Deploying the Platform in a public AWS cloud environment

data "aws_caller_identity" "current" {}

module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "3.6.0"

  bucket = "terraform-states-${data.aws_caller_identity.current.account_id}"
  acl    = "private"
  # S3 bucket-level Public Access Block configuration
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true

  versioning = {
    enabled = true
  }

  tags = merge(var.tags)
}

module "dynamodb_table" {
  source  = "terraform-aws-modules/dynamodb-table/aws"
  version = "3.1.2"

  name           = var.table_name
  billing_mode   = "PROVISIONED"
  read_capacity  = "1"
  write_capacity = "1"
  hash_key       = "LockID"

  attributes = [
    {
      name = "LockID"
      type = "S"
    }
  ]

  tags = merge(var.tags, tomap({ "Name" = var.table_name }))
}

terraform {
  required_version = "= 1.3.7"
}

provider "aws" {
  region = var.region
}

region = "eu-central-1"
tags = {
  "SysName"    = "EPAM"
  "Department" = "MDTU-DDM"
  "user:tag"   = "mdtuddm1"
}

variable "region" {
  description = "The AWS region to deploy the cluster into, e.g. eu-central-1"
  type        = string
}

variable "s3_states_bucket_name" {
  description = "Prefix for S3 bucket name. Since the name should be unique the account number will be added as suffix, e.g. terraform-states-<AWS_ACCOUNT_ID>"
  type        = string
  default     = "terraform-states"
}

variable "table_name" {
  description = "the name of DynamoDb table to store terraform tfstate lock"
  type        = string
  default     = "terraform_locks"
}

variable "tags" {
  description = "A map of tags to apply to all resources"
  type        = map(any)
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "3.19.0"

  name = var.platform_name

  cidr            = var.platform_cidr
  azs             = var.subnet_azs
  private_subnets = var.private_cidrs
  public_subnets  = var.public_cidrs

  enable_dns_hostnames   = true
  enable_dns_support     = true
  enable_nat_gateway     = true
  single_nat_gateway     = true
  one_nat_gateway_per_az = false

  tags = var.tags
}

module "ec2_instance" {
  source  = "terraform-aws-modules/ec2-instance/aws"
  version = "4.3.0"

  name = var.node_name

  ami                    = var.node_ami
  instance_type          = var.node_type
  key_name               = module.key_pair.key_pair_name
  vpc_security_group_ids = [aws_security_group.sg_private.id]
  subnet_id              = module.vpc.private_subnets[0]
  user_data              = templatefile("files/user_data.sh.tpl", { cross_account_role = var.cross_account_role_arn })
  iam_instance_profile   = aws_iam_instance_profile.node_profile.name
  enable_volume_tags     = false

  root_block_device = [
    {
      encrypted   = false
      volume_type = var.volume_type
      volume_size = var.volume_size
      tags        = var.tags
    },
  ]

  tags = var.tags
}

module "ec2_bastion" {
  source  = "terraform-aws-modules/ec2-instance/aws"
  version = "4.3.0"

  name = "bastion"

  ami                    = var.node_ami
  instance_type          = "t2.nano"
  key_name               = module.key_pair.key_pair_name
  vpc_security_group_ids = [aws_security_group.sg_public.id]
  subnet_id              = module.vpc.public_subnets[0]
  enable_volume_tags     = false

  tags = var.tags
}

module "key_pair" {
  source  = "terraform-aws-modules/key-pair/aws"
  version = "2.0.1"

  key_name   = var.key_pair
  public_key = trimspace(tls_private_key.main.public_key_openssh)
  tags = merge(var.tags, {
    "Name" = var.key_pair
  })
}

terraform {
  required_version = "= 1.3.7"

  # Fill the gaps instead <...>
  backend "s3" {
    bucket         = "terraform-states-<ACCOUNT_ID>"
    key            = "node/eu-central-1/terraform/terraform.tfstate"
    region         = "eu-central-1"
    acl            = "bucket-owner-full-control"
    dynamodb_table = "terraform_locks"
    encrypt        = true
  }

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.51.0"
    }
  }
}

provider "aws" {
  region = var.region
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }

  }
}

resource "aws_iam_role" "node_role" {
  name                  = var.role_name
  description           = "IAM role to assume to initial node"
  assume_role_policy    = data.aws_iam_policy_document.assume_role_policy.json
  force_detach_policies = true

  inline_policy {
    name = "CrossAccountPolicy"

