Terraform code to create an EC2 instance with Amazon linux 2, ECS and Falco

README.md

To create the instance:

terraform init
terraform apply

To log in:

$(terraform output ssh)

To remove everything:

terraform destroy

main.tf

provider "aws" {
  region = "eu-west-1"
}

data "aws_ami" "amzn2" {
  most_recent = true

  filter {
    name   = "name"
    values = ["amzn2-ami-ecs-hvm-*-x86_64-ebs"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }

  owners = ["amazon"]
}

resource "tls_private_key" "instance" {
  algorithm = "RSA"
  rsa_bits  = 2048
}

resource "random_string" "key" {
  length  = 32
  special = false
}

resource "local_file" "key" {
  sensitive_content = tls_private_key.instance.private_key_pem
  filename          = random_string.key.result
  file_permission   = "0600"
}

resource "aws_key_pair" "instance" {
  public_key = tls_private_key.instance.public_key_openssh
}

resource "aws_security_group" "instance" {
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = -1
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "instance" {
  ami                         = data.aws_ami.amzn2.id
  instance_type               = "c5.large"
  key_name                    = aws_key_pair.instance.key_name
  associate_public_ip_address = true
  vpc_security_group_ids      = [aws_security_group.instance.id]
  user_data                   = <<EOF
#!/usr/bin/env bash
rpm --import https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public
curl -s -o /etc/yum.repos.d/draios.repo https://s3.amazonaws.com/download.draios.com/stable/rpm/draios.repo
yum -y install kernel-devel-$(uname -r)
yum -y install falco vim
systemctl enable falco
systemctl start falco
docker pull centos
EOF
}

output "ssh" {
  value = "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ${local_file.key.filename} ec2-user@${aws_instance.instance.public_ip}"
}