Merge pull request #3710 from nhsuk/remove_dynamodb_locking

bogsi17 · web-flow · commit fbc63662cde9 · 2025-06-11T12:54:15.000+01:00
Remove deprecated state-lock mechanism
diff --git a/.github/workflows/destroy-infrastructure.yml b/.github/workflows/destroy-infrastructure.yml
@@ -83,5 +83,3 @@ jobs:
           set -e
           TF_STATE_FILE=nhse-mavis-terraform-state/terraform-${{ inputs.environment }}.tfstate
           aws s3 rm s3://$TF_STATE_FILE
-          aws dynamodb delete-item --table-name mavis-terraform-state-lock \
-          --key "{\"LockID\": {\"S\": \"$TF_STATE_FILE-md5\"}}"
diff --git a/docs/terraform.md b/docs/terraform.md
@@ -40,7 +40,6 @@ export AWS_PROFILE=default
 This repo contains 2 folders with terraform configuration.
 
 - The `bootstrap` folder stores the AWS resources required for remote state management of the app infrastructure.
-  For that purpose, it just contains an S3 bucket and a DynamoDB.
 - The `app` folder contains the actual infrastructure config for the app.
 
 #### Bootstrap -- Pre-requisites for creating a new environment:
diff --git a/terraform/account/main.tf b/terraform/account/main.tf
@@ -8,10 +8,9 @@ terraform {
   }
 
   backend "s3" {
-    region         = "eu-west-2"
-    dynamodb_table = "mavis-terraform-state-lock"
-    use_lockfile   = true
-    encrypt        = true
+    region       = "eu-west-2"
+    use_lockfile = true
+    encrypt      = true
   }
 }
 
diff --git a/terraform/app/env/preview-backend.hcl b/terraform/app/env/preview-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-preview.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/app/env/production-backend.hcl b/terraform/app/env/production-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state-production"
 key            = "terraform-production.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/app/env/qa-backend.hcl b/terraform/app/env/qa-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-qa.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/app/env/sandbox-alpha-backend.hcl b/terraform/app/env/sandbox-alpha-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-sandbox-alpha.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/app/env/sandbox-beta-backend.hcl b/terraform/app/env/sandbox-beta-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-sandbox-beta.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/app/env/test-backend.hcl b/terraform/app/env/test-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-test.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/app/env/training-backend.hcl b/terraform/app/env/training-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-training.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/app/main.tf b/terraform/app/main.tf
@@ -12,6 +12,7 @@ terraform {
   }
 
   backend "s3" {
+    region       = "eu-west-2"
     encrypt      = true
     use_lockfile = true
   }
diff --git a/terraform/backup/README.md b/terraform/backup/README.md
@@ -13,7 +13,7 @@ It will rarely change. In case of changes, terraform needs to be run manually.
 
 To set up the backup infrastructure from scratch, follow these steps:
 
-1. Bootstrap the destination backup account by running `terraform apply` in the `destination-bootstrap` directory. This will create an S3 bucket and a DynamoDB table for the Terraform state.
+1. Bootstrap the destination backup account by running `terraform apply` in the `destination-bootstrap` directory. This will create an S3 bucket for the Terraform state.
 2. Set up the **destination** account by running `terraform apply` in the `destination` directory. Pass the account_id of the source account as input.
    It returns the ARN of the destination vault that is created.
 3. Put the ARN of the destination vault in the \*.tfvars file in the `source` directory.
diff --git a/terraform/backup/destination-bootstrap/main.tf b/terraform/backup/destination-bootstrap/main.tf
@@ -23,19 +23,3 @@ module "terraform_state_bucket" {
   logging_target_bucket_id = module.access_logs_bucket.bucket_id
   logging_target_prefix    = "terraform-state/"
 }
-
-#### Dynamo DB table for terraform state locking
-resource "aws_dynamodb_table" "dynamodb_lock_table" {
-  name         = "mavisbackup-terraform-state-lock"
-  hash_key     = "LockID"
-  billing_mode = "PAY_PER_REQUEST"
-
-  attribute {
-    name = "LockID"
-    type = "S"
-  }
-
-  server_side_encryption {
-    enabled = true
-  }
-}
diff --git a/terraform/backup/destination/main.tf b/terraform/backup/destination/main.tf
@@ -8,11 +8,10 @@ terraform {
   }
 
   backend "s3" {
-    bucket         = "mavisbackup-terraform-state"
-    region         = "eu-west-2"
-    dynamodb_table = "mavisbackup-terraform-state-lock"
-    use_lockfile   = true
-    encrypt        = true
+    bucket       = "mavisbackup-terraform-state"
+    region       = "eu-west-2"
+    use_lockfile = true
+    encrypt      = true
   }
 }
 
diff --git a/terraform/backup/source/main.tf b/terraform/backup/source/main.tf
@@ -8,10 +8,9 @@ terraform {
   }
 
