SkyForge

single-ec2/main.tf

data "aws_caller_identity" "current" {}

locals {
  tags = {
    Project = var.project
    Env     = var.env
    Owner   = var.owner
  }
  name = "${var.project}-ec2-${var.env}"
}

resource "aws_kms_key" "main" {
  description             = "${var.project} ${var.env} single-ec2"
  deletion_window_in_days = 7
  enable_key_rotation     = true
  tags                    = local.tags

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "AllowAccountAdmin"
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
        Action    = "kms:*"
        Resource  = "*"
      },
      {
        Sid       = "AllowCloudWatchLogs"
        Effect    = "Allow"
        Principal = { Service = "logs.${var.region}.amazonaws.com" }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncryptFrom",
          "kms:ReEncryptTo",
          "kms:GenerateDataKey",
          "kms:GenerateDataKeyWithoutPlaintext",
          "kms:DescribeKey",
        ]
        Resource = "*"
        Condition = {
          ArnLike = {
            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${var.region}:${data.aws_caller_identity.current.account_id}:*"
          }
        }
      },
    ]
  })
}

resource "aws_kms_alias" "main" {
  name          = "alias/${var.project}-${var.env}-ec2"
  target_key_id = aws_kms_key.main.key_id
}

module "network" {
  source               = "../modules/network"
  name                 = local.name
  project              = var.project
  env                  = var.env
  owner                = var.owner
  region               = var.region
  vpc_cidr             = "10.20.0.0/16"
  az_count             = 1
  availability_zones   = var.availability_zones
  public_subnet_cidrs  = ["10.20.1.0/24"]
  private_subnet_cidrs = []
  enable_private       = false
  enable_nat           = false
  kms_key_arn          = aws_kms_key.main.arn
}

module "host" {
  source          = "../modules/ec2_docker_host"
  name            = local.name
  project         = var.project
  env             = var.env
  owner           = var.owner
  region          = var.region
  vpc_id          = module.network.vpc_id
  subnet_id       = module.network.public_subnet_ids[0]
  instance_type   = var.instance_type
  app_image       = var.container_image
  app_secret      = var.app_secret
  kms_key_arn     = aws_kms_key.main.arn
  snapshot_retain = var.env == "prod" ? 14 : 7
}