Skip to content

Commit 7a4efd8

Browse files
PradumnasarafPradumnasaraf
committed
docs: add Terraform documentation and aws commands
1 parent 9ef1dde commit 7a4efd8

File tree

2 files changed

+380
-2
lines changed

2 files changed

+380
-2
lines changed

Diff for: ‎docs/terraform/commands.md

+113-1
Original file line numberDiff line numberDiff line change
@@ -113,4 +113,116 @@ It is used to destroy the Terraform-managed infrastructure.
113113

114114
```bash
115115
terraform destroy
116-
```
116+
```
117+
118+
## AWS Commands
119+
120+
0. AWS Help
121+
122+
It is used to get help for the AWS CLI.
123+
124+
```bash
125+
aws help
126+
```
127+
128+
Or to get help for a specific command, we can use the following command:
129+
130+
```bash
131+
aws <command> help
132+
aws iam help
133+
```
134+
135+
1. AWS Configure
136+
137+
It is used to configure the AWS CLI.
138+
139+
```bash
140+
aws configure
141+
```
142+
143+
2. To create an IAM user
144+
145+
```bash
146+
aws iam create-user --user-name <user-name>
147+
aws iam create-user --user-name lucy
148+
```
149+
150+
To break it down here `iam` is command, `create-user` is the subcommand, `--user-name` is the option and `lucy` is the value of the option.
151+
152+
And the output for the above command will be:
153+
154+
```json
155+
{
156+
"User": {
157+
"Path": "/",
158+
"UserName": "lucy",
159+
"Tags": [],
160+
"UserId": "AIDAJJQJH4K7E7EXAMPLE",
161+
"Arn": "arn:aws:iam::123456789012:user/lucy",
162+
"CreateDate": "2021-09-29T10:00:00+00:00"
163+
}
164+
}
165+
```
166+
167+
3. To see the list of IAM users
168+
169+
```bash
170+
aws iam list-users
171+
```
172+
173+
4. To delete an IAM user
174+
175+
```bash
176+
aws iam delete-user --user-name <user-name>
177+
aws iam delete-user --user-name lucy
178+
```
179+
180+
5. To add a user to an IAM group
181+
182+
```bash
183+
aws iam add-user-to-group --user-name <user-name> --group-name <group-name>
184+
aws iam add-user-to-group --user-name lucy --group-name developers
185+
```
186+
187+
1. To see attached policies to a user
188+
189+
```bash
190+
aws iam list-attached-user-policies --user-name <user-name>
191+
aws iam list-attached-user-policies --user-name lucy
192+
```
193+
194+
1. To attach a policy to a user
195+
196+
```bash
197+
aws iam attach-user-policy --user-name <user-name> --policy-arn <policy-arn>
198+
aws iam attach-user-policy --user-name lucy --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess
199+
```
200+
201+
1. To create an IAM group
202+
203+
```bash
204+
aws iam create-group --group-name <group-name>
205+
aws iam create-group --group-name developers
206+
```
207+
208+
1. To see the list of IAM groups
209+
210+
```bash
211+
aws iam list-groups
212+
```
213+
214+
1. To see attached policies to a group
215+
216+
```bash
217+
aws iam list-attached-group-policies --group-name <group-name>
218+
aws iam list-attached-group-policies --group-name developers
219+
```
220+
221+
1. To attach a policy to a group
222+
223+
```bash
224+
aws iam attach-group-policy --group-name <group-name> --policy-arn <policy-arn>
225+
aws iam attach-group-policy --group-name developers --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess
226+
```
227+
228+

Diff for: ‎docs/terraform/introduction.md

+267-1
Original file line numberDiff line numberDiff line change
@@ -742,7 +742,6 @@ The data read from data source is available under data object. We can use the da
742742

743743
![Resource vs Data Source](https://github.com/user-attachments/assets/44c291ea-6b98-4812-a40a-49a0ca9dd564)
744744

745-
746745
## Meta-Arguments
747746

748747
