Skip to content

Commit 870c488

Browse files
Kris20030907Kris20030907
authored
Merge pull request #10 from AutoMQ/zhaoxi-fact
refactor: Separate AWS resources and CMP resource creation
2 parents f03796d + 9012c52 commit 870c488

File tree

5 files changed

+247
-233
lines changed

5 files changed

+247
-233
lines changed

‎aws.tf‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
provider "aws" {
2+
region = var.cloud_provider_region
3+
}
4+
5+
# Conditional creation of data bucket
6+
module "automq_byoc_data_bucket_name" {
7+
source = "terraform-aws-modules/s3-bucket/aws"
8+
version = "4.1.2"
9+
10+
create_bucket = var.automq_byoc_data_bucket_name == "" ? true : false
11+
bucket = "automq-data-${var.automq_byoc_env_id}"
12+
force_destroy = true
13+
}
14+
15+
# Conditional creation of ops bucket
16+
module "automq_byoc_ops_bucket_name" {
17+
source = "terraform-aws-modules/s3-bucket/aws"
18+
version = "4.1.2"
19+
20+
create_bucket = var.automq_byoc_ops_bucket_name == "" ? true : false
21+
bucket = "automq-ops-${var.automq_byoc_env_id}"
22+
force_destroy = true
23+
}
24+
25+
data "aws_availability_zones" "available_azs" {}
26+
27+
module "automq_byoc_vpc" {
28+
source = "terraform-aws-modules/vpc/aws"
29+
version = "5.0.0"
30+
31+
count = var.create_new_vpc ? 1 : 0
32+
cidr = "10.0.0.0/16"
33+
34+
azs = slice(data.aws_availability_zones.available_azs.names, 0, 3)
35+
public_subnets = ["10.0.0.0/20"]
36+
private_subnets = ["10.0.128.0/20", "10.0.144.0/20", "10.0.160.0/20"]
37+
38+
enable_dns_support = true
39+
enable_dns_hostnames = true
40+
41+
tags = {
42+
Name = "automq-byoc-vpc-${var.automq_byoc_env_id}"
43+
automqVendor = "automq"
44+
automqEnvironmentID = var.automq_byoc_env_id
45+
}
46+
}
47+
48+
resource "aws_security_group" "vpc_endpoint_sg" {
49+
count = var.create_new_vpc ? 1 : 0
50+
51+
description = "Security group for VPC endpoint"
52+
vpc_id = module.automq_byoc_vpc[0].vpc_id
53+
54+
ingress {
55+
from_port = 443
56+
to_port = 443
57+
protocol = "tcp"
58+
cidr_blocks = ["0.0.0.0/0"]
59+
}
60+
61+
egress {
62+
from_port = 0
63+
to_port = 0
64+
protocol = "-1"
65+
cidr_blocks = ["0.0.0.0/0"]
66+
}
67+
68+
tags = {
69+
Name = "automq-byoc-endpoint-sg-${var.automq_byoc_env_id}"
70+
automqVendor = "automq"
71+
automqEnvironmentID = var.automq_byoc_env_id
72+
}
73+
}
74+
75+
resource "aws_vpc_endpoint" "ec2_endpoint" {
76+
count = var.create_new_vpc ? 1 : 0
77+
78+
vpc_id = module.automq_byoc_vpc[0].vpc_id
79+
service_name = "com.amazonaws.${var.cloud_provider_region}.ec2"
80+
vpc_endpoint_type = "Interface"
81+
security_group_ids = [aws_security_group.vpc_endpoint_sg[0].id]
82+
subnet_ids = module.automq_byoc_vpc[0].private_subnets
83+
84+
private_dns_enabled = true
85+
86+
tags = {
87+
Name = "automq-byoc-ec2-endpoint-${var.automq_byoc_env_id}"
88+
automqVendor = "automq"
89+
automqEnvironmentID = var.automq_byoc_env_id
90+
}
91+
}
92+
93+
resource "aws_vpc_endpoint" "s3_endpoint" {
94+
count = var.create_new_vpc ? 1 : 0
95+
96+
vpc_id = module.automq_byoc_vpc[0].vpc_id
97+
service_name = "com.amazonaws.${var.cloud_provider_region}.s3"
98+
vpc_endpoint_type = "Gateway"
99+
100+
route_table_ids = concat(
101+
module.automq_byoc_vpc[0].public_route_table_ids,
102+
module.automq_byoc_vpc[0].private_route_table_ids
103+
)
104+
105+
tags = {
106+
Name = "automq-byoc-s3-endpoint-${var.automq_byoc_env_id}"
