#atlantis - August 2020

has anyone used atlantis 0.14.0's feature to turn atlantis into a bot instead of using a github user ?

I’m a huge fan of Atlantis and have implemented and used it to great success in the last 2 companies I’ve worked for.

I’ve just started at a new company where things are a bit messy; multiple terraform repos, 2 different home made ‘wrappers’ similar to terragrunt, with some changes being made through Jenkins pipeline and some made from engineers laptops (all with remote state).

I thought this would be a good chance to see what other people are doing before I go down the path of demoing and discussing what Atlantis can do.

Does anybody have any blogs/videos/slides/ideas about alternatives for Terraform deployment? Thanks!

Hey all, I’ve just deployed atlantis in fargate using the module. What do I need to do exactly to allow fargate to assume the role in my TF code?

assume role into another account ?

Same account, doing a POC for now.

The below is from my PR. I gave the ECS task role the admin access policy to get things working. According to policy simulator, the ECS role can assume ROLE_NAME in the below.

Error: error configuring Terraform AWS Provider: IAM Role (arn:aws:iam::ACCOUNT:role/ROLE_NAME) cannot be assumed.

There are a number of possible causes of this - the most common are:
  * The credentials used in order to assume the role are invalid
  * The credentials do not have appropriate permission to assume the role
  * The role ARN is not valid

Error: NoCredentialProviders: no valid providers in chain. Deprecated.
	For verbose messaging see aws.Config.CredentialsChainVerboseErrors

in the same account it does not have to assume role, it uses an instance profile

so you do not need to provide a role arn

Cool, that worked! Thanks 🙂

np

anyone got oidc working with atlantis on an aws alb ? we're using okta with the following settings

    issuer                              = "<https://company.okta.com/>"
    token_endpoint                      = "<https://company.okta.com/oauth2/default/v1/token>"
    user_info_endpoint                  = "<https://company.okta.com/oauth2/default/v1/userinfo>"
    authorization_endpoint              = "<https://company.okta.com/oauth2/default/v1/authorize>"
    authentication_request_extra_params = {}

is this correct ? we created a Web integration with OpenID Connect to get a client_id and client_secret

and

  allow_unauthenticated_access = true
  allow_github_webhooks        = true

Does anybody have a solution for deleting projects via Atlantis, once the pull request is open (which deletes a bunch of files)?

Background:
I am using terragrunt and each directory represents a project which creates various resources. If I am deleting this directory and create a pull request, Atlantis obviously isn't able to do a terraform/terragrunt destroy on those, as the directories don't exist anymore.