Meta-arguments are special arguments that can be used with resources and data sources to control their behavior. Meta-arguments are used to define dependencies, manage lifecycle, and configure the behavior of resources and data sources.
@@ -871,3 +870,270 @@ terraform {
871870
}
872871
}
873872
```
873+
874+
## Working With AWS
875+
876+
AWS is on of most popular cloud provider in the world. It has 100s of services from compute to AI. It's most global coverage and has the most data centers around the world. We need to create an AWS account to work with AWS services. We can use the free tier account to get started.
877+
878+
### IAM
879+
880+
When we create an AWS account, it a root user account and it has all the privileges to create, update, and delete resources. But it is not recommended to use the root user account to manage resources, like an Linux Root user account. We should create an IAM user account and use that account to manage resources. When we create an user we have two kind of access, `Programmatic Access` and `Console Access`. We can use `Programmatic Access` to access AWS services using APIs and SDKs. We can use `Console Access` to access AWS services using the AWS Management Console.
881+
882+
The only ideal use case for root user account is to create an IAM user account and manage billing and other account level settings.
883+
884+
### IAM Policies
885+
886+
IAM policies are used to define permissions for IAM users, groups, and roles. IAM policies are JSON documents that specify the actions, resources, and conditions that are allowed or denied. We can attach policies to IAM users, groups, and roles to grant or restrict access to AWS services and resources.
887+
888+
```json
889+
{
890+
"Version": "2012-10-17",
891+
"Statement": [
892+
{
893+
"Effect": "Allow",
894+
"Action": "s3:*",
895+
"Resource": "arn:aws:s3:::my-bucket/*"
896+
}
897+
]
898+
}
899+
```
900+
901+
Some other policies are:
902+
903+
![IAM Policies](https://github.com/user-attachments/assets/98237fdf-8ee8-4fee-bf5b-661dd50ea6ee)
904+
905+
For example, to create a policy that allows access to S3 buckets:
906+
907+
### IAM Groups
908+
909+
IAM groups are used to group IAM users and apply policies to multiple users at once. For example, you can create a group called `developers` and attach a policy that allows access to EC2 instances. Then you can add IAM users to the `developers` group to grant them access to EC2 instances. It great when we have multiple users with the same permissions.
910+
911+
![IAM Groups](https://github.com/user-attachments/assets/be4e6aec-2fd8-4dde-b886-40953d556f1e)
912+
913+
### IAM Roles
914+
915+
Let's understand with an example what if an EC2 instance to interact with S3 bucket? Creating policy with not make the job done. We need to create an IAM role and attach the policy to the role. Then we can attach the role to the EC2 instance. This is called IAM roles. IAM roles are used to grant permissions to AWS services like EC2 instances, Lambda functions, and ECS tasks. IAM roles are used to define the permissions that are allowed or denied to the service.
916+
917+
IAM roles are not just limited to AWS services, we can also use IAM roles to grant permissions to external services like third-party applications and services. We can use IAM roles to grant temporary access to external services without sharing access keys or credentials.
918+
919+
![IAM Roles](https://github.com/user-attachments/assets/1ad28ae1-c24d-427f-a882-79e0662a4095)
920+
921+
### AWS CLI
922+
923+
AWS CLI is a command-line tool that allows you to interact with AWS services using the command line. You can use the AWS CLI to manage resources, configure services, and automate tasks. You can use the AWS CLI to perform operations like creating EC2 instances, managing S3 buckets, and configuring IAM policies.
