Skip to content

Commit ddd9184

Browse files
author
Erin-Boehmer
committed
Make api gateway optional and adjust api_base_auth var naming
1 parent 2e78a28 commit ddd9184

File tree

9 files changed

+91
-62
lines changed

9 files changed

+91
-62
lines changed

‎README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,6 @@ You can find a more complete example that uses this module but also includes set
9595
| Name | Description | Type | Default | Required |
9696
|------|-------------|------|---------|:--------:|
9797
| <a name="input_access_list_cidr_blocks"></a> [access\_list\_cidr\_blocks](#input\_access\_list\_cidr\_blocks) | List of CIDRs we want to grant access to our Metaflow Metadata Service. Usually this is our VPN's CIDR blocks. | `list(string)` | `[]` | no |
98-
| <a name="input_api_basic_auth"></a> [api\_basic\_auth](#input\_api\_basic\_auth) | Enable basic auth for API Gateway? (requires key export) | `bool` | `true` | no |
9998
| <a name="input_batch_type"></a> [batch\_type](#input\_batch\_type) | AWS Batch Compute Type ('ec2', 'fargate') | `string` | `"ec2"` | no |
10099
| <a name="input_compute_environment_desired_vcpus"></a> [compute\_environment\_desired\_vcpus](#input\_compute\_environment\_desired\_vcpus) | Desired Starting VCPUs for Batch Compute Environment [0-16] for EC2 Batch Compute Environment (ignored for Fargate) | `number` | `8` | no |
101100
| <a name="input_compute_environment_egress_cidr_blocks"></a> [compute\_environment\_egress\_cidr\_blocks](#input\_compute\_environment\_egress\_cidr\_blocks) | CIDR blocks to which egress is allowed from the Batch Compute environment's security group | `list(string)` | <pre>[<br> "0.0.0.0/0"<br>]</pre> | no |
@@ -108,6 +107,8 @@ You can find a more complete example that uses this module but also includes set
108107
| <a name="input_extra_ui_static_env_vars"></a> [extra\_ui\_static\_env\_vars](#input\_extra\_ui\_static\_env\_vars) | Additional environment variables for UI static app | `map(string)` | `{}` | no |
109108
| <a name="input_iam_partition"></a> [iam\_partition](#input\_iam\_partition) | IAM Partition (Select aws-us-gov for AWS GovCloud, otherwise leave as is) | `string` | `"aws"` | no |
110109
| <a name="input_metadata_service_container_image"></a> [metadata\_service\_container\_image](#input\_metadata\_service\_container\_image) | Container image for metadata service | `string` | `""` | no |
110+
| <a name="input_metadata_service_enable_api_basic_auth"></a> [metadata\_service\_enable\_api\_basic\_auth](#input\_metadata\_service\_enable\_api\_basic\_auth) | Enable basic auth for API Gateway? (requires key export) | `bool` | `true` | no |
111+
| <a name="input_metadata_service_enable_api_gateway"></a> [metadata\_service\_enable\_api\_gateway](#input\_metadata\_service\_enable\_api\_gateway) | Enable API Gateway for public metadata service endpoint | `bool` | `true` | no |
111112
| <a name="input_resource_prefix"></a> [resource\_prefix](#input\_resource\_prefix) | string prefix for all resources | `string` | `"metaflow"` | no |
112113
| <a name="input_resource_suffix"></a> [resource\_suffix](#input\_resource\_suffix) | string suffix for all resources | `string` | `""` | no |
113114
| <a name="input_subnet1_id"></a> [subnet1\_id](#input\_subnet1\_id) | First subnet used for availability zone redundancy | `string` | n/a | yes |

‎examples/eks/metaflow.tf

+2-1
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,12 @@ module "metaflow-metadata-service" {
4848
resource_suffix = local.resource_suffix
4949

5050
access_list_cidr_blocks = []
51-
api_basic_auth = true
5251
database_name = module.metaflow-datastore.database_name
5352
database_password = module.metaflow-datastore.database_password
5453
database_username = module.metaflow-datastore.database_username
5554
datastore_s3_bucket_kms_key_arn = module.metaflow-datastore.datastore_s3_bucket_kms_key_arn
55+
enable_api_basic_auth = true
56+
enable_api_gateway = true
5657
fargate_execution_role_arn = aws_iam_role.ecs_execution_role.arn
5758
metaflow_vpc_id = module.vpc.vpc_id
5859
metadata_service_container_image = module.metaflow-common.default_metadata_service_container_image

‎main.tf

+2-1
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,12 @@ module "metaflow-metadata-service" {
1919
resource_suffix = local.resource_suffix
2020

2121
access_list_cidr_blocks = var.access_list_cidr_blocks
22-
api_basic_auth = var.api_basic_auth
2322
database_name = module.metaflow-datastore.database_name
2423
database_password = module.metaflow-datastore.database_password
2524
database_username = module.metaflow-datastore.database_username
2625
datastore_s3_bucket_kms_key_arn = module.metaflow-datastore.datastore_s3_bucket_kms_key_arn
26+
enable_api_basic_auth = var.metadata_service_enable_api_basic_auth
27+
enable_api_gateway = var.metadata_service_enable_api_gateway
2728
fargate_execution_role_arn = module.metaflow-computation.ecs_execution_role_arn
2829
iam_partition = var.iam_partition
2930
metadata_service_container_image = local.metadata_service_container_image

‎modules/metadata-service/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,12 @@ If the `access_list_cidr_blocks` variable is set, only traffic originating from
1616
| Name | Description | Type | Default | Required |
1717
|------|-------------|------|---------|:--------:|
1818
| <a name="input_access_list_cidr_blocks"></a> [access\_list\_cidr\_blocks](#input\_access\_list\_cidr\_blocks) | List of CIDRs we want to grant access to our Metaflow Metadata Service. Usually this is our VPN's CIDR blocks. | `list(string)` | n/a | yes |
19-
| <a name="input_api_basic_auth"></a> [api\_basic\_auth](#input\_api\_basic\_auth) | Enable basic auth for API Gateway? (requires key export) | `bool` | `true` | no |
2019
| <a name="input_database_name"></a> [database\_name](#input\_database\_name) | The database name | `string` | `"metaflow"` | no |
2120
| <a name="input_database_password"></a> [database\_password](#input\_database\_password) | The database password | `string` | n/a | yes |
2221
| <a name="input_database_username"></a> [database\_username](#input\_database\_username) | The database username | `string` | n/a | yes |
2322
| <a name="input_datastore_s3_bucket_kms_key_arn"></a> [datastore\_s3\_bucket\_kms\_key\_arn](#input\_datastore\_s3\_bucket\_kms\_key\_arn) | The ARN of the KMS key used to encrypt the Metaflow datastore S3 bucket | `string` | n/a | yes |
23+
| <a name="input_enable_api_basic_auth"></a> [enable\_api\_basic\_auth](#input\_enable\_api\_basic\_auth) | Enable basic auth for API Gateway? (requires key export) | `bool` | `true` | no |
24+
| <a name="input_enable_api_gateway"></a> [enable\_api\_gateway](#input\_enable\_api\_gateway) | Enable API Gateway for public metadata service endpoint | `bool` | `true` | no |
2425
| <a name="input_fargate_execution_role_arn"></a> [fargate\_execution\_role\_arn](#input\_fargate\_execution\_role\_arn) | The IAM role that grants access to ECS and Batch services which we'll use as our Metadata Service API's execution\_role for our Fargate instance | `string` | n/a | yes |
2526
| <a name="input_iam_partition"></a> [iam\_partition](#input\_iam\_partition) | IAM Partition (Select aws-us-gov for AWS GovCloud, otherwise leave as is) | `string` | `"aws"` | no |
2627
| <a name="input_is_gov"></a> [is\_gov](#input\_is\_gov) | Set to true if IAM partition is 'aws-us-gov' | `bool` | `false` | no |

