[카테고리:] Study

locals {
  http_port    = 80
  ssh_port     = 22
  any_port     = 0
  efs_port     = 2049
  any_protocol = "-1"
  tcp_protocol = "tcp"
  my_ip        = ["222.111.4.135/32"]
  all_ips      = ["0.0.0.0/0"]
  all_block    = "0.0.0.0/0"
}

resource "aws_vpc" "prj_vpc" {
  cidr_block       = var.vpc_cidr
  enable_dns_support = true
  enable_dns_hostnames = true

  tags = {
    Name = "${var.prj_name}-vpc"
  }
}

resource "aws_subnet" "prj_subnet1" {
  vpc_id     = aws_vpc.prj_vpc.id
  cidr_block = var.subnet1_cidr

  availability_zone = var.az_a

  tags = {
    Name = "${var.prj_name}-subnet1"
  }
}

resource "aws_subnet" "prj_subnet2" {
  vpc_id     = aws_vpc.prj_vpc.id
  cidr_block = var.subnet2_cidr

  availability_zone = var.az_c

  tags = {
    Name = "${var.prj_name}-subnet2"
  }
}

resource "aws_internet_gateway" "prj_igw" {
  vpc_id = aws_vpc.prj_vpc.id

  tags = {
    Name = "${var.prj_name}-igw"
  }
}


resource "aws_route_table" "prj_rt" {
  vpc_id = aws_vpc.prj_vpc.id

  tags = {
    Name = "${var.prj_name}-rt"
  }
}

resource "aws_route_table_association" "prj_asso1" {
  subnet_id      = aws_subnet.prj_subnet1.id
  route_table_id = aws_route_table.prj_rt.id
}

resource "aws_route_table_association" "prj_asso2" {
  subnet_id      = aws_subnet.prj_subnet2.id
  route_table_id = aws_route_table.prj_rt.id
}

resource "aws_route" "prj_dftrt" {
  route_table_id         = aws_route_table.prj_rt.id
  destination_cidr_block = local.all_block
  gateway_id             = aws_internet_gateway.prj_igw.id
}


resource "aws_security_group" "prj_sg" {
  name = "${var.prj_name}-sg"
  vpc_id      = aws_vpc.prj_vpc.id

  ingress {
    from_port   = local.http_port
    to_port     = local.http_port
    protocol    = local.tcp_protocol
    cidr_blocks = local.all_ips
  }

  ingress {
    from_port   = local.ssh_port
    to_port     = local.ssh_port
    protocol    = local.tcp_protocol
    cidr_blocks = local.my_ip
  }
  ingress {
description = "EFS mount target"
from_port   = local.efs_port
to_port     = local.efs_port
protocol    = local.tcp_protocol
cidr_blocks = local.all_ips
  }

  egress {
    from_port   = local.any_port
    to_port     = local.any_port
    protocol    = local.any_protocol
    cidr_blocks = local.all_ips
  }
  tags = {
    Name = "${var.prj_name}-sg"
  }
}

<hide/>
locals {
  http_protocol = "HTTP"
  ec2_file_system_local_mount_path = "/mnt/efs"
}

data "aws_ami" "prj_amazonlinux2" {
  most_recent = true
  filter {
    name   = "owner-alias"
    values = ["amazon"]
  }

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-ebs"]
  }

  owners = ["amazon"]
}

resource "aws_lb" "prj_alb" {
  name               = "${var.prj_name}-alb"
  load_balancer_type = "application"
  subnets            = [aws_subnet.prj_subnet1.id, aws_subnet.prj_subnet2.id]
  security_groups = [aws_security_group.prj_sg.id]

  tags = {
    Name = "${var.prj_name}-alb"
  }
}

resource "aws_lb_listener" "prj_http" {
  load_balancer_arn = aws_lb.prj_alb.arn
  port              = local.http_port
  protocol          = local.http_protocol