924+
925+
After installing we have to configure the AWS CLI with the access key and secret key. We can use `aws configure` command to configure the AWS CLI. We can also use `--profile` flag to create multiple profiles.
926+
927+
![AWS CLI](https://github.com/user-attachments/assets/75a4aa54-eb7e-4768-8f52-3b835b4a3496)
928+
929+
All the commands can be found [here](./commands.md#AWS-Commands).
930+
931+
### AWS S3 (Simple Storage Service)
932+
933+
Amazon S3 is a cloud storage service that allows you to store and retrieve data from anywhere on the web. S3 is highly scalable, durable, and secure. It great for storing files like images, videos, and documents. But not suitable for storing operating system files or databases.
934+
935+
Data is store in form of buckets. Everything under a bucket is an object. We can use the AWS CLI to create, update, and delete S3 buckets. We can also use the AWS Management Console to manage S3 buckets.
936+
937+
![AWS S3](https://github.com/user-attachments/assets/d452bd9e-1851-4840-8177-32e8be7eb934)
938+
939+
Once the bucket is created we can access it via unique URL. We can also use the bucket to host static websites. it's in format of `http://<bucket-name>.<region>.amazonaws.com`. For eg. `http://my-bucket.s3.ap-south-1.amazonaws.com`.
940+
941+
We can access the files in the bucket using the URL `http://<bucket-name>.<region>.amazonaws.com/<object-key>`. For eg. `http://my-bucket.s3.ap-south-1.amazonaws.com/index.html`.
942+
943+
![AWS S3 bucket](https://github.com/user-attachments/assets/3c7fa44c-3d3a-4b3f-b7bf-e2565be6bb79)
944+
945+
Any object stored in the bucket has the object data and the Metadata. The metadata contains information about the object like owner, size, last modified date, etc, in key-value pairs.
946+
947+
![AWS S3 object](https://github.com/user-attachments/assets/37c4c48a-011b-4fd5-8092-addcda8901e3)
948+
949+
950+
## AWS and Terraform
951+
952+
Terraform uses the AWS provider to interact with AWS services. The AWS provider allows you to define resources like EC2 instances, S3 buckets, and IAM policies in your Terraform configuration.
953+
954+
Creating an IAM user with Terraform:
955+
956+
```hcl
957+
# main.tf
958+
provider "aws" {
959+
region = "us-east-1"
960+
}
961+
962+
resource "aws_iam_user" "admin-user" {
963+
name = "admin"
964+
tags = {
965+
Description = "Technical Team Leader"
966+
}
967+
}
968+
969+
# .aws/credentials
970+
[default]
971+
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
972+
aws_secret_access_key = je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
973+
```
974+
975+
Terraform will automatically use the credentials from the `~/.aws/credentials` file to authenticate with AWS. We can also use environment variables to set the credentials. We can also use `profile` argument to specify the profile to use.
976+
977+
```hcl
978+
provider "aws" {
979+
region = "us-east
980+
profile = "default"
981+
}
982+
```
983+
984+
Another way to use `export` command to set the environment variables:
985+
986+
```bash
987+
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
988+
export AWS_SECRET_ACCESS_KEY=je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
989+
export AWS_REGION=us-east-1
990+
```
991+
992+
```hcl
993+
resource "aws_iam_user" "admin-user" {
994+
name = "lucy"
995+
tags = {
996+
Description = "Technical Team Leader"
997+
}
998+
}
999+
```
1000+
1001+
Now we don't need to specify the providers in the configuration file. Terraform will automatically use the environment variables to authenticate with AWS.
1002+
1003+
Attaching a policy to the IAM user:
1004+
1005+
```hcl
1006+
# main.tf
1007+
