-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #40 from kunduso/verify-access
Create AWS cloud resources to access the ElastiCache cluster from Amazon EC2 instances.
- Loading branch information
Showing
7 changed files
with
292 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| resource "aws_internet_gateway" "this-igw" { | ||
| vpc_id = aws_vpc.this.id | ||
| tags = { | ||
| "Name" = "app-4-gateway" | ||
| } | ||
| } | ||
| resource "aws_route" "internet-route" { | ||
| destination_cidr_block = "0.0.0.0/0" | ||
| route_table_id = aws_route_table.public.id | ||
| gateway_id = aws_internet_gateway.this-igw.id | ||
| } | ||
| # create a security group | ||
| resource "aws_security_group" "ec2_instance" { | ||
| name = "app-4-ec2" | ||
| description = "Allow inbound to and outbound access from the Amazon EC2 instance." | ||
| ingress { | ||
| from_port = 0 | ||
| to_port = 0 | ||
| protocol = "-1" | ||
| cidr_blocks = [var.vpc_cidr] | ||
| description = "Enable access from any resource inside the VPC." | ||
| } | ||
| egress { | ||
| from_port = 0 | ||
| to_port = 0 | ||
| protocol = "-1" | ||
| cidr_blocks = ["0.0.0.0/0"] | ||
| description = "Enable access to the internet." | ||
| } | ||
| vpc_id = aws_vpc.this.id | ||
| } | ||
|
|
||
| #create an EC2 in a public subnet | ||
| data "aws_ami" "amazon_ami" { | ||
| filter { | ||
| name = "name" | ||
| values = var.ami_name | ||
| } | ||
| filter { | ||
| name = "virtualization-type" | ||
| values = ["hvm"] | ||
| } | ||
| most_recent = true | ||
| owners = ["amazon"] | ||
| } | ||
| resource "aws_instance" "app-server-read" { | ||
| instance_type = var.instance_type | ||
| ami = data.aws_ami.amazon_ami.id | ||
| vpc_security_group_ids = [aws_security_group.ec2_instance.id] | ||
| iam_instance_profile = aws_iam_instance_profile.ec2_profile.name | ||
| associate_public_ip_address = true | ||
| #checkov:skip=CKV_AWS_88: Required for Session Manager access | ||
| subnet_id = aws_subnet.public[0].id | ||
| ebs_optimized = true | ||
| monitoring = true | ||
| root_block_device { | ||
| encrypted = true | ||
| } | ||
| metadata_options { | ||
| http_endpoint = "enabled" | ||
| http_tokens = "required" | ||
| } | ||
| tags = { | ||
| Name = "app-4-server-read" | ||
| } | ||
| user_data = templatefile("user_data/read_elasticache.tpl", | ||
| { | ||
| Region = var.region, | ||
| elasticache_ep = aws_ssm_parameter.elasticache_ep.name, | ||
| elasticache_ep_port = aws_ssm_parameter.elasticache_port.name, | ||
| elasticache_auth_token = aws_secretsmanager_secret.elasticache_auth.name | ||
| }) | ||
| } | ||
| resource "aws_instance" "app-server-write" { | ||
| instance_type = var.instance_type | ||
| ami = data.aws_ami.amazon_ami.id | ||
| vpc_security_group_ids = [aws_security_group.ec2_instance.id] | ||
| iam_instance_profile = aws_iam_instance_profile.ec2_profile.name | ||
| associate_public_ip_address = true | ||
| #checkov:skip=CKV_AWS_88: Required for Session Manager access | ||
| subnet_id = aws_subnet.public[0].id | ||
| ebs_optimized = true | ||
| monitoring = true | ||
| root_block_device { | ||
| encrypted = true | ||
| } | ||
| metadata_options { | ||
| http_endpoint = "enabled" | ||
| http_tokens = "required" | ||
| } | ||
| tags = { | ||
| Name = "app-4-server-write" | ||
| } | ||
| user_data = templatefile("user_data/write_elasticache.tpl", | ||
| { | ||
| Region = var.region, | ||
| elasticache_ep = aws_ssm_parameter.elasticache_ep.name, | ||
| elasticache_ep_port = aws_ssm_parameter.elasticache_port.name, | ||
| elasticache_auth_token = aws_secretsmanager_secret.elasticache_auth.name | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| # #https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role | ||
| resource "aws_iam_role" "ec2_role" { | ||
| name = "app-4-ec2-role" | ||
|
|
||
| # Terraform's "jsonencode" function converts a | ||
| # Terraform expression result to valid JSON syntax. | ||
| assume_role_policy = jsonencode({ | ||
| Version = "2012-10-17" | ||
| Statement = [ | ||
| { | ||
| Action = "sts:AssumeRole" | ||
| Effect = "Allow" | ||
| Sid = "" | ||
| Principal = { | ||
| Service = "ec2.amazonaws.com" | ||
| } | ||
| }, | ||
| ] | ||
| }) | ||
| } | ||
| #Attach role to policy | ||
| #https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment | ||
| resource "aws_iam_role_policy_attachment" "custom" { | ||
| role = aws_iam_role.ec2_role.name | ||
| policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" | ||
| } | ||
|
|
||
| resource "aws_iam_role_policy_attachment" "ssm_policy_attachement" { | ||
| role = aws_iam_role.ec2_role.name | ||
| policy_arn = aws_iam_policy.ssm_parameter_policy.arn | ||
| } | ||
| resource "aws_iam_role_policy_attachment" "secret_policy_attachement" { | ||
| role = aws_iam_role.ec2_role.name | ||