‎modules/metadata-service/api-gateway.tf

+56-43
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
resource "aws_api_gateway_rest_api_policy" "this" {
2-
count = length(var.access_list_cidr_blocks) > 0 ? 1 : 0
3-
rest_api_id = aws_api_gateway_rest_api.this.id
2+
count = var.enable_api_gateway && length(var.access_list_cidr_blocks) > 0 ? 1 : 0
3+
rest_api_id = aws_api_gateway_rest_api.this[0].id
44
policy = <<EOF
55
{
66
"Version": "2012-10-17",
@@ -9,13 +9,13 @@ resource "aws_api_gateway_rest_api_policy" "this" {
99
"Effect": "Allow",
1010
"Principal": "*",
1111
"Action": "execute-api:Invoke",
12-
"Resource": "arn:${var.iam_partition}:execute-api:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.this.id}/*/*/*"
12+
"Resource": "arn:${var.iam_partition}:execute-api:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.this[0].id}/*/*/*"
1313
},
1414
{
1515
"Effect": "Deny",
1616
"Principal": "*",
1717
"Action": "execute-api:Invoke",
18-
"Resource": "arn:${var.iam_partition}:execute-api:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.this.id}/*/*/*",
18+
"Resource": "arn:${var.iam_partition}:execute-api:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.this[0].id}/*/*/*",
1919
"Condition": {
2020
"NotIpAddress": {
2121
"aws:SourceIp": ${jsonencode(var.access_list_cidr_blocks)}
@@ -28,6 +28,7 @@ resource "aws_api_gateway_rest_api_policy" "this" {
2828
}
2929

3030
resource "aws_api_gateway_rest_api" "this" {
31+
count = var.enable_api_gateway ? 1 : 0
3132
name = "${var.resource_prefix}api${var.resource_suffix}"
3233
description = "Allows access to the Metadata service RDS instance"
3334

@@ -39,56 +40,63 @@ resource "aws_api_gateway_rest_api" "this" {
3940
}
4041

4142
resource "aws_api_gateway_resource" "this" {
42-
rest_api_id = aws_api_gateway_rest_api.this.id
43-
parent_id = aws_api_gateway_rest_api.this.root_resource_id
43+
count = var.enable_api_gateway ? 1 : 0
44+
rest_api_id = aws_api_gateway_rest_api.this[0].id
45+
parent_id = aws_api_gateway_rest_api.this[0].root_resource_id
4446
path_part = "{proxy+}"
4547
}
4648

4749
resource "aws_api_gateway_resource" "db" {
48-
rest_api_id = aws_api_gateway_rest_api.this.id
49-
parent_id = aws_api_gateway_rest_api.this.root_resource_id
50+
count = var.enable_api_gateway ? 1 : 0
51+
rest_api_id = aws_api_gateway_rest_api.this[0].id
52+
parent_id = aws_api_gateway_rest_api.this[0].root_resource_id
5053
path_part = "db_schema_status"
5154
}
5255

5356
resource "aws_api_gateway_vpc_link" "this" {
57+
count = var.enable_api_gateway ? 1 : 0
5458
name = "${var.resource_prefix}vpclink${var.resource_suffix}"
5559
target_arns = [aws_lb.this.arn]
5660

5761
tags = var.standard_tags
5862
}
5963

6064
resource "aws_api_gateway_method" "this" {
65+
count = var.enable_api_gateway ? 1 : 0
6166
http_method = "ANY"
62-
resource_id = aws_api_gateway_resource.this.id
63-
rest_api_id = aws_api_gateway_rest_api.this.id
67+
resource_id = aws_api_gateway_resource.this[0].id
68+
rest_api_id = aws_api_gateway_rest_api.this[0].id
6469
authorization = "NONE"
65-
api_key_required = var.api_basic_auth
70+
api_key_required = var.enable_api_basic_auth
6671

