Chore: install terraform in devcontainer (#3417)

Author: thekaveman

.devcontainer/Dockerfile

@@ -1,5 +1,8 @@
 FROM benefits_client:latest
 
+# should match the version specified in terraform/pipeline/deploy.yml
+ENV TF_VERSION="1.13.4"
+
 USER root
 
 # install apt packages using the archives and lists cache
@@ -10,7 +13,13 @@ RUN --mount=type=cache,id=apt-archives,sharing=locked,target=/var/cache/apt/arch
     curl -sL https://aka.ms/InstallAzureCLIDeb | bash && \
     # install webp CLI
     # https://developers.google.com/speed/webp/download
-    apt install locales webp -y
+    apt install locales webp -y && \
+    # install Terraform
+    # https://developer.hashicorp.com/terraform/tutorials/docker-get-started/install-cli#install-terraform
+    wget https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip && \
+    unzip terraform_${TF_VERSION}_linux_amd64.zip && \
+    chmod +x terraform && \
+    mv terraform /usr/local/bin/
 
 # VSCode will use en_US for git operations, so make it available in the container
 # https://github.com/microsoft/vscode/pull/210506

.vscode/settings.json

@@ -24,10 +24,12 @@
   "python.testing.pytestEnabled": true,
   "python.testing.unittestEnabled": false,
   "[terraform]": {
-    "editor.defaultFormatter": "hashicorp.terraform"
+    "editor.defaultFormatter": "hashicorp.terraform",
+    "editor.formatOnSave": true
   },
   "[terraform-vars]": {
-    "editor.defaultFormatter": "hashicorp.terraform"
+    "editor.defaultFormatter": "hashicorp.terraform",
+    "editor.formatOnSave": true
   },
   "workbench.editorAssociations": {
     "*.db": "sqlite-viewer.option"

docs/explanation/infrastructure.md

@@ -147,18 +147,14 @@ Use the following shorthand for conveying the Resource Type as part of the Resou
 ### Set up for local development
 
 1. [Get access to the Azure account through the DevSecOps team.](#getting-started)
-1. Install dependencies:
-
-   - [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)
-   - [Terraform](https://www.terraform.io/downloads) - see exact version in [`deploy.yml`](https://github.com/cal-itp/benefits/blob/main/terraform/pipeline/deploy.yml)
-
+1. Rebuild and launch the [dev container](development/README.md)
+1. Navigate to the [`terraform/`](https://github.com/cal-itp/benefits/tree/main/terraform) directory.
 1. [Authenticate using the Azure CLI](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli).
 
    ```sh
    az login
    ```
 
-1. Outside the [dev container](development/README.md), navigate to the [`terraform/`](https://github.com/cal-itp/benefits/tree/main/terraform) directory.
 1. [Initialize Terraform.](https://www.terraform.io/cli/commands/init) You can also use this script later to switch between [environments](#environments).
 
    ```sh
@@ -181,7 +177,8 @@ When configuration changes to infrastructure resources are needed, they should b
 1. [Submit the changes via pull request.](development/commits-branches-merging.md)
 
 !!! info "Azure tags"
-For Azure resources, you need to [ignore changes](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes) to tags, since they are [automatically created by an Azure Policy managed by CDT](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies).
+
+    For Azure resources, you need to [ignore changes](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes) to tags, since they are [automatically created by an Azure Policy managed by CDT](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies).
 
     ```hcl
     lifecycle {

terraform/.terraform.lock.hcl

@@ -1 +1 @@
-[Documentation](https://docs.calitp.org/benefits/deployment/infrastructure/)
+[Documentation](https://docs.calitp.org/benefits/explanation/infrastructure/)

terraform/README.md

@@ -23,12 +23,12 @@ resource "azurerm_linux_web_app" "main" {
   virtual_network_subnet_id = local.subnet_id
 
   site_config {
-    ftps_state                                    = "Disabled"
-    vnet_route_all_enabled                        = true
+    ftps_state             = "Disabled"
+    vnet_route_all_enabled = true
 
     # https://github.com/hashicorp/terraform-provider-azurerm/issues/25244
-    ip_restriction_default_action                 = "Allow"
-    scm_ip_restriction_default_action             = "Allow"
+    ip_restriction_default_action     = "Allow"
+    scm_ip_restriction_default_action = "Allow"
   }
 
   identity {

terraform/app_service.tf

@@ -7,7 +7,7 @@ locals {
   # Determine the correct sender domain based on the environment.
   # If is_prod is true, use the custom domain; otherwise, use the Azure-managed domain.
   sender_domain = local.is_prod ? azurerm_email_communication_service_domain.custom[0].mail_from_sender_domain : azurerm_email_communication_service_domain.azure_managed[0].mail_from_sender_domain
-  sender_email = "DoNotReply@${local.sender_domain}"
+  sender_email  = "DoNotReply@${local.sender_domain}"
 }
 
 resource "azurerm_key_vault_secret" "azure_communication_connection_string" {

terraform/email.tf

@@ -1,11 +1,11 @@
 locals {
-  is_prod             = terraform.workspace == "default"
-  is_test             = terraform.workspace == "test"
-  is_dev              = !(local.is_prod || local.is_test)
-  env_name            = local.is_prod ? "prod" : terraform.workspace
-  env_letter          = upper(substr(local.env_name, 0, 1))
-  hostname            = local.is_prod ? "benefits.calitp.org" : "${local.env_name}-benefits.calitp.org"
-  secret_prefix       = "@Microsoft.KeyVault(VaultName=KV-CDT-PUB-CALITP-${local.env_letter}-001;SecretName="
+  is_prod       = terraform.workspace == "default"
+  is_test       = terraform.workspace == "test"
+  is_dev        = !(local.is_prod || local.is_test)
+  env_name      = local.is_prod ? "prod" : terraform.workspace
+  env_letter    = upper(substr(local.env_name, 0, 1))
+  hostname      = local.is_prod ? "benefits.calitp.org" : "${local.env_name}-benefits.calitp.org"
+  secret_prefix = "@Microsoft.KeyVault(VaultName=KV-CDT-PUB-CALITP-${local.env_letter}-001;SecretName="
 }
 
 data "azurerm_resource_group" "main" {

terraform/environment.tf

@@ -65,10 +65,10 @@ resource "azurerm_backup_policy_file_share" "policy" {
 }
 
 resource "azurerm_storage_share" "data" {
-  name                 = "benefits-data"
-  storage_account_id   = azurerm_storage_account.main.id
-  quota                = 5
-  enabled_protocol     = "SMB"
+  name               = "benefits-data"
+  storage_account_id = azurerm_storage_account.main.id
+  quota              = 5
+  enabled_protocol   = "SMB"
   acl {
     id = "benefits-data-rwdl"
     access_policy {