Portfolio DevOps à 0€: Du Rêve à la Réalité

# 1. Déclarer GitHub comme fournisseur d'identité de confiance
resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
}

# 2. Créer un rôle IAM que GitHub peut "endosser"
resource "aws_iam_role" "github_actions" {
  name = "your-project-github-actions"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRoleWithWebIdentity"
      Effect = "Allow"
      Principal = {
        Federated = aws_iam_openid_connect_provider.github.arn
      }
      Condition = {
        StringLike = {
          # CRITIQUE: Seul CE repo peut utiliser ce rôle
          "token.actions.githubusercontent.com:sub" = "repo:YOUR_USERNAME/YOUR_REPO_NAME:*"
        }
      }
    }]
  })
}

# 3. Attacher les permissions minimales (moindre privilège)
resource "aws_iam_role_policy" "github_actions_policy" {
  name = "github-actions-policy"
  role = aws_iam_role.github_actions.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:PutObject",
          "s3:DeleteObject",
          "s3:GetObject",
          "s3:ListBucket"
        ]
        Resource = [
          "${aws_s3_bucket.website.arn}/*",
          aws_s3_bucket.website.arn
        ]
      },
      {
        Effect = "Allow"
        Action = [
          "dynamodb:PutItem",
          "dynamodb:GetItem",
          "dynamodb:DeleteItem"
        ]
        Resource = aws_dynamodb_table.terraform_lock.arn
      }
    ]
  })
}

name: Deploy

on:
  push:
    branches: [main]

permissions:
  id-token: write  # Indispensable pour demander le token OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Remplace les secrets GitHub par une auth OIDC
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::YOUR_AWS_ACCOUNT_ID:role/your-project-github-actions
          aws-region: YOUR_AWS_REGION

      # À partir d'ici, on a des creds temporaires (1h)
      - name: Terraform Init, Plan & Apply
        run: |
          terraform init
          terraform plan -out=tfplan
          terraform apply tfplan

      - name: Build Site
        run: npm run build

      - name: Deploy to S3
        run: aws s3 sync dist/ s3://your-bucket-name/

resource "aws_budgets_budget" "monthly_alert" {
  name              = "your-project-budget-monthly"
  budget_type       = "COST"
  limit_amount      = "1.0"  # Alerte dès 1$
  limit_unit        = "USD"
  time_unit         = "MONTHLY"

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80  # 80% du budget
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = [var.billing_email]
  }
}

resource "aws_budgets_budget" "forecasted_alert" {
  name              = "your-project-budget-forecasted"
  budget_type       = "COST"
  limit_amount      = "1.0"
  limit_unit        = "USD"
  time_unit         = "MONTHLY"

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100  # Dépasse la limite
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = [var.billing_email]
  }
}

resource "aws_s3_object" "website_index" {
  bucket               = aws_s3_bucket.website.id
  key                  = "index.html"
  source               = "dist/index.html"
  etag                 = filemd5("dist/index.html")
  content_type         = "text/html"
  cache_control        = "public, max-age=3600"  # 1h
}

resource "aws_s3_object" "website_assets" {
  bucket               = aws_s3_bucket.website.id
  key                  = "assets/*"
  source               = "dist/assets"
  etag                 = filemd5("dist/assets")
  content_type         = "application/octet-stream"
  cache_control        = "public, max-age=31536000"  # 1 an (cache-buster en nom)
}

# Backend S3 (AWS)
terraform {
  backend "s3" {
    bucket         = "your-terraform-state-bucket"
    key            = "prod/terraform.tfstate"
    region         = "YOUR_AWS_REGION"
    encrypt        = true
    dynamodb_table = "your-terraform-locks"
  }
}

# Protéger le bucket State
resource "aws_s3_bucket" "terraform_state" {
  bucket = "your-terraform-state-bucket"
}

resource "aws_s3_bucket_versioning" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id
  
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# Table DynamoDB pour les locks
resource "aws_dynamodb_table" "terraform_locks" {
  name           = "your-terraform-locks"
  billing_mode   = "PAY_PER_REQUEST"  # On ne paie que si on l'utilise
  hash_key       = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }
}

name: Health Check & Monitoring
on:
  schedule:
    # Tous les jours à 08:00, 12:00, 18:00 UTC
    - cron: '0 8,12,18 * * *'
  push:
    branches: [main]

permissions:
  id-token: write

jobs:
  health-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v3
        with:
          node-version: '18'

