-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathmain.tf
162 lines (140 loc) · 5.55 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
terraform {
required_providers {
aws = {
version = "~> 5"
}
}
}
provider "aws" {
region = "ap-southeast-2"
profile = "hills-carpal"
}
resource "aws_ecr_repository" "hills-carpal-repo" {
name = "hills-carpal-repo"
}
data "aws_iam_policy_document" "assume_role_policy" {
statement {
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["ecs-tasks.amazonaws.com"]
}
}
}
# Providing a reference to our default VPC
resource "aws_default_vpc" "default_vpc" {
assign_generated_ipv6_cidr_block = true
}
# Providing a reference to our default subnets
resource "aws_default_subnet" "default_subnet_a" {
availability_zone = "ap-southeast-2a"
map_public_ip_on_launch = false
ipv6_cidr_block = cidrsubnet(aws_default_vpc.default_vpc.ipv6_cidr_block, 8, 0)
}
resource "aws_default_subnet" "default_subnet_b" {
availability_zone = "ap-southeast-2b"
map_public_ip_on_launch = false
ipv6_cidr_block = cidrsubnet(aws_default_vpc.default_vpc.ipv6_cidr_block, 8, 1)
}
resource "aws_default_subnet" "default_subnet_c" {
availability_zone = "ap-southeast-2c"
map_public_ip_on_launch = false
ipv6_cidr_block = cidrsubnet(aws_default_vpc.default_vpc.ipv6_cidr_block, 8, 2)
}
resource "aws_iam_role" "ecs_task_execution_role" {
name = "ecs_task_execution_role"
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}
resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_policy" {
role = aws_iam_role.ecs_task_execution_role.name
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}
resource "aws_alb" "application_load_balancer" {
name = "hills-carpal-prod-lb-tf" # Naming our load balancer
load_balancer_type = "application"
subnets = [ # Referencing the default subnets
"${aws_default_subnet.default_subnet_a.id}",
"${aws_default_subnet.default_subnet_b.id}",
"${aws_default_subnet.default_subnet_c.id}"
]
enable_http2 = true
enable_deletion_protection = true
# Referencing the security group
security_groups = ["${aws_security_group.load_balancer_security_group.id}"]
ip_address_type = "dualstack"
}
# Creating a security group for the load balancer:
resource "aws_security_group" "load_balancer_security_group" {
ingress {
from_port = 80 # Allowing traffic in from port 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] # Allowing traffic in from all sources
}
ingress {
from_port = 1024 # Allowing traffic in from port 80
to_port = 1024
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] # Allowing traffic in from all sources
}
egress {
from_port = 0 # Allowing any incoming port
to_port = 0 # Allowing any outgoing port
protocol = "-1" # Allowing any outgoing protocol
cidr_blocks = ["0.0.0.0/0"] # Allowing traffic out to all IP addresses
}
}
module "prod_db" {
source = "./terraform/modules/database"
vpc = aws_default_vpc.default_vpc
database_id = "prod"
}
module "dev_db" {
source = "./terraform/modules/database"
vpc = aws_default_vpc.default_vpc
database_id = "dev"
}
module "bastion" {
source = "./terraform/modules/bastion"
vpc = aws_default_vpc.default_vpc
}
module "prod" {
source = "./terraform/modules/common-infra"
docker_image_tag = "ad5058328d59ee40e0f318fa668dca207a51ed2d"
environment_id = "prod"
ecs_task_execution_role = aws_iam_role.ecs_task_execution_role
hills_carpal_repo = aws_ecr_repository.hills-carpal-repo
vpc = aws_default_vpc.default_vpc
default_subnet_a = aws_default_subnet.default_subnet_a
default_subnet_b = aws_default_subnet.default_subnet_b
default_subnet_c = aws_default_subnet.default_subnet_c
external_url = "https://ride.carpal.org.au"
require_user_role = "prod"
environment_name = "Production"
load_balancer_security_group = aws_security_group.load_balancer_security_group
load_balancer = aws_alb.application_load_balancer
load_balancer_port = 80
db_instance = module.prod_db.db
backup_google_sheet_id = "1MFfENxjTsva5NZbzi9ArF2JS9NHv4ZxfkA0IJzhp8rM"
ecs_task_revision = 68
}
module "training" {
source = "./terraform/modules/common-infra"
docker_image_tag = "ad5058328d59ee40e0f318fa668dca207a51ed2d"
environment_id = "training"
ecs_task_execution_role = aws_iam_role.ecs_task_execution_role
hills_carpal_repo = aws_ecr_repository.hills-carpal-repo
vpc = aws_default_vpc.default_vpc
default_subnet_a = aws_default_subnet.default_subnet_a
default_subnet_b = aws_default_subnet.default_subnet_b
default_subnet_c = aws_default_subnet.default_subnet_c
external_url = "https://training.ride.carpal.org.au"
require_user_role = "training"
environment_name = "Training"
load_balancer_security_group = aws_security_group.load_balancer_security_group
load_balancer = aws_alb.application_load_balancer
load_balancer_port = 1024
db_instance = module.dev_db.db
backup_google_sheet_id = "190aMCZO9QwXU-9dIep6OPkadc4-8T4kW0cHEO8gEXp4"
ecs_task_revision = 87
}