CTFd AWS Terraform module

Terraform module to deploy CTFd into scalable AWS infrastructure

This has been used in a moderately sized CTF > 1000 participants and performed well with a setup similar to the example below, though you may want to scale out a little.

Design

The CTFd setup Looks something like this:

flowchart TB

  subgraph "Uploads"
    S3Uploads[S3]
  end

  subgraph "Logs"
    S3Logs[S3]
  end

  subgraph "RDS (mysql -  Serverless or Provisioned)"
    RDS[RDS autoscale]
  end

  subgraph "ElasticCache (redis)"
    REDIS[REDIS] --> ElasticCache1[Instance 1]
    REDIS[REDIS] --> ElasticCache[...]
    REDIS[REDIS] --> ElasticCacheN[Instance n]
  end

  LB[ALB] --> Ingress

  subgraph ECS[ECS]
    Ingress --> Service[CTFd service]
    Service --> Instance1[CTFd Instance 1]
    Service --> Instance[CTFd Instance ...]
    Service --> InstanceN[CTFd Instance n - HorizontalAutoScaling]
    Instance1 --> RDS[RDS]
    Instance --> RDS
    InstanceN --> RDS
    Instance1 --> REDIS[REDIS]
    Instance --> REDIS
    InstanceN --> REDIS
    Instance1 --> S3Uploads
    Instance --> S3Uploads
    InstanceN --> S3Uploads
    end
  ECS --> S3Logs

Requirements

Name	Version
terraform	>= 1.7.3
aws	>= 5.38.0
docker	3.0.2
random	3.6.0

Providers

Name	Version
random	3.6.0

Inputs

Name	Description	Type	Default	Required
app_name	Name of application (ex: "ctfd")	`string`	`"ctfd"`	no
aws_region	Region to deploy CTFd into	`string`	`"us-east-1"`	no
create_cdn	Whether to create a cloudfront CDN deployment.	`bool`	`false`	no
create_in_aws	Create AWS resources. If false an instance will be spun up locally with docker	`bool`	`true`	no
ctf_domain	Domain to use for the CTFd deployment. Only used if `create_cdn` is `true`	`string`	`""`	no
ctf_domain_zone_id	zone id for the route53 zone for the ctf_domain. Only used if `create_cdn` is `true`	`string`	`""`	no
ctfd_image	Docker image for the ctfd frontend.	`string`	`"ctfd/ctfd"`	no
db_character_set	The database character set.	`string`	`"utf8mb4"`	no
db_cluster_instance_type	Type of instances to create in the RDS cluster. Only used if db_serverless set to `false`	`string`	`"db.r5.large"`	no
db_collation	The database collation.	`string`	`"utf8mb4_bin"`	no
db_deletion_protection	If true database will not be able to be deleted without manual intervention	`bool`	`true`	no
db_engine	Engine for the RDS cluster	`string`	`"aurora-mysql"`	no
db_engine_version	Engine version for the RDS cluster	`string`	`"8.0.mysql_aurora.3.04.1"`	no
db_name	Name for the database in RDS	`string`	`"ctfd"`	no
db_port	Port to connect to the RDS cluster on	`number`	`3306`	no
db_serverless	Configure serverless RDS cluster	`bool`	`true`	no
db_serverless_max_capacity	Maximum capacity for serverless RDS. Only used if db_serverless set to `true`	`number`	`128`	no
db_serverless_min_capacity	Minimum capacity for serverless RDS. Only used if db_serverless set to `true`	`number`	`1`	no
db_skip_final_snapshot	If true database will not be snapshoted before deletion.	`bool`	`false`	no
db_user	Username for the RDS database	`string`	`"ctfd"`	no
elasticache_cluster_instance_type	Instance type for instance in ElastiCache cluster	`string`	`"cache.r6g.large"`	no
elasticache_cluster_instances	Number of instances in ElastiCache cluster	`number`	`3`	no
elasticache_cluster_port	Port to connect to the ElastiCache cluster on	`number`	`6379`	no
elasticache_encryption_key_arn	Encryption key for use with ElastiCache at-rest encryption. Unencrypted if this is empty.	`string`	`""`	no
force_destroy_challenge_bucket	Whether the S3 bucket containing the CTFD challenge data should be force destroyed	`bool`	`false`	no
force_destroy_log_bucket	Whether the S3 bucket containing the logging data should be force destroyed	`bool`	`false`	no
frontend_desired_count	Desired number of task instances for the frontend service.	`number`	`2`	no
frontend_maximum_percent	health percent for the frontend service.	`number`	`150`	no
frontend_minimum_healthy_percent	Minimum health percent for the frontend service.	`number`	`75`	no
https_certificate_arn	SSL Certificate ARN to be used for the HTTPS server.	`string`	`""`	no
rds_encryption_key_arn	Encryption key for use with RDS at-rest encryption. Unencrypted if this is empty.	`string`	`""`	no
registry_password	Password for container registry. Needed if using a private registry for a custom CTFd image.	`string`	`null`	no
registry_server	Container registry server. Needed if using a private registry for a custom CTFd image.	`string`	`"registry.gitlab.com"`	no
registry_username	Username for container registry. Needed if using a private registry for a custom CTFd image.	`string`	`null`	no
s3_encryption_key_arn	Encryption key for use with S3 bucket at-rest encryption. Unencrypted if this is empty.	`string`	`""`	no

Outputs

Name	Description
challenge_bucket_id	Challenge bucket name
lb_dns_name	DNS name for the Load Balancer
lb_port	Port that CTFd is reachable on
log_bucket_id	Logging bucket name
private_subnet_ids	List of private subnets that contain backend infrastructure (RDS, ElastiCache, EC2)
public_subnet_ids	List of public subnets that contain frontend infrastructure (ALB)
vpc_id	Id for the VPC created for CTFd

Examples

AWS Example

terraform {
  required_version = ">= 1.7.3"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.38.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

module "ctfd" {
  source                            = "../../" # Actually set to "1nval1dctf/ctfd/aws"
  db_deletion_protection            = false
  elasticache_cluster_instance_type = "cache.t2.micro"
  elasticache_cluster_instances     = 2
  db_serverless                     = true
}

Docker Example

terraform {
  required_version = ">= 1.7.3"
}

module "ctfd" {
  source        = "../../" # Actually set to "1nval1dctf/ctfd/aws"
  db_user       = "ctfd"
  db_name       = "ctfd"
  create_in_aws = false
}

Building / Contributing

Install prerequisites

Golang

wget https://dl.google.com/go/go1.19.5.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.19.5.linux-amd64.tar.gz
rm go1.19.5.linux-amd64.tar.gz

Terraform

LATEST_URL=$(curl https://releases.hashicorp.com/terraform/index.json | jq -r '.versions[].builds[].url | select(.|test("alpha|beta|rc")|not) | select(.|contains("linux_amd64"))' | sort -t. -k 1,1n -k 2,2n -k 3,3n | tail -1)
curl ${LATEST_URL} > /tmp/terraform.zip
(cd /tmp && unzip /tmp/terraform.zip && chmod +x /tmp/terraform && sudo mv /tmp/terraform /usr/local/bin/)

Pre-commit and tools

Follow: https://github.com/antonbabenko/pre-commit-terraform#how-to-install

Run tests

Default tests will run through various validation steps then spin up an instance with docker.

make

To test the AWS backed version run.

make test_aws

⚠️ Warning: This will spin up CTFd in AWS which will cost you some money.