DEV Community: ephantus gachomba

Deploying a Static Website on AWS S3 with Terraform: A Beginner's Guide

ephantus gachomba — Sun, 22 Sep 2024 10:32:55 +0000

Step 1 : create all configuration files in the modules folder from this format.
project-root/
├── modules/
│ └── s3-static-website/
│ ├── main.tf
│ ├── variables.tf
│ └── outputs.tf
├── envs/
│ └── dev/
│ ├── main.tf
│ ├── variables.tf
│ └── terraform.tfvars
├── backend.tf
├── provider.tf
└── variables.tf

main.tf file

#create the s3 bucket
resource "aws_s3_bucket" "website_bucket" {
  bucket = var.bucket_name
  tags   = var.tags
}

#Configuration of the S3 bucket website.
resource "aws_s3_bucket_website_configuration" "website_static" {
  bucket = aws_s3_bucket.website_bucket.id

  index_document {
    suffix = "index.html"
  }
}

#bucket policy ensures that all objects, regardless of how they are uploaded or by whom, will be accessible publicly.
#using bucket policies over ACLs provide better visibility and manageability
#bucket policy ensures consistent, secure, and more flexible access control
resource "aws_s3_bucket_policy" "website_policy" {
  bucket = aws_s3_bucket.website_bucket.id
  policy = data.aws_iam_policy_document.website_policy.json
}

data "aws_iam_policy_document" "website_policy" {
  statement {
    actions = ["s3:GetObject"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    resources = ["${aws_s3_bucket.website_bucket.arn}/*"]
    effect    = "Allow"
  }
}

resource "aws_s3_bucket_public_access_block" "website_bucket_block" {
  bucket = aws_s3_bucket.website_bucket.id

  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}

locals {
  s3_origin_id = "${var.bucket_name}-origin"
  s3_domain_name = "${var.bucket_name}.s3-website-${var.region}.amazonaws.com"
}


resource "aws_cloudfront_distribution" "cdn" {
    origin {
    domain_name = aws_s3_bucket.website_bucket.bucket_regional_domain_name 
    origin_id   = var.original_id
  }

  enabled             = true
  is_ipv6_enabled     = true
  default_root_object = "index.html"

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = var.original_id

    forwarded_values {
      query_string = true
      cookies {
        forward = "all"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 0
    max_ttl                = 0
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }
  viewer_certificate {
    cloudfront_default_certificate = true
  }

  depends_on = [aws_s3_bucket.website_bucket]
}

1.2
outputs.tf file contains

# Output the S3 bucket name
output "s3_bucket_name" {
  value = aws_s3_bucket.website_bucket.bucket
  description = "The name of the S3 bucket"
}

# Output the CloudFront distribution domain name
output "cloudfront_domain_name" {
  value = aws_cloudfront_distribution.cdn.domain_name
  description = "The domain name of the CloudFront distribution"
}

# Output the CloudFront distribution ID
output "cloudfront_distribution_id" {
  value = aws_cloudfront_distribution.cdn.id
  description = "The ID of the CloudFront distribution"
}

1.3 variables.tf

variable "region" {
  description = "Region"
  type = string
  default = "us-east-1"
}

variable "bucket_name" {
  description = "The name of the S3 bucket"
  type        = string
}

variable "original_id" {
  description = "The original ID for CloudFront"
  type        = string
  default     = "S3-Origin"
}

variable "tags" {
  description = "Tags for the resources"
  type        = map(string)
  default     = {}
}

hcl
Step 2 : head to the specific dev folder to import the configs
2.1
main.tf creates a module called s3_static_website

provider "aws" {
  region = "us-east-1"
}

module "s3_static_website" {
  source      = "../../modules/s3-static-website"
  bucket_name = var.bucket_name
  tags        = var.tags
}

2.2 variables.tf
contains the variables

variable "bucket_name" {
  description = "The name of the S3 bucket for the dev environment"
  type        = string
  #default     = "dev_static_website_bucket_efantus_new"
}

variable "tags" {
  description = "Tags for resources in dev environment"
  type        = map(string)
  default = {
    "Environment" = "dev"
  }
}

2.3 terraform.tfvars sets the value of the bucket

bucket_name = "dev-static-website-bucket"

2.4 outputs.tf get the name of s3, cloudfront domain names

# Output the S3 bucket name
output "s3_bucket_name" {
  value = var.bucket_name
  description = "The name of the S3 bucket"
}