    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Action   = "sts:AssumeRole"
          Effect   = "Allow"
          Resource = var.cross_account_role_arn
        },
      ]
    })
  }
  tags = merge(var.tags, tomap({ "Name" = var.role_name }))
}

resource "aws_iam_instance_profile" "node_profile" {
  name = var.role_name
  role = aws_iam_role.node_role.name

  tags = var.tags
}

resource "aws_eip" "bastion_ip" {
  instance = module.ec2_bastion.id

  tags = merge(var.tags, {
    "Name" = "bastion-ip"
  })
}

resource "aws_security_group" "sg_public" {
  name   = "sg public for bastion"
  vpc_id = module.vpc.vpc_id
  ingress {
    from_port = var.ssh_port
    to_port   = var.ssh_port
    protocol  = "tcp"
    #    cidr_blocks = var.ingress_cidr_blocks
    prefix_list_ids = [var.prefix_list_ids]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  tags = merge(var.tags, {
    "Name" = "sg-public"
  })
}

resource "aws_security_group" "sg_private" {
  name   = "sg private for node"
  vpc_id = module.vpc.vpc_id
  ingress {
    from_port       = var.ssh_port
    to_port         = var.ssh_port
    protocol        = "tcp"
    security_groups = [aws_security_group.sg_public.id]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  tags = merge(var.tags, {
    "Name" = "sg-private"
  })
}

resource "tls_private_key" "main" {
  algorithm = "RSA"
}

resource "null_resource" "main" {
  provisioner "local-exec" {
    command = "echo \"${tls_private_key.main.private_key_pem}\" > private.key"
  }

  provisioner "local-exec" {
    command = "chmod 600 private.key"
  }
}

#!/bin/bash
export VERSION_STRING=5:20.10.23~3-0~ubuntu-bionic

# Install docker
sudo apt-get update -y
sudo apt-get install \
    ca-certificates \
    curl \
    gnupg \
    lsb-release -y
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update -y
sudo apt-get install docker-ce=$VERSION_STRING docker-ce-cli=$VERSION_STRING containerd.io docker-compose-plugin -y
sudo usermod -aG docker ubuntu

# Install unzip
sudo apt install unzip -y

# Install aws-cli-v2
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Configure config for cross account integration
mkdir -p /home/ubuntu/.aws
touch /home/ubuntu/.aws/config
cat <<EOT >> /home/ubuntu/.aws/config
[profile cross-account-role]
role_arn = ${cross_account_role}
credential_source = Ec2InstanceMetadata
EOT

# Check out all the inputs based on the comments below and fill the gaps instead <...>
# More details on each variable can be found in the variables.tf file

region        = "eu-central-1"
platform_name = "okd-4-11" # the name of the cluster and AWS resources
platform_cidr = "10.0.0.0/16"
# The following will be created or used existing depending on the create_vpc value
subnet_azs    = ["eu-central-1a", "eu-central-1b", "eu-central-1c"]
private_cidrs = ["10.0.1.0/24"]
public_cidrs  = ["10.0.101.0/24"]

ssh_port = 22

# Uncomment this line to use a custom IP address for the SSH connection
#ingress_cidr_blocks = ["<CUSTOM_IP>"]

# Using prefix-list from epam-east-eu
prefix_list_ids = "pl-0ede2509a36215538"

node_name = "initial-node"
node_ami  = "ami-0e0102e3ff768559b"
node_type = "t2.medium"
key_pair  = "node_key"

volume_type = "gp3"
volume_size = 150

role_name              = "CustomEC2Role"
cross_account_role_arn = "arn:aws:iam::764324427262:role/CustomCrossAccountRole"

tags = {
  "SysName"    = "EPAM"
  "Department" = "MDTU-DDM"
  "user:tag"   = "mdtuddm1"
}

variable "region" {
  description = "The AWS region to deploy the cluster into, e.g. eu-central-1"
  type        = string
}

variable "platform_name" {
  description = "The name of the node that is used for tagging resources. Match the [a-z0-9_-]"
  type        = string
}

variable "platform_cidr" {
  description = "CIDR of your future VPC"
  type        = string
}

variable "subnet_azs" {
  description = "Available zones of your future or existing subnets"
  type        = list(any)
  default     = []
}

variable "private_cidrs" {
  description = "CIDR of your future VPC"
  type        = list(any)
  default     = []
}

variable "public_cidrs" {
  description = "CIDR of your future VPC"
  type        = list(any)
  default     = []
}

variable "node_name" {
  description = "The name of the node that is used for tagging resources. Match the [a-z0-9_-]"
  type        = string
}

variable "node_ami" {
  description = "The ami of the node"
  type        = string
}

variable "node_type" {
  description = "Type of the node"
  type        = string
}

variable "key_pair" {
  description = "The name of DynamoDb table to store terraform tfstate lock"
  type        = string
}

variable "volume_type" {
  description = "Root volume type of the node"
  type        = string
}

variable "volume_size" {
  description = "Root volume size of the node"
  type        = number
}

variable "ssh_port" {
  description = "Open the 22 port"
  type        = number
}

#Use this for a custom IP address for the SSH connection
#variable "ingress_cidr_blocks" {
#  description = "IP CIDR blocks for bastion"
#  type        = list(string)
#}

variable "prefix_list_ids" {
  description = "IP CIDR blocks for bastion"
  type        = string
}

variable "role_name" {
  description = "The AWS IAM role name for initial node"
  type        = string
}

variable "cross_account_role_arn" {
  description = "The AWS IAM role arn to assume from another AWS account"
  type        = string
}


variable "tags" {
  description = "A map of tags to apply to all resources"
  type        = map(any)
}