Skip to content

Commit f03796d

Browse files
Kris20030907Kris20030907
authored
Merge pull request #9 from AutoMQ/zhaoxi-refactor
refactor: refactor submodule
2 parents 81f2bd3 + ea5c188 commit f03796d

File tree

8 files changed

+291
-497
lines changed

8 files changed

+291
-497
lines changed

‎automq_byoc_role_policy.json.tpl‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"iam:CreateServiceLinkedRole"
8+
],
9+
"Resource": "*",
10+
"Condition": {
11+
"StringEquals": {
12+
"iam:AWSServiceName": "autoscaling.amazonaws.com"
13+
}
14+
}
15+
},
16+
{
17+
"Sid": "EC2InstanceProfileManagement",
18+
"Effect": "Allow",
19+
"Action": [
20+
"iam:PassRole"
21+
],
22+
"Resource": "*",
23+
"Condition": {
24+
"StringLike": {
25+
"iam:PassedToService": "ec2.amazonaws.com*"
26+
}
27+
}
28+
},
29+
{
30+
"Effect": "Allow",
31+
"Action": [
32+
"ssm:GetParameters",
33+
"pricing:GetProducts",
34+
"cloudwatch:PutMetricData",
35+
"ec2:DescribeImages",
36+
"ec2:CreateLaunchTemplate",
37+
"ec2:CreateLaunchTemplateVersion",
38+
"ec2:ModifyLaunchTemplate",
39+
"ec2:RebootInstances",
40+
"ec2:RunInstances",
41+
"ec2:StopInstances",
42+
"ec2:TerminateInstances",
43+
"ec2:CreateKeyPair",
44+
"ec2:CreateTags",
45+
"ec2:AttachVolume",
46+
"ec2:DetachVolume",
47+
"ec2:DescribeInstances",
48+
"ec2:DescribeLaunchTemplates",
49+
"ec2:DescribeLaunchTemplateVersions",
50+
"ec2:DescribeVolumes",
51+
"ec2:DescribeSubnets",
52+
"ec2:DescribeKeyPairs",
53+
"ec2:DescribeVpcs",
54+
"ec2:DescribeTags",
55+
"ec2:DeleteKeyPair",
56+
"ec2:CreateVolume",
57+
"ec2:DeleteVolume",
58+
"ec2:DeleteLaunchTemplate",
59+
"ec2:DescribeInstanceTypeOfferings",
60+
"ec2:DescribeSecurityGroups",
61+
"ec2:CreateSecurityGroup",
62+
"ec2:AuthorizeSecurityGroupIngress",
63+
"ec2:AuthorizeSecurityGroupEgress",
64+
"ec2:DeleteSecurityGroup",
65+
"autoscaling:CreateAutoScalingGroup",
66+
"autoscaling:DescribeAutoScalingGroups",
67+
"autoscaling:UpdateAutoScalingGroup",
68+
"autoscaling:DeleteAutoScalingGroup",
69+
"autoscaling:AttachInstances",
70+
"autoscaling:DetachInstances",
71+
"autoscaling:ResumeProcesses",
72+
"autoscaling:SuspendProcesses",
73+
"route53:CreateHostedZone",
74+
"route53:GetHostedZone",
75+
"route53:ChangeResourceRecordSets",
76+
"route53:ListHostedZonesByName",
77+
"route53:ListResourceRecordSets",
78+
"route53:DeleteHostedZone",
79+
"elasticloadbalancing:DescribeTargetGroups",
80+
"elasticloadbalancing:DescribeTags",
81+
"elasticloadbalancing:DeleteTargetGroup",
82+
"elasticloadbalancing:DeleteLoadBalancer"
83+
],
84+
"Resource": "*"
85+
},
86+
{
87+
"Effect": "Allow",
88+
"Action": [
89+
"s3:GetLifecycleConfiguration",
90+
"s3:PutLifecycleConfiguration",
91+
"s3:ListBucket"
92+
],
93+
"Resource": "*"
94+
},
95+
{
96+
"Effect": "Allow",
97+
"Action": [
98+
"s3:GetLifecycleConfiguration",
99+
"s3:PutLifecycleConfiguration",
100+
"s3:ListBucket"
101+
],
102+
"Resource": [
103+
"arn:aws:s3:::${automq_data_bucket}",
104+
"arn:aws:s3:::${automq_ops_bucket}"
105+
]
106+
},
107+
{
108+
"Effect": "Allow",
109+
"Action": [
110+
"s3:PutObject",
111+
"s3:GetObject",
112+
"s3:AbortMultipartUpload",
113+
"s3:PutObjectTagging",
114+
"s3:DeleteObject"
115+
],
116+
"Resource": [
117+
"arn:aws:s3:::${automq_data_bucket}/*",
118+
"arn:aws:s3:::${automq_ops_bucket}/*"
119+
]
120+
}
121+
]
122+
}

