/
auth_asg.tf
102 lines (90 loc) · 2.94 KB
/
auth_asg.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
// Autoscaling group for Teleport Authentication servers.
// Auth servers are most privileged in terms of IAM roles
// as they are allowed to publish to SSM parameter store,
// write certificates to encrypted S3 bucket.
resource "aws_autoscaling_group" "auth" {
name = "${var.cluster_name}-auth"
max_size = 5
min_size = length(local.azs)
health_check_grace_period = 300
health_check_type = "EC2"
desired_capacity = length(local.azs)
force_delete = false
vpc_zone_identifier = aws_subnet.auth.*.id
launch_template {
name = aws_launch_template.auth.name
version = "$Latest"
}
// These are target groups of the auth server network load balancer
// this autoscaling group is associated with target groups of the NLB
target_group_arns = [aws_lb_target_group.auth.arn]
tag {
key = "TeleportCluster"
value = var.cluster_name
propagate_at_launch = true
}
tag {
key = "TeleportRole"
value = "auth"
propagate_at_launch = true
}
// external autoscale algos can modify these values,
// so ignore changes to them
lifecycle {
ignore_changes = [
desired_capacity,
max_size,
min_size,
]
}
}
resource "aws_launch_template" "auth" {
lifecycle {
create_before_destroy = true
}
name_prefix = "${var.cluster_name}-auth-"
image_id = data.aws_ami.base.id
instance_type = var.auth_instance_type
user_data = base64encode(templatefile(
"${path.module}/auth-user-data.tpl",
{
region = var.region
locks_table_name = aws_dynamodb_table.locks.name
auth_server_addr = aws_lb.auth.dns_name
teleport_auth_type = var.teleport_auth_type
cluster_name = var.cluster_name
dynamo_table_name = aws_dynamodb_table.teleport.name
dynamo_events_table_name = aws_dynamodb_table.teleport_events.name
email = var.email
domain_name = var.route53_domain
s3_bucket = var.s3_bucket_name
license_path = var.license_path
teleport_uid = var.teleport_uid
use_acm = var.use_acm
use_tls_routing = var.use_tls_routing
}
))
metadata_options {
http_tokens = "required"
http_endpoint = "enabled"
}
block_device_mappings {
device_name = "/dev/xvda"
ebs {
delete_on_termination = true
encrypted = true
iops = 3000
throughput = 125
volume_type = "gp3"
}
}
key_name = var.key_name
ebs_optimized = true
network_interfaces {
associate_public_ip_address = false
security_groups = [aws_security_group.auth.id]
}
iam_instance_profile {
name = aws_iam_instance_profile.auth.name
}
}