/
server.tf
112 lines (100 loc) · 3.09 KB
/
server.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
##################################
# Security Groups
##################################
resource "aws_security_group" "sg_server" {
name = "Access for lakefs EC2 instance"
vpc_id = var.vpc_id
}
# Allow my IP to SSH
resource "aws_security_group_rule" "allow_my_ip_ssh" {
type = "ingress"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["${chomp(data.http.myip.body)}/32"]
security_group_id = aws_security_group.sg_server.id
}
# Allow ingress to UI
resource "aws_security_group_rule" "allow_my_ip_8000" {
type = "ingress"
from_port = 8000
to_port = 8000
protocol = "tcp"
cidr_blocks = ["${chomp(data.http.myip.body)}/32"]
security_group_id = aws_security_group.sg_server.id
}
# Glue
# TODO we aren't in a VPC so I had to allow 0/0
resource "aws_security_group_rule" "allow_glue_8000" {
type = "ingress"
from_port = 8000
to_port = 8000
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = aws_security_group.sg_server.id
}
resource "aws_security_group_rule" "allow_egress" {
type = "egress"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = aws_security_group.sg_server.id
}
##################################
# AMI
##################################
data "aws_ami" "amzn2" {
most_recent = true
filter {
name = "name"
values = ["amzn2-ami-kernel-*-x86_64-gp2"]
}
filter {
name = "virtualization-type"
values = ["hvm"]
}
owners = ["amazon"]
#owners = ["137112412989"] # Amazon
#image_owner_alias = "amazon"
}
##################################
# Server Instance
##################################
# Lookup the RDS as it could have been created from a snapshot
data "aws_db_instance" "lakefs" {
db_instance_identifier = local.rds_identifier
depends_on = [
aws_db_instance.lakefs,
aws_db_instance.lakefs_from_snapshot,
]
}
resource "aws_instance" "server" {
ami = data.aws_ami.amzn2.id
instance_type = var.lakefs_ec2_instance_type
subnet_id = var.subnet_ids[0]
vpc_security_group_ids = [aws_security_group.sg_server.id]
associate_public_ip_address = true
iam_instance_profile = aws_iam_instance_profile.lakefs_server.name
user_data = templatefile(
"scripts/server-cloud-init.yaml",
{
# TODO using the rds admin user for convenience
database_connection_string = format(
"postgresql://%s:%s@%s/%s",
var.rds_admin_user,
var.rds_admin_password,
data.aws_db_instance.lakefs.endpoint,
data.aws_db_instance.lakefs.db_name
)
encrypt_secret_key = var.lakefs_encrypt_secret_key
region = var.region
account_id = var.aws_account_id
ssh_authorized_keys = var.ssh_authorized_keys
})
# Rather add your public SSH keys to scripts/server-cloud-init.yaml
key_name = var.ec2_key_pair_name
tags = {
Name = "lakefs-server"
}
}