Environments templates

examples/iam/user-with-access-key/README.md

@@ -10,8 +10,8 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
-| <a name="provider_random"></a> [random](#provider\_random) | n/a |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.64.0 |
+| <a name="provider_random"></a> [random](#provider\_random) | 3.6.2 |
 
 ## Modules
 

templates/dev/README.md

@@ -0,0 +1,64 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 5.0 |
+| <a name="provider_random"></a> [random](#provider\_random) | ~> 3.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_ci_iam"></a> [ci\_iam](#module\_ci\_iam) | ../modules/iam/user-with-access-key | n/a |
+| <a name="module_cloudfront_app"></a> [cloudfront\_app](#module\_cloudfront\_app) | ../modules/cloudfront-app | n/a |
+| <a name="module_cloudfront_bucket_policy"></a> [cloudfront\_bucket\_policy](#module\_cloudfront\_bucket\_policy) | ../modules/cloudfront-s3-origin-bucket-policy | n/a |
+| <a name="module_cloudfront_deployment_policy"></a> [cloudfront\_deployment\_policy](#module\_cloudfront\_deployment\_policy) | ../modules/cloudfront-deployment-policy | n/a |
+| <a name="module_cluster"></a> [cluster](#module\_cluster) | ../modules/ecs-cluster | n/a |
+| <a name="module_database_subnet"></a> [database\_subnet](#module\_database\_subnet) | ../modules/vpc-private-subnet | n/a |
+| <a name="module_db"></a> [db](#module\_db) | ../modules/postgres | n/a |
+| <a name="module_ecr"></a> [ecr](#module\_ecr) | ../modules/ecr-repository | n/a |
+| <a name="module_info"></a> [info](#module\_info) | Selleo/context/null | 0.3.0 |
+| <a name="module_lb"></a> [lb](#module\_lb) | ../modules/lb/alb | n/a |
+| <a name="module_private_subnet"></a> [private\_subnet](#module\_private\_subnet) | ../modules/vpc-private-subnet | n/a |
+| <a name="module_public_subnet"></a> [public\_subnet](#module\_public\_subnet) | ../modules/vpc-public-subnet | n/a |
+| <a name="module_secrets_ci"></a> [secrets\_ci](#module\_secrets\_ci) | ../modules/ssm/parameters | n/a |
+| <a name="module_service"></a> [service](#module\_service) | ../modules/ecs-service | n/a |
+| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../modules/vpc | n/a |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_policy.ci_user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
+| [aws_iam_user_policy_attachment.ci_user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource |
+| [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
+| [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
+| [random_id.cdn](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
+| [random_id.example](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
+| [random_id.rds](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.ci_user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+| [aws_route53_zone.domain](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_region"></a> [region](#input\_region) | Default AWS region | `string` | `"eu-central-1"` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_url"></a> [url](#output\_url) | n/a |
+<!-- END_TF_DOCS -->

templates/dev/ci.tf

@@ -0,0 +1,60 @@
+module "ci_iam" {
+  source  = "../modules/iam/user-with-access-key"
+
+  name = "name-dev-ci" # TODO adjust name to your project
+
+  groups = [
+    module.cluster.deployment_group,
+    module.service.deployment_group,
+    module.ecr.deployment_group
+  ]
+
+  depends_on = [
+    module.ecr
+  ]
+}
+
+resource "aws_iam_user_policy_attachment" "ci_user" {
+  user       = module.ci_iam.name
+  policy_arn = aws_iam_policy.ci_user.arn
+}
+
+resource "aws_iam_policy" "ci_user" {
+  name   = "dev-apps-ci-ssm" 
+  policy = data.aws_iam_policy_document.ci_user.json
+}
+
+data "aws_iam_policy_document" "ci_user" {
+  statement {
+    actions = [
+      "ssm:GetParameter",
+      "ssm:GetParametersByPath"
+    ]
+    resources = ["arn:aws:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/name/dev/api/*"] # TODO adjust name to your project
+  }
+  statement {
+    effect = "Allow"
+    actions = [
+      "ssm:DescribeParameters"
+    ]
+    resources = ["*"]
+  }
+}
+
+module "secrets_ci" {
+  source  = "../modules/ssm/parameters"
+
+  context = {
+    namespace = "name" # TODO adjust namespace to your project
+    stage     = "dev"
+    name      = "secrets"
+  }
+
+  secrets = {
+    AWS_ACCESS_KEY_ID     = module.ci_iam.key_id
+    AWS_SECRET_ACCESS_KEY = module.ci_iam.key_secret
+    ECR_URL               = module.ecr.url
+    ECS_CLUSTER           = module.cluster.name
+    ECS_SERVICE           = module.service.name
+  }
+}  

