Terraform 301 — AWS Infrastructure Engineering

Copylocals {
  name_prefix = "lf-${var.environment}"
  tags = merge(var.common_tags, {
    Environment = var.environment
    ManagedBy   = "terraform"
  })
}

module "network" {
  source      = "../../modules/network"
  name        = "${local.name_prefix}-vpc"
  cidr_block  = var.vpc_cidr
  tags        = local.tags
}

Copy# test.tfvars  - non-prod account, smallest footprint
environment   = "test"
vpc_cidr      = "10.30.0.0/16"
instance_type = "t3.small"
common_tags = {
  CostCenter = "CC-1042"
  Owner      = "infra-platform"
  DataClass  = "internal"
}

Copy# prod.tfvars  - prod account, hardened sizing
environment   = "prod"
vpc_cidr      = "10.10.0.0/16"
instance_type = "m6i.large"
common_tags = {
  CostCenter = "CC-1001"
  Owner      = "infra-platform"
  DataClass  = "confidential"
  Compliance = "sox"
}

Copyoutput "vpc_id" {
  value       = module.network.vpc_id
  description = "VPC id created in this environment"
}

output "private_subnet_ids" {
  value = module.network.private_subnet_ids
}

Copy# modules/security/main.tf  -  the SG chain ALB -> web -> app -> db
# Use aws_vpc_security_group_*_rule (Terraform AWS provider 5.x) instead of inline rules.
# That way each rule is its own resource - cleaner diffs, no churn.

resource "aws_security_group" "alb" {
  name        = "${var.name_prefix}-alb"
  description = "ALB ingress from internet"
  vpc_id      = var.vpc_id
}

resource "aws_vpc_security_group_ingress_rule" "alb_https" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4         = "0.0.0.0/0"
  from_port         = 443
  to_port           = 443
  ip_protocol       = "tcp"
}

resource "aws_security_group" "web" {
  name        = "${var.name_prefix}-web"
  description = "Web tier - only ALB can reach it"
  vpc_id      = var.vpc_id
}
resource "aws_vpc_security_group_ingress_rule" "web_from_alb" {
  security_group_id            = aws_security_group.web.id
  referenced_security_group_id = aws_security_group.alb.id   # <- by id, not CIDR
  from_port                    = 80
  to_port                      = 80
  ip_protocol                  = "tcp"
}

resource "aws_security_group" "app" { name = "${var.name_prefix}-app"  vpc_id = var.vpc_id }
resource "aws_vpc_security_group_ingress_rule" "app_from_web" {
  security_group_id            = aws_security_group.app.id
  referenced_security_group_id = aws_security_group.web.id
  from_port = 8080  to_port = 8080  ip_protocol = "tcp"
}

resource "aws_security_group" "db"  { name = "${var.name_prefix}-db"   vpc_id = var.vpc_id }
resource "aws_vpc_security_group_ingress_rule" "db_from_app" {
  security_group_id            = aws_security_group.db.id
  referenced_security_group_id = aws_security_group.app.id
  from_port = 3306  to_port = 3306  ip_protocol = "tcp"
}

# Egress: explicit, not implicit "all"
# Each tier gets exactly what it needs.
resource "aws_vpc_security_group_egress_rule" "app_to_db" {
  security_group_id            = aws_security_group.app.id
  referenced_security_group_id = aws_security_group.db.id
  from_port = 3306  to_port = 3306  ip_protocol = "tcp"
}

Copy# modules/iam/main.tf  -  EC2 instance profile (least privilege)

data "aws_iam_policy_document" "assume_ec2" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ec2_app" {
  name               = "${var.name_prefix}-ec2-app"
  assume_role_policy = data.aws_iam_policy_document.assume_ec2.json
  tags               = var.tags
}

# Managed policy: SSM Session Manager (no SSH needed, ever)
resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.ec2_app.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# Inline policy: app-specific permissions
data "aws_iam_policy_document" "app_inline" {
  statement {
    sid     = "ReadAppArtifacts"
    actions = ["s3:GetObject", "s3:ListBucket"]
    resources = [
      "arn:aws:s3:::${var.artifacts_bucket}",
      "arn:aws:s3:::${var.artifacts_bucket}/*",
    ]
  }
  statement {
    sid     = "DecryptWithAppKey"
    actions   = ["kms:Decrypt"]
    resources = [var.app_kms_key_arn]
  }
}

resource "aws_iam_role_policy" "app_inline" {
  name   = "app-inline"
  role   = aws_iam_role.ec2_app.id
  policy = data.aws_iam_policy_document.app_inline.json
}

# Bind role to an instance profile - this is what you attach to EC2
resource "aws_iam_instance_profile" "ec2_app" {
  name = "${var.name_prefix}-ec2-app"
  role = aws_iam_role.ec2_app.name
}

output "instance_profile_name" { value = aws_iam_instance_profile.ec2_app.name }

Copy# Key pair (break-glass only - normal access is via SSM)
resource "tls_private_key" "break_glass" {
  algorithm = "ED25519"
}

resource "aws_key_pair" "break_glass" {
  key_name   = "${var.name_prefix}-break-glass"
  public_key = tls_private_key.break_glass.public_key_openssh
}

# Store the private key in SSM Parameter Store, not on a laptop
resource "aws_ssm_parameter" "break_glass_priv" {
  name  = "/${var.environment}/keys/break-glass"
  type  = "SecureString"
  value = tls_private_key.break_glass.private_key_pem
  tags  = var.tags
}