# Output the CloudFront distribution domain name
output "cloudfront_domain_name" {
  value = module.s3_static_website.cloudfront_domain_name
  description = "The domain name of the CloudFront distribution"
}

2.5
create the s3_bucket_cloudfront.tf file
it creates the config for both the s3 , dynamodb to store our state files.
security measure include:
--server side encyrption of the bucket
--version control
--lifecycyle prevent destroy to true.can't be deleted
--block all public access
--hash key for dynamodb

#step 1 : create s3 bucket
resource "aws_s3_bucket" "terraform_state" {
  bucket = "dev-state-file-new"

    #prevent accidental deletion of s3
  lifecycle {
    prevent_destroy = true
  }
}

#step 2 : Enable versioning of s3 bucket
resource "aws_s3_bucket_versioning" "enabled" {
  bucket = aws_s3_bucket.terraform_state.id
  versioning_configuration {
    status = "Enabled"
  }
}

#step 3 : Secure bucket using server side encryption
resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
  bucket = aws_s3_bucket.terraform_state.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

#step 4 : Block all public access to s3 bucket
resource "aws_s3_bucket_public_access_block" "public_access" {
  bucket = aws_s3_bucket.terraform_state.id
  block_public_acls = true
  block_public_policy = true
  ignore_public_acls = true
  restrict_public_buckets = true
}

#step 5 : create dynamodb table for locking 
resource "aws_dynamodb_table" "terraform_locks" {
  name = "dev_dynamodb_table_name_new"
  billing_mode = "PAY_PER_REQUEST"
  hash_key = "LockID"
  attribute {
    name = "LockID"
    type = "S"
  }
}

after this step, manually upload the index.html static file to the bucket_name = "dev-static-website-bucket"

2.6
backend.tf file.
NB :
--comment this file code until you have created all resources for storing state files in s3_bucket_state.tf
--uncoomment and upload the state files remotely to the s3 bucket

terraform {
  backend "s3" {
    bucket = "dev-state-file-new"
    key = "global/s3/terraform.tfstate"
    region = "us-east-1"
    dynamodb_table = "dev_dynamodb_table_name_new"
    encrypt = true
  }
}

Step 3 :
run terraform output to get:
cloudfront_domain_name && s3_bucket_name name

Step 4 :
created files ::

Step 5 :

# Deploying a Secure Three-Tier AWS Architecture with Terraform

ephantus gachomba — Fri, 20 Sep 2024 19:58:15 +0000

Architecture::

project-root/
├── modules/
│   ├── vpc/
│   │   ├── vpc.tf
│   │   └── outputs.tf
│   ├── ec2_webserver/
│   │   ├── launchweb.tf
│   │   ├── webserver_sg.tf
│   │   ├── variables.tf
│   │   ├── frontenddata.sh
│   │   └── outputs.tf
│   └── asg_webserver/
│   │    ├── webserverASG.tf
│   │    └── variables.tf
│   └── ec2_appserver/
│   │    ├── launchapp.tf
│   │    ├── appserver_sg.tf
│   │    ├── variables.tf
│   │    ├── backenddata.sh
│   │    └── outputs.tf
│   └── asg_appserver/
│   │    ├── appserverASG.tf
│   │    └── variables.tf
│   └── public_elb/
│   │    ├── main.tf
│   │    ├── securitygroup.tf
│   │    ├── outputs.tf
│   │    └── variables.tf
│   └── appserver_elb/
│   │    ├── main.tf
│   │    ├── securitygroup_elb.tf
│   │    ├── outputs.tf
│   │    └── variables.tf
│   └── cloudfront
│   │    ├── cloudfront.tf
│   │    ├── output.tf
│   │    └── variables.tf
│   └── cloudtrails/
│   │    ├── s3bucket_logs.tf
│   │    └── outputs.tf
├── main.tf
├── outputs.tf
└── README.md

Blog Post

Security Considerations

Create Before Destroy = true for EC2 Instances:
- This ensures that new EC2 instances are created before terminating the old ones, minimizing downtime and ensuring availability during updates or changes.

Public ELB can only be accessed via CloudFront:

prefix_list_ids = [data.aws_ec2_managed_prefix_list.cloudfront.id]

-->This restricts direct access to the Application Load Balancer (ALB), allowing only CloudFront to forward traffic, which enhances security by adding another layer of control and filtering malicious traffic.

