/terraform-aws-ec2-basic-layout

Terraform module to deploy a typical EC2 layout that includes an instance with a security group and a dns record.

Primary LanguageHCLApache License 2.0Apache-2.0

Binbash

Terraform Module: AWS EC2 Basic Layout

Overview

This module could be useful if you find yourself creating a layout that includes the following resources:

  • EC2 Instance w/ configurable AMI, family type, key pair, networking, userdata, among others.
  • EC2 Profile with a customizable IAM Role supporting both AWS and customer managed policies.
  • Multiple EBS dynamic blocks (root_block_device, ebs_block_device and ephemeral_block_device) w/ configurable type, size, device name and encryption configs among others.
  • Security group for the instance above.
  • Optionally associate a public IP address with the instance.
  • DNS record with a record that points to the instance private IP / public IP.
  • Tags: both EC2 and EBS.
  • SSM support for interactive shell access via browser or AWS CLI

Personally we have seen the need of creating a similar set of such resources for an OpenVPN instance, for Jenkins, Spinnaker, DroneCI, Prometheus, Grafana, Hashicorp Vault, ElasticSearch, Kibana and so forth.

Requirements

Name Version
terraform >= 0.13.2
aws ~> 4.0

Providers

Name Version
aws ~> 4.0

Modules

No modules.

Resources

Name Type
aws_eip.this resource
aws_iam_instance_profile.basic_instance resource
aws_iam_policy.cross_org_instance_access resource
aws_iam_role.basic_instance_assume_role resource
aws_iam_role_policy_attachment.basic_instance_aws_roles resource
aws_iam_role_policy_attachment.ec2_ssm_access resource
aws_iam_role_policy_attachment.this resource
aws_instance.main resource
aws_route53_record.main_private resource
aws_route53_record.main_public resource
aws_security_group.main resource
aws_security_group_rule.egress_allow_all resource
aws_security_group_rule.ingress_rules resource
aws_ami.ubuntu_linux data source
aws_iam_policy_document.cross_org_instance_access data source
aws_iam_policy_document.this data source

Inputs

Name Description Type Default Required
ami_id AMI Identifier string "" no
associate_public_ip_address Associate a public IP address with the instance bool false no
aws_ami_os_id AWS AMI Operating System Identificator string "ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*" no
aws_ami_os_owner AWS AMI Operating System Owner, eg: 099720109477 for Canonical string "099720109477" no
credit_specification_cpu Can be applied/modified to the EC2 at any time. The credit option for CPU usage. Can be 'standard' or 'unlimited'. By default T3 = unlimited & T2 'standard'. string "unlimited" no
cross_account_roles_resource_arn_list Resources arn list for cross org roles for EC2 profile IAM Role policy. list(string) [] no
disable_api_termination If true, enables EC2 Instance Termination Protection string "false" no
dns_records_internal_hosted_zone A list of DNS private (internal hosted zone) records to create with the instance's IP list(any) [] no
dns_records_public_hosted_zone A list of DNS public (public hosted zone) records to create with the instance's IP list(any) [] no
ebs_block_device Additional EBS block devices to attach to the instance list(map(string)) [] no
ebs_optimized Enable EBS Optimized string "false" no
enable_ssm_access If true, attaches SSM policy to instance role bool false no
ephemeral_block_device Customize Ephemeral (also known as Instance Store) volumes on the instance list(map(string)) [] no
instance_profile The IAM Instance Profile to launch the instance with. Specified as the name of the Instance Profile. string "" no
instance_type EC2 Instance Type string "t3.micro" no
key_pair_name Key Pair Name string n/a yes
monitoring If true, the launched EC2 instance will have detailed monitoring enabled bool false no
name Name string n/a yes
policy_arn Attach AWS IAM managed policies to the IAM Role. list(string) [] no
prefix Prefix string "default" no
root_block_device Customize details about the root block device of the instance. See Block Devices below for details list(map(string)) [] no
root_device_backup_tag EC2 Root Block Device backup tag string "True" no
security_group_ids A list of security group ids list(string) [] no
security_group_rules A list of security group rules list(any) [] no
subnet_id Subnet ID string n/a yes
tag_approved_ami_value Set the specific tag ApprovedAMI ('true' | 'false') that identifies aws-config compliant AMIs string "false" no
tags Tags map(string) {} no
user_data The user data to provide when launching the instance. Do not pass gzip-compressed data via this argument; see user_data_base64 instead. string null no
user_data_base64 Can be used instead of user_data to pass base64-encoded binary data directly. Use this instead of user_data whenever the value is not a valid UTF-8 string. For example, gzip-encoded user data must be base64-encoded and passed via this argument to avoid corruption. string null no
vpc_id VPC ID string n/a yes

Outputs

Name Description
aws_instance_ami The AMI of the Instance.
aws_instance_assume_role_name The IAM instance profile of the EC2.
aws_instance_iam_profile The IAM instance profile of the EC2.
aws_instance_key_name The ssh key pair name of the Instance.
aws_instance_private_ip Contains the instance private IP address.
aws_instance_public_ip Contains the instance public IP address.
aws_instance_type The type of the Instance.
aws_instance_volume_tags The root EBS volume tags of the instace.
dns_record_private DNS
dns_record_public n/a
instance Compute
security_group n/a

Examples

Please refer to the module Examples.

Binbash Leverage | DevOps Automation Code Library Integration

In order to get the full automated potential of the Binbash Leverage DevOps Automation Code Library
you should initialize all the necessary helper Makefiles.

How?

You must execute the make init-makefiles command at the root context:

╭─delivery at delivery-I7567 in ~/terraform/terraform-aws-backup-by-tags on master✔ 20-09-17
╰─⠠⠵ make
Available Commands:
 - init-makefiles     initialize makefiles

Why?

You'll get all the necessary commands to automatically operate this module via a dockerized approach, example shown below

╭─delivery at delivery-I7567 in ~/terraform/terraform-aws-backup-by-tags on master✔ 20-09-17
╰─⠠⠵ make
Available Commands:
 - circleci-validate-config  ## Validate A CircleCI Config (https
 - format-check        ## The terraform fmt is used to rewrite tf conf files to a canonical format and style.
 - format              ## The terraform fmt is used to rewrite tf conf files to a canonical format and style.
 - tf-dir-chmod        ## run chown in ./.terraform to gran that the docker mounted dir has the right permissions
 - version             ## Show terraform version
 - init-makefiles      ## initialize makefiles
╭─delivery at delivery-I7567 in ~/terraform/terraform-aws-backup-by-tags on master✔ 20-09-17
╰─⠠⠵ make format-check
docker run --rm -v /home/delivery/Binbash/repos/Leverage/terraform/terraform-aws-backup-by-tags:"/go/src/project/":rw -v :/config -v /common.config:/common-config/common.config -v ~/.ssh:/root/.ssh -v ~/.gitconfig:/etc/gitconfig -v ~/.aws/bb:/root/.aws/bb -e AWS_SHARED_CREDENTIALS_FILE=/root/.aws/bb/credentials -e AWS_CONFIG_FILE=/root/.aws/bb/config --entrypoint=/bin/terraform -w "/go/src/project/" -it binbash/terraform-awscli-slim:0.12.28 fmt -check

Release Management

CircleCi PR auto-release job

circleci