Add Terraform infrastructure for AWS EC2 deployment

[cedricgc]

Summary

This PR adds comprehensive Terraform infrastructure for deploying Greptile on AWS EC2 with Docker. The implementation follows a modular architecture with reusable components that can be composed into different deployment stacks.

What's included

Reusable Modules (terraform/modules/):

• ec2-app: Provisions an EC2 instance with security group, configurable ingress rules, and IAM instance profile support. Includes default ports for Greptile services (3000, 3010, 7077, 8080).
• rds-postgres: Manages PostgreSQL RDS instance with subnet group, security group, encryption, backup configuration, and autoscaling storage (400GB → 1TB).
• redis-cluster: Creates ElastiCache Redis replication group with subnet group, security group, and encryption at rest/in transit.

Complete Stack (terraform/stacks/aws-ec2/):

• Composes the three modules above into a production-ready deployment
• Includes IAM role with AmazonBedrockFullAccess for EC2 instances
• S3 backend configuration for state management
• Comprehensive variable definitions with sensible defaults
• Outputs for EC2 IP, RDS endpoint, and Redis endpoint

Examples (terraform/examples/):

• Documentation on consuming the stack as a Git-sourced module
• Sample configuration showing how to reference the stack from customer repos
• Complete variable definitions for easy customization

Architecture

terraform/
├── modules/           # Reusable building blocks
│   ├── ec2-app/
│   ├── rds-postgres/
│   └── redis-cluster/
├── stacks/           # Composed deployments
│   └── aws-ec2/      # EC2 + RDS + Redis stack
└── examples/         # Usage examples
    └── aws-ec2-module/

Test plan

• Run terraform init in terraform/stacks/aws-ec2/
• Run terraform validate to check syntax
• Run terraform plan with valid AWS credentials and VPC/subnet IDs
• Review plan output for expected resources (EC2, RDS, Redis, security groups, IAM role)
• (Optional) Apply to test environment and verify connectivity between services
• Verify example configuration in terraform/examples/aws-ec2-module/ is valid

[greptile-apps]

Skipped: This PR does not contain any of your configured keywords: (greptile-review)

[greptile-apps-staging]

Greptile Overview

Updated On: 2025-11-04 00:08:43 UTC

Greptile Summary

This PR adds production-ready Terraform infrastructure for deploying Greptile on AWS EC2 with Docker. The implementation follows a modular architecture with three reusable modules (ec2-app, rds-postgres, redis-cluster) that are composed into a complete deployment stack.

Key Improvements Made:

• Security hardened: Default ingress rules now use 10.0.0.0/8 instead of 0.0.0.0/0, and the EC2 module validates that at least one ingress rule is provided
• RDS final snapshots enabled by default with skip_final_snapshot = false to prevent data loss
• Redis authentication properly configured with validation requiring 16+ character auth_token when transit encryption is enabled
• GitHub organization name corrected from greptile to greptileai in example module source
• IAM role configured with Bedrock access for EC2 instances
• Encryption enabled by default for both RDS and Redis
• S3 backend configuration for state management
• Comprehensive outputs for connecting services

Architecture:
The stack creates a complete deployment with EC2 application server, PostgreSQL RDS database, and Redis ElastiCache cluster, all connected via security groups that restrict access appropriately.

Confidence Score: 4/5

• This PR is safe to merge with security improvements applied and proper validation in place.
• The infrastructure code is well-structured and addresses all critical security concerns raised in previous review. Default security posture is strong with restricted CIDR blocks, encryption enabled, and proper validation. Minor consideration: AmazonBedrockFullAccess is broad but acceptable for initial implementation. Score reflects solid infrastructure design with good security defaults.
• All critical security issues have been addressed. Consider reviewing terraform/stacks/aws-ec2/main.tf to potentially scope down Bedrock IAM permissions to specific models and actions in the future.

Important Files Changed

File Analysis

Filename	Score	Overview
terraform/modules/ec2-app/variables.tf	5/5	Includes validation requiring at least one ingress rule, preventing unintended open access.
terraform/modules/rds-postgres/main.tf	5/5	Properly configured RDS module with encryption, backups, and final snapshot handling. Security groups restrict access.
terraform/modules/redis-cluster/variables.tf	5/5	Redis variables with validation ensuring auth_token is provided when transit encryption is enabled.
terraform/stacks/aws-ec2/main.tf	4/5	Composes EC2, RDS, and Redis modules with IAM role for Bedrock access. Uses restricted CIDR blocks by default.
terraform/stacks/aws-ec2/variables.tf	5/5	Stack variables with sensible defaults using 10.0.0.0/8 CIDR for ingress rules instead of open internet access.

Sequence Diagram

sequenceDiagram
    participant User
    participant Terraform
    participant AWS_IAM as AWS IAM
    participant AWS_EC2 as AWS EC2
    participant AWS_RDS as AWS RDS
    participant AWS_Redis as AWS ElastiCache
    
    User->>Terraform: terraform init
    User->>Terraform: terraform plan
    User->>Terraform: terraform apply
    
    Terraform->>AWS_IAM: Create IAM role with Bedrock permissions
    AWS_IAM-->>Terraform: Role ARN
    
    Terraform->>AWS_IAM: Create instance profile
    AWS_IAM-->>Terraform: Instance profile ARN
    
    Terraform->>AWS_RDS: Create DB subnet group
    Terraform->>AWS_RDS: Create RDS security group
    Terraform->>AWS_RDS: Create PostgreSQL instance (encrypted)
    AWS_RDS-->>Terraform: RDS endpoint
    
    Terraform->>AWS_Redis: Create ElastiCache subnet group
    Terraform->>AWS_Redis: Create Redis security group
    Terraform->>AWS_Redis: Create Redis replication group (encrypted, auth enabled)
    AWS_Redis-->>Terraform: Redis primary endpoint
    
    Terraform->>AWS_EC2: Create EC2 security group with restricted ingress
    Terraform->>AWS_EC2: Launch EC2 instance with IAM profile
    AWS_EC2-->>Terraform: EC2 public IP
    
    Note over AWS_EC2,AWS_RDS: EC2 connects to RDS via security group rules
    Note over AWS_EC2,AWS_Redis: EC2 connects to Redis via security group rules
    
    Terraform-->>User: Output endpoints and IPs

Loading

[greptile-apps-staging]

_{27 files reviewed, 6 comments}

_{Edit Code Review Agent Settings | Greptile}

[HofmT]

@cedricgc We can actually get rid of REDIS entirely. There is no use-case for on-prem customers.

[cedricgc]

Good to know. We can simplify the stack here. I think I will keep the module but not wire it in to any of the stack to make the configuration much simpler