Skip to content

Move to alexs aws #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kurtwheeler wants to merge 11 commits into
base: master
Choose a base branch
from
Open

Move to alexs aws #10

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
ffe979e
Change AZ because that's where we got the SSL cert for by accident, b…
kurtwheeler Feb 8, 2018
6ecf004
Locks down IAM permissions.
kurtwheeler Feb 9, 2018
08127b6
Merge branch 'master' of https://github.com/cognoma/infrastructure in…
kurtwheeler Feb 9, 2018
0a55432
Switches back to us-east-1 because SES does not support us-east-2
kurtwheeler Feb 12, 2018
1004b37
Add terraform state file
kurtwheeler Feb 15, 2018
17ce2b6
Add 1 git-crypt collaborator
kurtwheeler Feb 15, 2018
1f38a8d
update tfstate
Miserlou Feb 16, 2018
d7df664
Removes our own ecs-service-role and uses the one provided by AWS bec…
kurtwheeler Feb 16, 2018
70885d3
WIP towards having ECS deploy the Docker images. This is close. I hat…
kurtwheeler Feb 17, 2018
1e4a833
Fix some settings in task definitions that didn't get updated, along …
kurtwheeler Feb 21, 2018
af7ce19
Looks like things are working, so this may finally be done.
kurtwheeler Mar 2, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 48 additions & 19 deletions container-registry.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,30 +22,59 @@ resource "aws_iam_role" "ecs-service-role" {
EOF
}

data "aws_iam_policy_document" "ecs-iam-role-document" {
statement {
effect = "Allow"
actions = [
"ec2:AuthorizeSecurityGroupIngress",
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:Describe*",
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
"elasticloadbalancing:RegisterTargets"
]

# VPCs and security groups do not have .arn attributes. The reason
# appears to be that when specifying them in IAM policies that you
# need to specify the region. Since this is only deployed in a
# single region, we can actually build an "effective arn" for them.
resources = [
"arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:security-group/${aws_security_group.cognoma-service.id}",
"arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:security-group/${aws_security_group.cognoma-public-elb.id}",
"${aws_elb.cognoma-core.arn}",
"${aws_elb.cognoma-nginx.arn}"
]

condition {
test = "StringEquals"
variable = "ec2:Vpc"
values = ["arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:vpc/${aws_vpc.cognoma-vpc.id}"]
}
}
}

resource "aws_iam_role_policy" "ecs-service" {
name = "ecs-service-policy"
role = "${aws_iam_role.ecs-service-role.name}"

policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:Describe*",
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:Describe*",
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
"elasticloadbalancing:RegisterTargets"
],
"Resource": "*"
}
]
policy = "${data.aws_iam_policy_document.ecs-iam-role-document.json}"
}
EOF

# ec2:Describe* cannot be limited to specfic resources:
# https://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions
data "aws_iam_policy_document" "ec2-describe-star" {
statement {
effect = "Allow"
actions = ["ec2:Describe*"]
resources = ["*"]
}
}

resource "aws_iam_role_policy" "ecs-describe-ec2" {
name = "ecs-describe-ec2"
role = "${aws_iam_role.ecs-service-role.name}"

policy = "${data.aws_iam_policy_document.ec2-describe-star.json}"
}

resource "aws_ecs_task_definition" "cognoma-core-service" {
Expand Down
8 changes: 4 additions & 4 deletions load-balancers.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
resource "aws_elb" "cognoma-core" {
name = "cognoma-core-service"
subnets = [
"${aws_subnet.cognoma-1a.id}",
"${aws_subnet.cognoma-1b.id}"]
"${aws_subnet.cognoma-2a.id}",
"${aws_subnet.cognoma-2b.id}"]

listener {
instance_port = 8000
Expand Down Expand Up @@ -41,8 +41,8 @@ data "aws_acm_certificate" "cognoma-ssl-cert" {
resource "aws_elb" "cognoma-nginx" {
name = "cognoma-nginx"
subnets = [
"${aws_subnet.cognoma-1a.id}",
"${aws_subnet.cognoma-1b.id}"
"${aws_subnet.cognoma-2a.id}",
"${aws_subnet.cognoma-2b.id}"
]

