Skip to content

Commit 55a3a14

Browse files
ulises-jeremiasulises-jeremias
committed
chore: Update example-rds-instance and rds-aurora modules
1 parent 83e6a97 commit 55a3a14

File tree

16 files changed

+225
-25
lines changed

16 files changed

+225
-25
lines changed

‎live/common-infra/example-rds-instance.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ module "exampledb" {
1515

1616
name = "${module.label.id}-exampledb"
1717

18-
vpc_id = data.aws_ssm_parameter.vpc_id.value
19-
db_subnet_group = data.aws_ssm_parameter.database_subnet_group.value
18+
vpc_id = data.aws_ssm_parameter.vpc_id.value
19+
db_subnet_group = data.aws_ssm_parameter.database_subnet_group.value
2020
vpc_security_group_ids = [module.security_group.security_group_id]
2121

2222
db_name = var.example_db_name

‎live/core-networking/vpc-endpoints-sg.tf

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
locals {
2+
# Check if the bastion exists (based on the length of the module.bastion array)
3+
bastion_sg_rule = length(module.bastion) > 0 ? [{
4+
rule = "https-443-tcp"
5+
source_security_group_id = module.bastion[0].security_group_id
6+
description = "vpc ssm vpce security group ingress rule for bastion host"
7+
}] : []
8+
9+
# Define the ingress rules for app security group
10+
app_sg_rule = [{
11+
rule = "https-443-tcp"
12+
source_security_group_id = module.vpc.app_security_group
13+
description = "vpc ssm vpce security group ingress rule for app security group"
14+
}]
15+
16+
# Concatenate the rules for app SG and bastion SG (if bastion exists)
17+
final_ssm_vpce_rules = concat(local.app_sg_rule, local.bastion_sg_rule)
18+
}
19+
20+
module "ssm_vpce_sg" {
21+
source = "terraform-aws-modules/security-group/aws"
22+
version = "4.17.1"
23+
24+
name = "${module.label.id}-vpc-ssm-vpce-security-group"
25+
description = "Security group for SSM VPC endpoint"
26+
vpc_id = module.vpc.vpc_id
27+
28+
ingress_with_source_security_group_id = local.final_ssm_vpce_rules
29+
30+
tags = var.tags
31+
}
32+
33+
module "ec2messages_vpce_sg" {
34+
source = "terraform-aws-modules/security-group/aws"
35+
version = "4.17.1"
36+
37+
name = "${module.label.id}-vpc-ec2messages-vpce-security-group"
38+
description = "Security group for EC2 Messages VPC endpoint"
39+
vpc_id = module.vpc.vpc_id
40+
41+
ingress_with_source_security_group_id = local.final_ssm_vpce_rules
42+
43+
tags = var.tags
44+
}
45+
46+
module "ssmmessages_vpce_sg" {
47+
source = "terraform-aws-modules/security-group/aws"
48+
version = "4.17.1"
49+
50+
name = "${module.label.id}-vpc-ssmmessages-vpce-security-group"
51+
description = "Security group for SSM Messages VPC endpoint"
52+
vpc_id = module.vpc.vpc_id
53+
54+
ingress_with_source_security_group_id = local.final_ssm_vpce_rules
55+
56+
tags = var.tags
57+
}

‎live/core-networking/vpc-endpoints.tf

Lines changed: 34 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,41 @@ module "vpc_endpoints" {
55

66
endpoints = {
77
s3 = {
8-
service = "s3"
9-
service_type = "Gateway"
10-
route_table_ids = module.vpc.public_route_table_ids
11-
policy = null
12-
tags = { Name = "${module.label.id}-s3-vpc-endpoint" }
8+
service = "s3"
9+
service_type = "Gateway"
10+
route_table_ids = module.vpc.public_route_table_ids
11+
security_group_ids = [module.vpc.default_security_group_id]
12+
policy = null
13+
tags = { Name = "${module.label.id}-s3-vpc-endpoint" }
1314
},
15+
ssm = {
16+
service = "ssm"
17+
service_type = "Interface"
18+
security_group_ids = [module.ssm_vpce_sg.security_group_id]
19+
private_dns_enabled = true
20+
subnet_ids = module.vpc.private_subnets
21+
policy = null
22+
tags = { Name = "${var.name}-ssm-vpc-endpoint" }
23+
},
24+
ec2messages = {
25+
service = "ec2messages"
26+
service_type = "Interface"
27+
security_group_ids = [module.ec2messages_vpce_sg.security_group_id]
28+
private_dns_enabled = true
29+
subnet_ids = module.vpc.private_subnets
30+
policy = null
31+
tags = { Name = "${var.name}-ec2messages-vpc-endpoint" }
32+
},
33+
ssmmessages = {
34+
service = "ssmmessages"
35+
service_type = "Interface"
36+
security_group_ids = [module.ssmmessages_vpce_sg.security_group_id]
37+
private_dns_enabled = true
38+
subnet_ids = module.vpc.private_subnets
39+
policy = null
40+
tags = { Name = "${var.name}-ssmmessages-vpc-endpoint" }
41+
}
1442
}
1543

