# Some instance variables locals { ami_selection = "tq" # master, minion, ... server_name_stem = "threatq" instance_count = 1 ebs_volume_type = "gp3" } # Use the default EBS key data "aws_kms_key" "ebs-key" { key_id = "alias/ebs_root_encrypt_decrypt" } resource "aws_instance" "instance" { count = local.instance_count tenancy = "default" ebs_optimized = true disable_api_termination = var.instance_termination_protection instance_initiated_shutdown_behavior = "stop" instance_type = "t3a.2xlarge" key_name = "msoc-build" monitoring = false # checkov:skip=CKV_AWS_126:Detailed monitoring not needed at this time iam_instance_profile = "msoc-default-instance-profile" associate_public_ip_address = false vpc_security_group_ids = [data.aws_security_group.typical-host.id, aws_security_group.instance.id] subnet_id = element(var.private_subnets, count.index) metadata_options { http_endpoint = "enabled" # checkov:skip=CKV_AWS_79:see tfsec explanation # tfsec:ignore:aws-ec2-enforce-http-token-imds Saltstack doesn't use s3 sources appropriately; see https://github.com/saltstack/salt/issues/60668 http_tokens = "optional" } ami = local.ami_map[local.ami_selection] # We need to ignore ebs_block_device changes, because if the AMI changes, so does the snapshot_id. # If they add a feature to block more specific changes (eg `ebs_block_devices[*].snapshot_id`), then # that could be removed. lifecycle { ignore_changes = [ami, key_name, user_data, ebs_block_device] } # These device definitions are optional, but added for clarity. root_block_device { volume_type = local.ebs_volume_type volume_size = "200" delete_on_termination = true encrypted = true kms_key_id = data.aws_kms_key.ebs-key.arn } ebs_block_device { # swap device_name = "/dev/xvdm" volume_type = local.ebs_volume_type #volume_size = 48 delete_on_termination = true encrypted = true kms_key_id = data.aws_kms_key.ebs-key.arn # Snapshot IDs need to be grabbed from the ami, or it will replace every time. It's ugly. # This may prompt replacement when the AMI is updated. # See: # https://github.com/hashicorp/terraform/issues/19958 # https://github.com/terraform-providers/terraform-provider-aws/issues/13118 snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdm"].ebs.snapshot_id } ebs_block_device { # /home device_name = "/dev/xvdn" volume_type = local.ebs_volume_type # volume_size = xx delete_on_termination = true encrypted = true kms_key_id = data.aws_kms_key.ebs-key.arn snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdn"].ebs.snapshot_id } ebs_block_device { # /var device_name = "/dev/xvdo" volume_type = local.ebs_volume_type volume_size = 200 delete_on_termination = true encrypted = true kms_key_id = data.aws_kms_key.ebs-key.arn snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdo"].ebs.snapshot_id } ebs_block_device { # /var/tmp device_name = "/dev/xvdp" volume_type = local.ebs_volume_type # volume_size = xx delete_on_termination = true encrypted = true kms_key_id = data.aws_kms_key.ebs-key.arn snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdp"].ebs.snapshot_id } ebs_block_device { # /var/log device_name = "/dev/xvdq" volume_type = local.ebs_volume_type # volume_size = xx delete_on_termination = true encrypted = true kms_key_id = data.aws_kms_key.ebs-key.arn snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdq"].ebs.snapshot_id } ebs_block_device { # /var/log/audit device_name = "/dev/xvdr" volume_type = local.ebs_volume_type # volume_size = xx delete_on_termination = true encrypted = true kms_key_id = data.aws_kms_key.ebs-key.arn snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdr"].ebs.snapshot_id } ebs_block_device { # /tmp device_name = "/dev/xvds" volume_type = local.ebs_volume_type # volume_size = xx delete_on_termination = true encrypted = true kms_key_id = data.aws_kms_key.ebs-key.arn snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvds"].ebs.snapshot_id } user_data = data.template_cloudinit_config.cloud_init_config[count.index].rendered tags = merge(local.standard_tags, var.tags, { Name = "${local.server_name_stem}-${count.index}" }) volume_tags = merge(local.standard_tags, var.tags, { Name = "${local.server_name_stem}-${count.index}" }) } module "private_dns_record" { count = local.instance_count source = "../../submodules/dns/private_A_record" name = "${local.server_name_stem}-${count.index}" ip_addresses = [aws_instance.instance[count.index].private_ip] dns_info = var.dns_info reverse_enabled = var.reverse_enabled providers = { aws.c2 = aws.c2 } } #module "public_dns_record" { # source = "../../submodules/dns/public_A_record" # # name = var.instance_name # ip_addresses = [ aws_eip.instance.public_ip ] # dns_info = var.dns_info # # providers = { # aws.mdr-common-services-commercial = aws.mdr-common-services-commercial # } #} # Render a multi-part cloud-init config making use of the part # above, and other source files data "template_cloudinit_config" "cloud_init_config" { count = local.instance_count gzip = true base64_encode = true # Main cloud-config configuration file. part { filename = "init.cfg" content_type = "text/cloud-config" content = templatefile("${path.module}/cloud-init/cloud-init.tpl", { hostname = "${local.server_name_stem}-${count.index}" fqdn = "${local.server_name_stem}-${count.index}.${var.dns_info["private"]["zone"]}" environment = var.environment salt_master = local.salt_master proxy = local.proxy aws_partition = var.aws_partition aws_partition_alias = var.aws_partition_alias aws_region = var.aws_region } ) } # mount /dev/xvdf at /opt/tqbackup part { content_type = "text/cloud-boothook" content = file("${path.module}/cloud-init/opt_tqbackup.boothook") } }