Skip to content

Commit 9fea695

Browse files
tomeresktomeresk
committed
add terraform
1 parent eb510c8 commit 9fea695

File tree

13 files changed

+1127
-0
lines changed

13 files changed

+1127
-0
lines changed

‎terraform/compute.tf‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#resource "aws_instance" "ec2_instance" {
2+
# # NOTE: The AMI ID is still hardcoded. For a more robust setup,
3+
# # consider using a map variable to look up AMIs by region.
4+
# ami = "ami-091e1eed890c3f1d1"
5+
#
6+
# # Use variables for instance type and key name
7+
# instance_type = var.instance_type
8+
# key_name = var.key_name
9+
#
10+
# # NOTE: This IAM profile ARN is still hardcoded.
11+
# iam_instance_profile = "arn:aws:iam::980573775279:instance-profile/eks-5ecb8bcc-f19e-43e1-a3ef-6c29d8215aba"
12+
#
13+
# # Reference the subnet created above
14+
# subnet_id = aws_subnet.k8s_subnet_2.id
15+
#
16+
# # NOTE: The Security Group ID is still hardcoded.
17+
# # This should reference an aws_security_group resource.
18+
# vpc_security_group_ids = [
19+
# "sg-00798d49dafea46e1"
20+
# ]
21+
#
22+
# metadata_options {
23+
# http_endpoint = "enabled"
24+
# http_tokens = "optional"
25+
# http_put_response_hop_limit = 2
26+
# }
27+
#
28+
# root_block_device {
29+
# delete_on_termination = true
30+
# }
31+
#
32+
# tags = {
33+
# "k8s.io/cluster-autoscaler/${var.cluster_name}" = "owned"
34+
# "aws:eks:cluster-name" = var.cluster_name
35+
# "eks:nodegroup-name" = "my-eks-nodegroup"
36+
# "k8s.io/cluster-autoscaler/enabled" = "true"
37+
# "eks:cluster-name" = var.cluster_name
38+
# "kubernetes.io/cluster/${var.cluster_name}" = "owned"
39+
# }
40+
#}
41+
42+
# compute.tf
43+
44+
# Data source to dynamically find the latest Amazon EKS-optimized AMI.
45+
data "aws_ami" "eks_node" {
46+
filter {
47+
name = "name"
48+
values = ["amazon-eks-node-${aws_eks_cluster.my_cluster.version}-v*"]
49+
}
50+
51+
most_recent = true
52+
owners = ["602401143452"] # AWS account ID for EKS-optimized AMIs
53+
}
54+
55+
# Defines a single EC2 instance to serve as an EKS worker node.
56+
resource "aws_instance" "eks_node" {
57+
ami = data.aws_ami.eks_node.id
58+
59+
instance_type = var.instance_type
60+
key_name = var.key_name
61+
62+
iam_instance_profile = aws_iam_instance_profile.eks_node.name
63+
64+
subnet_id = aws_subnet.private_1.id
65+
66+
vpc_security_group_ids = [
67+
aws_security_group.eks_node_sg.id,
68+
aws_security_group.eks_shared_sg.id,
69+
]
70+
71+
# This script runs on startup to register the node with the EKS cluster.
72+
user_data = <<-EOF
73+
#!/bin/bash
74+
set -o xtrace
75+
/etc/eks/bootstrap.sh ${aws_eks_cluster.my_cluster.name} --b64-cluster-ca '${aws_eks_cluster.my_cluster.certificate_authority[0].data}' --apiserver-endpoint '${aws_eks_cluster.my_cluster.endpoint}'
76+
EOF
77+
78+
root_block_device {
79+
volume_size = 20
80+
volume_type = "gp2"
81+
encrypted = true
82+
}
83+
84+
tags = {
85+
Name = "${var.cluster_name}-worker-node"
86+
"kubernetes.io/cluster/${var.cluster_name}" = "owned"
87+
}
88+
}

‎terraform/data_services.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# data_services.tf
2+
3+
# Configures the account-wide encryption settings for the AWS Glue Data Catalog.
4+
resource "aws_glue_data_catalog_encryption_settings" "glue_settings" {
5+
data_catalog_encryption_settings {
6+
# Configures encryption for the metadata (table definitions, etc.) at rest.
7+
encryption_at_rest {
8+
catalog_encryption_mode = "SSE-KMS"
9+
10+
# Reference the KMS key from your security.tf file.
11+
sse_aws_kms_key_id = aws_kms_key.cloudtrail_key.arn
12+
}
13+
14+
# Configures encryption for passwords used in data source connections.
15+
connection_password_encryption {
16+
return_connection_password_encrypted = true
17+
18+
# You can use the same KMS key for password encryption.
19+
aws_kms_key_id = aws_kms_key.cloudtrail_key.arn
20+
}
21+
}
22+
}

