Package: tfmake
tfmakeDEPRECATED: this project is deprecated and only minimal changes will be done.Hello ! 👋This is a Python based wrapper around an opionatedMakefileI use for multi-cloud/cross-accountterraformprojects.You still needmake, though. The main advantage is that you don't have to copy theMakefile.DISCLAIMERThis module includes a highly opinionatedMakefileimplementation. It's working very well for us, but your requirements might be different.Also, I've done my best to make this thing work on both MacOS and Linux. If you get an error message (~ and my colleagues haven't beat you to it) ... please get in touch and/or create a PR.Install$ pip install tfmakeUsageHere's the help for the wrapper$ tfmake --help
Usage: tfmake [OPTIONS] COMMAND [ARGS]...

Options:
  --version  Show the version and exit.
  --help     Show this message and exit.

Commands:
  aws    Use AWS provider.
  azure  Use Azure provider
  guess  Default command that guesses what provider you're using.
  init   Create configuration for provider.A warning will be shown when yourtfmakeis out-of-date. If you see one, please update:pip install --upgrade tfmakeProvidersCurrently,tfmakesupports two providers:awsandazure. The default provider isaws. Depending on the selected provider, a different, provider specific,Makefileis used to wrapterraform. Here, the provider is selected by using the right command.See 'examples' for some ... examples.Each provider leads to a specificMakefile. For example:provider==azureleads to usingMakefile.azure.Provider AuthenticationThe usedMakefilewillnothandle authentication. It just assumes you're using an authenticated context.For,aws, I useaws-vault. Forazure, I use theazure-cli.Here's the help for the (bundled) Makefile$ tfmake help
The AWS Edition

Usage: make <TARGET> (env=<ENVIRONMENT>) (<TERRAFORM ARGUMENTS>)

Where:
 ENVIRONMENT is one of ['dev','tst','acc','qas','prd','run']
 TARGET is one:
    update                          Update terraform modules and providers
    select                          Select and initialize terraform workspace (aka 'stage')
    show                            Show current terraform workspace
    plan                            Generate and show an execution plan
    apply                           Builds or changes infrastructure
    destroy                         Destroy Terraform-managed infrastructure
    refresh                         Refresh terraform state
    import                          Import existing infrastructure into your Terraform state

Note:

 - parameter 'env' is only required when selecting an environment
 - <TERRAFORM ARGUMENTS> can be used to pass arbitrary terraform parameters (without a prefix dash). Example: "make apply input=false no-color auto-approve"Usetfmake azure helpto see theazureedition ...Workspace PrefixWhen selecting an environment, by default, the following naming convention is used to store theterraformstate:<ACCOUNT_ALIAS>/<TERRAFORM_S3_KEY>Where:ACCOUNT_ALIASis the alias of the account you're using (either: AWS or Azure)TERRAFORM_S3_KEYis the value of thekeyinterraform.tfIf you want something in-between the alias and the key, you can use the 'workspace prefix' like this:Only needed when using theselectcommand!$ aws-vault exec my-aws-account -- tfmake select env=dev --workspace-key-prefix foo/barAfter youselected the environment, the path to yourterraformstate is:<ACCOUNT_ALIAS>/<WORKSPACE_PREFIX>/<TERRAFORM_S3_KEY>Assuming thekeyvalue iswhatever/terraform.tfstate, this leads to:my-aws-account/foo/bar/whatever/terraform.tfstateSafeguarding CredentialsThis works for bothAWSandAzureAlthough, you have to provide the correct credentials yourself,tfmakewillcheck if the credentials you provide are expected.$ cd /path/to/my/tf/project
$ aws-vault exec ACCOUNT_ONE -- tfmake select env=dev
Initializing modules...
...
>>> Now using Terraform workspace 'dev' on AWS account 'aws-account-one' ...If you use different credentials the next time you usetfmakein this project, you'll see a warning. Press<ENTER>to abort (oryto continue).$ cd /path/to/my/tf/project
$ aws-vault exec ACCOUNT_TWO -- tfmake plan
[WARNING] You previously used 'aws-account-one' for provider aws. Now you're using 'aws-account-two'. Are you sure? [y/N]:
Aborted!The 'magic' behind all this is a cache stored in$(PWD)/.tfmake/cache. So, if you delete this file, this safeguard won't work anymore :(Auto-switching Credentials on AzureWhen you're usingAzureandinstalledazctx,tfmakewill use the cached credentials to automatically switch to the correct subscription.In your.tfmake/config, make sure you enabledauto_switching:---
provider: azure
auto_switch: True

environment:
  - ARM_ACCESS_KEY = $(az keyvault secret show --name YOUR_SECRET --vault-name YOUR_VAULT --query value -o tsv)Support forAWSwill follow in a future version oftfmakeFinal NotesBy default, before any aterraformcommand is executed, you will be asked to confirm the usage of the current environment.$ tfmake azure apply

