_id | AWS access key ID | no | — |
| aws_secret_access_key | AWS secret access key | no | — |
| aws_session_token | AWS session token | no | — |
| aws_default_region | AWS default region | no | us-east-1 |
| aws_resource_identifier | Set to override the AWS resource identifier for the deployment. Defaults to `${org}-{repo}-{branch}`. Use with destroy to destroy specific resources. | no | — |
| aws_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| env_aws_secret | Secret name to pull env variables from AWS Secret Manager, could be a comma separated list, read in order. Expected JSON content. | no | — |
| env_repo | File containing environment variables to be used with the app | no | — |
| env_ghs | `.env` file to be used with the app from Github secrets | no | — |
| env_ghv | `.env` file to be used with the app from Github variables | no | — |
| aws_ec2_instance_create | Define if an EC2 instance should be created | no | — |
| aws_ec2_ami_filter | AWS AMI Filter string. Will be used to lookup for lates image based on the string. Defaults to `ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*`. | no | — |
| aws_ec2_ami_owner | Owner of AWS AMI image. This ensures the provider is the one we are looking for. Defaults to `099720109477`, Canonical (Ubuntu). | no | — |
| aws_ec2_ami_id | AWS AMI ID. Will default to lookup for latest image of the `aws_ec2_ami_filter` string. This will override `aws_ec2_ami_filter` lookup. | no | — |
| aws_ec2_ami_update | Set this to true if you want to recreate the EC2 instance if there is a newer version of the AMI. | no | — |
| aws_ec2_iam_instance_profile | The AWS IAM instance profile to use for the EC2 instance | no | — |
| aws_ec2_instance_type | The AWS Instance type | no | — |
| aws_ec2_instance_root_vol_size | Define the volume size (in GiB) for the root volume on the AWS Instance. | no | — |
| aws_ec2_instance_root_vol_preserve | Set this to true to avoid deletion of root volume on termination. Defaults to false. | no | — |
| aws_ec2_security_group_name | The name of the EC2 security group | no | — |
| aws_ec2_create_keypair_sm | Generates and manages a secret manager entry that contains the public and private keys created for the ec2 instance. | no | — |
| aws_ec2_instance_public_ip | Add a public IP to the instance or not. (Not an Elastic IP) | no | — |
| aws_ec2_port_list | List of ports to be enabled as an ingress rule in the EC2 SG, in a [xx,yy] format - Not the ELB | no | — |
| aws_ec2_user_data_file | Relative path in the repo for a user provided script to be executed with Terraform EC2 Instance creation. | no | — |
| aws_ec2_user_data_replace_on_change | If user_data file changes, instance will stop and start. Hence public IP will change. Defaults to true. | no | — |
| aws_ec2_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_vpc_create | Define if a VPC should be created | no | — |
| aws_vpc_name | Set a specific name for the VPC | no | — |
| aws_vpc_cidr_block | Define Base CIDR block which is divided into subnet CIDR blocks. Defaults to 10.0.0.0/16. | no | — |
| aws_vpc_public_subnets | Comma separated list of public subnets. Defaults to 10.10.110.0/24 | no | — |
| aws_vpc_private_subnets | Comma separated list of private subnets. If none, none will be created. | no | — |
| aws_vpc_availability_zones | Comma separated list of availability zones. Defaults to `aws_default_region. | no | — |
| aws_vpc_id | AWS VPC ID. Accepts `vpc-###` values. | no | — |
| aws_vpc_subnet_id | Specify a Subnet to be used with the instance. If none provided, will pick one. | no | — |
| aws_vpc_enable_nat_gateway | Enables NAT gateway | no | — |
| aws_vpc_single_nat_gateway | Creates only one NAT gateway | no | — |
| aws_vpc_external_nat_ip_ids | Comma separated list of IP IDS to reuse in the NAT gateways | no | — |
| aws_vpc_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_r53_enable | Enables the usage of Route53 to manage DNS records. | no | — |
| aws_r53_domain_name | Define the root domain name for the application. e.g. app.com | no | — |
| aws_r53_sub_domain_name | Define the sub-domain part of the URL. Defaults to `${org}-${repo}-{branch}` | no | — |
| aws_r53_root_domain_deploy | Deploy to root domain. Will generate two DNS recrods, one for root, another for www | no | — |
| aws_r53_enable_cert | Makes the application use a certificate by enabling a certificate lookup. | no | — |
| aws_r53_cert_arn | Define the certificate ARN to use for the application | no | — |
| aws_r53_create_root_cert | Generates and manage the root cert for the application | no | — |
| aws_r53_create_sub_cert | Generates and manage the sub-domain certificate for the application | no | — |
| aws_r53_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_elb_create | Create a load balancer and map ports to the EC2 instance. | no | — |
