Infrastructure as Code

module "eks_node_group" {
  source = "../../modules/eks-node-group"

  cluster_name    = var.cluster_name
  node_group_name = "${var.cluster_name}-${var.pool_name}"
  subnet_ids      = var.private_subnet_ids
  instance_types  = var.instance_types
  desired_size    = var.desired_size
  min_size        = var.min_size
  max_size        = var.max_size

  labels = {
    nodepool = var.pool_name
  }

  taints = var.taints

  tags = merge(var.common_tags, {
    ManagedBy = "terraform"
  })
}

terraform {
  required_version = ">= 1.6.0"

  backend "s3" {
    bucket         = "acme-terraform-state"
    key            = "production/eks/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "acme-terraform-locks"
  }

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      Environment = var.environment
      Repository  = "github.com/acme/platform-iac"
    }
  }
}

moved {
  from = aws_instance.web
  to   = aws_instance.web_v2
}

resource "aws_instance" "web_v2" {
  ami           = var.ami_id
  instance_type = "m6i.large"
  subnet_id     = var.subnet_id

  tags = {
    Name = "web-${var.environment}"
  }
}

resource "aws_s3_bucket" "artifacts" {
  bucket = var.bucket_name
}

resource "aws_s3_bucket_public_access_block" "artifacts" {
  bucket = aws_s3_bucket.artifacts.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "artifacts" {
  bucket = aws_s3_bucket.artifacts.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = var.kms_key_arn
    }
    bucket_key_enabled = true
  }
}

data "aws_iam_policy_document" "payments_api" {
  statement {
    sid    = "ReadArtifacts"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:ListBucket"
    ]
    resources = [
      aws_s3_bucket.artifacts.arn,
      "${aws_s3_bucket.artifacts.arn}/payments/*"
    ]
  }

  statement {
    sid    = "DecryptWithKms"
    effect = "Allow"
    actions = ["kms:Decrypt"]
    resources = [aws_kms_key.artifacts.arn]
  }
}

resource "aws_iam_role" "payments_api" {
  name = "payments-api-${var.environment}"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = aws_iam_openid_connect_provider.eks.arn
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "${replace(aws_iam_openid_connect_provider.eks.url, "https://", "")}:sub" =
            "system:serviceaccount:production:payments-api"
        }
      }
    }]
  })
}

locals {
  environment = basename(get_terragrunt_dir())
  common_tags = {
    Environment = local.environment
    ManagedBy   = "terragrunt"
  }
}

remote_state {
  backend = "s3"
  generate = {
    path      = "backend.tf"
    if_exists = "overwrite_terragrunt"
  }
  config = {
    bucket         = "acme-terraform-state"
    key            = "${local.environment}/${path_relative_to_include()}/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "acme-terraform-locks"
  }
}

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  source = "../../../modules//vpc"
}

dependency "network" {
  config_path = "../vpc"

  mock_outputs = {
    private_subnet_ids = ["subnet-mock-a", "subnet-mock-b"]
  }
  mock_outputs_allowed_terraform_commands = ["plan", "validate"]
}

inputs = {
  vpc_cidr           = "10.20.0.0/16"
  private_subnet_ids = dependency.network.outputs.private_subnet_ids
  cluster_name       = "acme-${basename(get_terragrunt_dir())}"
}

---
- name: Harden EKS bastion hosts
  hosts: bastions
  become: true
  vars:
    ssh_allowed_cidrs:
      - 10.0.0.0/8
  roles:
    - role: devsecops.ssh_hardening
    - role: devsecops.auditd
  tasks:
    - name: Ensure fail2ban running
      ansible.builtin.service:
        name: fail2ban
        state: started
        enabled: true
    - name: Restrict SSH users
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^AllowUsers'
        line: 'AllowUsers deploy'
      notify: Restart sshd
  handlers:
    - name: Restart sshd
      ansible.builtin.service:
        name: sshd
        state: restarted

import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";
import * as pulumi from "@pulumi/pulumi";

const config = new pulumi.Config();
const clusterName = config.require("clusterName");

const cluster = new eks.Cluster(clusterName, {
  version: "1.29",
  instanceType: "m6i.large",
  desiredCapacity: 3,
  minSize: 2,
  maxSize: 6,
  tags: {
    Environment: pulumi.getStack(),
    ManagedBy: "pulumi",
  },
});

export const kubeconfig = cluster.kubeconfig;
export const clusterArn = cluster.core.cluster.arn;

repos:
  - id: github.com/acme/platform-iac
    apply_requirements: [approved, mergeable]
    workflow: terragrunt
    allowed_overrides: [workflow]
    pre_workflow_hooks:
      - run: terragrunt hclfmt --check

workflows:
  terragrunt:
    plan:
      steps:
        - init
        - run: terragrunt run-all plan -no-color -out=$PLANFILE
    apply:
      steps:
        - init
        - run: terragrunt run-all apply -auto-approve $PLANFILE