6772
request_parameters = {
6873
"method.request.path.proxy" = true
6974
}
7075
}
7176

7277
resource "aws_api_gateway_method" "db" {
78+
count = var.enable_api_gateway ? 1 : 0
7379
http_method = "GET"
74-
resource_id = aws_api_gateway_resource.db.id
75-
rest_api_id = aws_api_gateway_rest_api.this.id
80+
resource_id = aws_api_gateway_resource.db[0].id
81+
rest_api_id = aws_api_gateway_rest_api.this[0].id
7682
authorization = "NONE"
77-
api_key_required = var.api_basic_auth
83+
api_key_required = var.enable_api_basic_auth
7884
}
7985

8086
resource "aws_api_gateway_integration_response" "this" {
81-
rest_api_id = aws_api_gateway_rest_api.this.id
82-
resource_id = aws_api_gateway_resource.this.id
83-
http_method = aws_api_gateway_method.this.http_method
87+
count = var.enable_api_gateway ? 1 : 0
88+
rest_api_id = aws_api_gateway_rest_api.this[0].id
89+
resource_id = aws_api_gateway_resource.this[0].id
90+
http_method = aws_api_gateway_method.this[0].http_method
8491
status_code = 200
85-
depends_on = [aws_api_gateway_integration.this]
92+
depends_on = [aws_api_gateway_integration.this[0]]
8693
}
8794

8895
resource "aws_api_gateway_integration" "this" {
89-
rest_api_id = aws_api_gateway_rest_api.this.id
90-
resource_id = aws_api_gateway_resource.this.id
91-
http_method = aws_api_gateway_method.this.http_method
96+
count = var.enable_api_gateway ? 1 : 0
97+
rest_api_id = aws_api_gateway_rest_api.this[0].id
98+
resource_id = aws_api_gateway_resource.this[0].id
99+
http_method = aws_api_gateway_method.this[0].http_method
92100

93101
request_parameters = {
94102
"integration.request.path.proxy" = "method.request.path.proxy"
@@ -99,46 +107,50 @@ resource "aws_api_gateway_integration" "this" {
99107
integration_http_method = "ANY"
100108
passthrough_behavior = "WHEN_NO_MATCH"
101109
connection_type = "VPC_LINK"
102-
connection_id = aws_api_gateway_vpc_link.this.id
110+
connection_id = aws_api_gateway_vpc_link.this[0].id
103111
}
104112

105113
resource "aws_api_gateway_integration" "db" {
106-
rest_api_id = aws_api_gateway_rest_api.this.id
107-
resource_id = aws_api_gateway_resource.db.id
108-
http_method = aws_api_gateway_method.db.http_method
114+
count = var.enable_api_gateway ? 1 : 0
115+
rest_api_id = aws_api_gateway_rest_api.this[0].id
116+
resource_id = aws_api_gateway_resource.db[0].id
117+
http_method = aws_api_gateway_method.db[0].http_method
109118

110119

111120
type = "HTTP_PROXY"
112121
uri = "http://${aws_lb.this.dns_name}:8082/db_schema_status"
113122
integration_http_method = "GET"
114123
passthrough_behavior = "WHEN_NO_MATCH"
115124
connection_type = "VPC_LINK"
116-
connection_id = aws_api_gateway_vpc_link.this.id
125+
connection_id = aws_api_gateway_vpc_link.this[0].id
117126
}
118127

119128
resource "aws_api_gateway_method_response" "this" {
120-
rest_api_id = aws_api_gateway_rest_api.this.id
121-
resource_id = aws_api_gateway_resource.this.id
122-
http_method = aws_api_gateway_method.this.http_method
129+
count = var.enable_api_gateway ? 1 : 0
130+
rest_api_id = aws_api_gateway_rest_api.this[0].id
131+
resource_id = aws_api_gateway_resource.this[0].id
132+
http_method = aws_api_gateway_method.this[0].http_method
123133
status_code = "200"
124-
depends_on = [aws_api_gateway_integration.this]
134+
depends_on = [aws_api_gateway_integration.this[0]]
125135
}
126136