16-
security_group_ids = [module.vpc.default_security_group_id]
17-
tags = module.label.tags
44+
tags = module.label.tags
1845
}

‎live/services-platform/ecr-repositories.tf

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
variable "ecr_repositories" {
2+
description = "List of ECR repositories to create"
3+
type = map(object({
4+
repository_image_tag_mutability = optional(string)
5+
}))
6+
}
7+
8+
module "ecr" {
9+
source = "terraform-aws-modules/ecr/aws"
10+
version = "2.3.0"
11+
12+
for_each = var.ecr_repositories
13+
14+
repository_name = each.key
15+
repository_image_tag_mutability = each.value.repository_image_tag_mutability
16+
17+
repository_read_write_access_arns = concat([data.aws_caller_identity.current.arn],
18+
module.eks_cluster.eks_cluster_node_group_roles_arns
19+
)
20+
create_lifecycle_policy = true
21+
repository_lifecycle_policy = jsonencode({
22+
rules = [
23+
{
24+
rulePriority = 1,
25+
description = "Keep last 30 images",
26+
selection = {
27+
tagStatus = "tagged",
28+
tagPrefixList = ["v"],
29+
countType = "imageCountMoreThan",
30+
countNumber = 30
31+
},
32+
action = {
33+
type = "expire"
34+
}
35+
}
36+
]
37+
})
38+
39+
repository_force_delete = true
40+
41+
tags = module.label.tags
42+
}
43+
44+
output "ecr_repository_urls" {
45+
value = [
46+
for repo in module.ecr : repo.repository_url
47+
]
48+
description = "List of ECR repository URLs"
49+
}

‎live/services-platform/eks-access-entries.tf

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,3 +120,33 @@ resource "aws_eks_access_policy_association" "access_policies_associations" {
120120
namespaces = [each.value.namespace]
121121
}
122122
}
123+
124+
125+
resource "aws_iam_policy" "ebs_csi_policy" {
126+
name = "${module.label.id}-ebs-csi-policy"
127+
128+
policy = jsonencode({
129+
Version = "2012-10-17"
130+
Statement = [
131+
{
132+
Action = [
133+
"ec2:CreateVolume",
134+
"ec2:AttachVolume",
135+
"ec2:DeleteVolume",
136+
"ec2:DetachVolume",
137+
"ec2:CreateTags",
138+
"ec2:DeleteTags",
139+
"ec2:DescribeVolumes"
140+
],
141+
Effect = "Allow",
142+
Resource = "*"
143+
},
144+
]
145+
})
146+
}
147+
148+
resource "aws_iam_role_policy_attachment" "attach_ebs_csi_policy" {
149+
for_each = toset(module.eks_cluster.eks_cluster_node_group_roles_names)
150+
role = each.value
151+
policy_arn = aws_iam_policy.ebs_csi_policy.arn
152+
}

‎live/services-platform/eks.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ variable "node_groups" {
3030
max_size = number
3131
desired_size = number
3232
health_check_type = string
33-
start_stop_schedule_enabled = bool
3433
ami_image_id = optional(string)
34+
start_stop_schedule_enabled = optional(bool)
3535
start_schedule_recurrence_cron = optional(string)
3636
stop_schedule_recurrence_cron = optional(string)
3737
kubernetes_labels = optional(map(string))

‎live/services-platform/vpc.tf

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ data "aws_ssm_parameter" "public_subnets" {
2626
name = "${var.core_networking_ssm_parameter_prefix}/public_subnets"
2727
}
2828

29+
data "aws_ssm_parameter" "app_security_group" {
30+
name = "${var.core_networking_ssm_parameter_prefix}/app_security_group"
31+
}
32+
2933
data "aws_security_group" "default" {
3034
vpc_id = local.vpc_id
3135

@@ -41,5 +45,10 @@ data "aws_vpc" "vpc" {
4145

4246
data "aws_security_group" "bastion_security_group" {
4347
name = var.bastion_security_group_name
44-
vpc_id = local.vpc_id
48+
vpc_id = data.aws_vpc.vpc.id
49+
}
50+
51+
data "aws_security_group" "app_security_group" {
52+
id = data.aws_ssm_parameter.app_security_group.value
53+
vpc_id = data.aws_vpc.vpc.id
4554
}