  <em># By default, return a simple 404 page</em>
  default_action {
    type = "fixed-response"

    fixed_response {
      content_type = "text/plain"
      message_body = "404: page not found - T101 Study"
      status_code  = 404
    }
  }
}

resource "aws_lb_target_group" "prj_albtg" {
  name = "${var.prj_name}-albtg"
  port     = local.http_port
  protocol = local.http_protocol
  vpc_id   = aws_vpc.prj_vpc.id

  health_check {
    path                = "/"
    protocol            = local.http_protocol
    matcher             = "200-299"
    interval            = 5
    timeout             = 3
    healthy_threshold   = 2
    unhealthy_threshold = 2
  }
}

resource "aws_lb_target_group_attachment" "prj_albrg_atch1" {
  target_group_arn = "${aws_lb_target_group.prj_albtg.arn}"
  target_id        = "${aws_instance.ami_backup_ec2.id}"
  port             = 80
}
resource "aws_lb_target_group_attachment" "prj_albrg_atch2" {
  target_group_arn = "${aws_lb_target_group.prj_albtg.arn}"
  target_id        = "${aws_instance.efs_backup_ec2.id}"
  port             = 80
}

resource "aws_key_pair" "prj_keypair" { 
  key_name = "ec2-kp"
  public_key = file("~/.ssh/id_rsa.pub") 
}


resource "aws_instance" "ami_backup_ec2" {

  depends_on = [
    aws_internet_gateway.prj_igw
    
  ]

  ami                         = data.aws_ami.prj_amazonlinux2.id
  associate_public_ip_address = true
  instance_type               = var.instance_type
  vpc_security_group_ids      = ["${aws_security_group.prj_sg.id}"]
  subnet_id                   = aws_subnet.prj_subnet1.id
key_name = aws_key_pair.prj_keypair.key_name
  user_data = <<-EOF
              <em>#!/bin/bash</em>
              wget https://busybox.net/downloads/binaries/1.31.0-defconfig-multiarch-musl/busybox-x86_64
              mv busybox-x86_64 busybox
              chmod +x busybox
              RZAZ=$(curl http://169.254.169.254/latest/meta-data/placement/availability-zone-id)
              IID=$(curl 169.254.169.254/latest/meta-data/instance-id)
              LIP=$(curl 169.254.169.254/latest/meta-data/local-ipv4)
              echo "<h1>RegionAz($RZAZ) : Instance ID($IID) : Private IP($LIP) : Web Server</h1>" > index.html
              nohup ./busybox httpd -f -p 80 &
              EOF

  user_data_replace_on_change = true

  tags = {
    Name = "${var.prj_name}-amibackup-ec2"
    backup = "enable"
  }
}

resource "aws_instance" "efs_backup_ec2" {

  depends_on = [
    aws_internet_gateway.prj_igw
    
  ]

  ami                         = data.aws_ami.prj_amazonlinux2.id
  associate_public_ip_address = true
  instance_type               = var.instance_type
  vpc_security_group_ids      = ["${aws_security_group.prj_sg.id}"]
  subnet_id                   = aws_subnet.prj_subnet2.id
key_name = aws_key_pair.prj_keypair.key_name

  user_data = <<-EOF
              <em>#!/bin/bash</em>
              wget https://busybox.net/downloads/binaries/1.31.0-defconfig-multiarch-musl/busybox-x86_64
              mv busybox-x86_64 busybox
              chmod +x busybox
              RZAZ=$(curl http://169.254.169.254/latest/meta-data/placement/availability-zone-id)
              IID=$(curl 169.254.169.254/latest/meta-data/instance-id)
              LIP=$(curl 169.254.169.254/latest/meta-data/local-ipv4)
              echo "<h1>RegionAz($RZAZ) : Instance ID($IID) : Private IP($LIP) : Web Server</h1>" > index.html
              nohup ./busybox httpd -f -p 80 &
              mkdir -p ${local.ec2_file_system_local_mount_path}
              yum install -y amazon-efs-utils
              mount -t efs -o iam,tls ${aws_efs_file_system.prj_efs.id} ${local.ec2_file_system_local_mount_path}
              echo "${aws_efs_file_system.prj_efs.id} ${local.ec2_file_system_local_mount_path} efs _netdev,tls,iam 0 0" >> /etc/fstab
              <em># Creating demo content for other services</em>
              mkdir -p ${local.ec2_file_system_local_mount_path}/fargate
              mkdir -p ${local.ec2_file_system_local_mount_path}/lambda
              df -h > ${local.ec2_file_system_local_mount_path}/fargate/demo.txt
              df -h > ${local.ec2_file_system_local_mount_path}/lambda/demo.txt
              chown ec2-user:ec2-user -R ${local.ec2_file_system_local_mount_path}
              EOF

