fix: enable blocking of calls to unauthorized endpoints (#613) #347

	name: "Terraform Apply"

	on:
	push:
	branches:
	- main
	paths:
	- "terraform/**"
	- ".github/workflows/tf_apply.yml"

	env:
	AWS_REGION: ca-central-1
	TERRAFORM_VERSION: 1.3.3
	TERRAGRUNT_VERSION: 0.31.1
	TF_VAR_google_oauth_pickle_string: "${{ secrets.GOOGLE_PICKLE_STRING }}"
	TF_VAR_slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
	TF_VAR_gcp_sre_service_account_key: ${{ secrets.GCP_SRE_SERVICE_ACCOUNT_KEY_FILE }}



	permissions:
	id-token: write
	contents: read

	jobs:
	terragrunt-apply:
	if: github.ref == 'refs/heads/main' && github.event_name == 'push'
	strategy:
	fail-fast: false
	matrix:
	include:
	- module: terraform

	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

	- name: setup terraform tools
	uses: cds-snc/terraform-tools-setup@v1

	- name: configure aws credentials using OIDC
	uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
	with:
	role-to-assume: arn:aws:iam::283582579564:role/sre-bot-apply
	role-session-name: TFApply
	aws-region: ${{ env.AWS_REGION }}

	- name: Apply Terraform
	working-directory: terraform
	run: terragrunt apply --terragrunt-non-interactive -auto-approve

Provide feedback