127137
resource "aws_api_gateway_method_response" "db" {
128-
rest_api_id = aws_api_gateway_rest_api.this.id
129-
resource_id = aws_api_gateway_resource.db.id
130-
http_method = aws_api_gateway_method.db.http_method
138+
count = var.enable_api_gateway ? 1 : 0
139+
rest_api_id = aws_api_gateway_rest_api.this[0].id
140+
resource_id = aws_api_gateway_resource.db[0].id
141+
http_method = aws_api_gateway_method.db[0].http_method
131142
status_code = "200"
132-
depends_on = [aws_api_gateway_integration.db]
143+
depends_on = [aws_api_gateway_integration.db[0]]
133144
}
134145

135146
resource "aws_api_gateway_deployment" "this" {
136-
rest_api_id = aws_api_gateway_rest_api.this.id
147+
count = var.enable_api_gateway ? 1 : 0
148+
rest_api_id = aws_api_gateway_rest_api.this[0].id
137149

138150
# explicit depends_on required to ensure module stands up on first `apply`
139151
# otherwise a second followup `apply` would be required
140152
# can read more here: https://stackoverflow.com/a/42783769
141-
depends_on = [aws_api_gateway_method.this, aws_api_gateway_integration.this]
153+
depends_on = [aws_api_gateway_method.this[0], aws_api_gateway_integration.this[0]]
142154

143155
# ensures properly ordered re-deployments occur
144156
lifecycle {
@@ -147,34 +159,35 @@ resource "aws_api_gateway_deployment" "this" {
147159
}
148160

149161
resource "aws_api_gateway_stage" "this" {
150-
deployment_id = aws_api_gateway_deployment.this.id
151-
rest_api_id = aws_api_gateway_rest_api.this.id
162+
count = var.enable_api_gateway ? 1 : 0
163+
deployment_id = aws_api_gateway_deployment.this[0].id
164+
rest_api_id = aws_api_gateway_rest_api.this[0].id
152165
stage_name = local.api_gateway_stage_name
153166

154167
tags = var.standard_tags
155168
}
156169

157170
resource "aws_api_gateway_api_key" "this" {
158-
count = var.api_basic_auth ? 1 : 0
171+
count = var.enable_api_gateway && var.enable_api_basic_auth ? 1 : 0
159172
name = local.api_gateway_key_name
160173

161174
tags = var.standard_tags
162175
}
163176

164177
resource "aws_api_gateway_usage_plan" "this" {
165-
count = var.api_basic_auth ? 1 : 0
178+
count = var.enable_api_gateway && var.enable_api_basic_auth ? 1 : 0
166179
name = local.api_gateway_usage_plan_name
167180

168181
api_stages {
169-
api_id = aws_api_gateway_rest_api.this.id
170-
stage = aws_api_gateway_stage.this.stage_name
182+
api_id = aws_api_gateway_rest_api.this[0].id
183+
stage = aws_api_gateway_stage.this[0].stage_name
171184
}
172185

173186
tags = var.standard_tags
174187
}
175188

176189
resource "aws_api_gateway_usage_plan_key" "this" {
177-
count = var.api_basic_auth ? 1 : 0
190+
count = var.enable_api_gateway && var.enable_api_basic_auth ? 1 : 0
178191
key_id = aws_api_gateway_api_key.this[0].id
179192
key_type = "API_KEY"
180193
usage_plan_id = aws_api_gateway_usage_plan.this[0].id

‎modules/metadata-service/outputs.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@ output "METAFLOW_SERVICE_INTERNAL_URL" {
44
}
55

66
output "METAFLOW_SERVICE_URL" {
7-
value = "https://${aws_api_gateway_rest_api.this.id}.execute-api.${data.aws_region.current.name}.amazonaws.com/api/"
7+
value = var.enable_api_gateway ? "https://${aws_api_gateway_rest_api.this[0].id}.execute-api.${data.aws_region.current.name}.amazonaws.com/api/" : ""
88
description = "URL for Metadata Service (Open to Public Access)"
99
}
1010