  user_data_replace_on_change = true

  tags = {
    Name = "${var.prj_name}-amibackup-ec2"
    <em>#backup = "enable"</em>
  }
}

resource "aws_lb_listener_rule" "prj_albrule" {
  listener_arn = aws_lb_listener.prj_http.arn
  priority     = 100

  condition {
    path_pattern {
      values = ["*"]
    }
  }

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.prj_albtg.arn
  }
}

resource "aws_efs_file_system" "prj_efs" {
  encrypted = false
  tags = {
    Name = "${var.prj_name}-efs"
    backup = "enable"
  }
}

resource "aws_efs_backup_policy" "prj_efs_backup_policy" {
  file_system_id = aws_efs_file_system.prj_efs.id

  backup_policy {
    status = "DISABLED"
  }
}

resource "aws_efs_mount_target" "prj_efs_backup_mt" {
  file_system_id = aws_efs_file_system.prj_efs.id
  subnet_id      = aws_subnet.prj_subnet2.id
  security_groups = ["${aws_security_group.prj_sg.id}"]
}

<hide/>

resource "aws_db_instance" "prj_rds" {
  <em>#name = "${var.prj_name}-prjdb"</em>
  db_name           = "tfstudyfprjdb"
  allocated_storage = 8
  engine = "mysql"
  engine_version = "5.7"
  instance_class = "db.t2.micro"
  username = ""
  password = ""
  db_subnet_group_name = aws_db_subnet_group.prj_dbsubnetgr.name
}

resource "aws_db_subnet_group" "prj_dbsubnetgr" {
    Name = "${var.prj_name}-dbsubnetgr"
  subnet_ids = [aws_subnet.prj_subnet1.id, aws_subnet.prj_subnet2.id]
}

resource "aws_kms_key" "prj_kmskey" {
  description             = "KMS key for backup vault"
}

resource "aws_backup_vault" "prj_kmskey" {
  name = "${var.prj_name}-backupvault"
  kms_key_arn = aws_kms_key.prj_kmskey.arn
}

resource "aws_backup_selection" "prj_backup_sel" {
  iam_role_arn = "arn:aws:iam::536033748497:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup"
  name = "${var.prj_name}-backupsel"
  plan_id      = aws_backup_plan.prj_backup_plan.id

  selection_tag {
    type  = "STRINGEQUALS"
    key   = "backup"
    value = "enalbe"
  }

}

resource "aws_backup_plan" "prj_backup_plan" {
  name = "${var.prj_name}-backupplan"

  rule {
    rule_name         = "${var.prj_name}-backuprule-ami"
    target_vault_name = aws_backup_vault.prj_kmskey.name
    schedule          = "cron(0 0/2 1/1 * ? *)"
    
    lifecycle {
      delete_after = 2
    }
  }

    rule {
    rule_name         = "${var.prj_name}-backuprule-efs"
    target_vault_name = aws_backup_vault.prj_kmskey.name
    schedule          = "cron(0 0/2 1/1 * ? *)"
    
    lifecycle {
      delete_after = 2
    }
  }
  rule {
    rule_name         = "${var.prj_name}-backuprule-rds"
    target_vault_name = aws_backup_vault.prj_kmskey.name
    schedule          = "cron(0 0/2 1/1 * ? *)"

    lifecycle {
      delete_after = 2
    }
  }

  advanced_backup_setting {
    backup_options = {
      WindowsVSS = "enabled"
    }
    resource_type = "EC2"
  }
}