templates/dev/cloudfront.tf

@@ -0,0 +1,46 @@
+resource "random_id" "cdn" {
+  byte_length = 4
+  prefix      = "tf-name-" # TODO adjust name to your project
+}
+
+resource "aws_s3_bucket" "this" {
+  bucket = "apps-${random_id.cdn.hex}" 
+}
+
+resource "aws_s3_bucket_public_access_block" "this" {
+  bucket = aws_s3_bucket.this.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+module "cloudfront_app" {
+  source = "../modules/cloudfront-app"
+
+  context = {
+    namespace = "template" # TODO adjust namespace to your project name
+    stage     = "dev"
+    name      = "app"
+  }
+  app_id          = "example" # TODO adjust app_id to your project name
+  s3_bucket       = aws_s3_bucket.this.bucket
+  aliases         = []
+  certificate_arn = ""
+}
+
+module "cloudfront_deployment_policy" {
+  source = "../modules/cloudfront-deployment-policy"
+
+  s3_bucket_arn   = aws_s3_bucket.this.arn
+  cloudfront_arns = [module.cloudfront_app.arn]
+  s3_origin_arns  = [module.cloudfront_app.s3_origin_arn]
+}
+
+module "cloudfront_bucket_policy" {
+  source = "../modules/cloudfront-s3-origin-bucket-policy"
+
+  s3_bucket       = aws_s3_bucket.this.bucket
+  cloudfront_arns = [module.cloudfront_app.arn]
+}

templates/dev/data.tf

@@ -0,0 +1,3 @@
+data "aws_caller_identity" "current" {}
+
+data "aws_region" "current" {}

templates/dev/ecr.tf

@@ -0,0 +1,19 @@
+module "info" {
+  source  = "Selleo/context/null"
+  version = "0.3.0"
+
+  namespace = "name" # TODO adjust name to your project
+  stage     = "dev"
+  name      = "api"
+}
+
+module "ecr" {
+  source = "../modules/ecr-repository"
+
+  context = module.info.context
+}
+
+output "url" {
+  value = module.ecr.url
+
+}

templates/dev/ecs.tf

@@ -0,0 +1,51 @@
+resource "random_id" "example" {
+  byte_length = 2
+
+  prefix = "discovery-"
+}
+
+# cluster
+
+module "cluster" {
+  source = "../modules/ecs-cluster"
+
+  context = {
+    namespace = "name" # TODO adjust name to your project
+    stage     = "dev"
+    name      = "cluster"
+  }
+
+  name_prefix          = random_id.example.hex
+  vpc_id               = module.vpc.id
+  subnet_ids           = module.public_subnet.ids
+  instance_type        = "t3.small"
+  lb_security_group_id = module.lb.security_group_id
+
+  autoscaling_group = {
+    min_size         = 1
+    max_size         = 5
+    desired_capacity = 1
+  }
+}
+
+module "service" {
+  source = "../modules/ecs-service"
+
+  name          = random_id.example.hex
+  vpc_id        = module.vpc.id
+  subnet_ids    = module.public_subnet.ids
+  cluster_id    = module.cluster.id
+  desired_count = 1
+
+  tcp_ports = [{
+      name      = "http"
+      host      = 0
+      container = 3000
+    }]
+
+  context = {
+    namespace = "name" # TODO adjust name to your project
+    stage     = "dev"
+    name      = "ecs"
+  }
+}

templates/dev/networking.tf

@@ -0,0 +1,78 @@
+locals {
+  context = {
+    namespace = "name" # TODO adjust name to your project
+    stage     = "dev"
+    name      = "networking"
+  }
+}
+
+module "vpc" {
+  source = "../modules/vpc"
+
+  name = random_id.example.hex
+  cidr = "10.0.0.0/16"
+}
+
+module "public_subnet" {
+  source = "../modules/vpc-public-subnet"
+
+  vpc_id              = module.vpc.id
+  internet_gateway_id = module.vpc.internet_gateway_id
+  config = {
+    "a" = {
+      az   = "eu-central-1a"
+      cidr = "10.0.1.0/24"
+      nat  = true
+    }
+    "b" = {
+      az   = "eu-central-1b"
+      cidr = "10.0.2.0/24"
+      nat  = false
+    }
+  }
+}
+
+module "private_subnet" {
+  source = "../modules/vpc-private-subnet"
+
+  context = local.context
+  vpc_id  = module.vpc.id
+
+  config = {
+    "a" = {
+      az   = "eu-central-1a"
+      cidr = "10.0.51.0/24"
+    }
+  }
+
+  nat_gateway_routing = {
+    "a" = module.public_subnet.nat_gateways["eu-central-1a"]
+  }
+}
+
+module "database_subnet" {
+  source = "../modules/vpc-private-subnet"
+
+  context = local.context
+  vpc_id  = module.vpc.id
+
+  config = {
+    "db-a" = {
+      az   = "eu-central-1a"
+      cidr = "10.0.101.0/24"
+    }
+  }
+
+  database_subnet = true
+}
+
+module "lb" {
+  source = "../modules/lb/alb"
+
+  name        = random_id.example.hex
+  vpc_id      = module.vpc.id
+  subnet_ids  = module.public_subnet.ids
+  force_https = false
+
+  context = local.context
+}