|
| 1 | +#---------------------------------------------------------- |
| 2 | +# Terraform - From Zero to Certified Professional |
| 3 | +# |
| 4 | +# Provision: |
| 5 | +# - VPC |
| 6 | +# - Internet Gateway |
| 7 | +# - XX Public Subnets |
| 8 | +# - XX Private Subnets |
| 9 | +# - XX NAT Gateways in Public Subnets to give Internet access from Private Subnets |
| 10 | +# |
| 11 | +# Developed by RANJEET JADHAV |
| 12 | +#---------------------------------------------------------- |
| 13 | +provider "aws" { |
| 14 | + region = "us-east-2" |
| 15 | + |
| 16 | +} |
| 17 | + |
| 18 | +data "aws_availability_zones" "available" {} |
| 19 | + |
| 20 | +#-------------VPC and Internet Gateway------------------------------------------ |
| 21 | +resource "aws_vpc" "sbi" { |
| 22 | + cidr_block = var.vpc_cidr |
| 23 | + tags = merge(var.tags, { Name = "${var.env}-vpc" }) |
| 24 | +} |
| 25 | + |
| 26 | +resource "aws_internet_gateway" "sbi" { |
| 27 | + vpc_id = aws_vpc.sbi.id |
| 28 | + tags = merge(var.tags, { Name = "${var.env}-igw" }) |
| 29 | +} |
| 30 | + |
| 31 | +#-------------Public Subnets and Routing---------------------------------------- |
| 32 | +resource "aws_subnet" "public_subnets" { |
| 33 | + count = length(var.public_subnet_cidrs) |
| 34 | + vpc_id = aws_vpc.sbi.id |
| 35 | + cidr_block = element(var.public_subnet_cidrs, count.index) |
| 36 | + availability_zone = data.aws_availability_zones.available.names[count.index] |
| 37 | + map_public_ip_on_launch = true |
| 38 | + tags = merge(var.tags, { Name = "${var.env}-public-${count.index + 1}" }) |
| 39 | +} |
| 40 | + |
| 41 | +resource "aws_route_table" "public_subnets" { |
| 42 | + vpc_id = aws_vpc.sbi.id |
| 43 | + route { |
| 44 | + cidr_block = "0.0.0.0/0" |
| 45 | + gateway_id = aws_internet_gateway.sbi.id |
| 46 | + } |
| 47 | + tags = merge(var.tags, { Name = "${var.env}-route-public-subnets" }) |
| 48 | +} |
| 49 | + |
| 50 | +resource "aws_route_table_association" "public_routes" { |
| 51 | + count = length(aws_subnet.public_subnets[*].id) |
| 52 | + route_table_id = aws_route_table.public_subnets.id |
| 53 | + subnet_id = aws_subnet.public_subnets[count.index].id |
| 54 | +} |
| 55 | + |
| 56 | +#-----NAT Gateways with Elastic IPs-------------------------- |
| 57 | + |
| 58 | +resource "aws_eip" "nat" { |
| 59 | + # count = length(var.private_subnet_cidrs) |
| 60 | + vpc = true |
| 61 | + tags = merge(var.tags, { Name = "${var.env}-nat-gw" }) |
| 62 | +} |
| 63 | + |
| 64 | + |
| 65 | +resource "aws_nat_gateway" "nat" { |
| 66 | + # count = length(var.private_subnet_cidrs) |
| 67 | + allocation_id = aws_eip.nat.id |
| 68 | + subnet_id = aws_subnet.public_subnets[0].id |
| 69 | + tags = merge(var.tags, { Name = "${var.env}-nat-gw" }) |
| 70 | +} |
| 71 | + |
| 72 | +#--------------Private Subnets and Routing------------------------- |
| 73 | +resource "aws_subnet" "private_subnets" { |
| 74 | + count = length(var.private_subnet_cidrs) |
| 75 | + vpc_id = aws_vpc.sbi.id |
| 76 | + cidr_block = var.private_subnet_cidrs[count.index] |
| 77 | + availability_zone = data.aws_availability_zones.available.names[count.index] |
| 78 | + tags = merge(var.tags, { Name = "${var.env}-private-${count.index + 1}" }) |
| 79 | +} |
| 80 | + |
| 81 | +resource "aws_route_table" "private_subnets" { |
| 82 | + # count = length(var.private_subnet_cidrs) |
| 83 | + vpc_id = aws_vpc.sbi.id |
| 84 | + route { |
| 85 | + cidr_block = "0.0.0.0/0" |
| 86 | + nat_gateway_id = aws_nat_gateway.nat.id |
| 87 | + } |
| 88 | + tags = merge(var.tags, { Name = "${var.env}-route-private-subnet" }) |
| 89 | +} |
| 90 | + |
| 91 | +resource "aws_route_table_association" "private_routes" { |
| 92 | + count = length(aws_subnet.private_subnets[*].id) |
| 93 | + route_table_id = aws_route_table.private_subnets.id |
| 94 | + subnet_id = aws_subnet.private_subnets[count.index].id |
| 95 | +} |
| 96 | + |
| 97 | +#============================================================== |
