lawliet89

resource "aws_instance" "instance" {
  ami           = "${data.aws_ami.ubuntu.id}"
  instance_type = "${var.instance_type}"

  key_name               = "${var.ssh_key_name}"
  subnet_id              = "${var.subnet_id}"
  vpc_security_group_ids = ["${aws_security_group.instance.id}"]

  tags        = "${merge(var.tags, map("Name", "${var.name}"))}"
  volume_tags = "${merge(var.tags, map("Name", "${var.name}"))}"

lawliet89

data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"

lawliet89

resource "aws_security_group" "instance" {
  name   = "${var.name}"
  vpc_id = "${var.vpc_id}"

  tags = "${merge(var.tags, map("Name", "${var.name}"))}"
}

resource "aws_security_group_rule" "ssh_inbound" {
  type        = "ingress"
  from_port   = 22

lawliet89

data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

module "secure-baseline" {
  source  = "nozaq/secure-baseline/aws"

  audit_log_bucket_name = "YOUR_BUCKET_NAME"
  aws_account_id = "${data.aws_caller_identity.current.account_id}"
  region = "${data.aws_region.current.name}"
  support_iam_role_principal_arn = "YOUR_IAM_USER"

lawliet89

# This file manages Route53 records
data "aws_route53_zone" "domain" {
  name = "${var.route53_zone}"
}

resource "aws_route53_record" "domain" {
  zone_id = "${data.aws_route53_zone.domain.zone_id}"

  name = "${var.domain}"
  type = "A"

lawliet89

# LB -> Clients
resource "aws_security_group_rule" "lb_client_egress" {
  type                     = "egress"
  from_port                = "${local.client_port}"
  to_port                  = "${local.client_port}"
  protocol                 = "tcp"
  source_security_group_id = "${aws_security_group.client.id}"
  security_group_id        = "${aws_security_group.lb.id}"
}

lawliet89

resource "aws_lb_listener_rule" "client" {
  listener_arn = "${aws_lb_listener.https.arn}"
  priority     = 100

  action {
    type             = "forward"
    target_group_arn = "${aws_lb_target_group.client.arn}"
  }

  condition {

lawliet89

# HTTP listener to redirect to HTTPS
resource "aws_lb_listener" "front_end" {
  load_balancer_arn = "${aws_lb.lb.arn}"
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {

lawliet89

resource "aws_lb" "lb" {
  name            = "${var.lb_name}"
  security_groups = ["${aws_security_group.lb.id}"]
  subnets         = ["${var.subnet_ids}"]

  tags = "${merge(var.tags, map("Name", "${var.lb_name}"))}"
}

resource "aws_security_group" "lb" {
  name        = "${var.lb_name}"

lawliet89

resource "aws_security_group" "client" {
  name_prefix = "${var.client_asg_name}"
  description = "Security Group for ${var.client_asg_name}"
  vpc_id      = "${var.vpc_id}"

  tags = "${merge(var.tags, map("Name", "${var.client_asg_name}"))}"

  # aws_launch_configuration.launch_configuration in this module sets create_before_destroy to true, which means
  # everything it depends on, including this resource, must set it as well, or you'll get cyclic dependency errors
  # when you try to do a terraform destroy.