This module creates Linux or Windows EC2 instances.
- Optionally set an Elastic IP (EIP)
- Specify an IAM role
- Assign security groups
- Optionally join a domain using SSM documents (see notes below)
- Attach 1 or more additional EBS volumes
- Support metadata IMDSv1 and IMDSv2
- For better security the default is IMDSv2. Using IMDSv1 will show up as "High" in SecurityHub
- Specify optional user data scripts
Add your own server specifc user data scripts (see full example below) that will be executed after the disk intialisation. To debug the scripts see the following folder on the running instance: C:\ProgramData\Amazon\EC2-Windows\Launch\Log
In order to join a domain as part of provisioning an Active Directory and SSM document must be in place already.
When using AWS AD sharing a default SSM document will be created that can be used.
This module follows the AWS conventions where by \dev\sda1
is defined as the root device and all other ebs volumes use the recommended names xvd[f-z] *
When creating addtional ebs volumes you can specify any variables as described in the Terraform docs: https://www.terraform.io/docs/providers/aws/r/instance.html#block-devices
For Windows you can specify the following drive properties as well:
- volume_letter
- volume_name
For example:
ebs_block_device = [
{
volume_letter = "E"
volume_name = "Data"
device_name = "xvdg"
volume_type = "gp2"
volume_size = 20
delete_on_termination = true
}
]
module "ec2_myserver" {
source = "git::https://github.com/ifunky/terraform-aws-ec2-instance?ref=master"
ami = data.aws_ami.linux.id
iam_role = "iam_role_name"
key_pair = "${var.useful_thing}"
instance_type = "t3a.small"
vpc_id = "a-12345678"
security_groups = ["sg_windows"]
subnet = "i-3r4t555"
name = "My_Server"
namespace = "ifunky"
stage = "dev"
tags = {
Terraform = "true"
}
}
Full example
module "ec2_myserver" {
source = "git::https://github.com/ifunky/terraform-aws-ec2-instance?ref=master"
ami = data.aws_ami.linux.id
iam_role = "iam_role_name"
key_pair = var.my_key
instance_type = "t3a.small"
vpc_id = "a-e343434334"
security_groups = ["sg_windows"]
subnet = "i-573443ww"
name = "My_Server"
namespace = "ifunky"
stage = "dev"
metadata_options {
enabled = true
require_session_tokens = true # Use metadata service V2
http_hop_limit = 1
}
user_data =<<EOF
echo "test" > c:\windows\temp\log1.log
echo "test2" > c:\windows\temp\log2.log
EOF
join_domain = true
join_domain_ssm_document = "awsconfig_Domain_d-34343434_ifunky.com"
join_domain_ssm_params = {
ServerName = "MyServerName"
}
ebs_block_device = [
{
volume_letter = "E"
volume_name = "Data"
device_name = "xvdg"
volume_type = "gp2"
volume_size = 20
delete_on_termination = true
},
{
volume_letter = "F"
volume_name = "Logs"
device_name = "xvdh"
volume_type = "gp2"
volume_size = 25
delete_on_termination = true
},
]
tags = {
Terraform = "true"
}
}
The following targets are available:
createdocs/help Create documentation help
polydev/createdocs Run PolyDev createdocs directly from your shell
polydev/help Help on using PolyDev locally
polydev/init Initialise the project
polydev/validate Validate the code
polydev Run PolyDev interactive shell to start developing with all the tools or run AWS CLI commands :-)
Core Version Constraints:
~> 0.13.5
Provider Requirements:
- aws:
~> 3.0
ami
(required): The AMI to use for the instanceassign_eip_address
(defaulttrue
): Assign an Elastic IP address to the instanceassociate_public_ip_address
(defaulttrue
): Associate a public IP address with the instanceattributes
(required): Additional attributes (e.g.1
)availability_zone
(required): Availability Zone the instance is launched in. If not set, will be launched in the first AZ of the regiondelete_on_termination
(defaulttrue
): Whether the volume should be destroyed on instance terminationdelimiter
(default"-"
): Delimiter to be used betweennamespace
,environment
,stage
,name
andattributes
detailed_monitoring