| aws_elb_security_group_name | The name of the ELB security group | no | — |
| aws_elb_app_port | Port to expose for the app | no | — |
| aws_elb_app_protocol | Protocol to enable. Could be HTTP, HTTPS, TCP or SSL. Defaults to TCP. | no | — |
| aws_elb_listen_port | Load balancer listening port. Defaults to 80 if NO FQDN provided, 443 if FQDN provided | no | — |
| aws_elb_listen_protocol | Protocol to enable. Could be HTTP, HTTPS, TCP or SSL. Defaults to TCP if NO FQDN provided, SSL if FQDN provided | no | — |
| aws_elb_healthcheck | Load balancer health check string. Defaults to TCP:22 | no | — |
| aws_elb_access_log_bucket_name | S3 bucket name to store the ELB access logs. | no | — |
| aws_elb_access_log_expire | Delete the access logs after this amount of days. Defaults to 90. | no | — |
| aws_elb_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_alb_create | Global toggle for ALB creation | no | — |
| aws_alb_security_group_name | Name of the security group to use for ALB | no | — |
| aws_alb_app_port | Comma-separated list of application ports for ALB target group | no | — |
| aws_alb_app_protocol | Comma-separated list of protocols for ALB target group (HTTP/HTTPS) | no | — |
| aws_alb_listen_port | Comma-separated list of listener ports for ALB | no | — |
| aws_alb_listen_protocol | Comma-separated list of listener protocols for ALB (HTTP/HTTPS) | no | — |
| aws_alb_redirect_enable | Enable HTTP to HTTPS redirection on ALB | no | — |
| aws_alb_www_to_apex_redirect | Enable www to apex domain redirection on ALB | no | — |
| aws_alb_healthcheck_path | Health check path for ALB target group | no | — |
| aws_alb_healthcheck_protocol | Health check protocol for ALB target group | no | — |
| aws_alb_ssl_policy | SSL policy for HTTPS listeners | no | — |
| aws_alb_access_log_enabled | Enable ALB access logs | no | — |
| aws_alb_access_log_bucket_name | S3 bucket name to store the ALB access logs | no | — |
| aws_alb_access_log_expire | Delete the access logs after this amount of days | no | — |
| aws_alb_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_waf_enable | Enable WAF for load balancer. | no | — |
| aws_waf_logging_enable | Enable WAF logging to CloudWatch. | no | — |
| aws_waf_log_retention_days | CloudWatch log retention period for WAF logs. | no | — |
| aws_waf_rule_rate_limit | Rate limit for WAF rules. | no | — |
| aws_waf_rule_rate_limit_priority | Priority for rate limit rule. | no | — |
| aws_waf_rule_managed_rules | Enable common managed rule groups to use. | no | — |
| aws_waf_rule_managed_rules_priority | Priority for managed rules group. | no | — |
| aws_waf_rule_managed_bad_inputs | Enable managed rule for bad inputs. | no | — |
| aws_waf_rule_managed_bad_inputs_priority | Priority for bad inputs managed rule. | no | — |
| aws_waf_rule_ip_reputation | Enable managed rule for IP reputation. | no | — |
| aws_waf_rule_ip_reputation_priority | Priority for IP reputation managed rule. | no | — |
| aws_waf_rule_anonymous_ip | Enable managed rule for anonymous IP. | no | — |
| aws_waf_rule_anonymous_ip_priority | Priority for anonymous IP managed rule. | no | — |
| aws_waf_rule_bot_control | Enable managed rule for bot control (costs extra). | no | — |
| aws_waf_rule_bot_control_priority | Priority for bot control managed rule. | no | — |
| aws_waf_rule_geo_block_countries | Comma separated list of countries to block. | no | — |
| aws_waf_rule_geo_block_countries_priority | Priority for geo block countries managed rule. | no | — |
| aws_waf_rule_geo_allow_only_countries | Comma separated list of countries to allow. | no | — |
| aws_waf_rule_geo_allow_only_countries_priority | Priority for geo allow only countries managed rule. | no | — |
| aws_waf_rule_sqli | Enable managed rule for SQL injection. | no | — |
| aws_waf_rule_sqli_priority | Priority for SQL injection managed rule. | no | — |
| aws_waf_rule_linux | Enable managed rule for Linux. | no | — |
| aws_waf_rule_linux_priority | Priority for Linux managed rule. | no | — |
| aws_waf_rule_unix | Enable managed rule for Unix. | no | — |
| aws_waf_rule_unix_priority | Priority for Unix managed rule. | no | — |
| aws_waf_rule_admin_protection | Enable managed rule for admin protection. | no | — |
| aws_waf_rule_admin_protection_priority | Priority for admin protection managed rule. | no | — |
| aws_waf_rule_user_arn | ARN of the user rule. | no | — |
| aws_waf_rule_user_arn_priority | Priority for user defined rule. | no | — |
| aws_waf_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_efs_create | Toggle to indicate whether to create and EFS and mount it to the ec2 as a part of the provisioning. Note: The EFS will be managed by the stack and will be destroyed along with the stack. | no | — |
| aws_efs_fs_id | ID of existing EFS | no | — |