‎terraform/ecr.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# ecr.tf
2+
3+
# Defines a private ECR (Elastic Container Registry) repository for the Flask webserver application.
4+
resource "aws_ecr_repository" "flask_webserver_repo" {
5+
# Name is now dynamic and uses a path-like structure for organization.
6+
name = "${var.cluster_name}/python-flask-webserver"
7+
8+
image_tag_mutability = "MUTABLE"
9+
10+
encryption_configuration {
11+
encryption_type = "AES256"
12+
}
13+
14+
# Enable vulnerability scanning on push for better security.
15+
image_scanning_configuration {
16+
scan_on_push = true
17+
}
18+
19+
tags = {
20+
"project" = var.cluster_name
21+
}
22+
}
23+
24+
# Defines a second ECR repository, in this case for storing malware analysis container images.
25+
resource "aws_ecr_repository" "malware_repo" {
26+
name = "${var.cluster_name}/malware"
27+
28+
image_tag_mutability = "MUTABLE"
29+
30+
encryption_configuration {
31+
encryption_type = "AES256"
32+
}
33+
34+
# Enable vulnerability scanning on push for better security.
35+
image_scanning_configuration {
36+
scan_on_push = true
37+
}
38+
39+
tags = {
40+
"project" = var.cluster_name
41+
}
42+
}

‎terraform/eks.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# eks.tf
2+
3+
# Defines the EKS (Kubernetes) cluster control plane.
4+
resource "aws_eks_cluster" "my_cluster" {
5+
name = var.cluster_name
6+
version = "1.30"
7+
8+
# Reference the IAM role created in iam.tf
9+
role_arn = aws_iam_role.eks_cluster.arn
10+
11+
vpc_config {
12+
# Place the EKS control plane ENIs in your private subnets for security.
13+
subnet_ids = [
14+
aws_subnet.private_1.id,
15+
aws_subnet.private_2.id,
16+
]
17+
18+
endpoint_private_access = true
19+
endpoint_public_access = true
20+
public_access_cidrs = ["0.0.0.0/0"]
21+
22+
# Reference the control plane security group from security.tf
23+
security_group_ids = [aws_security_group.eks_control_plane_sg.id]
24+
}
25+
26+
enabled_cluster_log_types = []
27+
28+
tags = {
29+
Name = var.cluster_name
30+
"aws:cloudformation:logical-id" = "EKSCluster"
31+
"aws:cloudformation:stack-name" = "eks-cluster"
32+
}
33+
}

