diff --git a/runatlantis.io/docs/server-configuration.md b/runatlantis.io/docs/server-configuration.md index 0258bfa697..cffd530788 100644 --- a/runatlantis.io/docs/server-configuration.md +++ b/runatlantis.io/docs/server-configuration.md @@ -47,26 +47,11 @@ won't work for multiple accounts since Atlantis wouldn't know which environment Terraform with. ### Assume Role Session Names -Atlantis injects 3 Terraform variables that can be used to dynamically name the assume role -session: +Atlantis injects 5 Terraform variables that can be used to dynamically name the assume role session name. +Setting the `session_name` allows you to trace API calls made through Atlantis back to a specific +user and repo via CloudWatch: ```bash -# Set to the VCS username of who is running the plan command, ex. lkysow -variable "atlantis_user" { - default = "atlantis_user" -} - -# Set to the full name of the repo the pull request is in, ex. runatlantis/atlantis -variable "atlantis_repo" { - default = "atlantis_repo" -} - -# Set to the pull request number, ex. 200 -variable "atlantis_pull_num" { - default = "atlantis_pull_num" -} - -# Can be used within the assume_role block for session_name. provider "aws" { assume_role { role_arn = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME" @@ -75,13 +60,19 @@ provider "aws" { } ``` -Setting `session_name` allows you to trace where API calls made through Atlantis came from in -CloudWatch. +Atlantis runs `terraform` with the following variables: +| `-var` Argument | Description | +|-------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| +| `atlantis_user=lkysow` | The VCS username of who is running the plan command. | +| `atlantis_repo=runatlantis/atlantis` | The full name of the repo the pull request is in. NOTE: This variable can't be used in the AWS session name because it contains a `/`. | +| `atlantis_repo_owner=runatlantis` | The name of the **owner** of the repo the pull request is in. | +| `atlantis_repo_name=atlantis` | The name of the repo the pull request is in. | +| `atlantis_pull_num=200` | The pull request number. | -If you're also using the [S3 Backend](https://www.terraform.io/docs/backends/types/s3.html) +If you want to use `assume_role` with Atlantis and you're also using the [S3 Backend](https://www.terraform.io/docs/backends/types/s3.html), make sure to add the `role_arn` option: -```hcl +```bash terraform { backend "s3" { bucket = "mybucket" @@ -94,11 +85,3 @@ terraform { } } ``` - -::: warning -Terraform doesn't support interpolations in backend config so you will not be -able to use `session_name = "${var.atlantis_user}"` in your backend block. However, the backend assumed -role is only used for state-related API actions. Any other API actions will be performed using -the assumed role specified in the `aws` provider and will have the session named as the GitHub user. -::: -