Terraform / IaC

SkyForge

Terraform for AWS: a single-EC2 Docker host, or ECS Fargate, tested offline.

Reference architecture and offline tests for a fictional Initech checkout-api. This is not a client project. No AWS account is used and nothing here is a price.

构建时记录 2026-10-03T06:25:29Z. Recorded when this demo was built. The page does not re-run Terraform, tflint, or checkov.

Two routes

A. Single EC2

B. ECS Fargate

Resource inventory

Counted with python-hcl2 from the .tf files. A module file counts once, not once per caller.

79 resource blocks, 7 module blocks.

Resource type	Count
`aws_appautoscaling_policy`	1
`aws_appautoscaling_target`	1
`aws_cloudwatch_log_group`	3
`aws_db_instance`	1
`aws_db_subnet_group`	1
`aws_default_security_group`	1
`aws_dlm_lifecycle_policy`	1
`aws_dynamodb_table`	1
`aws_ecr_lifecycle_policy`	1
`aws_ecr_repository`	1
`aws_ecs_cluster`	1
`aws_ecs_service`	1
`aws_ecs_task_definition`	1
`aws_eip`	2
`aws_flow_log`	1
`aws_iam_instance_profile`	1
`aws_iam_role`	6
`aws_iam_role_policy`	6
`aws_iam_role_policy_attachment`	1
`aws_instance`	1
`aws_internet_gateway`	1
`aws_kms_alias`	3
`aws_kms_key`	3
`aws_lb`	1
`aws_lb_listener`	2
`aws_lb_target_group`	1
`aws_nat_gateway`	1
`aws_route`	2
`aws_route_table`	2
`aws_route_table_association`	2
`aws_s3_bucket`	2
`aws_s3_bucket_lifecycle_configuration`	2
`aws_s3_bucket_ownership_controls`	2
`aws_s3_bucket_policy`	2
`aws_s3_bucket_public_access_block`	2
`aws_s3_bucket_server_side_encryption_configuration`	2
`aws_s3_bucket_versioning`	2
`aws_security_group`	5
`aws_security_group_rule`	1
`aws_ssm_parameter`	3
`aws_subnet`	2
`aws_vpc`	1
`aws_vpc_endpoint`	2

Module calls

Module	Source	File
`state`	`../modules/state_backend`	`bootstrap/main.tf`
`network`	`../modules/network`	`ecs-fargate/main.tf`
`ecr`	`../modules/ecr`	`ecs-fargate/main.tf`
`alb`	`../modules/alb`	`ecs-fargate/main.tf`
`service`	`../modules/ecs_service`	`ecs-fargate/main.tf`
`network`	`../modules/network`	`single-ec2/main.tf`
`host`	`../modules/ec2_docker_host`	`single-ec2/main.tf`

Checks

构建时记录. These cards repeat data/checks.json. Opening the page does not run Terraform.

terraform: Terraform v1.9.8 · tflint: TFLint version 0.55.1 · checkov: 3.2.449

AWS_ACCESS_KEY_ID was empty when these commands ran.

terraform fmt -check

pass

exit 0

Started 2026-10-03T06:25:29Z · 0.181s

terraform validate

pass

3 roots

single_ec2 exit 0 · 2.04s
ecs_fargate exit 0 · 2.431s
bootstrap exit 0 · 2.007s

tflint

pass

exit 0

Started 2026-10-03T06:25:35Z · 1.058s

checkov

fail

14 failed

passed 218, failed 14, skipped 2. HIGH failures: 0.

checkov 3.2.449 leaves severity empty unless a Bridgecrew or Prisma API key is set. Each severity below is the Severity field on that check's public Prisma Cloud policy page, fetched while this file was written.

Failed checks

CKV_AWS_260 LOW · module.alb.aws_security_group.alb · Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
CKV_AWS_150 LOW · module.alb.aws_lb.this · Ensure that Load Balancer has deletion protection enabled
CKV_AWS_260 LOW · module.host.aws_security_group.host · Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
CKV2_AWS_62 LOW · module.alb.aws_s3_bucket.logs · Ensure S3 buckets should have event notifications enabled
CKV2_AWS_62 LOW · module.state.aws_s3_bucket.state · Ensure S3 buckets should have event notifications enabled
CKV2_AWS_19 LOW · module.network.aws_eip.nat[0] · Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances
CKV_AWS_144 LOW · module.alb.aws_s3_bucket.logs · Ensure that S3 bucket has cross-region replication enabled
CKV_AWS_144 LOW · module.state.aws_s3_bucket.state · Ensure that S3 bucket has cross-region replication enabled
CKV2_AWS_5 LOW · module.network.aws_security_group.endpoints[0] · Ensure that Security Groups are attached to another resource
CKV2_AWS_34 LOW · module.host.aws_ssm_parameter.cwagent · AWS SSM Parameter should be Encrypted
CKV2_AWS_30 LOW · aws_db_instance.app · Ensure Postgres RDS as aws_db_instance has Query Logging enabled
CKV_AWS_18 LOW · module.alb.aws_s3_bucket.logs · Ensure the S3 bucket has access logging enabled
CKV_AWS_18 LOW · module.state.aws_s3_bucket.state · Ensure the S3 bucket has access logging enabled
CKV2_AWS_28 LOW · module.alb.aws_lb.this · Ensure public facing ALB are protected by WAF

HIGH exceptions

CKV_AWS_355 HIGH · module.host.aws_iam_role_policy.session — ssmmessages, ec2messages, and ssm:UpdateInstanceInformation do not support resource-level permissions; AWS requires Resource *
CKV_AWS_290 HIGH · module.host.aws_iam_role_policy.session — those Session Manager write actions cannot be constrained to a resource ARN

terraform test

pass

6 runs

Started 2026-10-03T06:25:41Z · 5.071s. passed 6, failed 0, errored 0, skipped 0.

ec2_dev_sg_and_tags pass
ec2_prod_size pass
ecs_dev_alb_role_and_tags pass
ecs_prod_size pass
ecs_without_nat pass
ecs_with_rds pass

Which route

No prices. Sizes are read from envs/dev.tfvars and envs/prod.tfvars.

	Single EC2	ECS Fargate
Shape	One host, Compose, user_data	VPC, ALB, ECR, Fargate service
Availability	One machine in one zone	Two zones, load balancer, rolling deploy
Operations	Patch the OS. SSM instead of SSH. Daily EBS snapshots.	No host OS. Ship a new task definition.
Change in size	Replace the instance	CPU target tracking between min and max
Dev in the example	t3.small	256 CPU / 512 MiB
Prod in the example	t3.medium	512 CPU / 1024 MiB
Fits when	The service can live on one machine	A task or a zone failing should not take the service down

Files

`bootstrap/variables.tf`

variable "project" {
  type        = string
  description = "Project tag."
  default     = "checkout-api"
}

variable "env" {
  type        = string
  description = "Tag stored on the shared state backend. This backend is not tied to one application environment."
  default     = "shared"
}

variable "owner" {
  type        = string
  description = "Owner tag."
  default     = "initech-platform"
}

variable "region" {
  type        = string
  description = "AWS region for the state bucket."
  default     = "us-east-1"
}

variable "bucket_name" {
  type        = string
  description = "Globally unique state bucket name chosen by the operator."
}

variable "lock_table_name" {
  type        = string
  description = "DynamoDB lock table name chosen by the operator."
}