Feature/create infra backend s3 (#1)

* Added backend specific config and wordpress for proimplant

* Added output for wordpress proimplant

CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [2020.02.25]
+
+### Added
+
+- Separate AWS Backend s3 config for Terraform from the rest
+- Add new WordPress machine for testing Proimplant

terraform/backend/provider.tf

@@ -0,0 +1,6 @@
+provider "aws" {
+  version = "~> 2.42"
+  access_key = var.aws_access_key
+  secret_key = var.aws_secret_key
+  region  = var.aws_region
+}

terraform/backend/resources.tf

@@ -0,0 +1,29 @@
+resource "aws_s3_bucket" "terraform_state" {
+    bucket = "tnp-infra"
+
+    lifecycle {
+        prevent_destroy = true
+    }
+
+    versioning {
+        enabled = true
+    }
+
+    server_side_encryption_configuration {
+        rule {
+            apply_server_side_encryption_by_default {
+                sse_algorithm = "AES256"
+            }
+        }
+    }
+}
+
+resource "aws_dynamodb_table" "terraform_locks" {
+    name = "tnp-infra-locks"
+    billing_mode = "PAY_PER_REQUEST"
+    hash_key = "LockID"
+    attribute {
+        name = "LockID"
+        type = "S"
+    }
+}

terraform/backend/terraform.tf

@@ -0,0 +1,3 @@
+terraform {
+  required_version = ">= 0.12"
+}

terraform/backend/variables.tf

@@ -0,0 +1,11 @@
+variable "aws_region" {
+  default = "eu-west-1"
+}
+
+variable "aws_access_key" {
+  default = ""
+}
+
+variable "aws_secret_key" {
+  default = ""
+}

terraform/outputs.tf

@@ -5,3 +5,7 @@ output "prestashop-staging" {
 output "prestashop-production" {
   value = "ssh ${aws_instance.prestashop_production.public_ip}:22"
 }
+
+output "proimplant-wordpress" {
+  value = "ssh ${aws_instance.proimplant_wordpress.public_ip}:22"
+}

terraform/proimplant.tf

@@ -0,0 +1,16 @@
+resource "aws_instance" "proimplant_wordpress" {
+  ami           = "ami-06206646e9f976074"  # WordPress from Bitnami
+  instance_type = var.ec2_size
+  key_name      = var.key_name
+
+  vpc_security_group_ids = [
+    aws_security_group.web.id,
+    aws_security_group.ssh.id,
+    aws_security_group.egress-tls.id,
+    aws_security_group.ping-ICMP.id
+  ]
+
+  tags = {
+    Name = "proimplant-wordpress"
+  }
+}

terraform/resources.tf

@@ -0,0 +1,99 @@
+resource "aws_instance" "prestashop_staging" {
+  ami           = var.ami
+  instance_type = var.ec2_size
+  key_name      = var.prestashop_key_name
+
+  vpc_security_group_ids = [
+    aws_security_group.web.id,
+    aws_security_group.ssh.id,
+    aws_security_group.egress-tls.id,
+    aws_security_group.ping-ICMP.id
+  ]
+
+  tags = {
+    Name = "prestashop-staging"
+  }
+}
+
+resource "aws_instance" "prestashop_production" {
+  ami           = var.ami
+  instance_type = var.ec2_size
+  key_name      = var.prestashop_key_name
+
+  vpc_security_group_ids = [
+    aws_security_group.web.id,
+    aws_security_group.ssh.id,
+    aws_security_group.egress-tls.id,
+    aws_security_group.ping-ICMP.id
+  ]
+
+  tags = {
+    Name = "prestashop-production"
+  }
+}
+
+resource "aws_security_group" "web" {
+  name        = "default-web-prestashop"
+  description = "Security group for web that allows web traffic from internet"
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_security_group" "ssh" {
+  name        = "default-ssh-prestashop"
+  description = "Security group for nat instances that allows SSH and VPN traffic from internet"
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_security_group" "egress-tls" {
+  name        = "default-egress-tls-prestashop"
+  description = "Default security group that allows inbound and outbound traffic from all instances in the VPC"
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_security_group" "ping-ICMP" {
+  name        = "default-ping-prestashop"
+  description = "Default security group that allows to ping the instance"
+
+  ingress {
+    from_port        = -1
+    to_port          = -1
+    protocol         = "icmp"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
+  }
+}
+
+resource "aws_dynamodb_table" "terraform_locks" {
+    name = "tnp-infra-locks"
+    billing_mode = "PAY_PER_REQUEST"
+    hash_key = "LockID"
+    attribute {
+        name = "LockID"
+        type = "S"
+    }
+}

terraform/terraform.tf

@@ -1,89 +1,10 @@
-resource "aws_instance" "prestashop_staging" {
-  ami           = var.ami
-  instance_type = var.ec2_size
-  key_name      = var.key_name
-
-  vpc_security_group_ids = [
-    aws_security_group.web.id,
-    aws_security_group.ssh.id,
-    aws_security_group.egress-tls.id,
-    aws_security_group.ping-ICMP.id
-  ]
-
-  tags = {
-    Name = "prestashop-staging"
-  }
-}
-
-resource "aws_instance" "prestashop_production" {
-  ami           = var.ami
-  instance_type = var.ec2_size
-  key_name      = var.key_name
-
-  vpc_security_group_ids = [
-    aws_security_group.web.id,
-    aws_security_group.ssh.id,
-    aws_security_group.egress-tls.id,
-    aws_security_group.ping-ICMP.id
-  ]
-
-  tags = {
-    Name = "prestashop-production"
-  }
-}
-
-resource "aws_security_group" "web" {
-  name        = "default-web-prestashop"
-  description = "Security group for web that allows web traffic from internet"
-
-  ingress {
-    from_port   = 80
-    to_port     = 80
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  ingress {
-    from_port   = 443
-    to_port     = 443
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-}
-
-resource "aws_security_group" "ssh" {
-  name        = "default-ssh-prestashop"
-  description = "Security group for nat instances that allows SSH and VPN traffic from internet"
-
-  ingress {
-    from_port   = 22
-    to_port     = 22
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-}
-
-resource "aws_security_group" "egress-tls" {
-  name        = "default-egress-tls-prestashop"
-  description = "Default security group that allows inbound and outbound traffic from all instances in the VPC"
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-}
-
-resource "aws_security_group" "ping-ICMP" {
-  name        = "default-ping-prestashop"
-  description = "Default security group that allows to ping the instance"
-
-  ingress {
-    from_port        = -1
-    to_port          = -1
-    protocol         = "icmp"
-    cidr_blocks      = ["0.0.0.0/0"]
-    ipv6_cidr_blocks = ["::/0"]
+terraform {
+  required_version = ">= 0.12"
+  backend "s3" {
+    bucket = "tnp-infra"
+    key = "global/terraform.tfstate"
+    region = "eu-central-1"
+    dynamodb_table = "tnp-infra-locks"
+    encrypt = true
   }
 }

terraform/variables.tf

@@ -6,6 +6,11 @@ variable "region" {
   default = "eu-west-1"
 }
 
+variable "prestashop_key_name" {
+  default = "javaguirre-tnp"
+  description = "The first machines we deployed had an specific key pair we maintain now"
+}
+
 variable "key_name" {
   default = "javaguirre-tnp"
 }
@@ -18,10 +23,6 @@ variable "aws_secret_key" {
   default = ""
 }
 
-variable "instance" {
-  default = "t2.micro"
-}
-
 variable "instance_count" {
   default = "1"
 }