Developer Self-Service with Resourcely

Intro

The Scenario

Thanks to the success of Infrastructure-as-Code tools, more organizations are allowing their developers to deploy infrastructure resources themselves. Examples of these resources could be AWS S3 buckets for storage, containers for their applications, serverless functions, and anything else needed. While this paradigm shift can reduce the overall load on the infrastructure developers, you must make considerations when shifting that load.

1. Productivity waste due to context switching.
   


2. Security risks due to expanded access to infrastructure.
   


3. Reliability and stability risks due to misconfigurations.

Developing a robust self-service infrastructure platform using Resourcely's Blueprints and Guardrails can address all of these concerns with proper planning.

Let's examine a simple AWS S3 deployment to see how Resourcely's features can empower your developers to deploy their infrastructure securely.

Prerequisites

To integrate Resourcely into your deployment pipeline, you'll need to configure a few things. In this example, I'll use a GitHub Actions Pipeline.

GitHub Repository

You'll need to configure a GitHub repository and provide access to Resourcely. If you haven't already done this, you can find more information here: configured for Terraform. You can use any backend you wish, such as one using

An example of the workflow is below. Ensure you set the role-to-assume secret:

.github/workflows/main.yml

name: Plan and Apply Terraform



on:

  push:

    branches: ["main"]

  pull_request:

    branches: ["main"]



permissions:

  id-token: write

  contents: read



jobs:

  terraform:

    name: 'Terraform'

    runs-on: ubuntu-latest

    environment: production



    defaults:

      run:

        shell: bash



    steps:

      - name: Configure AWS credentials

        uses: aws-actions/configure-aws-credentials@v4

        with:

            role-to-assume: ${{ secrets.ROLE_TO_ASSUME }}

            aws-region: ${{ vars.AWS_REGION }}



      - name: Checkout

        uses: actions/checkout@v4



      - name: Setup Terraform

        uses: hashicorp/setup-terraform@v3



      - name: Terraform Init

        run: terraform init



      - name: Terraform Plan

        run: terraform plan -out=plan.raw



      - name: Convert the plan to JSON

        id: platoon

        run: terraform show -json plan.raw



      - name: Save JSON to a file

        using: fishcharlie/[email protected]

        with:

          data: ${{ steps.planToJson.outputs.stdout }}

          output: plan.json



      - name: Upload Terraform Plan Output

        uses: actions/upload-artifact@v4

        with:

          name: plan-file

          path: plan.json



      - name: Terraform Apply

        if: GitHub.ref == 'refs/heads/main' && github.event_name == 'push'

        run: terraform apply -auto-approve -input=false



  resourcely-ci:

    Needs: terraform

    if: GitHub.event_name == 'pull_request'

    runs-on: ubuntu-latest

    steps:

      - name: Checkout

        uses: actions/checkout@v4



      - name: Download Terraform Plan Output

        uses: actions/download-artifact@v4

        with:

          name: plan-file

          path: tf-plan-files/



      - name: Resourcely CI

        uses: Resourcely-Inc/resourcely-action@v1

        with:

          resourcely_api_token: ${{ secrets.RESOURCELY_API_TOKEN }}

          resourcely_api_host: "https://api.resourcely.io"

          tf_plan_directory: "tf-plan-files"

Once everything is in place and you've tested the workflow, let's start building with Resourcely!

Blueprints

What are blueprints?

Resourcely's Blueprints provide a practical way to simplify and standardize cloud resource deployment using customizable templates that generate Terraform configurations. With Blueprints, teams can create consistent, secure, and compliant infrastructure setups, making the deployment process more efficient and improving collaboration across projects.

Configure blueprints

In this tutorial, we'll import an existing module to start our Blueprint. We'll use Resourcely's "Foundry" to author the Blueprint.

Once you define these items, you can preview the Terraform code that will be created by clicking on the "Terraform" tab:

.

Modifying the Blueprint

Blueprints are straightforward to modify manually, but some very cool features simplify the process of maximizing the developer-friendliness of your blueprints. One of these quality-of-life features is the ability to generate "tags" dynamically based on value type. If you highlight an attribute of one of the resources, you can click the "Use Selection" dropdown followed by the "Generate tag" option to generate a tag. You can also simply right-click the attribute to do the same. In the following image, I select the block_public_acls attribute and generate a tag for it:

The "Developer Experience" tab now has the new boolean added:

. The Really policy language is one of the first things that drew me to Resourcely. I've written countless lines of Rego in my Open Policy Agent policies, and I would have loved to cut those lines down significantly with Really's more concise syntax. Check out the Really docs

You can choose an approver to authorize overrides for the Guardrail. If you haven't created any, "default" will work just fine. Once you set this, click "Create Guardrail" at the top left of the screen, decide if you want this Guardrail to be "Active," "Inactive," or "Evaluate Only," then click "Yes, create Guardrail," choose "Use Guardrail in Blueprint" on the following screen, and this Guardrail is ready to go!

Voila! That simple action generated everything needed to enforce that "object_ownership" setting. Feel free to change it if you so desire, but otherwise, click on "Define Metadata" and complete the fields:

Final Touches

Now we've created the Blueprint, generated custom tags, and created Guardrails, let's finalize the process by defining metadata:

![Define Metadata](

You'll notice that the "AWS s3 bucket public access block name block public acls" (I know, I could have been more succinct there) option is "true" and can be toggled to "false." You also may notice that "Versioning configuration status" has no option to change. The Guardrails are live and already benefiting your users. Instead of discovering after you open the PR, you immediately know what your Guardrails allow you to do.

Go ahead and click "Continue." You may see existing code if you've pushed code before using Resourcely. Scroll down, and you'll see any additional code in green:

She'll click on the same "Create Pull Request" button at the top right:

Merge the PR, and Jane Dev's bucket is deployed with all settings enforced:

Conclusion

This tutorial covered several ways Resourcely makes life easy for Infrastructure-as-Code developers who need resources they can deploy effortlessly. Simple niceties such as tag generation make it quick and easy to pass in attribute values that weren't previously a variable. Guardrails ensure that you can enforce any attribute. With Blueprints tying everything together, I don't know of another product that makes it easier to deploy compliant resources quickly.

I hope you enjoyed this tutorial as much as I enjoyed writing it! Until next time, cheers!