Terraform / IaC

SkyForge

Terraform for AWS: a single-EC2 Docker host, or ECS Fargate, tested offline.

Reference architecture and offline tests for a fictional Initech checkout-api. This is not a client project. No AWS account is used and nothing here is a price.

构建时记录 2026-10-03T06:25:29Z. Recorded when this demo was built. The page does not re-run Terraform, tflint, or checkov.

Two routes

A. Single EC2

B. ECS Fargate

Resource inventory

Counted with python-hcl2 from the .tf files. A module file counts once, not once per caller.

79 resource blocks, 7 module blocks.

Resource type	Count
`aws_appautoscaling_policy`	1
`aws_appautoscaling_target`	1
`aws_cloudwatch_log_group`	3
`aws_db_instance`	1
`aws_db_subnet_group`	1
`aws_default_security_group`	1
`aws_dlm_lifecycle_policy`	1
`aws_dynamodb_table`	1
`aws_ecr_lifecycle_policy`	1
`aws_ecr_repository`	1
`aws_ecs_cluster`	1
`aws_ecs_service`	1
`aws_ecs_task_definition`	1
`aws_eip`	2
`aws_flow_log`	1
`aws_iam_instance_profile`	1
`aws_iam_role`	6
`aws_iam_role_policy`	6
`aws_iam_role_policy_attachment`	1
`aws_instance`	1
`aws_internet_gateway`	1
`aws_kms_alias`	3
`aws_kms_key`	3
`aws_lb`	1
`aws_lb_listener`	2
`aws_lb_target_group`	1
`aws_nat_gateway`	1
`aws_route`	2
`aws_route_table`	2
`aws_route_table_association`	2
`aws_s3_bucket`	2
`aws_s3_bucket_lifecycle_configuration`	2
`aws_s3_bucket_ownership_controls`	2
`aws_s3_bucket_policy`	2
`aws_s3_bucket_public_access_block`	2
`aws_s3_bucket_server_side_encryption_configuration`	2
`aws_s3_bucket_versioning`	2
`aws_security_group`	5
`aws_security_group_rule`	1
`aws_ssm_parameter`	3
`aws_subnet`	2
`aws_vpc`	1
`aws_vpc_endpoint`	2

Module calls

Module	Source	File
`state`	`../modules/state_backend`	`bootstrap/main.tf`
`network`	`../modules/network`	`ecs-fargate/main.tf`
`ecr`	`../modules/ecr`	`ecs-fargate/main.tf`
`alb`	`../modules/alb`	`ecs-fargate/main.tf`
`service`	`../modules/ecs_service`	`ecs-fargate/main.tf`
`network`	`../modules/network`	`single-ec2/main.tf`
`host`	`../modules/ec2_docker_host`	`single-ec2/main.tf`

Checks

构建时记录. These cards repeat data/checks.json. Opening the page does not run Terraform.

terraform: Terraform v1.9.8 · tflint: TFLint version 0.55.1 · checkov: 3.2.449

AWS_ACCESS_KEY_ID was empty when these commands ran.

terraform fmt -check

pass

exit 0

Started 2026-10-03T06:25:29Z · 0.181s

terraform validate

pass

3 roots

single_ec2 exit 0 · 2.04s
ecs_fargate exit 0 · 2.431s
bootstrap exit 0 · 2.007s

tflint

pass

exit 0

Started 2026-10-03T06:25:35Z · 1.058s

checkov

fail

14 failed

passed 218, failed 14, skipped 2. HIGH failures: 0.

checkov 3.2.449 leaves severity empty unless a Bridgecrew or Prisma API key is set. Each severity below is the Severity field on that check's public Prisma Cloud policy page, fetched while this file was written.