‎main.tf‎

Lines changed: 145 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ provider "aws" {
44

55
# Conditional creation of data bucket
66
module "automq_byoc_data_bucket_name" {
7-
source = "terraform-aws-modules/s3-bucket/aws"
7+
source = "terraform-aws-modules/s3-bucket/aws"
88
version = "4.1.2"
99

1010
# If you don't specify a data-bucket, it will be created, otherwise the available bucket provided will be used
@@ -34,25 +34,20 @@ module "automq_byoc_vpc" {
3434
name = "automq-byoc-vpc-${var.automq_byoc_env_id}"
3535
cidr = "10.0.0.0/16"
3636

37-
azs = slice(data.aws_availability_zones.available.names, 0, 3)
38-
public_subnets = ["10.0.0.0/20"]
37+
azs = slice(data.aws_availability_zones.available.names, 0, 3)
38+
public_subnets = ["10.0.0.0/20"]
3939
private_subnets = ["10.0.128.0/20", "10.0.144.0/20", "10.0.160.0/20"]
4040

4141
enable_dns_support = true
4242
enable_dns_hostnames = true
4343

44+
# 标签统一
4445
tags = {
4546
Terraform = "true"
4647
Environment = "dev"
4748
}
4849
}
4950

50-
resource "aws_eip" "nat" {
51-
count = 3
52-
53-
domain = "vpc"
54-
}
55-
5651
resource "aws_security_group" "endpoint_sg" {
5752
count = var.create_new_vpc ? 1 : 0
5853

@@ -61,16 +56,16 @@ resource "aws_security_group" "endpoint_sg" {
6156
vpc_id = module.automq_byoc_vpc[0].vpc_id
6257

6358
ingress {
64-
from_port = 443
65-
to_port = 443
66-
protocol = "tcp"
59+
from_port = 443
60+
to_port = 443
61+
protocol = "tcp"
6762
cidr_blocks = ["0.0.0.0/0"]
6863
}
6964

7065
egress {
71-
from_port = 0
72-
to_port = 0
73-
protocol = "-1"
66+
from_port = 0
67+
to_port = 0
68+
protocol = "-1"
7469
cidr_blocks = ["0.0.0.0/0"]
7570
}
7671

@@ -112,26 +107,146 @@ resource "aws_vpc_endpoint" "s3" {
112107
}
113108
}
114109

115-
# Determine the vpc and subnet id, mainly related to the set variables of whether to create a VPC
116110
locals {
117111
automq_byoc_vpc_id = var.create_new_vpc ? module.automq_byoc_vpc[0].vpc_id : var.automq_byoc_vpc_id
118112
automq_byoc_env_console_public_subnet_id = var.create_new_vpc ? element(module.automq_byoc_vpc[0].public_subnets, 0) : var.automq_byoc_env_console_public_subnet_id
119113
automq_data_bucket = var.automq_byoc_data_bucket_name == "" ? module.automq_byoc_data_bucket_name.s3_bucket_id : "${var.automq_byoc_data_bucket_name}-${var.automq_byoc_env_id}"
120114
automq_ops_bucket = var.automq_byoc_ops_bucket_name == "" ? module.automq_byoc_ops_bucket_name.s3_bucket_id : "${var.automq_byoc_ops_bucket_name}-${var.automq_byoc_env_id}"
121115
}
122116

