Repository: chanzuckerberg/fogg
Pull request #634 (2022-04-26 19:27:45)

fix: treat AWS account IDs as strings
### Summary
This PR fixes a bug in that AWS account IDs were being templated as numbers. This is a problem when AWS account IDs start with zeroes because terraform will cast them to string without the leading zeros. For instance, `0000000000000009273135997` will be transformed to `"9273135997"`.

### Test Plan
* make update-golden-files
* make test

### References
* [failed terraform plan](https://si.prod.tfe.czi.technology/app/shared-infra/workspaces/accounts-czi-id/runs/run-D1ndxWxfEBU3V5uq)


Patch:
diff --git a/templates/templates/component/terraform/fogg.tf.tmpl b/templates/templates/component/terraform/fogg.tf.tmpl
index 538e5b14..8271d648 100644
--- a/templates/templates/component/terraform/fogg.tf.tmpl
+++ b/templates/templates/component/terraform/fogg.tf.tmpl
@@ -159,7 +159,7 @@ variable "aws_accounts" {
   type =  map(string)
   default = {
   {{ range $account, $id := .Accounts }}
-    {{ $account }} = {{ $id }}
+    {{ $account }} = "{{ $id }}"
   {{ end }}
   }
 }


Test patch:
diff --git a/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml b/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml
index e354a3f1..3594ee23 100644
--- a/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml
+++ b/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml
@@ -44,7 +44,7 @@ jobs:
       - run: aws configure set aws_access_key_id     ${{ secrets.IDACCT_AWS_ACCESS_KEY_ID }}     --profile _idacct
       - run: aws configure set aws_secret_access_key ${{ secrets.IDACCT_AWS_SECRET_ACCESS_KEY }} --profile _idacct
       - run: aws --profile _idacct sts get-caller-identity
-      - run: aws configure set profile.profile.role_arn arn:aws:iam::456:role/foo
+      - run: aws configure set profile.profile.role_arn arn:aws:iam::00456:role/foo
       - run: aws configure set profile.profile.source_profile _idacct
       - run: aws --profile profile sts get-caller-identity
       # we only run the following if there are changes in the terraform/* directory
diff --git a/testdata/v2_full_yaml/fogg.yml b/testdata/v2_full_yaml/fogg.yml
index fe1ba016..4bbcc3f9 100644
--- a/testdata/v2_full_yaml/fogg.yml
+++ b/testdata/v2_full_yaml/fogg.yml
@@ -2,7 +2,7 @@ accounts:
   bar:
     providers:
       aws:
-        account_id: 456
+        account_id: 00456
         additional_regions:
           - us-east-1
           - us-east-2
@@ -44,7 +44,7 @@ defaults:
   project: proj
   providers:
     aws:
-      account_id: 456
+      account_id: 00456
       profile: profile
       region: us-west-2
       version: 0.12.0
diff --git a/testdata/v2_full_yaml/terraform/accounts/bar/Makefile b/testdata/v2_full_yaml/terraform/accounts/bar/Makefile
index 083b2ba2..d8ca0515 100644
--- a/testdata/v2_full_yaml/terraform/accounts/bar/Makefile
+++ b/testdata/v2_full_yaml/terraform/accounts/bar/Makefile
@@ -11,7 +11,7 @@ export AWS_BACKEND_PROFILE := profile
 
 
 
-export AWS_PROVIDER_ROLE_ARN := arn:aws:iam::456:role/foo
+export AWS_PROVIDER_ROLE_ARN := arn:aws:iam::00456:role/foo
 
 
 
diff --git a/testdata/v2_full_yaml/terraform/accounts/bar/fogg.tf b/testdata/v2_full_yaml/terraform/accounts/bar/fogg.tf
index 299798ff..b08748bc 100644
--- a/testdata/v2_full_yaml/terraform/accounts/bar/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/accounts/bar/fogg.tf
@@ -6,10 +6,10 @@ provider "aws" {
 
 
   assume_role {
-    role_arn = "arn:aws:iam::456:role/foo"
+    role_arn = "arn:aws:iam::00456:role/foo"
   }
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -124,10 +124,10 @@ provider "aws" {
 
 
   assume_role {
-    role_arn = "arn:aws:iam::456:role/foo"
+    role_arn = "arn:aws:iam::00456:role/foo"
   }
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 
 
@@ -137,10 +137,10 @@ provider "aws" {
 
 
   assume_role {
-    role_arn = "arn:aws:iam::456:role/foo"
+    role_arn = "arn:aws:iam::00456:role/foo"
   }
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 
 
@@ -306,9 +306,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/accounts/foo/fogg.tf b/testdata/v2_full_yaml/terraform/accounts/foo/fogg.tf
index e5ac296d..cff4261b 100644
--- a/testdata/v2_full_yaml/terraform/accounts/foo/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/accounts/foo/fogg.tf
@@ -148,9 +148,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/datadog/fogg.tf b/testdata/v2_full_yaml/terraform/envs/prod/datadog/fogg.tf
index af15b1fe..b664c858 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/datadog/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/prod/datadog/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -223,9 +223,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/hero/fogg.tf b/testdata/v2_full_yaml/terraform/envs/prod/hero/fogg.tf
index 6af45922..bcab70c3 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/hero/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/prod/hero/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -146,9 +146,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/okta/fogg.tf b/testdata/v2_full_yaml/terraform/envs/prod/okta/fogg.tf
index c1d557db..05874f62 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/okta/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/prod/okta/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -226,9 +226,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/sentry/fogg.tf b/testdata/v2_full_yaml/terraform/envs/prod/sentry/fogg.tf
index 3fd8971c..7fcc190f 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/sentry/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/prod/sentry/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -156,9 +156,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/vpc/fogg.tf b/testdata/v2_full_yaml/terraform/envs/prod/vpc/fogg.tf
index ff2b437d..a0ae01cc 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/vpc/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/prod/vpc/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -216,9 +216,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/comp1/fogg.tf b/testdata/v2_full_yaml/terraform/envs/staging/comp1/fogg.tf
index d7d1db2a..a481c6d2 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/comp1/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/staging/comp1/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -184,9 +184,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/comp2/fogg.tf b/testdata/v2_full_yaml/terraform/envs/staging/comp2/fogg.tf
index d9e6abdb..0fbdb648 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/comp2/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/staging/comp2/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -184,9 +184,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/vpc/fogg.tf b/testdata/v2_full_yaml/terraform/envs/staging/vpc/fogg.tf
index b07a49f2..0097aa77 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/vpc/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/staging/vpc/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).
 
@@ -184,9 +184,9 @@ variable "aws_accounts" {
   type = map(string)
   default = {
 
-    bar = 456
+    bar = "00456"
 
-    foo = 123
+    foo = "123"
 
   }
 }
diff --git a/testdata/v2_full_yaml/terraform/global/fogg.tf b/testdata/v2_full_yaml/terraform/global/fogg.tf
index 94c24b63..0f5e6bfc 100644
--- a/testdata/v2_full_yaml/terraform/global/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/global/fogg.tf
@@ -5,7 +5,7 @@ provider "aws" {
   region  = "us-west-2"
   profile = "profile"
 
-  allowed_account_ids = [456]
+  allowed_account_ids = [00456]
 }
 # Aliased Providers (for doing things in every region).