Failed checks

CKV_AWS_260 LOW · module.alb.aws_security_group.alb · Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
CKV_AWS_150 LOW · module.alb.aws_lb.this · Ensure that Load Balancer has deletion protection enabled
CKV_AWS_260 LOW · module.host.aws_security_group.host · Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
CKV2_AWS_62 LOW · module.alb.aws_s3_bucket.logs · Ensure S3 buckets should have event notifications enabled
CKV2_AWS_62 LOW · module.state.aws_s3_bucket.state · Ensure S3 buckets should have event notifications enabled
CKV2_AWS_19 LOW · module.network.aws_eip.nat[0] · Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances
CKV_AWS_144 LOW · module.alb.aws_s3_bucket.logs · Ensure that S3 bucket has cross-region replication enabled
CKV_AWS_144 LOW · module.state.aws_s3_bucket.state · Ensure that S3 bucket has cross-region replication enabled
CKV2_AWS_5 LOW · module.network.aws_security_group.endpoints[0] · Ensure that Security Groups are attached to another resource
CKV2_AWS_34 LOW · module.host.aws_ssm_parameter.cwagent · AWS SSM Parameter should be Encrypted
CKV2_AWS_30 LOW · aws_db_instance.app · Ensure Postgres RDS as aws_db_instance has Query Logging enabled
CKV_AWS_18 LOW · module.alb.aws_s3_bucket.logs · Ensure the S3 bucket has access logging enabled
CKV_AWS_18 LOW · module.state.aws_s3_bucket.state · Ensure the S3 bucket has access logging enabled
CKV2_AWS_28 LOW · module.alb.aws_lb.this · Ensure public facing ALB are protected by WAF

HIGH exceptions

CKV_AWS_355 HIGH · module.host.aws_iam_role_policy.session — ssmmessages, ec2messages, and ssm:UpdateInstanceInformation do not support resource-level permissions; AWS requires Resource *
CKV_AWS_290 HIGH · module.host.aws_iam_role_policy.session — those Session Manager write actions cannot be constrained to a resource ARN

terraform test

pass

6 runs

Started 2026-10-03T06:25:41Z · 5.071s. passed 6, failed 0, errored 0, skipped 0.

ec2_dev_sg_and_tags pass
ec2_prod_size pass
ecs_dev_alb_role_and_tags pass
ecs_prod_size pass
ecs_without_nat pass
ecs_with_rds pass

Which route

No prices. Sizes are read from envs/dev.tfvars and envs/prod.tfvars.

	Single EC2	ECS Fargate
Shape	One host, Compose, user_data	VPC, ALB, ECR, Fargate service
Availability	One machine in one zone	Two zones, load balancer, rolling deploy
Operations	Patch the OS. SSM instead of SSH. Daily EBS snapshots.	No host OS. Ship a new task definition.
Change in size	Replace the instance	CPU target tracking between min and max
Dev in the example	t3.small	256 CPU / 512 MiB
Prod in the example	t3.medium	512 CPU / 1024 MiB
Fits when	The service can live on one machine	A task or a zone failing should not take the service down

Files

`modules/ec2_docker_host/user_data.sh.tpl`

#!/bin/bash
set -euo pipefail
dnf install -y docker amazon-cloudwatch-agent openssl
systemctl enable --now docker
mkdir -p /usr/local/lib/docker/cli-plugins /opt/checkout/tls
curl -fsSL -o /usr/local/lib/docker/cli-plugins/docker-compose \
  https://github.com/docker/compose/releases/download/v2.29.7/docker-compose-linux-x86_64
chmod 0755 /usr/local/lib/docker/cli-plugins/docker-compose
# First boot only. Replace these files over Session Manager. Do not commit them.
if [ ! -s /opt/checkout/tls/fullchain.pem ] || [ ! -s /opt/checkout/tls/privkey.pem ]; then
  openssl req -x509 -nodes -newkey rsa:2048 -days 30 \
    -keyout /opt/checkout/tls/privkey.pem \
    -out /opt/checkout/tls/fullchain.pem \
    -subj "/CN=checkout-api.example"
fi
chmod 0644 /opt/checkout/tls/fullchain.pem
chmod 0600 /opt/checkout/tls/privkey.pem
cat > /opt/checkout/nginx.conf << 'EOF'
server {
  listen 80;
  return 301 https://$host$request_uri;
}
server {
  listen 443 ssl;
  ssl_certificate /etc/nginx/tls/fullchain.pem;
  ssl_certificate_key /etc/nginx/tls/privkey.pem;
  location / {
    proxy_pass http://api:8080;
  }
}
EOF
aws ssm get-parameter --region "${aws_region}" \
  --name "${secret_param}" --with-decryption --query Parameter.Value --output text \
  > /opt/checkout/app.env
chmod 0600 /opt/checkout/app.env
cat > /opt/checkout/docker-compose.yml << EOF
services:
  api:
    image: ${app_image}
    restart: unless-stopped
    env_file:
      - ./app.env
    ports:
      - "127.0.0.1:8080:8080"
  nginx:
    image: public.ecr.aws/docker/library/nginx:1.27-alpine
    restart: unless-stopped
    depends_on:
      - api
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./tls:/etc/nginx/tls:ro
EOF
docker compose -f /opt/checkout/docker-compose.yml up -d
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config -m ec2 -s -c ssm:${ssm_param}