| 98 | + |
| 99 | +resource "aws_iam_role" "eks_cluster-terra" { |
| 100 | + name = "eks-cluster-terra" |
| 101 | + assume_role_policy = <<POLICY |
| 102 | +{ |
| 103 | + "Version": "2012-10-17", |
| 104 | + "Statement": [ |
| 105 | + { |
| 106 | + "Effect": "Allow", |
| 107 | + "Principal": { |
| 108 | + "Service": "eks.amazonaws.com" |
| 109 | + }, |
| 110 | + "Action": "sts:AssumeRole" |
| 111 | + } |
| 112 | + ] |
| 113 | +} |
| 114 | +POLICY |
| 115 | +} |
| 116 | + |
| 117 | +resource "aws_iam_role_policy_attachment" "AmazonEKSClusterPolicy" { |
| 118 | + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" |
| 119 | + role = aws_iam_role.eks_cluster-terra.name |
| 120 | +} |
| 121 | + |
| 122 | + |
| 123 | +resource "aws_iam_role_policy_attachment" "AmazonEKSServicePolicy" { |
| 124 | + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy" |
| 125 | + role = aws_iam_role.eks_cluster-terra.name |
| 126 | +} |
| 127 | + |
| 128 | +resource "aws_eks_cluster" "aws_eks" { |
| 129 | + name = "eks-cluster-terra" |
| 130 | + role_arn = aws_iam_role.eks_cluster-terra.arn |
| 131 | + |
| 132 | + vpc_config { |
| 133 | + subnet_ids = ["${aws_subnet.private_subnets[0].id}", "${aws_subnet.private_subnets[1].id}", "${aws_subnet.public_subnets[0].id}", "${aws_subnet.public_subnets[1].id}"] |
| 134 | + endpoint_private_access = true |
| 135 | + endpoint_public_access = true |
| 136 | + public_access_cidrs = ["0.0.0.0/0"] |
| 137 | + } |
| 138 | + |
| 139 | + tags = { |
| 140 | + Name = "eks-terra" |
| 141 | + Owner = "Ranjeet Jadhav" |
| 142 | + } |
| 143 | +} |
| 144 | + |
| 145 | +resource "aws_iam_role" "eks-node-grp-terra" { |
| 146 | + name = "eks-nodegrp-terra" |
| 147 | + assume_role_policy = <<POLICY |
| 148 | +{ |
| 149 | + "Version": "2012-10-17", |
| 150 | + "Statement": [ |
| 151 | + { |
| 152 | + "Effect": "Allow", |
| 153 | + "Principal": { |
| 154 | + "Service": "ec2.amazonaws.com" |
| 155 | + }, |
| 156 | + "Action": "sts:AssumeRole" |
| 157 | + } |
| 158 | + ] |
| 159 | +} |
| 160 | +POLICY |
| 161 | +} |
| 162 | + |
| 163 | +resource "aws_iam_role_policy_attachment" "AmazonEKSWorkerNodePolicy" { |
| 164 | + policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy" |
| 165 | + role = aws_iam_role.eks-node-grp-terra.name |
| 166 | +} |
| 167 | + |
| 168 | +resource "aws_iam_role_policy_attachment" "AmazonEKS_CNI_Policy" { |
| 169 | + policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy" |
| 170 | + role = aws_iam_role.eks-node-grp-terra.name |
| 171 | +} |
| 172 | + |
| 173 | +resource "aws_iam_role_policy_attachment" "AmazonEC2ContainerRegistryReadOnly" { |
| 174 | + policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" |
| 175 | + role = aws_iam_role.eks-node-grp-terra.name |
| 176 | +} |
| 177 | + |
| 178 | + |
| 179 | +resource "aws_eks_node_group" "node" { |
| 180 | + cluster_name = aws_eks_cluster.aws_eks.name |
| 181 | + node_group_name = "eks-node-group-terra" |
| 182 | + node_role_arn = aws_iam_role.eks-node-grp-terra.arn |
| 183 | + instance_types = ["t2.medium"] |
| 184 | + subnet_ids = ["${aws_subnet.private_subnets[0].id}", "${aws_subnet.private_subnets[1].id}"] |
| 185 | + ami_type = "AL2_x86_64" # AL2_x86_64, AL2_x86_64_GPU, AL2_ARM_64, CUSTOM |
| 186 | + capacity_type = "ON_DEMAND" # ON_DEMAND, SPOT |
| 187 | + disk_size = 20 |
| 188 | + |
| 189 | + scaling_config { |
| 190 | + desired_size = 1 |
| 191 | + max_size = 1 |
| 192 | + min_size = 1 |
| 193 | + } |
| 194 | + |
| 195 | + # Ensure that IAM Role permissions are created before and deleted after EKS Node Group handling. |
| 196 | + # Otherwise, EKS will not be able to properly delete EC2 Instances and Elastic Network Interfaces. |
| 197 | + depends_on = [ |
| 198 | + aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy, |
| 199 | + aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy, |
| 200 | + aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly, |
| 201 | + ] |
| 202 | +} |
0 commit comments