3 . Viewer Protocol is redirect-to-https:
- This setting forces HTTP requests to be redirected to HTTPS, ensuring all traffic is encrypted in transit for better security, particularly for sensitive data or login sessions.

4 . Whitelisted Countries: ["US", "CA", "KE"]:
- By specifying allowed countries, only requests originating from the listed regions (United States, Canada, Kenya) can access the application, providing geo-based access control to mitigate security risks.

5 . CloudTrail for Logging:
- AWS CloudTrail is enabled to log API calls and user activities across your AWS environment, allowing you to track changes and detect potential security threats or compliance issues. Logs can be stored securely in an S3 bucket for audit and analysis.

Step 1: VPC Service

Create VPC
Create Subnets:
- us-east-1a: (Public Subnet A, Private Subnet A, Private Subnet C)
- us-east-1b: (Public Subnet B, Private Subnet B, Private Subnet D)
Create Internet Gateway

Create Route Table

Route:

  cloudforce_rt: destination_cidr_block = "0.0.0.0/0"

Associate Route Table to Public Subnets: (A, B)
Create an Elastic IP
Create a NAT Gateway in Public Subnet A and associate it with the Elastic IP
Create a Route Table for NAT Gateway:
```
destination_cidr_block = "0.0.0.0/0"
```
Associate Route Table for NAT Gateway: (Private Subnets: A, B, C, D)

Step 2: EC2 Webserver

Create a Launch Web Template
Create a Webserver Security Group:
- Inbound Rules:
  - Allow traffic from ELB in public (ports 80).
- Outbound Rules:
  - Allow all outgoing traffic to the internet.
Outputs:
- launch_template_id (used by /asg_webserver module).
- webserver_sg (used by /public_elb/, /appserver_elb/ modules as source for security groups).

Step 3: ASG Webserver Module

Creates the Auto Scaling Group (ASG) for the Webserver Instances.

Step 4: EC2 Appserver Module

Create a Launch App Template: (launchapp.tf)
Create App Server Security Group: (appserver_sg.tf)
- Inbound Rules:
  - Allow traffic from app ELB ( 443).
- Outbound Rules:
  - Allow all outgoing traffic to the internet.
Outputs:
- appserver_sg (used by appserver_elb_sg).
- launch_template_id (used by asg_appserver).

Step 5: ASG Appserver Module

Creates the Auto Scaling Group for the Application Server.

Step 6: Public ELB Module

Creates Load Balancer, Target Group, Listener: (main.tf)
Create Public ELB Security Group: (securitygroup_elb.tf)
- Inbound Rules:
  - Allow traffic from CloudFront only (ports 80 & 443).
- Outbound Rules:
  - Allow all outgoing traffic to the web servers.
Outputs:
- frontendTG (used by asg_webserver).
- elb_security_group_id (used by ec2_appserver, ec2_webserver).
- frontend_lb_dns_name (used by CloudFront).
- frontend_lb (used by CloudFront).

Step 7: Appserver ELB Module

Create Application Load Balancer: (main.tf)
- Load balancer type: application.
Create App Server ELB Security Group: (securitygroup_elb.tf)
- Inbound Rules:
  - Allow traffic from Web Instances.
- Outbound Rules:
  - Allow all outgoing traffic to the internet.
Outputs:
- appserver_elb_sg_id (used by EC2 Appserver).
- appserverTG (used by ASG Appserver).

Step 8: CloudFront Module

Domain Name: cloudfront_domain_name.
Origin Protocol Type: HTTP.
Viewer Protocol: redirect-to-https.
Whitelisted Countries: ["US", "CA", "KE"].
Outputs:
- cloudfront_domain_name (displayed on terminal).

Step 9: CloudTrails Module

Create an S3 Bucket to store CloudFront logs.
Create CloudTrail to log CloudFront events.

Step 10: Root Module (`main.tf`)

Initialize all modules with their sources and dependent arguments.

Step 11: Root Module (`outputs.tf`)

Outputs:
- cloudfront_domain_name.
- frontend_lb_dns_name.

