SkyForge

modules/ec2_docker_host/main.tf

data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023.*-x86_64"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

data "aws_caller_identity" "current" {}

locals {
  tags = {
    Project = var.project
    Env     = var.env
    Owner   = var.owner
  }

  account_id = data.aws_caller_identity.current.account_id
}

resource "aws_security_group" "host" {
  name        = "${var.name}-host"
  description = "HTTP and HTTPS only. Administration uses Session Manager."
  vpc_id      = var.vpc_id
  tags        = merge(local.tags, { Name = "${var.name}-host" })

  ingress {
    description = "http"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "https"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "https for packages images and aws apis"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "dns"
    from_port   = 53
    to_port     = 53
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_cloudwatch_log_group" "agent" {
  name              = "/${var.project}/${var.env}/ec2"
  retention_in_days = 365
  kms_key_id        = var.kms_key_arn
  tags              = local.tags
}

resource "aws_ssm_parameter" "app_secret" {
  name   = "/${var.project}/${var.env}/checkout-api/app_secret"
  type   = "SecureString"
  key_id = var.kms_key_arn
  value  = var.app_secret
  tags   = local.tags
}

resource "aws_ssm_parameter" "cwagent" {
  name = "/${var.project}/${var.env}/cloudwatch-agent"
  type = "String"
  tags = local.tags
  value = jsonencode({
    logs = {
      logs_collected = {
        files = {
          collect_list = [{
            file_path       = "/var/log/messages"
            log_group_name  = aws_cloudwatch_log_group.agent.name
            log_stream_name = "{instance_id}"
          }]
        }
      }
    }
  })
}

resource "aws_iam_role" "instance" {
  name = "${var.name}-instance"
  tags = local.tags

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "instance" {
  name = "${var.name}-instance"
  role = aws_iam_role.instance.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "ReadParameters"
        Effect = "Allow"
        Action = ["ssm:GetParameter"]
        Resource = [
          aws_ssm_parameter.cwagent.arn,
          aws_ssm_parameter.app_secret.arn,
        ]
      },
      {
        Sid      = "DecryptParameters"
        Effect   = "Allow"
        Action   = ["kms:Decrypt"]
        Resource = var.kms_key_arn
      },
      {
        Sid    = "WriteAgentLogs"
        Effect = "Allow"
        Action = [
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DescribeLogStreams",
        ]
        Resource = "${aws_cloudwatch_log_group.agent.arn}:*"
      },
    ]
  })
}

# Session Manager's channel and message APIs do not support resource-level
# permissions. AWS documents Resource "*" for them. Checkov still treats the
# write actions as unconstrained, so the exception is recorded in checks.json.
resource "aws_iam_role_policy" "session" {
  #checkov:skip=CKV_AWS_355:ssmmessages, ec2messages, and ssm:UpdateInstanceInformation do not support resource-level permissions; AWS requires Resource *
  #checkov:skip=CKV_AWS_290:those Session Manager write actions cannot be constrained to a resource ARN
  name = "${var.name}-session"
  role = aws_iam_role.instance.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid    = "SessionManager"
      Effect = "Allow"
      Action = [
        "ssmmessages:CreateControlChannel",
        "ssmmessages:CreateDataChannel",
        "ssmmessages:OpenControlChannel",
        "ssmmessages:OpenDataChannel",
        "ssm:UpdateInstanceInformation",
        "ec2messages:GetMessages",
        "ec2messages:AcknowledgeMessage",
        "ec2messages:SendReply",
      ]
      Resource = "*"
    }]
  })
}

resource "aws_iam_instance_profile" "instance" {
  name = "${var.name}-instance"
  role = aws_iam_role.instance.name
  tags = local.tags
}

resource "aws_instance" "host" {
  ami                         = data.aws_ami.al2023.id
  instance_type               = var.instance_type
  subnet_id                   = var.subnet_id
  vpc_security_group_ids      = [aws_security_group.host.id]
  iam_instance_profile        = aws_iam_instance_profile.instance.name
  associate_public_ip_address = false
  monitoring                  = true
  ebs_optimized               = true
  user_data = templatefile("${path.module}/user_data.sh.tpl", {
    app_image    = var.app_image
    aws_region   = var.region
    ssm_param    = aws_ssm_parameter.cwagent.name
    secret_param = aws_ssm_parameter.app_secret.name
  })
  tags = merge(local.tags, { Name = var.name })

  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "required"
    http_put_response_hop_limit = 1
  }

  root_block_device {
    volume_type = "gp3"
    volume_size = var.volume_size
    encrypted   = true
    kms_key_id  = var.kms_key_arn
    tags        = merge(local.tags, { Snapshot = "daily" })
  }
}

resource "aws_eip" "host" {
  domain   = "vpc"
  instance = aws_instance.host.id
  tags     = merge(local.tags, { Name = "${var.name}-eip" })
}

resource "aws_iam_role" "dlm" {
  name = "${var.name}-dlm"
  tags = local.tags

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "dlm.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "dlm" {
  name = "${var.name}-dlm"
  role = aws_iam_role.dlm.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "ManageSnapshots"
        Effect = "Allow"
        Action = [
          "ec2:CreateSnapshot",
          "ec2:CreateTags",
          "ec2:DeleteSnapshot",
        ]
        Resource = [
          "arn:aws:ec2:${var.region}:${local.account_id}:volume/*",
          "arn:aws:ec2:${var.region}:${local.account_id}:snapshot/*",
        ]
      },
      {
        Sid    = "DescribeForDlm"
        Effect = "Allow"
        Action = [
          "ec2:DescribeInstances",
          "ec2:DescribeVolumes",
          "ec2:DescribeSnapshots",
        ]
        # Describe actions for DLM do not support resource-level permissions.
        Resource = "*"
      },
    ]
  })
}

resource "aws_dlm_lifecycle_policy" "daily" {
  description        = "Daily snapshots of ${var.name} volumes"
  execution_role_arn = aws_iam_role.dlm.arn
  state              = "ENABLED"
  tags               = local.tags

  policy_details {
    resource_types = ["VOLUME"]

    target_tags = {
      Snapshot = "daily"
    }

    schedule {
      name = "daily"

      create_rule {
        interval      = 24
        interval_unit = "HOURS"
        times         = ["03:00"]
      }

      retain_rule {
        count = var.snapshot_retain
      }

      copy_tags = true
    }
  }
}