Terraform reference implementation example to create and run Snyk Broker as an AWS Elastic Container Service (ECS) Fargate Service.

❗ Note

Requires a public hosted domain name managed by AWS Route53 Domain Name System (DNS) zone

1. Create a S3 bucket to store deployment terraform state
2. Create GitHub repository dev environment
3. Modify env/dev/config.s3.backend
4. Modify env/dev/terraform.tfvars

This GitHub CI workflow (ci.yml) accepts input for running Snyk broker and deploys necessary AWS resources running SnykBroker as a Fargate Service.

1. AWS_ACCESS_KEY_ID
2. AWS_SECRET_ACCESS_KEY
3. DOCKERHUB_ACCESS_TOKEN
4. DOCKERHUB_USERNAME
5. SNYK_TOKEN

1. AWS_REGION
2. BROKER_ENV_VARS

This Environment variable value is specified as a map(string). Example:

{"BROKER_TOKEN":"xxx","GITHUB_TOKEN":"yyy"}

Public SSL certificate for <broker_hostname>.<public_domain_name> is created and managed by AWS Certificate Manager (ACM) with its renewal automatically handled.

• Upload private SSL certificate (.pem) and its private key (.key) to a S3 bucket
• Verify S3 bucket and these objects are accessible to Terraform assumed credentials
• Set variable config_bucket_name="<S3_bucket_name>"
• Set variable broker_private_key_object="<S3_folder>/<key_name.key>"
• Set variable broker_ssl_cert_object="<S3_folder>/<cert_name.pem>"

Private SSL certificate validity and renewal are handled independently by Customer.

• Upload custom integration type accept.json to S3 bucket
• Verify S3 bucket and accept.json are accessible to Terraform assumed credentials
• Set variable config_bucket_name="<S3_bucket_name>"
• Set variable custom_listing_filter="<S3_folder>/accept.json"

1. Configure S3 backend for terraform state
2. Setup Terraform input tfvars
3. Invoke the commands defined below to create the Fargate Service that launches corresponding SnykBroker dockerized container.

$ terraform init -backend-config="env/dev/config.s3.tfbackend"
$ terraform plan -input=false -var-file="env/dev/terraform.tfvars" -out=tfplan
$ terraform apply "tfplan"

{
  "Snyk": "SnykBroker"
}

{
  "artifactory": [
    "BROKER_TOKEN",
    "ARTIFACTORY_URL"
  ],
  "azurerepos": [
    "BROKER_TOKEN",
    "AZURE_REPOS_TOKEN",
    "AZURE_REPOS_ORG",
    "AZURE_REPOS_HOST",
    "PORT",
    "BROKER_CLIENT_URL"
  ],
  "bitbucket": [
    "BROKER_TOKEN",
    "BITBUCKET_USERNAME",
    "BITBUCKET_PASSWORD",
    "BITBUCKET",
    "BITBUCKET_API",
    "BROKER_CLIENT_URL",
    "PORT"
  ],
  "gh": [
    "BROKER_TOKEN",
    "GITHUB_TOKEN",
    "PORT",
    "BROKER_CLIENT_URL"
  ],
  "ghe": [
    "BROKER_TOKEN",
    "GITHUB_TOKEN",
    "GITHUB",
    "GITHUB_API",
    "GITHUB_GRAPHQL",
    "PORT",
    "BROKER_CLIENT_URL"
  ],
  "gitlab": [
    "BROKER_TOKEN",
    "GITLAB_TOKEN",
    "GITLAB",
    "PORT",
    "BROKER_CLIENT_URL"
  ],
  "jira": [
    "BROKER_TOKEN",
    "JIRA_USERNAME",
    "JIRA_PASSWORD",
    "JIRA_HOSTNAME",
    "BROKER_CLIENT_URL",
    "PORT"
  ],
  "nexus": [
    "BROKER_TOKEN",
    "BASE_NEXUS_URL",
    "BROKER_CLIENT_VALIDATION_URL",
    "RES_BODY_URL_SUB"
  ]
}

{
  "artifactory": "artifactory",
  "azurerepos": "azure-repos",
  "bitbucket": "bitbucket-server",
  "gh": "github-com",
  "ghe": "github-enterprise",
  "gitlab": "gitlab",
  "jira": "jira",
  "nexus": "nexus"
}