xdr-terraform-modules/base/vmray_instances/server.tf

# Handy tool to find AMIs:
#   https://cloud-images.ubuntu.com/locator/ec2/
#data "aws_ami" "ubuntu_pro" {
#  # Ubuntu Pro 18.04 Product ID: fc15dd7b-2aa0-47e5-bb05-94c75950b5de
#
#  most_recent = true
#  owners = [ "513442679011" ] # This seems like it might change sometimes?
#
#  # sadly, it looks like the image isn't named correctly in govcloud. I've given
#  # canonical feedback on this, but for now we'll use the ami id directly.
#  #filter {
#  #  name   = "name"
#  #  values = ["ubuntu-pro/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*", ]
#  #}
#
#  filter {
#    name   = "image-id"
#    values = [ "ami-0fe6338c47e61cd5d" ]
#  }
#
#  filter {
#    name   = "root-device-type"
#    values = ["ebs"]
#  }
#
#  filter {
#    name   = "virtualization-type"
#    values = ["hvm"]
#  }
#}

data "aws_security_group" "typical-host" {
  name   = "typical-host"
  vpc_id = var.vpc_id
}

# Use the default EBS key
data "aws_kms_key" "ebs-key" {
  key_id = "alias/ebs_root_encrypt_decrypt"
}

resource "aws_network_interface" "vmray-server-interface" {
  subnet_id       = var.private_subnets[0]
  security_groups = [data.aws_security_group.typical-host.id, aws_security_group.vmray_server_sg.id]
  description     = "vmray-server"
  tags            = merge(local.standard_tags, var.tags, { Name = "vmray-server" })
}

## Make /opt/vmray separate from the instance for greater margin of safety
#resource "aws_ebs_volume" "server_opt_vmray" {
#  availability_zone = var.azs[0]
#  size              = var.vmray_server_opt_vmray_size
#  type              = "gp3"
#  encrypted         = true
#  kms_key_id        = data.aws_kms_key.ebs-key.arn
#
#  tags = merge(local.standard_tags, var.tags, { Name = "vmray-server" })
#}
#
# Has to be on the same partition as /tmp
#resource "aws_volume_attachment" "server_opt_vmray" {
#  device_name = "/dev/xvdf"
#  volume_id   = aws_ebs_volume.server_opt_vmray.id
#  instance_id = aws_instance.vmray-server-instance.id
#}

resource "aws_instance" "vmray-server-instance" {
  tenancy                              = "default"
  ebs_optimized                        = true
  disable_api_termination              = var.instance_termination_protection
  instance_initiated_shutdown_behavior = "stop"
  instance_type                        = "m5a.xlarge"
  key_name                             = "msoc-build"
  monitoring                           = false
  iam_instance_profile                 = module.instance_profile.profile_id

  ami = data.aws_ami.ubuntu2004.image_id
  # We need to ignore ebs_block_device changes, because if the AMI changes, so does the snapshot_id.
  # If they add a feature to block more specific changes (eg `ebs_block_devices[*].snapshot_id`), then
  # that could be removed.
  lifecycle { ignore_changes = [ami, key_name, user_data, ebs_block_device] }

  metadata_options {
    http_endpoint = "enabled"
    # tfsec:ignore:aws-ec2-enforce-http-token-imds salt requirement?
    http_tokens = "optional"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = var.environment == "test" ? 60 : 500
    delete_on_termination = true
    encrypted             = true
    kms_key_id            = data.aws_kms_key.ebs-key.arn
  }