| aws_efs_create_mount_target | Toggle to indicate whether we should create a mount target for the EFS volume. Accepts incoming fs_id with no mount targets too. | no | — |
| aws_efs_create_ha | Toggle to indicate whether the EFS resource should be highly available (mount points in all available zones within region). | no | — |
| aws_efs_vol_encrypted | Toggle encryption of the EFS volume. | no | — |
| aws_efs_kms_key_id | The ARN for the KMS encryption key. Default key will be used if none defined. | no | — |
| aws_efs_performance_mode | Toggle perfomance mode. Options are: generalPurpose or maxIO. | no | — |
| aws_efs_throughput_mode | Throughput mode for the file system. Defaults to bursting. Valid values: bursting, provisioned, or elastic. When using provisioned, also set provisioned_throughput_in_mibps. | no | — |
| aws_efs_throughput_speed | The throughput, measured in MiB/s, that you want to provision for the file system. Only applicable with throughput_mode set to provisioned. | no | — |
| aws_efs_security_group_name | The name of the EFS security group. Defaults to SG for aws_resource_identifier - EFS. | no | — |
| aws_efs_allowed_security_groups | Comma separated list of security groups to be added to the EFS SG. | no | — |
| aws_efs_ingress_allow_all | Allow incoming traffic from 0.0.0.0/0. | no | — |
| aws_efs_create_replica | Toggle to indiciate whether a read-only replica should be created for the EFS primary file system | no | — |
| aws_efs_replication_destination | AWS Region to target for replication | no | — |
| aws_efs_enable_backup_policy | Toggle to indiciate whether the EFS should have a backup policy, default is `false` | no | — |
| aws_efs_transition_to_inactive | https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system#transition_to_ia | no | — |
| aws_efs_mount_target | Directory path in efs to mount to | no | — |
| aws_efs_ec2_mount_point | Directory path in application env to mount directory | no | — |
| aws_efs_additional_tags | A list of strings that will be added to created resources | no | — |
| aws_rds_db_enable | Set to true to enable an RDS DB. | no | — |
| aws_rds_db_proxy | Set to true to add a RDS DB Proxy | no | — |
| aws_rds_db_identifier | Database identifier that will appear in the AWS Console. Defaults to aws_resource_identifier if none set. | no | — |
| aws_rds_db_name | The name of the database to create when the DB instance is created. | no | — |
| aws_rds_db_user | Username for the db. Defaults to dbuser. | no | — |
| aws_rds_db_engine | Which Database engine to use. Default is postgres | no | — |
| aws_rds_db_engine_version | Which Database engine version to use. | no | — |
| aws_rds_db_ca_cert_identifier | Certificate to use with the database. Defaults to rds-ca-ecc384-g1 | no | — |
| aws_rds_db_security_group_name | The name of the database security group. Defaults to SG for aws_resource_identifier - RDS. | no | — |
| aws_rds_db_allowed_security_groups | Comma separated list of security groups to add to the DB SG | no | — |
| aws_rds_db_ingress_allow_all | Allow incoming traffic from 0.0.0.0/0. | no | — |
| aws_rds_db_publicly_accessible | Allow the database to be publicly accessible. | no | — |
| aws_rds_db_port | Port where the DB listens to. | no | — |
| aws_rds_db_subnets | Specify which subnets to use as a list of strings. | no | — |
| aws_rds_db_allocated_storage | Storage size. Defaults to 10. | no | — |
| aws_rds_db_max_allocated_storage | Max storage size. Defaults to 0 to disable auto-scaling. | no | — |
| aws_rds_db_storage_encrypted | Toogle storage encryption. Defatuls to false. | no | — |
| aws_rds_db_storage_type | Storage type. Like gp2 / gp3. Defaults to gp2. | no | — |
| aws_rds_db_kms_key_id | The ARN for the KMS encryption key. | no | — |
| aws_rds_db_instance_class | DB instance server type. Defaults to db.t3.micro. | no | — |
| aws_rds_db_final_snapshot | Generates a snapshot of the database before deletion. | no | — |
| aws_rds_db_restore_snapshot_identifier | Name of the snapshot to restore the database from. | no | — |
| aws_rds_db_cloudwatch_logs_exports | Set of log types to enable for exporting to CloudWatch logs. | no | — |
| aws_rds_db_multi_az | Specifies if the RDS instance is multi-AZ | no | — |
| aws_rds_db_maintenance_window | The window to perform maintenance in. Eg: Mon:00:00-Mon:03:00 | no | — |
| aws_rds_db_apply_immediately | Specifies whether any database modifications are applied immediately, or during the next maintenance window | no | — |
| aws_rds_db_performance_insights_enable | Enables performance insights for the database. Defaults to false. | no | — |
| aws_rds_db_performance_insights_retention | Number of days to retain performance insights data. Defaults to 7. | no | — |
| aws_rds_db_performance_insights_kms_key_id | KMS key ID to use for encrypting performance insights data. | no | — |