123-
module "automq_byoc" {
124-
source = "./modules/aws-console-module"
125-
126-
cloud_provider_region = var.cloud_provider_region
127-
automq_byoc_vpc_id = local.automq_byoc_vpc_id
128-
automq_byoc_env_console_public_subnet_id = local.automq_byoc_env_console_public_subnet_id
129-
automq_byoc_data_bucket_name = local.automq_data_bucket
130-
automq_byoc_ops_bucket_name = local.automq_ops_bucket
131-
automq_byoc_env_id = var.automq_byoc_env_id
132-
automq_byoc_ec2_instance_type = var.automq_byoc_ec2_instance_type
133-
automq_byoc_env_version = var.automq_byoc_env_version
134-
specified_ami_by_marketplace = var.specified_ami_by_marketplace
135-
automq_byoc_env_console_ami = var.automq_byoc_env_console_ami
136-
automq_byoc_env_console_cidr = var.automq_byoc_env_console_cidr
117+
data "aws_vpc" "selected" {
118+
id = local.automq_byoc_vpc_id
119+
}
120+
121+
locals {
122+
ssm_parameter_path = "/aws/service/marketplace/prod-nl2cyzygb46fw/${var.automq_byoc_env_version}"
123+
}
124+
125+
data "aws_ssm_parameter" "marketplace_ami" {
126+
name = local.ssm_parameter_path
127+
}
128+
129+
data "aws_ami" "marketplace_ami_details" {
130+
most_recent = true
131+
132+
filter {
133+
name = "image-id"
134+
values = [data.aws_ssm_parameter.marketplace_ami.value]
135+
}
136+
}
137+
138+
resource "aws_security_group" "allow_all" {
139+
vpc_id = data.aws_vpc.selected.id
140+
141+
ingress {
142+
from_port = 8080
143+
to_port = 8080
144+
protocol = "tcp"
145+
cidr_blocks = [var.automq_byoc_env_console_cidr]
146+
}
147+
148+
egress {
149+
from_port = 0
150+
to_port = 0
151+
protocol = "-1"
152+
cidr_blocks = ["0.0.0.0/0"]
153+
}
154+
}
155+
156+
resource "aws_iam_role" "automq_byoc_role" {
157+
name = "automq-byoc-service-role-${var.automq_byoc_env_id}"
158+
159+
assume_role_policy = jsonencode({
160+
Version = "2012-10-17"
161+
Statement = [
162+
{
163+
Action = "sts:AssumeRole"
164+
Effect = "Allow"
165+
Sid = ""
166+
Principal = {
167+
Service = "ec2.amazonaws.com"
168+
}
169+
},
170+
]
171+
})
172+
}
173+
174+
resource "aws_iam_policy" "automq_byoc_policy" {
175+
name = "automq-byoc-service-policy-${var.automq_byoc_env_id}"
176+
description = "Custom policy for automq_byoc service"
177+
178+
policy = templatefile("${path.module}/automq_byoc_role_policy.json.tpl", {
179+
automq_data_bucket = local.automq_data_bucket
180+
automq_ops_bucket = local.automq_ops_bucket
181+
})
182+
}
183+
184+
resource "aws_iam_role_policy_attachment" "automq_byoc_role_attachment" {
185+
role = aws_iam_role.automq_byoc_role.name
186+
policy_arn = aws_iam_policy.automq_byoc_policy.arn
187+
}
188+
189+
resource "aws_iam_instance_profile" "automq_byoc_instance_profile" {
190+
name = "automq-byoc-instance-profile-${var.automq_byoc_env_id}"
191+
role = aws_iam_role.automq_byoc_role.name
192+
}
193+
194+
resource "aws_instance" "web" {
195+
ami = var.specified_ami_by_marketplace ? data.aws_ami.marketplace_ami_details.id : var.automq_byoc_env_console_ami
196+
instance_type = var.automq_byoc_ec2_instance_type
197+
subnet_id = local.automq_byoc_env_console_public_subnet_id
198+
vpc_security_group_ids = [aws_security_group.allow_all.id]
199+
200+
iam_instance_profile = aws_iam_instance_profile.automq_byoc_instance_profile.name
201+
202+
root_block_device {
203+
volume_size = 20
204+
volume_type = "gp3"
205+
}
206+
207+
ebs_block_device {
208+
device_name = "/dev/sdh"
209+
volume_size = 20
210+
volume_type = "gp3"
211+
}
212+
213+
tags = {
214+
Name = "automq-byoc-console-${var.automq_byoc_env_id}"
215+
}
216+
217+
user_data = <<-EOF
218+
#cloud-config
219+
bootcmd:
220+
- |
221+
if [ ! -f "/home/admin/config.properties" ]; then
222+
touch /home/admin/config.properties
223+
echo "cmp.provider.credential=vm-role://${local.aws_iam_instance_profile_arn_encoded}@aws" >> /home/admin/config.properties
224+
echo 'cmp.provider.databucket=${local.automq_data_bucket}' >> /home/admin/config.properties
225+
echo 'cmp.provider.opsBucket=${local.automq_ops_bucket}' >> /home/admin/config.properties
226+
echo 'cmp.provider.instanceSecurityGroup=${aws_security_group.allow_all.id}' >> /home/admin/config.properties
227+
echo 'cmp.provider.instanceDNS=${aws_route53_zone.private.zone_id}' >> /home/admin/config.properties
228+
echo 'cmp.provider.instanceProfile=${aws_iam_instance_profile.automq_byoc_instance_profile.arn}' >> /home/admin/config.properties
229+
echo 'cmp.environmentId=${var.automq_byoc_env_id}' >> /home/admin/config.properties
230+
fi
231+
EOF
232+
}
233+
234+
resource "aws_route53_zone" "private" {
235+
name = "${var.automq_byoc_env_id}.automq.private"
236+
237+
vpc {
238+
vpc_id = local.automq_byoc_vpc_id
239+
}
240+
241+
lifecycle {
242+
create_before_destroy = true
243+
}
244+
}
245+
246+
resource "aws_eip" "web_ip" {
247+
instance = aws_instance.web.id
248+
}
249+
250+
locals {
251+
aws_iam_instance_profile_arn_encoded = urlencode(aws_iam_instance_profile.automq_byoc_instance_profile.arn)
137252
}

‎modules/aws-console-module/README.md‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

0 commit comments

Comments
 (0)