  ebs_block_device {
    # swap
    device_name = "/dev/xvdm"
    #volume_size = 48
    volume_type           = "gp3"
    delete_on_termination = true
    encrypted             = true
    kms_key_id            = data.aws_kms_key.ebs-key.arn
    # Snapshot IDs need to be grabbed from the ami, or it will replace every time. It's ugly.
    # This may prompt replacement when the AMI is updated.
    # See:
    #   https://github.com/hashicorp/terraform/issues/19958
    #   https://github.com/terraform-providers/terraform-provider-aws/issues/13118
    snapshot_id = local.block_device_mappings["/dev/xvdm"].ebs.snapshot_id
  }
  ebs_block_device {
    # /home
    device_name = "/dev/xvdn"
    # volume_size = xx
    volume_type           = "gp3"
    delete_on_termination = true
    encrypted             = true
    kms_key_id            = data.aws_kms_key.ebs-key.arn
    snapshot_id           = local.block_device_mappings["/dev/xvdn"].ebs.snapshot_id
  }
  #  ebs_block_device {
  #    # /var
  #    device_name = "/dev/xvdo"
  #    # volume_size = xx
  #    volume_type           = "gp3"
  #    delete_on_termination = true
  #    encrypted             = true
  #    kms_key_id            = data.aws_kms_key.ebs-key.arn
  #    snapshot_id           = local.block_device_mappings["/dev/xvdo"].ebs.snapshot_id
  #  }
  #  ebs_block_device {
  #    # /var/tmp
  #    device_name = "/dev/xvdp"
  #    # volume_size = xx
  #    volume_type           = "gp3"
  #    delete_on_termination = true
  #    encrypted             = true
  #    kms_key_id            = data.aws_kms_key.ebs-key.arn
  #    snapshot_id           = local.block_device_mappings["/dev/xvdp"].ebs.snapshot_id
  #  }
  ebs_block_device {
    # /var/log
    device_name = "/dev/xvdq"
    # volume_size = xx
    volume_type           = "gp3"
    delete_on_termination = true
    encrypted             = true
    kms_key_id            = data.aws_kms_key.ebs-key.arn
    snapshot_id           = local.block_device_mappings["/dev/xvdq"].ebs.snapshot_id
  }
  ebs_block_device {
    # /var/log/audit
    device_name = "/dev/xvdr"
    # volume_size = xx
    volume_type           = "gp3"
    delete_on_termination = true
    encrypted             = true
    kms_key_id            = data.aws_kms_key.ebs-key.arn
    snapshot_id           = local.block_device_mappings["/dev/xvdr"].ebs.snapshot_id
  }
  #  ebs_block_device {
  #    # /tmp
  #    device_name           = "/dev/xvds"
  #    volume_size           = 100 # VMray extracts isos to /tmp
  #    volume_type           = "gp3"
  #    delete_on_termination = true
  #    encrypted             = true
  #    kms_key_id            = data.aws_kms_key.ebs-key.arn
  #    snapshot_id           = local.block_device_mappings["/dev/xvds"].ebs.snapshot_id
  #  }

  network_interface {
    device_index         = 0
    network_interface_id = aws_network_interface.vmray-server-interface.id
  }

  user_data   = data.template_cloudinit_config.cloud-init-vmray-server.rendered
  tags        = merge(local.standard_tags, var.tags, { Name = "vmray-server" })
  volume_tags = merge(local.standard_tags, var.tags, { Name = "vmray-server" })
}

# Disabling this since we don't actually use it, but leaving this in here as 
# an example for future engineers, hopefully.
#
# Secrets example:
#  1. Find the secret
#  2. Get the secret
#  3. Decode the json
#data "aws_secretsmanager_secret" "ubuntu" {
#  name = "Ubuntu"
#  provider = aws.c2
#}
#
#data "aws_secretsmanager_secret_version" "ubuntu" {
#  secret_id = data.aws_secretsmanager_secret.ubuntu.id
#  provider = aws.c2
#}
#
#locals {
#  secret_ubuntu = jsondecode(data.aws_secretsmanager_secret_version.ubuntu.secret_string)
#}

# Render a multi-part cloud-init config making use of the part
# above, and other source files
data "template_cloudinit_config" "cloud-init-vmray-server" {
  gzip          = true
  base64_encode = true

  # Main cloud-config configuration file.
  part {
    filename     = "init.cfg"
    content_type = "text/cloud-config"
    content = templatefile("${path.module}/cloud-init/cloud-init.tpl",
      {
        hostname            = "vmray-server"
        fqdn                = "vmray-server.${var.dns_info["private"]["zone"]}"
        environment         = var.environment
        salt_master         = local.salt_master
        proxy               = local.proxy
        aws_partition       = var.aws_partition
        aws_partition_alias = var.aws_partition_alias
        aws_region          = var.aws_region
      }
    )
  }

  # mount /dev/xvdf at /opt/vmray
  #part {
  #  content_type = "text/cloud-boothook"
  #  content      = file("${path.module}/cloud-init/opt_vmray.boothook")
  #}

}

module "private_dns_record_vmray_server" {
  source = "../../submodules/dns/private_A_record"

  name            = "vmray-server"
  ip_addresses    = [aws_instance.vmray-server-instance.private_ip]
  dns_info        = var.dns_info
  reverse_enabled = true

  providers = {
    aws.c2 = aws.c2
  }
}