VPC Setup

vpc.rb

DEB7_AMI = 'ami-61e56916' # Fetched from https://wiki.debian.org/Cloud/AmazonEC2Image/Wheezy

AZS = [:a, :b]

cidr_block_lookup = {
  public: { a: '172.20.0.0/24',
            b: '172.20.1.0/24',
            c: '172.20.2.0/24' },
  private: { a: '172.20.8.0/24',
             b: '172.20.9.0/24',
             c: '172.20.10.0/24' }
}

provider 'aws',
         region: 'eu-west-1',
         access_key: @aws_access_key_id,
         secret_key: @aws_secret_access_key

VPC_NAME = 'SOMETHING'

aws_vpc VPC_NAME,
        tags: { Name: VPC_NAME },
        cidr_block: '172.20.0.0/20'

aws_internet_gateway 'production',
                     vpc_id: id_of('aws_vpc', VPC_NAME)

aws_instance "bastion",
             ami: DEB7_AMI,
             availability_zone: "eu-west-1a",
             instance_type: 't2.micro',
             key_name: 'ops',
             vpc_security_group_ids: [id_of('aws_security_group', 'all_servers'),
                                      id_of('aws_security_group', 'allow_external_ssh'),
                                      id_of('aws_security_group', 'bastion')],
             subnet_id: id_of('aws_subnet', 'public-a'),
             associate_public_ip_address: true,
             source_dest_check: false,
             monitoring: true,
             tags: { Name: "bastion" }

aws_eip "bastion",
        instance: id_of('aws_instance', "bastion"),
        vpc: true

aws_security_group 'allow_external_ssh',
                   name: 'allow_external_ssh',
                   ingress: { from_port: 22,
                              to_port: 22,
                              protocol: 'tcp',
                              cidr_blocks: ['0.0.0.0/0'] },
                   vpc_id: id_of('aws_vpc', VPC_NAME)

aws_security_group 'bastion',
                   name: 'bastion',
                   vpc_id: id_of('aws_vpc', VPC_NAME)

aws_security_group 'allow_bastion',
                   name: 'allow_bastion',
                   ingress: { from_port: 22,
                              to_port: 22,
                              protocol: 'tcp',
                              security_groups: [id_of('aws_security_group', 'bastion')]
                            },
                   vpc_id: id_of('aws_vpc', VPC_NAME)

aws_security_group 'all_servers',
                   name: 'all_servers',
                   egress: { from_port: 0,
                             to_port: 0,
                             protocol: -1,
                             cidr_blocks: ['0.0.0.0/0']
                           },
                   vpc_id: id_of('aws_vpc', VPC_NAME)

aws_route_table 'public',
                tags: { Name: 'public' },
                vpc_id: id_of('aws_vpc', VPC_NAME),
                route: { cidr_block: '0.0.0.0/0',
                         gateway_id: id_of('aws_internet_gateway', 'production')
                       }


AZS.each do |az|
  [:private, :public].each do |type|
    subnet_name = "#{type}-#{az}"
    public_subnet_name = "public-#{az}"
    resource 'aws_subnet', subnet_name,
             tags: { Name: subnet_name },
             vpc_id: id_of('aws_vpc', VPC_NAME),
             cidr_block: cidr_block_lookup[type][az],
             availability_zone: "eu-west-1#{az}"

    case type
    when :public
      nat_eip = "#{subnet_name}-nat"

      resource 'aws_route_table_association', subnet_name,
               route_table_id: id_of('aws_route_table', 'public'),
               subnet_id: id_of('aws_subnet', subnet_name)

      resource 'aws_nat_gateway', subnet_name,
         allocation_id: id_of('aws_eip', nat_eip),
         subnet_id:  id_of('aws_subnet', subnet_name)

      aws_eip nat_eip,
              vpc: true

    when :private
      aws_route_table subnet_name,
                tags: { Name: subnet_name },
                vpc_id: id_of('aws_vpc', VPC_NAME),
                route: { cidr_block: '0.0.0.0/0',
                         nat_gateway_id: id_of('aws_nat_gateway', public_subnet_name)
                       }

      resource 'aws_route_table_association', subnet_name,
               route_table_id: id_of('aws_route_table', subnet_name),
               subnet_id: id_of('aws_subnet', subnet_name)
    end
  end
end