1111
output "api_gateway_rest_api_id" {
12-
value = aws_api_gateway_rest_api.this.id
12+
value = var.enable_api_gateway ? aws_api_gateway_rest_api.this[0].id : ""
1313
description = "The ID of the API Gateway REST API we'll use to accept MetaData service requests to forward to the Fargate API instance"
1414
}
1515

‎modules/metadata-service/variables.tf

+12-6
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,6 @@ variable "access_list_cidr_blocks" {
33
description = "List of CIDRs we want to grant access to our Metaflow Metadata Service. Usually this is our VPN's CIDR blocks."
44
}
55

6-
variable "api_basic_auth" {
7-
type = bool
8-
default = true
9-
description = "Enable basic auth for API Gateway? (requires key export)"
10-
}
116

127
variable "database_name" {
138
type = string
@@ -30,6 +25,18 @@ variable "datastore_s3_bucket_kms_key_arn" {
3025
description = "The ARN of the KMS key used to encrypt the Metaflow datastore S3 bucket"
3126
}
3227

28+
variable "enable_api_basic_auth" {
29+
type = bool
30+
default = true
31+
description = "Enable basic auth for API Gateway? (requires key export)"
32+
}
33+
34+
variable "enable_api_gateway" {
35+
type = bool
36+
default = true
37+
description = "Enable API Gateway for public metadata service endpoint"
38+
}
39+
3340
variable "fargate_execution_role_arn" {
3441
type = string
3542
description = "The IAM role that grants access to ECS and Batch services which we'll use as our Metadata Service API's execution_role for our Fargate instance"
@@ -104,7 +111,6 @@ variable "subnet2_id" {
104111
type = string
105112
description = "Second private subnet used for availability zone redundancy"
106113
}
107-
108114
variable "vpc_cidr_blocks" {
109115
type = list(string)
110116
description = "The VPC CIDR blocks that we'll access list on our Metadata Service API to allow all internal communications"

‎outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ output "metaflow_profile_json" {
7474
"METAFLOW_BATCH_CONTAINER_REGISTRY" = element(split("/", aws_ecr_repository.metaflow_batch_image[0].repository_url), 0),
7575
"METAFLOW_BATCH_CONTAINER_IMAGE" = element(split("/", aws_ecr_repository.metaflow_batch_image[0].repository_url), 1)
7676
} : {},
77-
var.api_basic_auth ? {
77+
var.enable_api_basic_auth ? {
7878
"METAFLOW_SERVICE_AUTH_KEY" = "## Replace with output from 'aws apigateway get-api-key --api-key ${module.metaflow-metadata-service.api_gateway_rest_api_id_key_id} --include-value | grep value' ##"
7979
} : {},
8080
var.batch_type == "fargate" ? {

‎variables.tf

+12-6
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,6 @@ variable "access_list_cidr_blocks" {
44
default = []
55
}
66

7-
variable "api_basic_auth" {
8-
type = bool
9-
default = true
10-
description = "Enable basic auth for API Gateway? (requires key export)"
11-
}
12-
137
variable "batch_type" {
148
type = string
159
description = "AWS Batch Compute Type ('ec2', 'fargate')"
@@ -79,6 +73,18 @@ variable "metadata_service_container_image" {
7973
description = "Container image for metadata service"
8074
}
8175

76+
variable "metadata_service_enable_api_basic_auth" {
77+
type = bool
78+
default = true
79+
description = "Enable basic auth for API Gateway? (requires key export)"
80+
}
81+
82+
variable "metadata_service_enable_api_gateway" {
83+
type = bool
84+
default = true
85+
description = "Enable API Gateway for public metadata service endpoint"
86+
}
87+
8288
variable "ui_static_container_image" {
8389
type = string
8490
default = ""

0 commit comments

Comments
 (0)