      - name: Install Dependencies
        run: npm install

      - name: Run Playwright Tests
        env:
          PLAYWRIGHT_TEST_BASE_URL: "https://your-domain.com"
        run: npx playwright test

      - name: Publish Test Results
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: always()
        with:
          files: test-results/*.xml

// tests/health.spec.ts
import { test, expect } from '@playwright/test';

test.describe('Production Monitoring', () => {
  
  test('Homepage loads and renders correctly', async ({ page }) => {
    await page.goto('/');
    
    // Vérifier que la page répond bien
    expect(page.url()).toContain('your-domain.com');
    
    // Vérifier que les éléments critiques sont présents
    await expect(page.locator('header')).toBeVisible();
    await expect(page.locator('main')).toBeVisible();
    
    // Vérifier que le logo charge
    const logo = page.locator('img[alt="Logo"]');
    await expect(logo).toBeVisible();
    await expect(logo).toHaveJSProperty('naturalWidth', (width) => width > 0);
  });

  test('CSS and JS are loaded', async ({ page }) => {
    await page.goto('/');
    
    // Vérifier qu'au moins 5 stylesheets sont chargés
    const cssCount = await page.evaluate(() => {
      return document.styleSheets.length;
    });
    expect(cssCount).toBeGreaterThanOrEqual(1);
    
    // Vérifier que les scripts sont actifs
    const jsLoaded = await page.evaluate(() => {
      return window.__APP_LOADED__ === true;
    });
    expect(jsLoaded).toBe(true);
  });

  test('Performance metrics meet SLA', async ({ page }) => {
    const metrics = [];
    
    page.on('framenavigated', async () => {
      const perfData = await page.evaluate(() => {
        const navigation = performance.getEntriesByType('navigation')[0];
        return {
          domContentLoaded: navigation.domContentLoadedEventEnd - navigation.domContentLoadedEventStart,
          loadComplete: navigation.loadEventEnd - navigation.loadEventStart,
          fcp: performance.getEntriesByName('first-contentful-paint')[0]?.startTime || 0,
        };
      });
      metrics.push(perfData);
    });

    await page.goto('/');
    
    // SLA: FCP < 2s, Load < 3s
    const fcp = metrics[0]?.fcp || 0;
    expect(fcp).toBeLessThan(2000);
  });
});

# 1. Une seule fois, avec les credentials AWS
aws s3api create-bucket \
  --bucket your-terraform-state-bucket \
  --region YOUR_AWS_REGION \
  --create-bucket-configuration LocationConstraint=YOUR_AWS_REGION

aws s3api put-bucket-versioning \
  --bucket your-terraform-state-bucket \
  --versioning-configuration Status=Enabled

# 2. Créer la table DynamoDB
aws dynamodb create-table \
  --table-name your-terraform-locks \
  --attribute-definitions AttributeName=LockID,AttributeType=S \
  --key-schema AttributeName=LockID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST

# 3. À partir de là, Terraform prend le relais
terraform init
terraform apply

# 4. Import du bucket/table dans l'état
terraform import aws_s3_bucket.terraform_state your-terraform-state-bucket
terraform import aws_dynamodb_table.terraform_locks your-terraform-locks

# Lister les locks actifs
aws dynamodb scan --table-name your-terraform-locks

# Supprimer le lock (ATTENTION: ne pas faire pendant une opération!)
terraform force-unlock abc123...

# Mieux: automatiser le cleanup
# Dans github/workflows/cleanup-locks.yml
- name: Force Unlock on Timeout
  if: failure()
  run: terraform force-unlock -force $(aws dynamodb get-item --table-name your-terraform-locks | jq -r '.Item.LockID.S')

data "tls_certificate" "github" {
  url = "https://token.actions.githubusercontent.com"
}

resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  
  # Utiliser le certificat actuel, pas un thumbprint codé en dur
  thumbprint_list = [
    data.tls_certificate.github.certificates[0].sha1_fingerprint
  ]
}

# 1. Clone
git clone https://github.com/YOUR_USERNAME/YOUR_REPO_NAME.git
cd YOUR_REPO_NAME

# 2. Configure AWS
export AWS_PROFILE=your-profile
export TF_VAR_billing_email=your@email.com

# 3. Deploy
terraform init
terraform apply

# 4. Build & Deploy site
npm run build
aws s3 sync dist/ s3://your-bucket/