Mastering Basic Infrastructure with Terraform #Day4of30TerraformChallenge

ephantus gachomba — Fri, 30 Aug 2024 14:20:05 +0000

Deploying a Highly Available Web App on AWS Using Terraform in a file `main.tf` , `main.tf`

provider "aws" {
  region = "us-east-2"
}

step 1.1
Creating an aws_launch_configuration launch configuration which specifies how to configure each EC2 Instance in the ASG.
--doesn’t support tags
-- lifecycle :: ensures the resource is created before destroyed as it is referenced else by aws_autoscaling_group

resource "aws_launch_configuration" "example" {
  image_id        = "ami-0fb653ca2d3203ac1"
  instance_type   = "t2.micro"
  security_groups = [aws_security_group.instance.id]

  user_data = <<-EOF
              #!/bin/bash
              echo "Hello, World" > index.html
              nohup busybox httpd -f -p ${var.server_port} &
              EOF
  lifecycle {
    create_before_destroy = true
  }
}

step 1.2 create the ASG itself using the aws_autoscaling_group resource:

resource "aws_autoscaling_group" "example" {
  launch_configuration = aws_launch_configuration.example.name
  vpc_zone_identifier  = data.aws_subnets.default.ids

  target_group_arns = [aws_lb_target_group.asg.arn]
  health_check_type = "ELB"

  min_size = 2
  max_size = 10

  tag {
    key                 = "Name"
    value               = "terraform-asg-example"
    propagate_at_launch = true
  }
}

--A data source represents a piece of read-only information that is fetched from the
//provider (in this case, AWS) every time you run Terraform

data "aws_vpc" "default" {
  default = true
}

data "aws_subnets" "default" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.default.id]
  }
}

step 2.1 deploying a Load Balancer

resource "aws_lb" "example" {
  name               = var.alb_name
  load_balancer_type = "application"
  subnets            = data.aws_subnets.default.ids
  security_groups    = [aws_security_group.alb.id]
}

step 2.2
A listener is a process that checks for connection requests, using the protocol and port

resource "aws_lb_listener" "http" {
  load_balancer_arn = aws_lb.example.arn
  port              = 80
  protocol          = "HTTP"

  # By default, return a simple 404 page
  default_action {
    type = "fixed-response"

    fixed_response {
      content_type = "text/plain"
      message_body = "404: page not found"
      status_code  = 404
    }
  }
}

step 2.3 the security group our network lb will use.

resource "aws_security_group" "alb" {
  name = "terraform-example-alb"
  ingress {
    from_port   = var.server_port
    to_port     = var.server_port
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

step 2.4
target group will health check your Instances by periodically sending an HTTP
request to each Instance and will consider the Instance “healthy” only if the Instance
returns a response that matches the configured matcher

resource "aws_lb_target_group" "asg" {
  name     = var.alb_name
  port     = var.server_port
  protocol = "HTTP"
  vpc_id   = data.aws_vpc.default.id

  health_check {
    path                = "/"
    protocol            = "HTTP"
    matcher             = "200"
    interval            = 15
    timeout             = 3
    healthy_threshold   = 2
    unhealthy_threshold = 2
  }
}

step 2.5
--listener rule:

resource "aws_lb_listener_rule" "asg" {
  listener_arn = aws_lb_listener.http.arn
  priority     = 100

  condition {
    path_pattern {
      values = ["*"]
    }
  }

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.asg.arn
  }
}

Deploying Your First Server with Terraform: A Beginner's Guide #Day3of30days

ephantus gachomba — Fri, 30 Aug 2024 09:18:47 +0000

Deploying a Single EC2 Instance on AWS Using Terraform

This guide will walk you through deploying a single EC2 instance on AWS using Terraform. The instance will serve a simple web page using a minimal HTTP server.

1. Provider Configuration

Create a file named main.tf and add the following configuration to specify the AWS provider:

provider "aws" {
  region = "us-east-2"
}

2. Security Group

a security group configuration to allow inbound traffic on port 8080:

resource "aws_security_group" "instance" {
  name        = "terraform-example-instance"
  description = "Allow inbound traffic on port 8080"

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

3. EC2 Instance

Add the EC2 instance configuration with user data to run a minimal HTTP server:

resource "aws_instance" "example" {
  ami                    = "ami-0fb653ca2d3203ac1"
  instance_type          = "t2.micro"
  vpc_security_group_ids = [aws_security_group.instance.id]

  user_data = <<-EOF
    #!/bin/bash
    echo "Hello, World" > index.html
    nohup busybox httpd -f -p 8080 &
    EOF

  user_data_replace_on_change = true
  tags = {
    Name = "terraform-example"
  }
}