Remove all stale tf references to the dynamodb lock table

Author: jhrr

tf/environments/staging/environment.hcl

@@ -4,7 +4,6 @@
 # configuration and fed forward to the child modules when required.
 
 locals {
-  namespace   = "ida"
   environment = "staging"
 
   aws_account = 209330743443
@@ -23,7 +22,6 @@ locals {
   ]
   aws_dns_writer_role_name = "DNSWriterRole"
 
-  lock_table                         = "terraform-locks"
   oauth_client_id                    = "zzr1i8b3d4xqi3jb4lkro39r.ida.staging"
   postgres_version                   = 16
   opensearch_version                 = "Elasticsearch_7.7"

tf/modules/infra/authorization/README.md

@@ -40,7 +40,6 @@
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_allowed_oidc"></a> [allowed\_oidc](#input\_allowed\_oidc) | Github repos/branches allowed to assume to OIDC role. | `list(map(string))` | n/a | yes |
-| <a name="input_lock_table"></a> [lock\_table](#input\_lock\_table) | DynamoDB table holding terraform state locks. | `string` | n/a | yes |
 
 ## Outputs
 

tf/modules/infra/authorization/iam.tf

@@ -90,29 +90,6 @@ data "aws_iam_policy_document" "gha_oidc_policy_one" {
     resources = ["arn:aws:cloudwatch:${var.aws_region}:${var.aws_account}:*"]
   }
 
-  statement {
-    effect = "Allow"
-    # tfsec:ignore:aws-iam-no-policy-wildcards
-    actions = [
-      "dynamodb:Describe*",
-    ]
-    # tfsec:ignore:aws-iam-no-policy-wildcards
-    resources = ["*"]
-  }
-
-  statement {
-    effect = "Allow"
-    # tfsec:ignore:aws-iam-no-policy-wildcards
-    actions = [
-      "dynamodb:DeleteItem",
-      "dynamodb:Get*",
-      "dynamodb:PutItem",
-    ]
-    resources = [
-      "arn:aws:dynamodb:${var.aws_region}:${var.aws_account}:table/${var.lock_table}",
-    ]
-  }
-
   statement {
     effect = "Allow"
     # tfsec:ignore:aws-iam-no-policy-wildcards

tf/modules/infra/authorization/variables.tf

@@ -1,10 +1,5 @@
 # Variables for the authorization module.
 
-variable "lock_table" {
-  description = "DynamoDB table holding terraform state locks."
-  type        = string
-}
-
 variable "allowed_oidc" {
   description = "Github repos/branches allowed to assume to OIDC role."
   type        = list(map(string))

tf/nodes/authorization.hcl

@@ -6,11 +6,9 @@ terraform {
 
 locals {
   env          = read_terragrunt_config(find_in_parent_folders("environment.hcl"))
-  lock_table   = local.env.locals.lock_table
   allowed_oidc = local.env.locals.allowed_oidc
 }
 
 inputs = {
-  lock_table   = local.lock_table
   allowed_oidc = local.allowed_oidc
 }

tf/nodes/datastores.hcl

@@ -6,14 +6,14 @@ terraform {
 
 locals {
   env                                = read_terragrunt_config(find_in_parent_folders("environment.hcl"))
-  namespace                          = local.env.locals.namespace
   admins                             = local.env.locals.admins
   domain                             = local.env.locals.domain
   environment                        = local.env.locals.environment
   opensearch_master_user_secret_name = local.env.locals.opensearch_master_user_secret_name
   opensearch_version                 = local.env.locals.opensearch_version
   ports                              = local.env.locals.ports
   postgres_version                   = local.env.locals.postgres_version
+  db_name                            = "ida"
 }
 
 inputs = {
@@ -48,7 +48,7 @@ inputs = {
     apply_immediately                     = contains(["development", "staging"], local.environment)
     backup_retention_period               = 7
     cidr_blocks                           = "0.0.0.0/0"
-    db_name                               = local.namespace
+    db_name                               = local.db_name
     deletion_protection                   = local.environment == "production"
     engine                                = "postgres"
     engine_version                        = local.postgres_version
@@ -67,6 +67,6 @@ inputs = {
     skip_final_snapshot                   = contains(["development", "staging"], local.environment)
     storage_encrypted                     = true
     storage_type                          = "gp2"
-    username                              = local.namespace
+    username                              = local.db_name
   }
 }

tf/root.hcl

@@ -11,7 +11,7 @@ locals {
   aws_account_dns          = 203918846978 # The ida-root account.
   aws_dns_writer_role_name = local.environment_vars.locals.aws_dns_writer_role_name
 
-  namespace   = local.environment_vars.locals.namespace
+  namespace   = "ida"
   environment = local.environment_vars.locals.environment
 }