resource "aws_iam_user" "admin-user" {
1008+
name = "lucy"
1009+
tags = {
1010+
Description = "Technical Team Leader"
1011+
}
1012+
}
1013+
1014+
resource "aws_iam_policy" "adminUser" {
1015+
name = "AdminUsers"
1016+
policy = <<EOF
1017+
{
1018+
"Version": "2012-10-17",
1019+
"Statement": [
1020+
{
1021+
"Effect": "Allow",
1022+
"Action": "*",
1023+
"Resource": "*"
1024+
}
1025+
]
1026+
}
1027+
EOF
1028+
}
1029+
1030+
resource "aws_iam_user_policy_attachment" "lucy-admin-access" {
1031+
user = aws_iam_user.admin-user.name
1032+
policy_arn = aws_iam_policy.adminUser.arn
1033+
}
1034+
```
1035+
1036+
We use heredoc syntax to define the policy (`<<EOF`). We can use `terraform plan` to see the changes and `terraform apply` to apply the changes.
1037+
1038+
![terraform apply](https://github.com/user-attachments/assets/3f661e06-dc17-4bc6-a829-810cb4fd9ca5)
1039+
1040+
Another way to create an IAM policy is to create a JSON file and use the `file()` function to read the file.
1041+
1042+
```hcl
1043+
# main.tf
1044+
resource "aws_iam_user" "admin-user" {
1045+
name = "lucy"
1046+
tags = {
1047+
Description = "Technical Team Leader"
1048+
}
1049+
}
1050+
1051+
resource "aws_iam_policy" "adminUser" {
1052+
name = "AdminUsers"
1053+
policy = file("policy.json")
1054+
}
1055+
1056+
resource "aws_iam_user_policy_attachment" "lucy-admin-access" {
1057+
user = aws_iam_user.admin-user.name
1058+
policy_arn = aws_iam_policy.adminUser.arn
1059+
}
1060+
```
1061+
1062+
```json
1063+
# policy.json
1064+
{
1065+
"Version": "2012-10-17",
1066+
"Statement": [
1067+
{
1068+
"Effect": "Allow",
1069+
"Action": "*",
1070+
"Resource": "*"
1071+
}
1072+
]
1073+
}
1074+
```
1075+
1076+
We can proceed with `terraform plan` and `terraform apply` to create the IAM user and attach the policy to the user.
1077+
1078+
Another example to create IAM user for a list of users:
1079+
1080+
```hcl
1081+
# main.tf
1082+
variable "dev-team" {
1083+
type = list(string)
1084+
default = ["lucy", "john", "jane"]
1085+
}
1086+
1087+
resource "aws_iam_user" "admin-user" {
1088+
name = var.dev-team[count.index]
1089+
count = length(var.dev-team)
1090+
tags = {
1091+
Description = "Technical Team Leader"
1092+
}
1093+
}
1094+
1095+
### S3
1096+
1097+
Here we are creating an S3 bucket, uploading a file to the bucket, and creating a bucket policy to allow access to the bucket.
1098+
1099+
```hcl
1100+
# main.tf
1101+
resource "aws_s3_bucket" "finance" {
1102+
bucket = "finance-21092020 # optional, otherwise Terraform will create a unique name
1103+
tags = {
1104+
Name = "Finance and Payroll"
1105+
}
1106+
}
1107+
1108+
resource "aws_s3_bucket_object" "finance-2020" {
1109+
content = "/root/finance/finance-2020.doc"
1110+
key = "finance-2020.doc"
1111+
bucket = aws_s3_bucket.finance.id # reference to the bucket
1112+
}
1113+
1114+
data "aws_iam_group" "finance-data" {
1115+
group_name = "finance-analysts"
1116+
}
1117+
1118+
resource "aws_s3_bucket_policy" "finance-policy" {
1119+
bucket = aws_s3_bucket.finance.id
1120+
policy = <<EOF
1121+
{
1122+
"Version": "2012-10-17",
1123+
"Statement": [
1124+
{
1125+
"Action": "*",
1126+
"Effect": "Allow",
1127+
"Resource": "arn:aws:s3:::${aws_s3_bucket.finance.id}/*",
1128+
"Principal": {
1129+
"AWS": ["${data.aws_iam_group.finance-data.arn}"
1130+
]
1131+
}
1132+
}
1133+
]
1134+
}
1135+
EOF
1136+
}
1137+
```
1138+
1139+
Here, `aws_s3_bucket` resource is used to create an S3 bucket, `aws_s3_bucket_object` resource is used to upload a file to the bucket, and `aws_s3_bucket_policy` resource is used to create a bucket policy to allow access to the bucket. Additionally, we are using the `data` block to fetch information about an IAM group.

0 commit comments

Comments
 (0)