| aws_rds_db_monitoring_interval | The interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance. To disable, set to 0. | no | — |
| aws_rds_db_monitoring_role_arn | The ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs. | no | — |
| aws_rds_db_insights_mode | The mode for Performance Insights. | no | — |
| aws_rds_db_allow_major_version_upgrade | Indicates that major version upgrades are allowed. | no | — |
| aws_rds_db_auto_minor_version_upgrade | Indicates that minor version upgrades are allowed. | no | — |
| aws_rds_db_backup_retention_period | The number of days to retain backups for. Must be between 0 (disabled) and 35. | no | — |
| aws_rds_db_backup_window | The window during which backups are taken. | no | — |
| aws_rds_db_copy_tags_to_snapshot | Indicates whether to copy tags to snapshots. | no | — |
| aws_rds_db_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_aurora_enable | Toggles deployment of an Aurora database. Defaults to false. | no | — |
| aws_aurora_proxy | Aurora DB Proxy Toggle. Defaults to false. | no | — |
| aws_aurora_cluster_name | The name of the cluster. Will be created if it does not exist. Defaults to aws_resource_identifier if none set. | no | — |
| aws_aurora_engine | The database engine to use. Defaults to aurora-postgresql. | no | — |
| aws_aurora_engine_version | The DB version of the engine to use. | no | — |
| aws_aurora_engine_mode | Database engine mode. Could be global, multimaster, parallelquey, provisioned, serverless. | no | — |
| aws_aurora_availability_zones | List of availability zones for the DB cluster storage where DB cluster instances can be created. | no | — |
| aws_aurora_cluster_apply_immediately | Apply changes immediately to the cluster. If not, will be done in next maintenance window.. Default false | no | — |
| aws_aurora_allocated_storage | Amount of storage in gigabytes. Required for multi-az cluster. | no | — |
| aws_aurora_storage_encrypted | Toggles whether the DB cluster is encrypted. Defaults to true. | no | — |
| aws_aurora_kms_key_id | KMS Key ID to use with the cluster encrypted storage. | no | — |
| aws_aurora_storage_type | Define type of storage to use. Required for multi-az cluster. | no | — |
| aws_aurora_storage_iops | iops for storage. Required for multi-az cluster. | no | — |
| aws_aurora_database_name | The name of the database. will be created if it does not exist. Defaults to aurora | no | — |
| aws_aurora_master_username | Master username. Defaults to aurora | no | — |
| aws_aurora_database_group_family | The family of the DB parameter group. See https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html. Defaults set for Postges and MySQL. | no | — |
| aws_aurora_iam_auth_enabled | Toggles IAM Authentication. Defaults to false. | no | — |
| aws_aurora_iam_roles | Define the ARN list of allowed roles. | no | — |
| aws_aurora_cluster_db_instance_class | To create a Multi-AZ RDS cluster, you must additionally specify the engine, storage_type, allocated_storage, iops and aws_aurora_db_cluster_instance_class attributes. | no | — |
| aws_aurora_security_group_name | Name of the security group to use for postgres. Defaults to SG for ${var.aws_resource_identifier} - Aurora | no | — |
| aws_aurora_ingress_allow_all | Allow access from 0.0.0.0/0 in the same VPC. Defaults to true | no | — |
| aws_aurora_allowed_security_groups | Extra names of the security groups to access Aurora. | no | — |
| aws_aurora_subnets | The list of subnet ids to use for postgres. | no | — |
| aws_aurora_database_port | Database port. Defaults to 5432 | no | — |
| aws_aurora_db_publicly_accessible | Make database publicly accessible. Defaults to false. | no | — |
| aws_aurora_cloudwatch_enable | Toggles cloudwatch. Defaults to true | no | — |
| aws_aurora_cloudwatch_log_type | Comma separated list of log types to include in cloudwatch. If none defined, will use [postgresql] or [audit,error,general,slowquery]. Based on the db engine. | no | — |
| aws_aurora_cloudwatch_retention_days | Days to store cloudwatch logs. Defaults to 7. | no | — |
| aws_aurora_backtrack_window | Target backtrack window, in seconds. Only available for aurora and aurora-mysql engines currently. 0 to disable. Defaults to 0 | no | — |
| aws_aurora_backup_retention_period | Days to retain backups for. Defaults to 5. | no | — |
| aws_aurora_backup_window | Daily time range during which the backups happen. | no | — |
| aws_aurora_maintenance_window | Maintenance window. | no | — |
| aws_aurora_database_final_snapshot | Set the name to Generate a snapshot of the database before deletion. | no | — |
| aws_aurora_deletion_protection | Protects the database from deletion. Defaults to false. This wont prevent Terraform from destroying it. | no | — |
| aws_aurora_delete_auto_backups | Specifies whether to remove automated backups immediately after the DB cluster is deleted. Default is true. | no | — |
