From c6ab4a1f85f97930149f04025a07f272a20d3d10 Mon Sep 17 00:00:00 2001 From: Tom Vaughan Date: Sun, 18 Jun 2023 13:43:24 +0100 Subject: [PATCH 1/4] Full ecs backend deployment. Still doesn't quite work, but isn't far off --- README.md | 5 ++ main.tf | 250 +++++++++++++++++++++++++++++++++++++++++------------- 2 files changed, 198 insertions(+), 57 deletions(-) diff --git a/README.md b/README.md index c09d1d5..fbfd7eb 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,8 @@ # Fight.Me Infrastructure Yep + +## aws-vault + +Account ID: `470096912115` +User: `tom` diff --git a/main.tf b/main.tf index 637e811..8eaaea7 100644 --- a/main.tf +++ b/main.tf @@ -12,85 +12,221 @@ provider "aws" { region = "eu-west-2" } -resource "aws_security_group" "fight_me_backend_sg" { - name = "fight_me_backend_sg" - description = "Allow inbound traffic for Socket.IO server" +resource "aws_ecs_cluster" "fight_me_backend_cluster" { + name = "fight-me-backend-cluster" +} - # tfsec:ignore:aws-ec2-no-public-ingress-sgr - ingress { - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - description = "Allow inbound http/websocket traffic to server on port 80" +resource "aws_ecs_task_definition" "fight_me_backend_task" { + family = "fight-me-backened-task" + container_definitions = < with the name of your main Python file) -nohup python fight_me_backend/main.py & -EOF + user_data = <<-EOF + #!/bin/bash + echo ECS_CLUSTER=${aws_ecs_cluster.fight_me_backend_cluster.name} >> /etc/ecs/ecs.config + EOF tags = { - Name = "fight-me-backend" + Name = "ECS Instance - ${aws_ecs_cluster.fight_me_backend_cluster.name}" + } +} + +resource "aws_iam_instance_profile" "ecs_instance_profile" { + name = "ecs-instance-profile" + role = aws_iam_role.ecs_instance_role.name +} + +resource "aws_iam_role" "ecs_instance_role" { + name = "ecs-instance-role" + + assume_role_policy = < Date: Sun, 18 Jun 2023 16:40:11 +0100 Subject: [PATCH 2/4] Health endpoint now accessible --- main.tf | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 51 insertions(+), 4 deletions(-) diff --git a/main.tf b/main.tf index 8eaaea7..01b8f46 100644 --- a/main.tf +++ b/main.tf @@ -91,6 +91,16 @@ resource "aws_lb_target_group" "fight_me_backend_tg" { port = 5000 protocol = "HTTP" vpc_id = aws_default_vpc.default_vpc.id + + health_check { + interval = 30 + path = "/health" + protocol = "HTTP" + timeout = 5 + healthy_threshold = 2 + unhealthy_threshold = 2 + matcher = "200" + } } resource "aws_lb_listener" "fight_me_backend_listener" { @@ -129,6 +139,21 @@ resource "aws_security_group" "lb_sg" { protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } + + # New rule to allow inbound traffic on port 5000 + ingress { + from_port = 5000 + to_port = 5000 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } } resource "aws_default_vpc" "default_vpc" { @@ -167,14 +192,36 @@ data "aws_ami" "latest_ecs_optimized" { owners = ["amazon"] } -resource "aws_instance" "ecs_instance" { - ami = data.aws_ami.latest_ecs_optimized.id - instance_type = "t2.micro" +# ECS Instance Security Group +resource "aws_security_group" "ecs_instance_sg" { + name = "ecs_instance_sg" + description = "Allow inbound traffic from ALB" + vpc_id = aws_default_vpc.default_vpc.id + + ingress { + from_port = 5000 + to_port = 5000 + protocol = "tcp" + security_groups = [aws_security_group.lb_sg.id] # Allows traffic from the ALB to the EC2 instance + } - # key_name = "your-key-name" + # This will allow all outbound traffic. Modify to meet your needs. + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } +} +# ECS Instance +resource "aws_instance" "ecs_instance" { + ami = data.aws_ami.latest_ecs_optimized.id + instance_type = "t2.micro" iam_instance_profile = aws_iam_instance_profile.ecs_instance_profile.name + vpc_security_group_ids = [aws_security_group.ecs_instance_sg.id] # Associates the new security group with the EC2 instance + user_data = <<-EOF #!/bin/bash echo ECS_CLUSTER=${aws_ecs_cluster.fight_me_backend_cluster.name} >> /etc/ecs/ecs.config From 4eb8455e804d50eca0aa536127f0b159897bbb8f Mon Sep 17 00:00:00 2001 From: Tom Vaughan Date: Sun, 18 Jun 2023 18:39:53 +0100 Subject: [PATCH 3/4] README update --- README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/README.md b/README.md index fbfd7eb..bdf32fa 100644 --- a/README.md +++ b/README.md @@ -6,3 +6,21 @@ Yep Account ID: `470096912115` User: `tom` + +1. Install aws-vault (using homebrew, works for both mac and wsl linux) + + ```bash + brew install aws-vault + ``` + +2. Add IAM credentials. This is where you'll need to enter your access key and secret (access) key. Replace `my_iam_name` with your account name. + + ```bash + aws-vault add my_iam_name + ``` + +3. Initialise Terraform backend + + ```bash + aws-vault exec my_iam_name -- terraform init + ``` From e678096eb112317881c80a97b37921e2d938ed9d Mon Sep 17 00:00:00 2001 From: Tom Vaughan Date: Sun, 18 Jun 2023 18:51:01 +0100 Subject: [PATCH 4/4] More docs --- README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/README.md b/README.md index bdf32fa..25aacad 100644 --- a/README.md +++ b/README.md @@ -24,3 +24,15 @@ User: `tom` ```bash aws-vault exec my_iam_name -- terraform init ``` + +4. To deploy infrastructure + + ```bash + aws-vault exec my_iam_name -- terraform apply + ``` + +5. To remove infrastructure + + ```bash + aws-vault exec my_iam_name -- terraform destroy + ```