terraform-ec2-example/main.tf at main · elva-labs/terraform-ec2-example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
# Local Values
locals {
  ubuntu_ami_id = "ami-0914547665e6a707c" # Ubuntu 24.04 LTS AMI for eu-north-1
  aws_region    = "eu-north-1"
  vpc_id        = "vpc-04fb44b7a81d06950"
  subnet_id     = "subnet-0e0ab6a06e3cee9fb"
  key_pairs = {
    "tobias" = "coretura-tobias-test"
  }
}

# Data Sources (Existing Networking / Security Resources)
data "aws_vpc" "existing" {
  id = local.vpc_id
}

data "aws_subnet" "existing" {
  id = local.subnet_id
}

data "aws_caller_identity" "current" {}

# EC2 Instance Tobias
module "ec2" {
  source = "./modules/ec2"

  providers = {
    aws = aws.north
  }

  # Basic Instance Info
  instance_name = "tobias-dev-instance"
  key_name      = local.key_pairs["tobias"]

  # Instance Configuration
  ami_id        = local.ubuntu_ami_id
  instance_type = "t3.large"

  # Network Configuration
  vpc_id    = data.aws_vpc.existing.id
  subnet_id = data.aws_subnet.existing.id

  # Security Group Rules
  ingress_rules = [
    {
      description = "SSH from anywhere"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    },
    {
      description = "HTTPS from anywhere"
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  ]

  # IAM Permissions
  iam_permissions = [
    {
      effect = "Allow"
      actions = [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret"
      ]
      resources = [
        "arn:aws:secretsmanager:${local.aws_region}:${data.aws_caller_identity.current.account_id}:secret:*"
      ]
    },
    {
      effect = "Allow"
      actions = [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath"
      ]
      resources = [
        "arn:aws:ssm:${local.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/github/*"
      ]
    }
  ]

  # User Data / Init Script
  user_data = file("${path.module}/scripts/init.sh")

  # Storage Configuration
  root_volume_type      = "gp3"
  root_volume_size      = 30

  # Tags
  tags = {
    Environment = "Development"
    Project     = "QNX"
    ManagedBy   = "Terraform"
  }
}