| aws_aurora_restore_snapshot_id | Restore an initial snapshot of the DB if specified. | no | — |
| aws_aurora_restore_to_point_in_time | Restore database to a point in time. Will require a map of strings. Like {"restore_to_time"="W","restore_type"="X","source_cluster_identifier"="Y", "use_latest_restorable_time"="Z"}. Default {} | no | — |
| aws_aurora_snapshot_name | Takes a snapshot of the DB. | no | — |
| aws_aurora_snapshot_overwrite | Overwrites snapshot if same name is set. Defaults to false. | no | — |
| aws_aurora_db_instances_count | Amount of instances to create. Defaults to 1. | no | — |
| aws_aurora_db_instance_class | Database instance size. Defaults to db.r6g.large. | no | — |
| aws_aurora_db_apply_immediately | Specifies whether any modifications are applied immediately, or during the next maintenance window. Defaults to false. | no | — |
| aws_aurora_db_ca_cert_identifier | Certificate to use with the database. Defaults to rds-ca-ecc384-g1. | no | — |
| aws_aurora_db_maintenance_window | Maintenance window. | no | — |
| aws_aurora_performance_insights_enable | Enables performance insights for the database. Defaults to false. | no | — |
| aws_aurora_performance_insights_kms_key_id | KMS key ID to use for encrypting performance insights data. | no | — |
| aws_aurora_performance_insights_retention | Number of days to retain performance insights data. Defaults to 7. | no | — |
| aws_aurora_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_db_proxy_enable | Toggle DB Proxy creation | no | — |
| aws_db_proxy_name | DB Proxy name | no | — |
| aws_db_proxy_database_id | Database ID to create proxy for | no | — |
| aws_db_proxy_cluster | Define if Database is a cluster or not | no | — |
| aws_db_proxy_secret_name | Name of the secret containing DB parameters to connect to | no | — |
| aws_db_proxy_client_password_auth_type | Auth type to use, will use the following, depending on DB the family. MYSQL_NATIVE_PASSWORD, POSTGRES_SCRAM_SHA_256, and SQL_SERVER_AUTHENTICATION | no | — |
| aws_db_proxy_tls | Toogle TLS enforcement for connection | no | — |
| aws_db_proxy_security_group_name | Name for the proxy security group. Default to aws_resource_identifier if none. | no | — |
| aws_db_proxy_database_security_group_allow | Will add an incoming rule from every security group associated with the DB | no | — |
| aws_db_proxy_allowed_security_group | Comma separated list of SG Ids to add. | no | — |
| aws_db_proxy_allow_all_incoming | Allow all incoming traffic to the DB Proxy. Mind that the proxy is only available from the internal network except manually exposed. | no | — |
| aws_db_proxy_cloudwatch_enable | Toggle Cloudwatch logs. Will be stored in /aws/rds/proxy/rds_proxy.name | no | — |
| aws_db_proxy_cloudwatch_retention_days | Number of days to retain logs | no | — |
| aws_db_proxy_additional_tags | A list of strings that will be added to created resources | no | — |
| aws_redis_enable | Enables the creation of a Redis instance | no | — |
| aws_redis_user | Redis username. Defaults to redisuser | no | — |
| aws_redis_user_access_string | String expression for user access. Defaults to on ~* +@all | no | — |
| aws_redis_user_group_name | User group name. Defaults to aws_resource_identifier-redis | no | — |
| aws_redis_security_group_name | Redis security group name. Defaults to SG for aws_resource_identifier - Redis | no | — |
| aws_redis_ingress_allow_all | Allow access from 0.0.0.0/0 in the same VPC | no | — |
| aws_redis_allowed_security_groups | Comma separated list of security groups to be added to the Redis SG. | no | — |
| aws_redis_subnets | Define a list of specific subnets where Redis will live. Defaults to all of the VPC ones. If not defined, default VPC. | no | — |
| aws_redis_port | Redis port. Defaults to 6379 | no | — |
| aws_redis_at_rest_encryption | Encryption at rest. Defaults to true. | no | — |
| aws_redis_in_transit_encryption | In-transit encryption. Defaults to true. | no | — |
| aws_redis_replication_group_id | Name of the Redis replication group. Defaults to aws_resource_identifier-redis | no | — |
| aws_redis_node_type | Node type of the Redis instance. Defaults to cache.t2.small | no | — |
| aws_redis_num_cache_clusters | Amount of Redis nodes. Defaults to 1 | no | — |
| aws_redis_parameter_group_name | Redis parameters groups name. If cluster wanted, set it to something that includes .cluster.on. Defaults to default.redis7 | no | — |
| aws_redis_num_node_groups | Number of node groups. Defaults to 0. | no | — |
| aws_redis_replicas_per_node_group | Number of replicas per node group. Defaults to 0 | no | — |
| aws_redis_multi_az_enabled | Enables multi-availability-zone redis. Defaults to false | no | — |
| aws_redis_automatic_failover | Allows overriding the automatic configuration of this value, only needed when playing with resources in a non-conventional way. | no | — |