Using workspace 'prd' on 'My_fancy_Azure_Production_subscription'.

Press [ENTER] to continue or [CTRL-C] to stop.Please notice that the prompt shows the selectedterraformworkspace and the alias/name of the provider account.UseTFMAKE_AGREE=1to auto confirm that prompt ...ExampleInitialise 'dev' environment$ aws-vault exec foobar -- tfmake select env=devPlan changes$ aws-vault exec foobar -- tfmake planPlan changes with plan file$ aws-vault exec foobar -- tfmake plan out=foobar.planApply changes$ aws-vault exec foobar -- tfmake applyApply changes using plan file$ aws-vault exec foobar -- tfmake apply input=false auto-approve foobar.planApply changes using theazureprovider$ az login
# (optionaly set subscription)
$ az account set --subscription=YOUR_SUBSCRIPTION_ID_HERE
$ tfmake azure applyApply changes ... automagically$ aws-vault exec foobar -- tfmake apply input=false no-color auto-approve'Note: you can use arbitrary Terraform arguments after the command you're executing (~ in this example:apply). So, in this example,input=false no-color auto-approvewill be used to create the followingterraformarguments:-input=false -no-color -auto-approve.Notice that you have to skip the dash in front of each argument.Another Note: :arrow_up ... this only applies when usingtfmake... if, for whatever reason, you choose to use theMakefiledirectly: runmake helpAdvanced UsageYou can use aperproject configuration file in which you can specify, for example, environment variables and/or arbitrary commands that need to be execute before or after themaketarget.$ tfmake init aws

Configuration written to '/your/current/directory/.tfmake'---
#
# Welcome to the wonderful world of TFMAKE!
#
# This file is the main config file for your tfmake project.
# It's very minimal at this point and uses default values.
# You can always add more config options for more control.
#
# Happy Coding!
#
provider: aws

# You can define service wide environment variables here
# Notes:
# - when using commands, dont use single quotes (sorry)
# - commands should be between $( and )
#
# environment:
#    - variable1 = value
#    - variable2 = $(command)

# You can define commands here that are executed _before_ the Make target
# Note: dont use single quotes (sorry)
#
# before:
#    - echo "[INFO] before"

# You can define commands here that are executed _after_ the Make target
# Note: dont use single quotes (sorry)
#
# after:
#    - echo "[INFO] after"%SectionproviderTheprovidersection specifies what (default) provider to use for this project. As a result, you don't have to specify it anymore on the command-line.So, no moretfmake azure plan. Instead, just configure theproviderproperty and typetfmake plan.SectionenvironmentTheenvironmentsection can contain a list of environment variables that need to be set before calling themaketarget.For example, when using theazureprovider, you might want to dynamically fetch the value for theARM_SAS_TOKENorARM_ACCESS_KEYfrom an Azure Key Vault.SectionbeforeThebeforesection can contain a list of commands that need to be executed preparing the call to themaketarget.SectionafterTheaftersection can contain a list of commands that you can use to cleanup after calling themaketarget.ExampleAzureThe following example configuration creates an environment variable using a specified secret from a given key vault. Then, it will execute allbeforestatements. Next it will just execute theMakefiletarget. And finally, it will execute allafterstatements.Please note that theenvironmentvariables willnotbe exposed system-wide. They will only be 'visible' within the context of the session. As a result,terraformcan use it, but when the process is done, the variable will no longer be available.---
provider: azure

environment:
    - ARM_ACCESS_KEY = $(az keyvault secret show --name YOUR_SECRET --vault-name YOUR_VAULT --query value -o tsv)

before:
    - echo $ARM_ACCESS_KEY

after:
    - echo "DONE!!"~ the end