listener {
Expand Down
30 changes: 18 additions & 12 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,15 @@
provider "aws" {
region = "us-east-1"
region = "us-east-2"
}

variable "database_password" {}

data "aws_caller_identity" "current" {}

data "aws_region" "current" {
current = true
}

resource "aws_vpc" "cognoma-vpc" {
cidr_block = "172.31.0.0/16"
enable_dns_support = true
Expand Down Expand Up @@ -35,25 +41,25 @@ resource "aws_route_table" "cognoma" {
}
}

resource "aws_subnet" "cognoma-1a" {
availability_zone = "us-east-1a"
resource "aws_subnet" "cognoma-2a" {
availability_zone = "us-east-2a"
cidr_block = "172.31.48.0/20"
vpc_id = "${aws_vpc.cognoma-vpc.id}"
map_public_ip_on_launch = true

tags {
Name = "cognoma-1a"
Name = "cognoma-2a"
}
}

resource "aws_subnet" "cognoma-1b" {
availability_zone = "us-east-1b"
resource "aws_subnet" "cognoma-2b" {
availability_zone = "us-east-2b"
cidr_block = "172.31.0.0/20"
vpc_id = "${aws_vpc.cognoma-vpc.id}"
map_public_ip_on_launch = true

tags {
Name = "cognoma-1b"
Name = "cognoma-2b"
}
}

Expand Down Expand Up @@ -97,11 +103,11 @@ resource "aws_key_pair" "cognoma" {

resource "aws_instance" "cognoma-service-1" {
ami = "ami-275ffe31"
availability_zone = "us-east-2a"
instance_type = "r4.large"
availability_zone = "us-east-1a"
vpc_security_group_ids = ["${aws_security_group.cognoma-service.id}"]
iam_instance_profile = "${aws_iam_instance_profile.ecs-instance-profile.name}"
subnet_id = "${aws_subnet.cognoma-1a.id}"
subnet_id = "${aws_subnet.cognoma-2a.id}"
depends_on = ["aws_internet_gateway.cognoma"]
user_data = "${file("instance-user-data.sh")}"
key_name = "${aws_key_pair.cognoma.key_name}"
Expand All @@ -113,11 +119,11 @@ resource "aws_instance" "cognoma-service-1" {

resource "aws_instance" "cognoma-service-2" {
ami = "ami-275ffe31"
availability_zone = "us-east-2b"
instance_type = "r4.large"
availability_zone = "us-east-1b"
vpc_security_group_ids = ["${aws_security_group.cognoma-service.id}"]
iam_instance_profile = "${aws_iam_instance_profile.ecs-instance-profile.name}"
subnet_id = "${aws_subnet.cognoma-1b.id}"
subnet_id = "${aws_subnet.cognoma-2b.id}"
depends_on = ["aws_internet_gateway.cognoma"]
user_data = "${file("instance-user-data.sh")}"
key_name = "${aws_key_pair.cognoma.key_name}"
Expand All @@ -129,7 +135,7 @@ resource "aws_instance" "cognoma-service-2" {

resource "aws_db_subnet_group" "cognoma" {
name = "cognoma"
subnet_ids = ["${aws_subnet.cognoma-1a.id}", "${aws_subnet.cognoma-1b.id}"]
subnet_ids = ["${aws_subnet.cognoma-2a.id}", "${aws_subnet.cognoma-2b.id}"]

tags {
Name = "Cognoma DB Subnet"
Expand Down
2 changes: 1 addition & 1 deletion route53.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ variable "cognoma-domain" {
}

data "aws_route53_zone" "cognoma" {
zone_id = "Z2GDAYII3P3OEX"
zone_id = "Z1D5X4ZSR5R6N1"
}

resource "aws_ses_domain_identity" "cognoma" {
Expand Down