| aws_redis_apply_immediately | Specifies whether any modifications are applied immediately, or during the next maintenance window. Default is false. | no | — |
| aws_redis_auto_minor_upgrade | Specifies whether minor version engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window. Defaults to true. | no | — |
| aws_redis_maintenance_window | Specifies the weekly time range for when maintenance on the cache cluster is performed. Example:sun:05:00-sun:06:00. Defaults to null. | no | — |
| aws_redis_snapshot_window | Daily time range (in UTC) when to start taking a daily snapshot. Minimum is a 60 minute period. Example: 05:00-09:00. Defaults to null. | no | — |
| aws_redis_final_snapshot | Change name to define a final snapshot. | no | — |
| aws_redis_snapshot_restore_name | Set name to restore a snapshot to the cluster. The default behaviour is to restore it each time this action runs. | no | — |
| aws_redis_cloudwatch_enabled | Enable or disables Cloudwatch logging. | no | — |
| aws_redis_cloudwatch_lg_name | Cloudwatch log group name. Defaults to /aws/redis/aws_resource_identifier. Will append log_type to it. | no | — |
| aws_redis_cloudwatch_log_format | Define log format between json (default) and text. | no | — |
| aws_redis_cloudwatch_log_type | Log type. Older Redis engines need slow-log. Newer support engine-log (default) | no | — |
| aws_redis_cloudwatch_retention_days | Number of days to retain logs. 0 to never expire. Default 14 | no | — |
| aws_redis_single_line_url_secret | Creates an AWS secret containing the connection string containing protocol://user@pass:endpoint:port | no | — |
| aws_redis_additional_tags | Additional tags to be added to every Redis related resource | no | — |
| docker_install | Define if docker should be installed. After this, docker-compose up will be excecuted. | no | — |
| docker_remove_orphans | Toggle --remove-orphans flag. Defaults to false. | no | — |
| docker_full_cleanup | Set to true to run docker-compose down and docker system prune --all --force --volumes after. | no | — |
| docker_repo_app_directory | Relative path for the directory of the app (i.e. where `Dockerfile` and `docker-compose.yaml` files are located). This is the directory that is copied to the compute instance (EC2). Default is the root of the repo. Add a .gha-ignore file with a list of files to be exluded. | no | — |
| docker_repo_app_directory_cleanup | Will generate a timestamped compressed file and delete the app repo directory. | no | — |
| docker_backup_retention | Number of old backups to retain. Default is unlimited. | no | — |
| docker_efs_mount_target | Directory path within docker env to mount directory to, default is `/data` | no | — |
| docker_cloudwatch_enable | Toggle cloudwatch creation for Docker containers. | no | — |
| docker_cloudwatch_lg_name | Log group name. Will default to aws_identifier if none. | no | — |
| docker_cloudwatch_skip_destroy | Toggle deletion or not when destroying the stack. | no | — |
| docker_cloudwatch_retention_days | Number of days to retain logs. 0 to never expire. | no | — |
| aws_ecs_enable | Toggle ECS Creation | no | — |
| aws_ecs_service_name | Elastic Container Service name | no | — |
| aws_ecs_cluster_name | Elastic Container Service cluster name | no | — |
| aws_ecs_service_launch_type | Configuration type. Could be EC2, FARGATE or EXTERNAL | no | — |
| aws_ecs_task_type | Configuration type. Could be EC2, FARGATE or empty. Will default to aws_ecs_service_launch_type if none defined. (Blank if EXTERNAL) | no | — |
| aws_ecs_task_name | Elastic Container Service task name | no | — |
| aws_ecs_task_ignore_definition | Toggle to ignore task definition changes after first deployment. Useful when using external tools to manage the task definition. | no | — |
| aws_ecs_task_execution_role | Task execution role name that the Amazon ECS container agent and the Docker daemon can assume | no | — |
| aws_ecs_task_role | Name of the IAM role that allows your Amazon ECS container task to make calls to other AWS services | no | — |
| aws_ecs_task_reuse_role | Toggle reusing the task execution role as the task role. | no | — |
| aws_ecs_task_json_definition_file | Name of the json file containing task definition. Overrides every other input. | no | — |
| aws_ecs_task_network_mode | Network type to use in task definition | no | — |
| aws_ecs_task_cpu | Task CPU Amount | no | — |
| aws_ecs_task_mem | Task Mem Amount | no | — |
| aws_ecs_container_cpu | Container CPU Amount | no | — |
| aws_ecs_container_mem | Container Mem Amount | no | — |
| aws_ecs_container_user | User to run container as | no | — |
| aws_ecs_node_count | Node count for ECS Cluster | no | — |
| aws_ecs_app_image | Name of the image to be used | no | — |
