2e3dfccc68
* setup GCP terraform structure for connector dev infra * fxes * Created aws terraform bootstrap infrastructure * Corrected path for S3 state file * Creating ssh tunnel testing infrastructure * Creating a bastion host * Docs * Created bastion host with airbyte unprivileged account for tunneling * Added yum updates * Create a private subnet and a postgres database within it * Identifier for db * Create postgres and bastion within a module. * Set up postgres infrastructure * Don't need this terraform wrapper when we run with tfenv * Dropped incomplete WIP from GCP setup for this PR. * Touchups to how to use terraform * Updated to resolve merge conflict * More separated top level structure to avoid monorepo problems with terraform destroy. * Clarifying directory structure * Migrated directory structure for testing infrastructure Co-authored-by: Jenny Brown <jenny@airbyte.io>
118 lines
3.4 KiB
HCL
118 lines
3.4 KiB
HCL
# Setting up a subnet within our main vpc, for ssh tunnel testing.
|
|
# We need an ec2 instance (bastion host) reachable from the net with port 22 open for inbound ssh.
|
|
# The ec2 instance should be able to download package updates from the public internet, for ease of setup.
|
|
#
|
|
# We need a postgres instance NOT reachable from the net, but YES reachable from the EC2 instance.
|
|
# AWS lets us set publicly_accessible=false (this is default) on the rds instance
|
|
# to ensure no public IP is assigned to the postgres server.
|
|
# That means we can put the postgres server and the bastion host in the same subnet
|
|
# for simplicity, and not have to worry about maintaining route tables.
|
|
|
|
data "aws_vpc" "main" {
|
|
id = var.aws_vpc_id
|
|
}
|
|
data "aws_internet_gateway" "default" {
|
|
filter {
|
|
name = "attachment.vpc-id"
|
|
values = [data.aws_vpc.main.id]
|
|
}
|
|
}
|
|
|
|
# Bastion host sits inside a public subnet
|
|
resource "aws_subnet" "main-subnet-public-dbtunnel" {
|
|
vpc_id = data.aws_vpc.main.id
|
|
cidr_block = var.subnet_cidr_block1
|
|
map_public_ip_on_launch = "true"
|
|
availability_zone = var.subnet_az1
|
|
tags = {
|
|
Name = "public-dbtunnel"
|
|
}
|
|
}
|
|
|
|
# Because an RDS instance requires two AZs we need another subnet for it
|
|
resource "aws_subnet" "main-subnet-private-dbtunnel" {
|
|
vpc_id = data.aws_vpc.main.id
|
|
cidr_block = var.subnet_cidr_block2
|
|
map_public_ip_on_launch = "false"
|
|
availability_zone = var.subnet_az2
|
|
tags = {
|
|
Name = "private-dbtunnel"
|
|
}
|
|
}
|
|
|
|
|
|
# Output to the public internet
|
|
resource "aws_route_table" "dbtunnel-public-route" {
|
|
vpc_id = data.aws_vpc.main.id
|
|
|
|
route {
|
|
cidr_block = "0.0.0.0/0"
|
|
gateway_id = data.aws_internet_gateway.default.id
|
|
}
|
|
|
|
tags = {
|
|
Name = "dbtunnel-public-route"
|
|
}
|
|
}
|
|
|
|
resource "aws_route_table_association" "dbtunnel-route-assoc-public-subnet-1"{
|
|
subnet_id = "${aws_subnet.main-subnet-public-dbtunnel.id}"
|
|
route_table_id = "${aws_route_table.dbtunnel-public-route.id}"
|
|
}
|
|
|
|
resource "aws_route_table_association" "dbtunnel-route-assoc-private-subnet-2"{
|
|
subnet_id = "${aws_subnet.main-subnet-private-dbtunnel.id}"
|
|
route_table_id = "${aws_route_table.dbtunnel-public-route.id}"
|
|
}
|
|
|
|
|
|
resource "aws_security_group" "ssh-and-egress-allowed" {
|
|
vpc_id = data.aws_vpc.main.id
|
|
|
|
egress {
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = -1
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
}
|
|
ingress {
|
|
from_port = 22
|
|
to_port = 22
|
|
protocol = "tcp"
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
}
|
|
tags = {
|
|
Name = "ssh-and-egress-allowed"
|
|
}
|
|
}
|
|
|
|
|
|
# If we don't provide a security group, RDS picks a default, which won't have our port open.
|
|
# So set up a custom security group where we can control the ports open to the database.
|
|
resource "aws_security_group" "dbtunnel-sg" {
|
|
name = "dbtunnel-sg-allow-postgres"
|
|
description = "Allow inbound traffic but only from the dbtunnel subnet"
|
|
vpc_id = data.aws_vpc.main.id
|
|
|
|
ingress {
|
|
description = "tcp on 5432 from subnet"
|
|
from_port = 5432
|
|
to_port = 5432
|
|
protocol = "tcp"
|
|
cidr_blocks = [aws_subnet.main-subnet-public-dbtunnel.cidr_block]
|
|
}
|
|
|
|
egress {
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
ipv6_cidr_blocks = ["::/0"]
|
|
}
|
|
|
|
tags = {
|
|
Name = "dbtunnel-sg-allow-postgres"
|
|
}
|
|
}
|
|
|