# Extra EBS volume for app data (separate from root)
resource "aws_ebs_volume" "app_data" {
  availability_zone = var.az
  size              = var.data_volume_size_gb     # e.g. 100
  type              = "gp3"
  iops              = 3000
  throughput        = 125
  encrypted         = true
  kms_key_id        = var.app_kms_key_arn
  tags              = merge(var.tags, { Name = "${var.name_prefix}-data" })
}

resource "aws_volume_attachment" "app_data" {
  device_name = "/dev/xvdf"
  volume_id   = aws_ebs_volume.app_data.id
  instance_id = aws_instance.app.id
}

Copy# modules/compute/main.tf - launch template + autoscaling group + ALB target group

data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}

resource "aws_launch_template" "app" {
  name_prefix            = "${var.name_prefix}-app-"
  image_id               = data.aws_ami.al2023.id
  instance_type          = var.instance_type
  key_name               = var.key_pair_name
  vpc_security_group_ids = [var.app_sg_id]

  iam_instance_profile {
    name = var.instance_profile_name
  }

  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      volume_size = 30
      volume_type = "gp3"
      encrypted   = true
    }
  }

  user_data = base64encode(templatefile("${path.module}/userdata.sh.tpl", {
    environment = var.environment
  }))

  tag_specifications {
    resource_type = "instance"
    tags          = merge(var.tags, { Name = "${var.name_prefix}-app" })
  }
}

resource "aws_autoscaling_group" "app" {
  name                = "${var.name_prefix}-app-asg"
  vpc_zone_identifier = var.private_subnet_ids
  min_size            = var.min_size
  max_size            = var.max_size
  desired_capacity    = var.desired_capacity
  target_group_arns   = [aws_lb_target_group.app.arn]
  health_check_type   = "ELB"

  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }

  tag {
    key                 = "Environment"
    value               = var.environment
    propagate_at_launch = true
  }
}

Copy# modules/database/main.tf - Aurora MySQL cluster (writer + 2 readers, Multi-AZ)

resource "aws_db_subnet_group" "this" {
  name       = "${var.name_prefix}-db"
  subnet_ids = var.private_subnet_ids
  tags       = var.tags
}

resource "aws_rds_cluster_parameter_group" "this" {
  name   = "${var.name_prefix}-aurora-mysql"
  family = "aurora-mysql8.0"
  parameter {
    name  = "binlog_format"
    value = "ROW"
  }
}

resource "aws_rds_cluster" "this" {
  cluster_identifier           = "${var.name_prefix}-aurora"
  engine                       = "aurora-mysql"
  engine_version               = "8.0.mysql_aurora.3.05.2"
  database_name                = var.db_name
  master_username              = var.db_user
  master_password              = random_password.db.result
  db_subnet_group_name         = aws_db_subnet_group.this.name
  vpc_security_group_ids       = [var.db_sg_id]
  db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.this.name
  storage_encrypted            = true
  kms_key_id                   = var.kms_key_arn
  backup_retention_period      = var.backup_retention_days
  preferred_backup_window      = "03:00-04:00"
  deletion_protection          = var.environment == "prod"
  skip_final_snapshot          = var.environment != "prod"
  tags                          = var.tags
}

resource "aws_rds_cluster_instance" "this" {
  count                = var.cluster_size       # prod=3, uat=2, test=1
  identifier           = "${var.name_prefix}-aurora-${count.index}"
  cluster_identifier   = aws_rds_cluster.this.id
  instance_class       = var.db_instance_class
  engine               = aws_rds_cluster.this.engine
  engine_version       = aws_rds_cluster.this.engine_version
  db_subnet_group_name = aws_db_subnet_group.this.name
  tags                 = var.tags
}

resource "random_password" "db" {
  length  = 32
  special = true
}

resource "aws_secretsmanager_secret" "db" {
  name = "${var.name_prefix}/db/master"
}
resource "aws_secretsmanager_secret_version" "db" {
  secret_id     = aws_secretsmanager_secret.db.id
  secret_string = jsonencode({ username = var.db_user, password = random_password.db.result })
}

Copy# envs/uat/main.tf - the env root just composes modules with uat values

module "network" {
  source     = "../../modules/network"
  name       = "lf-${var.environment}"
  cidr_block = var.vpc_cidr
  tags       = local.tags
}

module "security" {
  source      = "../../modules/security"
  name_prefix = "lf-${var.environment}"
  vpc_id      = module.network.vpc_id
}

module "iam" {
  source           = "../../modules/iam"
  name_prefix      = "lf-${var.environment}"
  artifacts_bucket = "lf-artifacts-${var.environment}"
  app_kms_key_arn  = aws_kms_key.app.arn
  tags             = local.tags
}

module "app" {
  source                = "../../modules/compute"
  name_prefix           = "lf-${var.environment}"
  environment           = var.environment
  private_subnet_ids    = module.network.private_subnet_ids
  app_sg_id             = module.security.app_sg_id
  instance_profile_name = module.iam.instance_profile_name
  instance_type         = var.instance_type
  min_size              = 2
  max_size              = 4
  desired_capacity      = 2
  tags                  = local.tags
}

module "db" {
  source                  = "../../modules/database"
  name_prefix             = "lf-${var.environment}"
  environment             = var.environment
  private_subnet_ids      = module.network.private_subnet_ids
  db_sg_id                = module.security.db_sg_id
  kms_key_arn             = aws_kms_key.app.arn
  cluster_size            = 2
  db_instance_class       = "db.r6g.large"
  backup_retention_days   = 14
  db_name                  = "appdb"
  db_user                  = "appadmin"
  tags                     = local.tags
}