terraform {
    backend "remote" {
        hostname     = "app.terraform.io"
        organization = "hamaguri-corporation"
        workspaces {
          name = "hamaguri-terraform"
        }
    }
    required_providers {
        aws = {
            version = "5.36.0"
            source = "hashicorp/aws"
        }
    }
}

variable "AWS_ACCESS_KEY_ID" {}
variable "AWS_SECRET_ACCESS_KEY" {}

provider "aws" {
  region = "ap-northeast-1"
}

provider "aws" {
  alias  = "us-east-1"
  region = "us-east-1"
}

$ head terraform.tf -n 2
terraform {
    backend "local" {}
$ terraform init -migrate-state

Initializing Terraform Cloud...
╷
│ Error: Invalid command-line option
│ 
│ The -migrate-state option is for migration between state
│ backends only, and is not applicable when using
│ Terraform Cloud.
│ 
$ terraform init

Initializing the backend...
Migrating from Terraform Cloud to local state.
│ Terraform Cloud migration has additional steps,
│ configured by interactive prompts.
│ Error: Migrating state from Terraform Cloud to another backend is not yet implemented.
│ 
│ Please use the API to do this: https://www.terraform.io/docs/cloud/api/state-versions.html
│ 
│ 

terraform {
  required_providers {
    github = {
      source  = "integrations/github"
      # required_status_checks ブロックでエラーが出るので古いバージョンを使用
      # Issue: https://github.com/integrations/terraform-provider-github/issues/1147
      version = "4.22.0"
    }
    tfe = {
      version = "0.52.0"
    }
  }
}

variable "github_token" {}
variable "oauth_token_id" {}

variable "AWS_ACCESS_KEY_ID" {}
variable "AWS_SECRET_ACCESS_KEY" {}
variable "DB_PASSWORD" {}

provider "github" {
  owner = "hamaguri-corporation"
  token = var.github_token
}

locals {
  project           = "hamaguri-project"
  terraform_version = "1.7.3"
  workspace = [
    "development",
    "production"
  ]
  common_files = [
    "ip_addresses.tf",
    "project.tf"
  ]
}

# GitHub

resource "github_repository" "main" {
  name       = local.project
  visibility = "private"
  # Pull Requset がマージされた後に head ブランチを自動で削除するかどうか
  delete_branch_on_merge = true
  # 最初の commit を自動でするかどうか
  auto_init = true
  /*
  auto_init を false にすると以下のようなエラーが出てしまう

  │ Error: PATCH https://api.github.com/repos/hamaguri-corporation/hamaguri-project: 422 Validation Failed [{Resource:Repository Field:default_branch Code:invalid Message:Cannot update default branch for an empty repository. Please init the repository and push first.}]
  │ 
  │   with github_branch_default.main,
  │   on terraform.tf line 48, in resource "github_branch_default" "main":
  │   48: resource "github_branch_default" "main" {
  │ 
  ╵
  */
}

resource "github_branch_default" "main" {
  repository = github_repository.main.name
  branch     = "master"
}

resource "github_branch_protection_v3" "main" {
  repository     = github_repository.main.name
  branch         = "master"
  # わかりにくいが "Do not allow bypassing the above settings" の設定
  enforce_admins = true

  required_status_checks {
    strict = true
  }

  required_pull_request_reviews {
    dismiss_stale_reviews           = true
    required_approving_review_count = 1
  }

}

# Terraform Cloud

/*
$ tree workspace
workspace
├── development
└── production
*/

resource "tfe_project" "main" {
  organization = "hamaguri-corporation"
  name         = "hamaguri-project"
}

resource "tfe_workspace" "main" {
  for_each = toset(local.workspace)

  name         = "${local.project}-${each.key}"
  organization = "hamaguri-corporation"
  # 指定 branch への push にトリガーして自動で apply するかどうか
  # push が頻繁にあるなら true がよい
  # クリティカルな本番環境なら false がベターだがトリプルチェックともいえる
  auto_apply = false
  # トリガーするファイルを指定するかどうか。false だとあらゆるファイルの変更にトリガー
  file_triggers_enabled = true
  # terraform_remote_state を全ての workspace から受け付けるかどうか。
  global_remote_state = true
  # Pull Request に対して plan を提供するかどうか
  speculative_enabled = true
  # plan/apply に Terraform Cloud が提供する User Interface を使うかどうか
  structured_run_output_enabled = true

  terraform_version = local.terraform_version
  # Working Directory 以外にトリガーするファイル path
  trigger_prefixes = local.common_files

  working_directory = each.key

  project_id = tfe_project.main.id

  vcs_repo {
    branch         = "master"
    identifier     = "hamaguri-corporation/${local.project}"
    oauth_token_id = var.oauth_token_id
  }
}

resource "tfe_workspace_settings" "test-settings" {
  for_each       = toset(local.workspace)

  workspace_id   = tfe_workspace.main[each.key].id
  execution_mode = "remote"
}

resource "tfe_variable" "key-id" {
  for_each = toset(local.workspace)

  key          = "AWS_ACCESS_KEY_ID"
  value        = var.AWS_ACCESS_KEY_ID
  category     = "terraform"
  workspace_id = tfe_workspace.main[each.key].id
}

resource "tfe_variable" "secret-key" {
  for_each = toset(local.workspace)

  key          = "AWS_SECRET_ACCESS_KEY"
  value        = var.AWS_SECRET_ACCESS_KEY
  category     = "terraform"
  sensitive    = true
  workspace_id = tfe_workspace.main[each.key].id
}

resource "tfe_variable" "db-password" {
  for_each = toset(local.workspace)

  key          = "DB_PASSWORD"
  value        = var.DB_PASSWORD
  category     = "terraform"
  sensitive    = true
  workspace_id = tfe_workspace.main[each.key].id
}