Terraform

Collection of frequently used modules and how to start a new project.

Enterprise by Default

• Encryption at Rest (AES256 or KMS)
• Encryption in Transit (TLSv1.2)
• High availability and redundancy (Multi AZ)
• Least permission roles
• Tags: (Name, Terraform, Cost-Center, Environment)

Getting Started

Installing Terraform

$ brew install terraform

Install node dependencies

$ npm run install:npm

Project Structure

${project}-infrastructure
|-- package.json	# script shortcuts (lint, install, deploy, test) & versioning?
|-- master			# Setup for root level account
|   |-- users		# IAM roles
|   |-- state		# Sets up state management for terraform
|-- operations		# Setup for operation pieces
|   |-- cicd		# Jenkins
|   |-- dns			# Route53
|   |-- logging		# ELK & CloudWatch
|   |-- monitoring	# CloudTrail
|   |-- secrets		# HashiCorp Vault
|   |-- state		# Sets up state management for terraform
|-- environments
|   |-- app			# Public static assets
|   |-- api			# Public/Private API endpoints and support infrastructure
|   |-- dashboard	# Ops dashboards
|   |-- db			# Databases
|   |-- state		# Sets up state management for terraform
|   |-- users		# Sets up IAM roles for users
|   |-- vpc			# VPC & Networking
|-- modules			# collection of project specific modules

Most application will have similar modules, most included in this project. Execution order is important.

1. state
2. users
3. vpc
4. db
5. api
6. app
7. dashboard

Each environment module will follow the following format.

${module}
|-- main.tf						# Includes state management & module inclusion
|-- terraform.tfvars			# Includes ENV that apply to all env
|-- env.development.tfvars.enc	# Includes `development` ENV
|-- env.testing.tfvars.enc		# Includes `testing` ENV
|-- env.staging.tfvars.enc		# Includes `staging` ENV
|-- env.production.tfvars.enc	# Includes `production` ENV

All env.*.tfvars will be encrypted. (TODO add in script to do that with CI/CD)

Project specific modules should follow the following structure:

modules
|-- waf
|   |-- variables.tf	# inputs
|   |-- locals.tf		# internal variables
|   |-- main.tf			# setup
|   |-- ...				# tf file for each logical part of the module
|   |-- output			# outputs

Deployment

$ terraform apply -var-file=env.${environment}.${region}.tfvars
# review changes
$ yes

Roadmap

Phase I (Single Region Environment)

• VPC (bastion, proxy, nat w/ Multi-AZ)
• EC2 (ECS, EKS) w/ Multi-AZ
• DB (RDS, ES, DynamoDB) w/ Multi-AZ & Read Replicas
• Cache (redis) w/ Multi-AZ & Read Replicas
• Static Assets
• APIG
• WAF
• EKS

Phase II (Multi-Account)

• User Account Auth
• Cognito

Phase III (Operation Account)

• CI/CD
• DNS
• VPN w/ Peering?

Phase IV (Multi-Region)

• VPC w/ Peering
• DB
• S3
• DNS

Phase V (Compliance)

• Audit Logging
• Monitoring

Phase X (Multi Cloud Provider)

• Google
• MS Azure
• OpenStack

Built With

• Terraform
• NodeJS

Contributing

See Developer Guide (TODO add link)

Versioning

We use SemVer for versioning. For the versions available, see the tags on this repository.

Authors

• will Farrell

See also the list of contributors who participated in this project.

License

This project is licensed under the MIT License - see the LICENSE.md file for details

Acknowledgments