‎terraform/iam.tf‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
# iam.tf
2+
3+
# --------------------------------------------------------------
4+
# IAM Roles & Policies for EKS
5+
# --------------------------------------------------------------
6+
7+
# Defines the IAM role that the EKS control plane will assume.
8+
resource "aws_iam_role" "eks_cluster" {
9+
name_prefix = "eks-cluster-role-"
10+
11+
assume_role_policy = jsonencode({
12+
Version = "2012-10-17",
13+
Statement = [{
14+
Action = "sts:AssumeRole",
15+
Effect = "Allow",
16+
Principal = { Service = "eks.amazonaws.com" }
17+
}]
18+
})
19+
}
20+
21+
# Attaches the required AWS-managed policy for EKS clusters to the role.
22+
resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
23+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
24+
role = aws_iam_role.eks_cluster.name
25+
}
26+
27+
28+
# Defines the IAM role that EKS worker nodes (EC2 instances) will assume.
29+
resource "aws_iam_role" "eks_node" {
30+
name_prefix = "eks-node-role-"
31+
32+
assume_role_policy = jsonencode({
33+
Version = "2012-10-17",
34+
Statement = [{
35+
Action = "sts:AssumeRole",
36+
Effect = "Allow",
37+
Principal = { Service = "ec2.amazonaws.com" }
38+
}]
39+
})
40+
}
41+
42+
# Creates an instance profile, which is a container for the IAM role that EC2 can use.
43+
resource "aws_iam_instance_profile" "eks_node" {
44+
name_prefix = "eks-node-profile-"
45+
role = aws_iam_role.eks_node.name
46+
}
47+
48+
# Attaches the standard EKS worker node policy.
49+
resource "aws_iam_role_policy_attachment" "eks_node_worker_policy" {
50+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
51+
role = aws_iam_role.eks_node.name
52+
}
53+
54+
# Attaches the CNI policy, allowing pods to get IP addresses from the VPC.
55+
resource "aws_iam_role_policy_attachment" "eks_node_cni_policy" {
56+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
57+
role = aws_iam_role.eks_node.name
58+
}
59+
60+
# Attaches a read-only policy for ECR, allowing nodes to pull container images.
61+
resource "aws_iam_role_policy_attachment" "eks_node_ecr_policy" {
62+
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
63+
role = aws_iam_role.eks_node.name
64+
}
65+
66+
67+
# --------------------------------------------------------------
68+
# IAM Roles & Policies for Lambda
69+
# --------------------------------------------------------------
70+
71+
# A data source to create a reusable IAM trust policy for all Lambda functions.
72+
data "aws_iam_policy_document" "lambda_assume_role" {
73+
statement {
74+
action = "sts:AssumeRole"
75+
effect = "Allow"
76+
principals {
77+
type = "Service"
78+
identifiers = ["lambda.amazonaws.com"]
79+
}
80+
}
81+
}
82+
83+
# Defines an execution role for the 'cortex_custom_lambda' function.
84+
resource "aws_iam_role" "cortex_custom_lambda" {
85+
name_prefix = "cortex-custom-lambda-role-"
86+
assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
87+
}
88+
89+
# Attaches the basic execution policy, allowing the function to write to CloudWatch Logs.
90+
resource "aws_iam_role_policy_attachment" "cortex_custom_lambda_policy" {
91+
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
92+
role = aws_iam_role.cortex_custom_lambda.name
93+
}
94+
95+
# Defines an execution role for the 'empty_bucket_lambda' function.
96+
resource "aws_iam_role" "empty_bucket_lambda" {
97+
name_prefix = "empty-bucket-lambda-role-"
98+
assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
99+
}
100+
101+
# Attaches the basic execution policy.
102+
resource "aws_iam_role_policy_attachment" "empty_bucket_lambda_policy" {
103+
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
104+
role = aws_iam_role.empty_bucket_lambda.name
105+
}
106+
107+
# Defines an execution role for the second 'cortex_custom_lambda' function.
108+
resource "aws_iam_role" "cortex_custom_lambda_2" {
109+
name_prefix = "cortex-custom-lambda-2-role-"
110+
assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
111+
}

‎terraform/lambda.tf‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# lambda.tf
2+
3+
# Defines a map of common settings to be reused by all Lambda functions in this file.
4+
locals {
5+
common_lambda_settings = {
6+
handler = "index.handler"
7+
runtime = "python3.12"
8+
memory_size = 128
9+
architectures = ["x86_64"]
10+
}
11+
}
12+
13+
# Defines the first Cortex custom Lambda function.
14+
resource "aws_lambda_function" "cortex_custom_lambda" {
15+
filename = "source_code/cortex_custom_lambda.zip"
16+
source_code_hash = filebase64sha256("source_code/cortex_custom_lambda.zip")
17+
18+
function_name = var.cortex_custom_lambda_name_1
19+
role = aws_iam_role.cortex_custom_lambda.arn
20+
21+
handler = local.common_lambda_settings.handler
22+
runtime = local.common_lambda_settings.runtime
23+
memory_size = local.common_lambda_settings.memory_size
24+
architectures = local.common_lambda_settings.architectures
25+
timeout = 75
26+
}
27+
28+
# Defines the Lambda function responsible for emptying S3 buckets.
29+
resource "aws_lambda_function" "empty_bucket_lambda" {
30+
filename = "source_code/empty_bucket_lambda.zip"
31+
source_code_hash = filebase64sha256("source_code/empty_bucket_lambda.zip")
32+
33+
function_name = var.empty_bucket_lambda_name
34+
role = aws_iam_role.empty_bucket_lambda.arn
35+
36+
handler = local.common_lambda_settings.handler
37+
runtime = local.common_lambda_settings.runtime
38+
memory_size = local.common_lambda_settings.memory_size
39+
architectures = local.common_lambda_settings.architectures
40+
timeout = 600
41+
}
42+
43+
# Defines the second Cortex custom Lambda function.
44+
resource "aws_lambda_function" "cortex_custom_lambda_2" {
45+
filename = "source_code/cortex_custom_lambda_2.zip"
46+
source_code_hash = filebase64sha256("source_code/cortex_custom_lambda_2.zip")
47+
48+
function_name = var.cortex_custom_lambda_name_2
49+
role = aws_iam_role.cortex_custom_lambda_2.arn
50+
51+
handler = local.common_lambda_settings.handler
52+
runtime = local.common_lambda_settings.runtime
53+
memory_size = local.common_lambda_settings.memory_size
54+
architectures = local.common_lambda_settings.architectures
55+
timeout = 75
56+
}

0 commit comments

Comments
 (0)