(required): Enables EC2 detailed monitoringdisable_api_termination
(required): Enable EC2 instance termination protectionebs_block_device
(required): Additional EBS block devices to attach to the instanceebs_device_name
(default["/dev/xvdb","/dev/xvdc","/dev/xvdd","/dev/xvde","/dev/xvdf","/dev/xvdg","/dev/xvdh","/dev/xvdi","/dev/xvdj","/dev/xvdk","/dev/xvdl","/dev/xvdm","/dev/xvdn","/dev/xvdo","/dev/xvdp","/dev/xvdq","/dev/xvdr","/dev/xvds","/dev/xvdt","/dev/xvdu","/dev/xvdv","/dev/xvdw","/dev/xvdx","/dev/xvdy","/dev/xvdz"]
): Name of the EBS device to mountebs_iops
(required): Amount of provisioned IOPS. This must be set with a volume_type of io1ebs_optimized
(required): Minimises contention between Amazon EBS I/O and other traffic from your instanceebs_volume_count
(required): Count of EBS volumes that will be attached to the instanceebs_volume_size
(default10
): Size of the EBS volume in gigabytesebs_volume_type
(default"gp2"
): The type of EBS volume. Can be standard, gp2 or io1enabled
(defaulttrue
): Set to false to prevent the module from creating any resourcesenvironment
(required): Environment, e.g. 'prod', 'staging', 'dev', 'pre-prod', 'UAT'ephemeral_block_device
(required): Add Ephemeral volumes to the instanceiam_role
(required): IAM instance profile to assign to instanceinstance_type
(default"t2.micro"
): The type of the instancejoin_domain
(required): If true uses SSM document attachment for AD domain joiningjoin_domain_ssm_document
(required): SSM document name that will be used for joining the domainjoin_domain_ssm_params
(required): Parameters to pass into the join domain SSM document.key_pair
(required): Key pair used to when provisioning the instancemetadata_options
(default{"enabled":true,"http_hop_limit":1,"require_session_tokens":false}
): Set instance metadata optionsname
(required): Solution name, e.g. 'app' or 'jenkins'namespace
(required): Namespace, which could be your organization name or abbreviation, e.g. 'ifunky' or 'WonkaCo'os_type
(default"linux"
): Type of OS. Either linux or windowsplacement_group
(required): Placement Group to launch the instance inprivate_ip
(required): Private IP address to associate with the instance in the VPCregion
(required): AWS Region to launch the region in, defaults to current context region if not specifedroot_block_device
(default[{"delete_on_termination":true,"volume_size":60,"volume_type":"gp2"}]
): Customise root block devices of the instancesecurity_groups
(required): List of Security Group IDs allowed to connect to the instancesource_dest_check
(defaulttrue
): Controls if traffic is routed to the instance when the destination address does not match the instance. Used for NAT or VPNsstage
(required): Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'subnet
(required): VPC Subnet ID to launch the instance intotags
(required): Additional tags (e.g.map('BusinessUnit','XYZ')
user_data
(required): Instance user data. Do not pass gzip-compressed data via this argumentvpc_id
(required): The ID of the VPC that the instance security group belongs to
ebs_ids
: IDs of EBSsid
: ID of the instanceprivate_dns
: Private DNS of instanceprivate_ip
: Private IP of instancepublic_dns
: Public DNS of instance (or DNS of EIP)public_ip
: Public IP of instance (or EIP)
aws_ebs_volume.default
fromaws
aws_eip.default
fromaws
aws_instance.default
fromaws
aws_ssm_association.default
fromaws
aws_volume_attachment.default
fromaws
data.aws_caller_identity.default
fromaws
data.aws_region.default
fromaws
data.aws_subnet.default
fromaws
label
fromgit::https://github.com/cloudposse/terraform-null-label?ref=master
Here are some useful related projects.
- PolyDev - PolyDev repo and setup guide
For more information please see the following links of interest:
- AWS Windows User Data - AWS Windows User Data guide
- AWS Windows Device Mapping - AWS Windows Volume Mapping
- AWS Metadata Service - Metadata Official Docs
- Terraform EC2 Instance - Terraform EC2 documentation