| aws_ecs_security_group_name | ECS Secruity group name | no | — |
| aws_ecs_assign_public_ip | Assign public IP to node | no | — |
| aws_ecs_container_port | Comma separated list of container ports | no | — |
| aws_ecs_lb_port | Comma serparated list of ports exposed by the load balancer | no | — |
| aws_ecs_lb_redirect_enable | Toggle redirect from HTTP and/or HTTPS to the main port. | no | — |
| aws_ecs_lb_container_path | Path for subsequent deployed images. eg. api. | no | — |
| aws_ecs_lb_ssl_policy | SSL Policy for HTTPS listener in ALB. Will default to ELBSecurityPolicy-TLS13-1-2-2021-06 if none provided. | no | — |
| aws_ecs_lb_www_to_apex_redirect | Toggle redirect from www to apex domain. aws_r53_domain_name must be set. | no | — |
| aws_ecs_autoscaling_enable | Toggle ecs autoscaling policy | no | — |
| aws_ecs_autoscaling_max_nodes | Max ammount of nodes to scale up to. | no | — |
| aws_ecs_autoscaling_min_nodes | Min ammount of nodes to scale down to. | no | — |
| aws_ecs_autoscaling_max_mem | Max ammount of mem to scale up to. | no | — |
| aws_ecs_autoscaling_max_cpu | Max ammount of cou to scale up to. | no | — |
| aws_ecs_cloudwatch_enable | Toggle cloudwatch for ECS. Defaults to false | no | — |
| aws_ecs_cloudwatch_lg_name | Log group name. Will default to aws_identifier if none. | no | — |
| aws_ecs_cloudwatch_skip_destroy | Toggle deletion or not when destroying the stack. | no | — |
| aws_ecs_cloudwatch_retention_days | Number of days to retain logs. 0 to never expire. Default 14 | no | — |
| aws_ecs_efs_fs_id | ID of the EFS File System | no | — |
| aws_ecs_efs_root_directory | Directory within the FS to mount as the root directory. Defaults to /, ignored if access_point_id defined | no | — |
| aws_ecs_efs_transit_encryption | EFS Volume Transit Encryption. Defaults to true (ENABLED) | no | — |
| aws_ecs_efs_transit_encryption_port | EFS Volume Transit Encryption Port | no | — |
| aws_ecs_efs_access_point_id | EFS Volume Access Point ID to use | no | — |
| aws_ecs_efs_container_path | Directory path within container to mount the EFS volume to | no | — |
| aws_ecs_efs_readonly | Whether the EFS volume is mounted as read-only | no | — |
| aws_ecs_efs_iam | Whether or not to use the ECS task IAM role defined in a task definition when mounting the FS. Defaults to false. (DISABLED) | no | — |
| aws_ecs_additional_tags | A list of strings that will be added to created resources | no | — |
| aws_ecr_repo_create | Determines whether a repository will be created | no | — |
| aws_ecr_repo_type | The type of repository to create. Either `public` or `private`. Defaults to `private`. | no | — |
| aws_ecr_repo_name | The name of the repository. If none, will use the default resource-identifier. | no | — |
| aws_ecr_repo_mutable | The tag mutability setting for the repository. Set this to true if `MUTABLE`. Defaults to false, so `IMMUTABLE` | no | — |
| aws_ecr_repo_encryption_type | The encryption type for the repository. Must be one of: `KMS` or `AES256`. Defaults to `AES256` | no | — |
| aws_ecr_repo_encryption_key_arn | The ARN of the KMS key to use when encryption_type is `KMS`. If not specified, uses the default AWS managed key for ECR | no | — |
| aws_ecr_repo_force_destroy | If `true`, will delete the repository even if it contains images. Defaults to `false` | no | — |
| aws_ecr_repo_image_scan | Indicates whether images are scanned after being pushed to the repository (`true`) (default) or not scanned (`false`) | no | — |
| aws_ecr_registry_scan_rule | One or multiple blocks specifying scanning rules to determine which repository filters are used and at what frequency scanning will occur. Use [] | no | — |
| aws_ecr_registry_pull_through_cache_rules | List of pull through cache rules to create. Use map(map(string)). | no | — |
| aws_ecr_registry_scan_config | Scanning type to set for the registry. Can be either `ENHANCED` or `BASIC`. Defaults to null. | no | — |
| aws_ecr_registry_replication_rules_input | The replication rules for a replication configuration. A maximum of 10 are allowed. Defaults to `[]`. | no | — |
| aws_ecr_repo_policy_attach | Determines whether a repository policy will be attached to the repository. Defaults to `true`. | no | — |
| aws_ecr_repo_policy_create | Determines whether a repository policy will be created. Defaults to `true`. | no | — |
| aws_ecr_repo_policy_input | The JSON policy to apply to the repository. If defined overrides the default policy | no | — |
| aws_ecr_repo_read_arn | The ARNs of the IAM users/roles that have read access to the repository. (Comma separated list) | no | — |
| aws_ecr_repo_write_arn | The ARNs of the IAM users/roles that have read/write access to the repository. (Comma separated list) | no | — |
| aws_ecr_repo_read_external_aws_account | The ARNs of the external AWS accounts that have read access to the repository | no | — |
