Deploying Private Terraform Modules with AWS AFT Control Tower

Description

If you are using AWS AFT for Account provisioning and as we know it connects with your private VCS using AWS CodeConnections.

However, the AWS CodeConnections is only used for connecting repo for AFT related four repositories. In case if you want to use private terraform modules in account customizations or in global customizations then there is no solution out of the box.

Four Repositories related to AFT :-

Solution

The approach i have used to do is that, saving your private repo access token in AWS secret manager and retrieving the secret in pre-api-helpers.sh file.

As we know we have api_helpers folder/directory in every account customization directory. So i am utilizing pre-api-helpers.sh file to setup token for my private github repos.

File needs to be used :-

Please find below the contents of the pre-api-helpers.sh file, you can. use the same and start using your private modules. Note : Please modify the GIT_REPO_URL to your organization and also at the start make sure to setup right aws_profile, if the repo_token is in different account export profile accordingly.

#!/bin/bash

echo "Executing Pre-API Helpers"

# Set AWS Profile (Modify as needed or remove if using default credentials)
export AWS_PROFILE=my-aft-mgmt # if secrets are in aft mgmt account.

# Fetch the repository authentication token from AWS Secrets Manager
export REPO_TOKEN=$(aws secretsmanager get-secret-value \
    --secret-id MY_SECRET_ID \
    --region my-region \
    --query SecretString \
    --output text | jq -r '.REPO_TOKEN')

# Validate token retrieval
if [[ -z "$REPO_TOKEN" || "$REPO_TOKEN" == "null" ]]; then
    echo "Error: Failed to retrieve the token from AWS Secrets Manager."
    exit 1
fi

# Configure Git to use the retrieved token for authentication
GIT_REPO_URL="github.com/my-org/my-repo"
git config --global url."https://git:${REPO_TOKEN}@${GIT_REPO_URL}".insteadOf "https://${GIT_REPO_URL}"
git config --global url."https://${REPO_TOKEN}:x-oauth-basic@${GIT_REPO_URL}".insteadOf "ssh://git@${GIT_REPO_URL}"

echo "Git configuration updated successfully."