   backend "s3" {
-    region         = "eu-west-2"
-    use_lockfile   = true
-    dynamodb_table = "mavis-terraform-state-lock"
-    encrypt        = true
+    region       = "eu-west-2"
+    use_lockfile = true
+    encrypt      = true
   }
 }
 
diff --git a/terraform/bootstrap/main.tf b/terraform/bootstrap/main.tf
@@ -144,19 +144,3 @@ resource "aws_s3_bucket_policy" "logs" {
     ]
   })
 }
-
-#### Dynamo DB table for terraform state locking
-resource "aws_dynamodb_table" "dynamodb_lock_table" {
-  name         = "mavis-terraform-state-lock"
-  hash_key     = "LockID"
-  billing_mode = "PAY_PER_REQUEST"
-
-  attribute {
-    name = "LockID"
-    type = "S"
-  }
-
-  server_side_encryption {
-    enabled = true
-  }
-}
diff --git a/terraform/data_replication/env/production-backend.hcl b/terraform/data_replication/env/production-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state-production"
 key            = "terraform-data-replication-production.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/qa-backend.hcl b/terraform/data_replication/env/qa-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-data-replication-qa.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/sandbox-alpha-backend.hcl b/terraform/data_replication/env/sandbox-alpha-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-data-replication-sandbox-alpha.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/sandbox-beta-backend.hcl b/terraform/data_replication/env/sandbox-beta-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-data-replication-sandbox-beta.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/test-backend.hcl b/terraform/data_replication/env/test-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-data-replication-test.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/training-backend.hcl b/terraform/data_replication/env/training-backend.hcl
@@ -1,4 +1,2 @@
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-data-replication-training.tfstate"
-region         = "eu-west-2"
-dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/main.tf b/terraform/data_replication/main.tf
@@ -8,6 +8,7 @@ terraform {
   }
 
   backend "s3" {
+    region       = "eu-west-2"
     use_lockfile = true
     encrypt      = true
   }
diff --git a/terraform/resources/github_actions_policy.json b/terraform/resources/github_actions_policy.json
@@ -21,8 +21,6 @@
         "codedeploy:RegisterApplicationRevision",
         "codedeploy:UpdateDeploymentGroup",
         "codedeploy:UpdateApplication",
-        "dynamodb:PutItem",
-        "dynamodb:DeleteItem",
         "ec2:AllocateAddress",
         "ec2:AssociateRouteTable",
         "ec2:AttachInternetGateway",
diff --git a/terraform/resources/github_data_replication_actions_policy.json b/terraform/resources/github_data_replication_actions_policy.json
@@ -22,9 +22,7 @@
       "Action": ["*"],
       "NotResource": [
         "arn:aws:s3:::nhse-mavis-terraform-state-production",
-        "arn:aws:s3:::nhse-mavis-terraform-state",
-        "arn:aws:dynamodb:eu-west-2:820242920762:table/mavis-terraform-state-lock",
-        "arn:aws:dynamodb:eu-west-2:393416225559:table/mavis-terraform-state-lock"
+        "arn:aws:s3:::nhse-mavis-terraform-state"
       ],
       "Condition": {
         "StringEquals": {
diff --git a/terraform/scripts/bootstrap.sh b/terraform/scripts/bootstrap.sh
@@ -85,8 +85,6 @@ create_environment_files () {
   cat << EOF > "$ENV-backend.hcl" || { echo "Failed backend file creation"; exit 1; }
 bucket         = "nhse-mavis-terraform-state"
 key            = "terraform-$ENV.tfstate"
-region         = "$REGION"
-dynamodb_table = "mavis-terraform-state-lock"
 EOF
   cat << EOF > "$ENV.tfvars" || { echo "Failed environment variables file creation"; exit 1; }
 environment           = "$ENV"
@@ -118,12 +116,11 @@ EOF
 }
 
 ENV="$1"
-REGION=eu-west-2
 
 if [ "$#" == 0 ] || [ "$#" -gt 2 ] ; then
   echo "Usage: $0 <Environment name> [options]"
   echo "Options:"
-  echo "  --environment-only  Skips creation of dynamodb table and S3 bucket (e.g. if these resources already exist)"
+  echo "  --environment-only  Skips creation of S3 bucket for terraform state (e.g. if it already exists)"
   exit 1
 elif [ -n "$(echo "$ENV" | tr -d 'a-z0-9-')" ] ; then
  echo "Invalid environment string. Only lowercase alphanumeric characters and '-' are allowed"

Original file line number	Diff line number	Diff line change
`@@ -8,10 +8,9 @@ terraform {`
`8`	`8`	`}`
`9`	`9`
`10`	`10`	`backend "s3" {`
`11`		`- region = "eu-west-2"`
`12`		`- dynamodb_table = "mavis-terraform-state-lock"`
`13`		`- use_lockfile = true`
`14`		`- encrypt = true`
	`11`	`+ region = "eu-west-2"`
	`12`	`+ use_lockfile = true`
	`13`	`+ encrypt = true`
`15`	`14`	`}`
`16`	`15`	`}`
`17`	`16`