From 5df91775d033deedd2c81d185d519699249e857b Mon Sep 17 00:00:00 2001 From: Christopher Edmund Coletta Date: Fri, 22 Mar 2024 13:44:06 -0400 Subject: [PATCH 1/2] initial add --- .../terraform/dev/main.tf | 64 +++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 practices/infrastructure/examples/single-server-terraform-aws-app/terraform/dev/main.tf diff --git a/practices/infrastructure/examples/single-server-terraform-aws-app/terraform/dev/main.tf b/practices/infrastructure/examples/single-server-terraform-aws-app/terraform/dev/main.tf new file mode 100644 index 0000000..483b8e4 --- /dev/null +++ b/practices/infrastructure/examples/single-server-terraform-aws-app/terraform/dev/main.tf @@ -0,0 +1,64 @@ + +terraform { + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 3.27" + } + } + + required_version = ">= 0.14" +} + +provider "aws" { + region = "us-east-1" # or your preferred region +} + +resource "aws_instance" "app_server" { + ami = "ami-1234567890abcdef0" # replace with a valid AMI for your region + instance_type = "t3.xlarge" + + key_name = "my-aws-keypair" # Ensure this key pair exists in your AWS account + + # Security groups and networking + vpc_security_group_ids = ["sg-12345678"] # Replace with your security group ID + subnet_id = "subnet-12345678" # Replace with your subnet ID + + user_data = <<-EOF + #!/bin/bash + sudo apt-get install -y git docker.io docker-compose + git clone https://github.com/yourusername/yourrepo.git /home/ubuntu/yourrepo + cd /home/ubuntu/yourrepo + sudo docker-compose up -d + EOF + + tags = { + Name = "DockerComposeServer" + } +} + +resource "aws_security_group" "app_sg" { + name = "app-sg" + + ingress { + from_port = 80 + to_port = 80 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } +} + + +resource "aws_ebs_volume" "db_volume" { + availability_zone = "us-east-1" + size = 100 + type = "gp3" + iops = 3000 # Only necessary for io1 or io2 + throughput = 125 # Only applicable for gp3 + encrypted = true + kms_key_id = "arn:aws:kms:us-west-2:123456789012:key/abcd1234-a123-456a-a12b-a123b4cd56ef" + + tags = { + Name = "MyDatabaseVolume" + } +} From 93699d06d337705cf81eff2d287cbb5ed114b8ec Mon Sep 17 00:00:00 2001 From: Christopher Edmund Coletta Date: Fri, 22 Mar 2024 14:26:09 -0400 Subject: [PATCH 2/2] fleshing out security groups and ingress ports --- .../terraform/dev/main.tf | 29 +++++++++++++++++-- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/practices/infrastructure/examples/single-server-terraform-aws-app/terraform/dev/main.tf b/practices/infrastructure/examples/single-server-terraform-aws-app/terraform/dev/main.tf index 483b8e4..f91b12e 100644 --- a/practices/infrastructure/examples/single-server-terraform-aws-app/terraform/dev/main.tf +++ b/practices/infrastructure/examples/single-server-terraform-aws-app/terraform/dev/main.tf @@ -18,10 +18,14 @@ resource "aws_instance" "app_server" { ami = "ami-1234567890abcdef0" # replace with a valid AMI for your region instance_type = "t3.xlarge" - key_name = "my-aws-keypair" # Ensure this key pair exists in your AWS account + # Go to AWS EC2 key-pair listing + key_name = "key-0dd9b3a1cbe164237" # Ensure this key pair exists in your AWS account # Security groups and networking - vpc_security_group_ids = ["sg-12345678"] # Replace with your security group ID + + # Security group as defined below, use as is if you want to create a new security group every time + # Or replace with your preexisting security group ID + vpc_security_group_ids = aws_security_group.app_sg.id subnet_id = "subnet-12345678" # Replace with your subnet ID user_data = <<-EOF @@ -38,13 +42,32 @@ resource "aws_instance" "app_server" { } resource "aws_security_group" "app_sg" { + # Display name in console on AWS name = "app-sg" + # use individual ingress blocks ingress { + # Beginning bound of port range from_port = 80 + # end bound of port range to_port = 80 protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] + cidr_blocks = ["0.0.0.0/0"] # wildcard, lock down to a specific cidr range, anything that can get to it is allowed to. + # + } + ingress { + from_port = 443 + to_port = 443 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] # wildcard, lock down to a specific cidr range, anything that can get to it is allowed to. + } + # hard code my home & work ip, or pull out of a parameter store + # Or add all IPS to a security group. + ingress { + from_port = 22 + to_port = 22 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] # wildcard, lock down to a specific cidr range, anything that can get to it is allowed to. } }