Merge pull request #4744 from consideRatio/main

terraform, aws: simplify resource tagging by using aws provider's default_tags

Author: consideRatio

terraform/aws/aws-ce-grafana-backend-iam.tf

@@ -3,7 +3,6 @@ resource "aws_iam_role" "aws_ce_grafana_backend_iam_role" {
   count = var.enable_aws_ce_grafana_backend_iam ? 1 : 0
 
   name = "aws_ce_grafana_backend_iam_role"
-  tags = var.tags
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"

terraform/aws/buckets.tf

@@ -2,7 +2,7 @@
 resource "aws_s3_bucket" "user_buckets" {
   for_each = var.user_buckets
   bucket   = lower("${var.cluster_name}-${each.key}")
-  tags     = merge(var.tags, each.value.tags)
+  tags     = each.value.tags
 }
 
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration

terraform/aws/cd.tf

@@ -5,7 +5,6 @@
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user
 resource "aws_iam_user" "continuous_deployer" {
   name = "hub-continuous-deployer"
-  tags = var.tags
 }
 
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key

terraform/aws/db.tf

@@ -20,7 +20,6 @@ resource "aws_security_group" "db" {
   name        = "db"
   description = "Allow traffic into the db"
   vpc_id      = data.aws_eks_cluster.cluster.vpc_config[0]["vpc_id"]
-  tags        = var.tags
 
   ingress {
     to_port          = 3306
@@ -47,8 +46,6 @@ resource "aws_db_subnet_group" "db" {
   count = var.db_enabled ? 1 : 0
 
   subnet_ids = data.aws_subnets.cluster_subnets[0].ids
-
-  tags = var.tags
 }
 
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance
@@ -69,16 +66,13 @@ resource "aws_db_instance" "db" {
   apply_immediately      = true
   availability_zone      = var.cluster_nodes_location
   parameter_group_name   = aws_db_parameter_group.db[0].name
-
-  tags = var.tags
 }
 
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_parameter_group
 resource "aws_db_parameter_group" "db" {
   count  = var.db_enabled ? 1 : 0
   name   = var.db_instance_identifier
   family = "${var.db_engine}${var.db_engine_version}"
-  tags   = var.tags
 
   dynamic "parameter" {
     for_each = var.db_params

terraform/aws/efs.tf

@@ -47,7 +47,7 @@ data "aws_security_group" "cluster_nodes_shared_security_group" {
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system
 resource "aws_efs_file_system" "hub_homedirs" {
   for_each = var.filestores
-  tags = merge(var.tags, each.value.tags, {
+  tags = merge(each.value.tags, {
     Name = each.value.name_suffix == null ? "hub-homedirs" : "hub-homedirs-${each.value.name_suffix}"
   })
   encrypted = true

terraform/aws/grafana-athena-iam.tf

@@ -3,7 +3,6 @@ resource "aws_iam_role" "grafana_athena_role" {
   count = var.enable_grafana_athena_iam ? 1 : 0
 
   name = "${var.cluster_name}-grafana-athena-iam-role"
-  tags = var.tags
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"

terraform/aws/irsa.tf

@@ -63,7 +63,6 @@ data "aws_iam_policy_document" "irsa_role_assume" {
 resource "aws_iam_role" "irsa_role" {
   for_each = { for index, hr in local.hub_to_role_mapping : hr.iam_role_name => hr }
   name     = "${var.cluster_name}-${each.key}"
-  tags     = var.tags
 
   assume_role_policy = data.aws_iam_policy_document.irsa_role_assume[each.key].json
 }
@@ -72,7 +71,6 @@ resource "aws_iam_role" "irsa_role" {
 resource "aws_iam_policy" "extra_user_policy" {
   for_each = { for index, hr in local.hub_to_role_mapping : hr.iam_role_name => hr if hr.cloud_permissions.extra_iam_policy != "" }
   name     = "${var.cluster_name}-${each.key}-extra-user-policy"
-  tags     = var.tags
 
   description = "Extra permissions granted to users on hub ${each.key} on ${var.cluster_name}"
   policy      = each.value.cloud_permissions.extra_iam_policy

terraform/aws/main.tf

@@ -32,6 +32,13 @@ provider "random" {}
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs
 provider "aws" {
   region = var.region
+
+  # default_tags ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block
+  default_tags {
+    tags = {
+      for k, v in var.default_tags : k => replace(v, "{var_cluster_name}", var.cluster_name)
+    }
+  }
 }
 
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster

terraform/aws/projects/2i2c-aws-us.tfvars

@@ -2,11 +2,6 @@ region                 = "us-west-2"
 cluster_name           = "2i2c-aws-us"
 cluster_nodes_location = "us-west-2a"
 
-tags = {
-  "2i2c.org/cluster-name" : "2i2c-aws-us",
-  "ManagedBy" : "2i2c",
-}
-
 user_buckets = {
   "scratch-staging" : {
     "delete_after" : 7

terraform/aws/projects/catalystproject-africa.tfvars

@@ -2,11 +2,6 @@ region                 = "af-south-1"
 cluster_name           = "catalystproject-africa"
 cluster_nodes_location = "af-south-1a"
 
-tags = {
-  "2i2c.org/cluster-name" : "catalystproject-africa",
-  "ManagedBy" : "2i2c",
-}
-
 user_buckets = {
   "scratch-staging" : {
     "delete_after" : 7