| aws_ecr_repo_write_external_aws_account | The ARNs of the external AWS accounts that have write access to the repository | no | — |
| aws_ecr_repo_read_arn_lambda | The ARNs of the Lambda service roles that have read access to the repository. (Comma separated list) | no | — |
| aws_ecr_lifecycle_policy_input | The policy document. This is a JSON formatted string. See more details about [Policy Parameters](http://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html#lifecycle_policy_parameters) in the official AWS docs | no | — |
| aws_ecr_public_repo_catalog | Catalog data configuration for the repository. Defaults to `{}`. | no | — |
| aws_ecr_registry_policy_input | The policy document. This is a JSON formatted string | no | — |
| aws_ecr_additional_tags | A list of strings that will be added to created resources | no | — |
| aws_eks_create | Define if an EKS cluster should be created | no | — |
| aws_eks_security_group_name_cluster | SG for ${var.aws_resource_identifier} - ${var.aws_eks_environment} - EKS Master | no | — |
| aws_eks_security_group_name_node | SG for ${var.aws_resource_identifier} - ${var.aws_eks_environment} - EKS Worker | no | — |
| aws_eks_environment | Specify the eks environment name. Defaults to env | no | — |
| aws_eks_management_cidr | Enter your public IP or CIDR to add it to the allowed master security groups port 443. | no | — |
| aws_eks_allowed_ports | Allow incoming traffic from this port. Accepts comma separated values, matching 1 to 1 with aws_eks_allowed_ports_cidr. | no | — |
| aws_eks_allowed_ports_cidr | Allow incoming traffic from this CIDR block. Accepts comma separated values, matching 1 to 1 with aws_eks_allowed_ports. If none defined, will allow all incoming traffic. | no | — |
| aws_eks_cluster_name | EKS Cluster name. Defaults to eks-cluster | no | — |
| aws_eks_cluster_admin_role_arn | Role ARN to grant cluster-admin permissions | no | — |
| aws_eks_cluster_log_types | EKS Log types, comma separated list. Defaults to api,audit,authenticator | no | — |
| aws_eks_cluster_log_retention_days | Days to store logs. Defaults to 7. | no | — |
| aws_eks_cluster_log_skip_destroy | Skip deletion of cluster logs if set to true | no | — |
| aws_eks_cluster_version | Specify the k8s cluster version | no | — |
| aws_eks_instance_type | enter the aws instance type | no | — |
| aws_eks_instance_ami_id | AWS AMI ID. Will default to the latest Amazon EKS Node image for the cluster version. | no | — |
| aws_eks_instance_user_data_file | Relative path in the repo for a user provided script to be executed with Terraform EKS Node creation. | no | — |
| aws_eks_ec2_key_pair | Enter the existing ec2 key pair for worker nodes. If none, one will be created. | no | — |
| aws_eks_store_keypair_sm | If true, will store the newly created keys in Secret Manager | no | — |
| aws_eks_desired_capacity | Enter the desired capacity for the worker nodes | no | — |
| aws_eks_max_size | Enter the max_size for the worker nodes | no | — |
| aws_eks_min_size | Enter the min_size for the worker nodes | no | — |
| aws_eks_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
Outputs
| name | description |
|---|---|
| aws_vpc_id | The selected VPC ID used. |
| vm_url | The URL of the generated app |
| instance_endpoint | The URL of the generated ec2 instance |
| ec2_sg_id | SG ID for the EC2 instance |
| aws_efs_fs_id | EFS FS ID |
| aws_efs_replica_fs_id | EFS FS Replica ID |
| aws_efs_sg_id | EFS FS SG ID |
| db_endpoint | RDS Endpoint |
| db_secret_details_name | AWS Secret name containing db credentials |
| db_sg_id | SG ID for the RDS instance |
| db_proxy_rds_endpoint | Database proxy endpoint |
| db_proxy_secret_name_rds | AWS Secret name containing proxy credentials |
| db_proxy_sg_id_rds | SG ID for the RDS Proxy instance |
| aurora_db_endpoint | Aurora Endpoint |
| aurora_db_secret_details_name | AWS Secret name containing db credentials |
| aurora_db_sg_id | SG ID for the Aurora instance |
| aurora_proxy_endpoint | Database proxy endpoint |
| aurora_proxy_secret_name | AWS Secret name containing proxy credentials |
| aurora_proxy_sg_id | SG ID for the RDS Proxy instance |
| db_proxy_endpoint | Database proxy endpoint |
| db_proxy_secret_name | Database proxy secret_name |
| db_proxy_sg_id | SG ID for the RDS Proxy instance |
| ecs_load_balancer_dns | ECS ALB DNS Record |
| ecs_dns_record | ECS DNS URL |
| ecs_sg_id | ECS SG ID |
| ecs_lb_sg_id | ECS LB SG ID |
| ecr_repository_arn | ECR Repo ARN |
| ecr_repository_url | ECR Repo URL |
| redis_endpoint | Redis Endpoint |
| redis_secret_name | Redis Secret name |
| redis_connection_string_secret | Redis secret containing complete URL to connect directly. (e.g. rediss://user:pass@host:port) |
| redis_sg_id | Redis SG ID |
| eks_cluster_name | EKS Cluster name |
| eks_cluster_role_arn | EKS Role ARN |