{"id":18930370,"url":"https://github.com/mitocgroup/terraform-aws-landing-zone-reader","last_synced_at":"2025-04-15T15:31:23.852Z","repository":{"id":143629544,"uuid":"227846455","full_name":"MitocGroup/terraform-aws-landing-zone-reader","owner":"MitocGroup","description":"Terraform Module for AWS Landing Zone (Read-Only)","archived":false,"fork":false,"pushed_at":"2020-01-25T02:48:55.000Z","size":52,"stargazers_count":6,"open_issues_count":0,"forks_count":5,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-03-28T22:51:11.633Z","etag":null,"topics":["amazon","amazon-web-services","aws-landing-zone","infrastructure","infrastructure-as-code","landing-zone","multi-account","terraform"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/MitocGroup/landing-zone-reader/aws","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MitocGroup.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-12-13T13:29:38.000Z","updated_at":"2021-10-19T23:45:34.000Z","dependencies_parsed_at":null,"dependency_job_id":"fa35fe92-ada3-4cde-acd3-066e3a01a364","html_url":"https://github.com/MitocGroup/terraform-aws-landing-zone-reader","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MitocGroup%2Fterraform-aws-landing-zone-reader","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MitocGroup%2Fterraform-aws-landing-zone-reader/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MitocGroup%2Fterraform-aws-landing-zone-reader/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MitocGroup%2Fterraform-aws-landing-zone-reader/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MitocGroup","download_url":"https://codeload.github.com/MitocGroup/terraform-aws-landing-zone-reader/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249097955,"owners_count":21212386,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amazon","amazon-web-services","aws-landing-zone","infrastructure","infrastructure-as-code","landing-zone","multi-account","terraform"],"created_at":"2024-11-08T11:37:24.790Z","updated_at":"2025-04-15T15:31:23.841Z","avatar_url":"https://github.com/MitocGroup.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform module `landing_zone_reader`\r\n[AWS Landing Zone](https://aws.amazon.com/solutions/aws-landing-zone/) is\r\na solution that helps customers more quickly set up a secure, multi-account\r\nAWS environment based on AWS best practices. This repository contains\r\nterraform module `landing_zone_reader` that allows read-only access and\r\nview into resources managed by terraform module `landing_zone`.\r\n\r\nRELATED: [terraform module `landing_zone`](https://github.com/MitocGroup/terraform-aws-landing-zone)\r\n\r\n\r\n## Usage Example\r\nTo get started, simply include the following terraform codebase:\r\n```hcl\r\nmodule \"landing_zone_reader\" {\r\n  source  = \"MitocGroup/landing-zone-reader/aws\"\r\n  version = \"0.0.1\"\r\n  landing_zone_providers   = var.landing_zone_providers\r\n  landing_zone_components  = var.landing_zone_components\r\n  terraform_backend_type   = var.terraform_backend_type\r\n  terraform_backend_config = var.terraform_backend_config\r\n  terraform_reader_config  = var.terraform_reader_config\r\n}\r\n```\r\n\u003e NOTE: Make sure to include `variables.tf` and optionally `terraform.tfvars`\r\n\r\nTo simplify and make it easier to understand, we included default values in `terraform.tfvars`:\r\n```hcl\r\nlanding_zone_providers = {\r\n  default = {\r\n    account_id = \"123456789012\"\r\n    region     = \"us-east-1\"\r\n  }\r\n  [...]\r\n}\r\nlanding_zone_components = {\r\n  landing_zone_vpc = \"s3://terraform-aws-landing-zone/components/landing_zone_vpc/*.tfvars\"\r\n  [...]\r\n}\r\nterraform_backend_type   = \"s3\"\r\nterraform_backend_config = {\r\n  bucket  = \"terraform-aws-landing-zone\"\r\n  key     = \"terraform/landing_zone_reader_output/terraform.tfstate\"\r\n  region  = \"us-east-1\"\r\n}\r\nterraform_reader_config = true\r\n```\r\n\r\n\u003e NOTE: Placeholder `[...]` from above is used to suggest that similar syntax can be added. Remove it or update in order to have valid HCL / terraform configuration.\r\n\r\nThis means that before you use this terraform module, you will need to:\r\n1. Change `landing_zone_providers` to values that describe your AWS Organization account\r\n    * `default` reflects the default setup corresponding to AWS Organization account; add more providers by extending `landing_zone_providers` map with extra AWS accounts and/or AWS regions\r\n        * `account_id` reflects the AWS account used to deploy AWS resources; prevents provisioning AWS resources into wrong AWS account in case of valid AWS credentials\r\n        * `region` reflects the AWS region used to deploy AWS resources; create 2 different providers for the same AWS account, but different AWS regions\r\n2. Change `landing_zone_components` to values that fit into your AWS Landing Zone use case\r\n    * each key from `landing_zone_components` map represents the name of the component from [this list of available components](https://github.com/MitocGroup/terraform-aws-landing-zone/tree/master/components)\r\n    * each value from `landing_zone_components` map represents the path to `.tfvars` file on S3 and/or local disk\r\n        * each `.tfvars` file must use HCL format; DO NOT USE other formats like JSON or YAML\r\n3. Change `terraform_backend_type` and `terraform_backend_config` to values that reflect your terraform backend where `.tfstate` files are stored (in `variables.tf` default parameter value is defined as `local`)\r\n\r\n### More Examples\r\n* [Terraform module for AWS Lambda function using AWS Landing Zone reader](https://github.com/MitocGroup/terraform-aws-landing-zone-reader/tree/master/examples/example_landing_zone_reader)\r\n\r\n\r\n## Why to Use This Solution\r\n\r\n### No need for code changes\r\nTerraform module for AWS Landing Zone solution is up to 10 lines of code that receives a list of `.tfvars` files as input variables which describe providers (to be read: AWS accounts and AWS regions) and configs (to be read: AWS resources)\r\n\r\n### No need for code rewrites\r\nThis implementation engages microservices architecture, allowing any component to be replaced with another component (or multiple components)\r\n\r\n### No need for hard-coded values\r\nExisting AWS resources created by your team can be reused programmatically as read only values by other teams' terraform configurations\r\n\r\n### No need to rebuild from scratch\r\nExisting AWS resources in your current AWS account(s) can be imported and reused without downtime by this terraform module via `terraform import` command\r\n\r\n### No need to exclude pieces of account(s) baseline\r\nSome customers were avoiding in the past AWS Landing Zone because it doesn't support some kind of 3rd party SSO solution or 3rd party Logging solution. By using terraform, we can easily bring those solutions into AWS Landing Zone as a set of components and empower customers to continue using best practices of both worlds\r\n\r\n### Additionally, this module helps enforce best practices\r\n- By removing the need for access to AWS root account(s)\r\n- By using IAM cross-account roles and/or STS temporary credentials\r\n- By enabling centralized CloudTrail logs and cross-region replication of CloudTrail logs\r\n- By empowering complex organizations to separate roles and responsibilities (e.g. InfoSec team can place explicit deny on IAM, VPC, SG and STS for other teams and/or other environments like production or pre-production)\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitocgroup%2Fterraform-aws-landing-zone-reader","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmitocgroup%2Fterraform-aws-landing-zone-reader","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitocgroup%2Fterraform-aws-landing-zone-reader/lists"}