‎modules/bastion/docs/MODULE.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,15 @@
4646
|------|-------------|------|---------|:--------:|
4747
| <a name="input_allowed_cidrs"></a> [allowed\_cidrs](#input\_allowed\_cidrs) | Allow these CIDR blocks to instance | `string` | `null` | no |
4848
| <a name="input_ami"></a> [ami](#input\_ami) | AMI to use for the instance - will default to latest Ubuntu | `string` | `""` | no |
49+
| <a name="input_create_vpc_endpoints"></a> [create\_vpc\_endpoints](#input\_create\_vpc\_endpoints) | Create VPC endpoints for SSM, EC2 Messages, and SSM Messages | `bool` | `true` | no |
4950
| <a name="input_instance_type"></a> [instance\_type](#input\_instance\_type) | EC2 instance type/size - the default is not part of free tier! | `string` | `"t3.nano"` | no |
5051
| <a name="input_key_name"></a> [key\_name](#input\_key\_name) | SSH key name to use for the instance | `string` | `""` | no |
5152
| <a name="input_name"></a> [name](#input\_name) | Name to be used on all the resources as identifier | `string` | `""` | no |
5253
| <a name="input_private_subnets"></a> [private\_subnets](#input\_private\_subnets) | List of private subnets in which the EC2 instance is to be created. | `list(string)` | n/a | yes |
5354
| <a name="input_root_volume_size"></a> [root\_volume\_size](#input\_root\_volume\_size) | Size of the root volume in GB | `number` | `8` | no |
5455
| <a name="input_root_volume_type"></a> [root\_volume\_type](#input\_root\_volume\_type) | Type of the root volume | `string` | `"gp2"` | no |
5556
| <a name="input_tags"></a> [tags](#input\_tags) | Any extra tags to assign to objects | `map(any)` | `{}` | no |
57+
| <a name="input_vpc_endpoint_security_group_ids"></a> [vpc\_endpoint\_security\_group\_ids](#input\_vpc\_endpoint\_security\_group\_ids) | List of security group IDs to attach to the VPC endpoints. Will be ignored if create\_vpc\_endpoints is false. | `list(string)` | `[]` | no |
5658
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC id in which the EC2 instance is to be created. | `string` | n/a | yes |
5759

5860
## Outputs
@@ -61,5 +63,6 @@
6163
|------|-------------|
6264
| <a name="output_instance_id"></a> [instance\_id](#output\_instance\_id) | n/a |
6365
| <a name="output_instance_profile"></a> [instance\_profile](#output\_instance\_profile) | n/a |
66+
| <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | n/a |
6467
| <a name="output_ssm_parameter_ssh_key"></a> [ssm\_parameter\_ssh\_key](#output\_ssm\_parameter\_ssh\_key) | n/a |
6568
<!-- END_TF_DOCS -->

‎modules/bastion/outputs.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,7 @@ output "instance_profile" {
99
output "ssm_parameter_ssh_key" {
1010
value = try(aws_ssm_parameter.ssh_key[0].name, null)
1111
}
12+
13+
output "security_group_id" {
14+
value = module.ec2_security_group.security_group_id
15+
}

‎modules/bastion/scripts/connect.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,9 @@ if [[ -n "$tunnel_target_user" && -n "$tunnel_target_key" ]]; then
9797
tunnel_host=$(echo "$tunnel" | cut -d':' -f2)
9898
ssh_proxy_command_option="ProxyCommand ssh -i $tunnel_target_key -W %h:%p $tunnel_target_user@$tunnel_host"
9999
ssh_tunnel_proxy_command_option="ProxyCommand ssh -i $tunnel_target_key -W %h:%p $tunnel_target_user@$tunnel_host"
100+
echo "Tunnel established. Press Ctrl+C to close the tunnel."
100101
ssh -i "$SSH_KEY_PATH" -o "$ssh_proxy_command_option" -L "$tunnel" -o "$ssh_tunnel_proxy_command_option" -N "$BASTION_USER@$instance_id"
101102
else
103+
echo "Tunnel established. Press Ctrl+C to close the tunnel."
102104
ssh -i "$SSH_KEY_PATH" -o "$ssh_proxy_command_option" -L "$tunnel" -N "$BASTION_USER@$instance_id"
103105
fi
104-
echo "Tunnel established through Bastion host."

0 commit comments

Comments
 (0)