| policy_arn = aws_iam_policy.secret_manager_policy.arn | ||
| } | ||
| #Attach role to an instance profile | ||
| #https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile | ||
| resource "aws_iam_instance_profile" "ec2_profile" { | ||
| name = "app-4-ec2-profile" | ||
| role = aws_iam_role.ec2_role.name | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| #!/bin/bash | ||
| yum update -y | ||
| yum install python-pip -y | ||
| yum install python3 -y | ||
| pip3 install redis-py-cluster | ||
| pip3 install boto3 | ||
| pip3 install botocore | ||
| echo "The region value is ${Region}" | ||
| AWS_REGION=${Region} | ||
| local_elasticache_ep=${elasticache_ep} | ||
| local_auth_token=${elasticache_auth_token} | ||
| local_elasticache_ep_port=${elasticache_ep_port} | ||
| cat <<EOF >> /var/read_cache.py | ||
| from rediscluster import RedisCluster | ||
| from botocore.exceptions import ClientError | ||
| import logging | ||
| import boto3 | ||
| def main(): | ||
| session = boto3.Session(region_name='$AWS_REGION') | ||
| auth_token = get_secret(session) | ||
| elasticache_endpoint = get_elasticache_endpoint(session) | ||
| elasticache_port = get_elasticache_port(session) | ||
| read_from_redis_cluster(elasticache_endpoint, elasticache_port, auth_token) | ||
| def get_secret(session): | ||
| secret_client = session.client('secretsmanager') | ||
| try: | ||
| get_secret_value_response = secret_client.get_secret_value( | ||
| SecretId='$local_auth_token' | ||
| ) | ||
| except ClientError as e: | ||
| raise e | ||
| return get_secret_value_response | ||
| def get_elasticache_endpoint(session): | ||
| ssm_client = session.client('ssm') | ||
| return ssm_client.get_parameter( | ||
| Name='$local_elasticache_ep', WithDecryption=True) | ||
| def get_elasticache_port(session): | ||
| ssm_client = session.client('ssm') | ||
| return ssm_client.get_parameter( | ||
| Name='$local_elasticache_ep_port', WithDecryption=True) | ||
| def read_from_redis_cluster(endpoint, port, auth): | ||
| logging.basicConfig(level=logging.INFO) | ||
| redis = RedisCluster(startup_nodes=[{ | ||
| "host": endpoint['Parameter']['Value'], | ||
| "port": port['Parameter']['Value']}], | ||
| decode_responses=True,skip_full_coverage_check=True,ssl=True, | ||
| password=auth['SecretString']) | ||
| if redis.ping(): | ||
| logging.info("Connected to Redis") | ||
| print("The city name entered is "+redis.get("City")) | ||
| redis.close() | ||
| main() | ||
| EOF |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| #!/bin/bash | ||
| yum update -y | ||
| yum install python-pip -y | ||
| yum install python3 -y | ||
| pip3 install redis-py-cluster | ||
| pip3 install boto3 | ||
| pip3 install botocore | ||
| echo "The region value is ${Region}" | ||
| AWS_REGION=${Region} | ||
| local_elasticache_ep=${elasticache_ep} | ||
| local_auth_token=${elasticache_auth_token} | ||
| local_elasticache_ep_port=${elasticache_ep_port} | ||
| cat <<EOF >> /var/write_cache.py | ||
| from rediscluster import RedisCluster | ||
| import logging | ||
| import boto3 | ||
| import sys | ||
| def main(): | ||
| CityName = input("Enter a City Name: ") | ||
| session = boto3.Session(region_name='$AWS_REGION') | ||
| auth_token = get_secret(session) | ||
| elasticache_endpoint = get_elasticache_endpoint(session) | ||
| elasticache_port = get_elasticache_port(session) | ||
| write_into_redis_cluster( | ||
| elasticache_endpoint, | ||
| elasticache_port, | ||
| auth_token, | ||
| CityName) | ||
| def get_secret(session): | ||
| secret_client = session.client('secretsmanager') | ||
| try: | ||
| get_secret_value_response = secret_client.get_secret_value( | ||
| SecretId='$local_auth_token' | ||
| ) | ||
| except ClientError as e: | ||
| raise e | ||
| return get_secret_value_response | ||
| def get_elasticache_endpoint(session): | ||
| ssm_client = session.client('ssm') | ||
| return ssm_client.get_parameter( | ||
| Name='$local_elasticache_ep', WithDecryption=True) | ||
| def get_elasticache_port(session): | ||
| ssm_client = session.client('ssm') | ||
| return ssm_client.get_parameter( | ||
| Name='$local_elasticache_ep_port', WithDecryption=True) | ||
| def write_into_redis_cluster(endpoint, port, auth, cityname): | ||
| logging.basicConfig(level=logging.INFO) | ||
| redis = RedisCluster(startup_nodes=[{ | ||
| "host": endpoint['Parameter']['Value'], | ||
| "port": port['Parameter']['Value']}], | ||
| decode_responses=True,skip_full_coverage_check=True,ssl=True, | ||
| password=auth['SecretString']) | ||
| if redis.ping(): | ||
| logging.info("Connected to Redis") | ||
| redis.set('City', cityname) | ||
| print("The city name entered is updated in the Redis cache cluster.") | ||
| redis.close() | ||
| main() | ||
| EOF |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters