xdr-terraform-modules/base/dns/resolver_instance/main.tf

locals {
  instance_name = "resolver-${var.aws_partition_alias}-${var.instance_number}"
}

# Rather than pass in the aws security group, we just look it up. This will
# probably be useful other places, as well.
data "aws_security_group" "typical-host" {
  name   = "typical-host"
  vpc_id = var.vpc_id
}

resource "aws_network_interface" "instance" {
  subnet_id = var.subnet_id
  security_groups = [ data.aws_security_group.typical-host.id, aws_security_group.dns_security_group.id ]
  description = local.instance_name
  tags = merge(var.standard_tags, var.tags, { Name = local.instance_name })
}

resource "aws_eip" "instance" {
  vpc = true
  tags = merge(var.standard_tags, var.tags, { Name = local.instance_name })
}

resource "aws_eip_association" "instance" {
  network_interface_id = aws_network_interface.instance.id
  allocation_id = aws_eip.instance.id
}

resource "aws_instance" "instance" {
  #availability_zone = var.azs[count.index % 2]
  tenancy = "default"
  ebs_optimized = true
  disable_api_termination = var.instance_termination_protection
  instance_initiated_shutdown_behavior = "stop"
  instance_type = var.resolver_instance_type
  key_name = var.resolver_instance_key_name
  monitoring = false

  iam_instance_profile = "msoc-default-instance-profile"

  ami = local.ami_map["minion"]
  lifecycle { ignore_changes = [ ami, key_name, user_data ] }

  root_block_device {
      volume_type = "gp2"
      #volume_size = "60"
      delete_on_termination = true
  }

  network_interface {
    device_index = 0
    network_interface_id = aws_network_interface.instance.id
  }

  user_data = data.template_cloudinit_config.cloud-init.rendered
  tags = merge( var.standard_tags, var.tags, { Name = local.instance_name })
}

module "private_dns_record" {
  source = "../../../submodules/dns/private_A_record"

  name = local.instance_name
  ip_addresses = [ aws_instance.instance.private_ip ]
  dns_info = var.dns_info
  reverse_enabled = var.reverse_enabled

  providers = {
    aws.c2 = aws.c2
  }
}

module "public_dns_record" {
  source = "../../../submodules/dns/public_A_record"

  name = local.instance_name
  ip_addresses = [ aws_eip.instance.public_ip ]
  dns_info = var.dns_info

  providers = {
    aws.mdr-common-services-commercial = aws.mdr-common-services-commercial
  }
}

# Render a multi-part cloud-init config making use of the part
# above, and other source files
data "template_cloudinit_config" "cloud-init" {
  gzip          = true
  base64_encode = true

  # Main cloud-config configuration file.
  part {
    filename     = "init.cfg"
    content_type = "text/cloud-config"
    content      = templatefile("${path.module}/cloud-init/cloud-init.tpl",
      {
        hostname = local.instance_name
        fqdn = "resolver-${var.aws_partition_alias}-${var.instance_number}.${var.dns_info["private"]["zone"]}"
        environment = var.environment
        # can't use the DNS name like we would most places, because this is the DNS server
        saltmaster  = var.salt_master_ip
        proxy = var.proxy_ip
        aws_partition = var.aws_partition
        aws_partition_alias = var.aws_partition_alias
        aws_region = var.aws_region
      }
    )
  }

  # Additional parts as needed
  #part {
  #  content_type = "text/x-shellscript"
  #  content      = "ffbaz"
  #}
}

resource "aws_security_group" "dns_security_group" {
  name = "dns_security_group_${var.instance_number}"
  description = "DNS Security Group"
  vpc_id = var.vpc_id
  tags = merge(var.standard_tags, var.tags)
}

resource "aws_security_group_rule" "dns-tcp" {
  type              = "ingress"
  from_port         = 53
  to_port           = 53
  protocol          = "tcp"
  cidr_blocks       = [ "10.0.0.0/8" ]
  security_group_id = aws_security_group.dns_security_group.id
}

resource "aws_security_group_rule" "dns-udp" {
  type              = "ingress"
  from_port         = 53
  to_port           = 53
  protocol          = "udp"
  cidr_blocks       = [ "10.0.0.0/8" ]
  security_group_id = aws_security_group.dns_security_group.id
}

resource "aws_security_group_rule" "dns_outbound_tcp" {
  type = "egress"
  from_port = 53
  to_port = 53
  protocol = "tcp"
  cidr_blocks = [ "0.0.0.0/0" ]
  security_group_id = aws_security_group.dns_security_group.id
}

resource "aws_security_group_rule" "dns_outbound_udp" {
  type = "egress"
  from_port = 53
  to_port = 53
  protocol = "udp"
  cidr_blocks = [ "0.0.0.0/0" ]
  security_group_id = aws_security_group.dns_security_group.id
}