107+
automqVendor = "automq"
108+
automqEnvironmentID = var.automq_byoc_env_id
109+
}
110+
}
111+
112+
locals {
113+
automq_byoc_vpc_id = var.create_new_vpc ? module.automq_byoc_vpc[0].vpc_id : var.automq_byoc_vpc_id
114+
automq_byoc_env_console_public_subnet_id = var.create_new_vpc ? element(module.automq_byoc_vpc[0].public_subnets, 0) : var.automq_byoc_env_console_public_subnet_id
115+
automq_data_bucket = var.automq_byoc_data_bucket_name == "" ? module.automq_byoc_data_bucket_name.s3_bucket_id : "${var.automq_byoc_data_bucket_name}-${var.automq_byoc_env_id}"
116+
automq_ops_bucket = var.automq_byoc_ops_bucket_name == "" ? module.automq_byoc_ops_bucket_name.s3_bucket_id : "${var.automq_byoc_ops_bucket_name}-${var.automq_byoc_env_id}"
117+
}
118+
119+
data "aws_vpc" "vpc_id" {
120+
id = local.automq_byoc_vpc_id
121+
}
122+
123+
locals {
124+
ssm_parameter_path = "/aws/service/marketplace/prod-nl2cyzygb46fw/${var.automq_byoc_env_version}"
125+
}
126+
127+
data "aws_ssm_parameter" "marketplace_ami" {
128+
name = local.ssm_parameter_path
129+
}
130+
131+
data "aws_ami" "marketplace_ami_details" {
132+
most_recent = true
133+
134+
filter {
135+
name = "image-id"
136+
values = [data.aws_ssm_parameter.marketplace_ami.value]
137+
}
138+
}
139+
140+
resource "aws_security_group" "automq_byoc_console_sg" {
141+
vpc_id = data.aws_vpc.vpc_id.id
142+
143+
name = "automq-byoc-console-sg-${var.automq_byoc_env_id}"
144+
ingress {
145+
from_port = 8080
146+
to_port = 8080
147+
protocol = "tcp"
148+
cidr_blocks = [var.automq_byoc_env_console_cidr]
149+
}
150+
151+
egress {
152+
from_port = 0
153+
to_port = 0
154+
protocol = "-1"
155+
cidr_blocks = ["0.0.0.0/0"]
156+
}
157+
}
158+
159+
resource "aws_iam_role" "automq_byoc_role" {
160+
name = "automq-byoc-service-role-${var.automq_byoc_env_id}"
161+
162+
assume_role_policy = jsonencode({
163+
Version = "2012-10-17"
164+
Statement = [
165+
{
166+
Action = "sts:AssumeRole"
167+
Effect = "Allow"
168+
Sid = ""
169+
Principal = {
170+
Service = "ec2.amazonaws.com"
171+
}
172+
},
173+
]
174+
})
175+
}
176+
177+
resource "aws_iam_policy" "automq_byoc_policy" {
178+
name = "automq-byoc-service-policy-${var.automq_byoc_env_id}"
179+
description = "Custom policy for automq_byoc service"
180+
181+
policy = templatefile("${path.module}/tpls/automq_byoc_role_policy.json.tpl", {
182+
automq_data_bucket = local.automq_data_bucket
183+
automq_ops_bucket = local.automq_ops_bucket
184+
})
185+
}
186+
187+
resource "aws_iam_role_policy_attachment" "automq_byoc_role_attachment" {
188+
role = aws_iam_role.automq_byoc_role.name
189+
policy_arn = aws_iam_policy.automq_byoc_policy.arn
190+
}
191+
192+
resource "aws_iam_instance_profile" "automq_byoc_instance_profile" {
193+
name = "automq-byoc-instance-profile-${var.automq_byoc_env_id}"
194+
role = aws_iam_role.automq_byoc_role.name
195+
}
196+
197+
resource "aws_route53_zone" "private_r53" {
198+
name = "${var.automq_byoc_env_id}.automq.private"
199+
200+
vpc {
201+
vpc_id = local.automq_byoc_vpc_id
202+
}
203+
204+
lifecycle {
205+
create_before_destroy = true
206+
}
207+
}
208+
209+
locals {
210+
aws_iam_instance_profile_arn_encoded = urlencode(aws_iam_instance_profile.automq_byoc_instance_profile.arn)
211+
}
212+
213+
resource "aws_eip" "web_ip" {
214+
instance = aws_instance.automq_byoc_console.id
215+
}

0 commit comments

Comments
 (0)