Terraformと他のツールとの間でデータを共有するために設定値をyamlで管理する

# variables.yaml
ip_addresses:
  - 1.1.1.1
  - 2.2.2.2

# main.tf
locals {
  ip_addresses = yamldecode(file("variables.yaml")).ip_addresses
}

output "ip_addresses" {
  value = local.ip_addresses
}

Changes to Outputs:
  + ip_addresses = [
      + "1.1.1.1",
      + "2.2.2.2",
    ]

infra-repository/
├── service1/
│   ├── environment1/
│   │  └── terraform/
│   │      └── code-for-project1.tf
│   ├── environment2/
│   │  └── terraform/
│   │      └── code-for-project2.tf
│   └── environment3/
│      └── terraform/
│          └── code-for-project1.tf
├── service2/
│   ├── environment1/
│   │   ├── terraform/
│   │   │  └── code-for-project3.tf
│   └── environment2/
│       ├── terraform/
│       │   └── code-for-project3.tf
...

# variables.yaml
project_id: "my-project1-id"

# /path/to/a/terraform-directory/main.tf
locals { project = yamldecode(file("variables.yaml")).project_id }
provider "google" {
  project     = local.project
  region      = "my-region"
}

# config/gcloud_projects_data.yaml
projects:
- name: my-project1-display-name
  project_id: my-project1-id
  project_number: my-project1-number
- name: my-project2-display-name
  project_id: my-project2-id
  project_number: my-project2-number
- name: my-project3-display-name
  project_id: my-project3-id
  project_number: my-project3-number

# .github/workflows/terraform.yaml
name: Terraform workflow
on:
  workflow_dispatch:
    inputs:
      directory:
        description: 'Terraform directory'
        required: true
jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v4
    - name: Install yq
      run: wget https://github.com/mikefarah/yq/releases/download/v4.6.1/yq_linux_amd64 -O yq && chmod +x yq
    - name: Extract Project Data by Directory 
      id: 'extract-project'
      run: |
        DIRECTORY="${{ inputs.directory }}"

        # ディレクトリごとのプロジェクト情報を取得
        GCLOUD_PROJECT_ID=$(yq e '.project_id' $DIRECTORY/variables.yaml)
        GCLOUD_PROJECT_NUMBER=$(yq e ".projects[] | select(.project_id == \"$GCLOUD_PROJECT_ID\").project_number" config/gcloud_projects_data.yaml)
        
        echo "project-id=${GCLOUD_PROJECT_ID}" >> $GITHUB_OUTPUT
        echo "project-number=${GCLOUD_PROJECT_NUMBER}" >> $GITHUB_OUTPUT
    - name: Authenticate to Google Cloud
      id: 'auth'
      uses: google-github-actions/auth@v1
      with:
        workload_identity_provider: projects/${{ steps.extract-project.outputs.project-number }}/locations/global/workloadIdentityPools/gh-oidc-pool/providers/github-actions # プロジェクトごとに同名のOIDCプロバイダを作成しておく
        service_account: github-actions@${{ steps.extract-project.outputs.project-id}}.iam.gserviceaccount.com # プロジェクトごとに同名のサービスアカウントを作成しておく
        project_id: ${{ steps.extract-project.outputs.project-id }}
    - name: Do something with Terraform after authentication
      working-directory: ${{ inputs.directory }}
      run: |
        # 認証が完了した状態なのでTerraformコマンドが実行できる
...