Skip to content

Commit 0ca788a

Browse files
leroyguillaumeleroyguillaume
committed
feat: add support of TLS/DB encryption/custom SG rules
1 parent 664d281 commit 0ca788a

File tree

15 files changed

+541
-281
lines changed

15 files changed

+541
-281
lines changed

‎modules/aws_ec2_standalone/main.tf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@ provider "aws" {
1313

1414
data "aws_ami" "this" {
1515
most_recent = true # get the latest version
16-
filter {
17-
name = "name"
18-
values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
16+
filter {
17+
name = "name"
18+
values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
1919
}
2020

2121
filter {
22-
name = "virtualization-type"
23-
values = ["hvm"]
22+
name = "virtualization-type"
23+
values = ["hvm"]
2424
}
2525

2626
owners = [

‎modules/aws_ecs/ecs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ resource "aws_ecs_cluster_capacity_providers" "this" {
2323
# Required setup for EC2 instances (if not using Fargate)
2424
data "aws_ami" "this" {
2525
most_recent = true # get the latest version
26-
name_regex = "^amzn2-ami-ecs-hvm-\\d\\.\\d\\.\\d{8}-x86_64-ebs$"
26+
name_regex = "^amzn2-ami-ecs-hvm-\\d\\.\\d\\.\\d{8}-x86_64-ebs$"
2727

2828
filter {
2929
name = "virtualization-type"
@@ -67,7 +67,7 @@ resource "aws_launch_configuration" "this" {
6767

6868
# Allow the EC2 instances to access AWS resources on your behalf, using this instance profile and the permissions defined there
6969
iam_instance_profile = aws_iam_instance_profile.ec2[0].arn
70-
70+
7171
lifecycle {
7272
create_before_destroy = true
7373
}

‎modules/aws_ecs/loadbalancers.tf‎

Lines changed: 38 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,57 @@
11
resource "aws_lb" "this" {
22
name = "${var.deployment_name}-alb"
33
idle_timeout = var.alb_idle_timeout
4+
internal = var.alb_internal
45

56
security_groups = [aws_security_group.alb.id]
6-
subnets = var.subnet_ids
7+
subnets = var.alb_subnet_ids != null ? var.alb_subnet_ids : var.subnet_ids
78
}
89

9-
resource "aws_lb_listener" "this" {
10+
resource "aws_lb_listener" "http" {
1011
load_balancer_arn = aws_lb.this.arn
1112
port = 80
1213
protocol = "HTTP"
1314

15+
dynamic "default_action" {
16+
for_each = var.alb_certificate_arn == null ? [1] : []
17+
18+
content {
19+
type = "forward"
20+
target_group_arn = aws_lb_target_group.this.arn
21+
}
22+
}
23+
24+
dynamic "default_action" {
25+
for_each = var.alb_certificate_arn != null ? [1] : []
26+
27+
content {
28+
type = "redirect"
29+
30+
redirect {
31+
port = "443"
32+
protocol = "HTTPS"
33+
status_code = "HTTP_301"
34+
}
35+
}
36+
}
37+
}
38+
39+
resource "aws_lb_listener" "https" {
40+
count = var.alb_certificate_arn != null ? 1 : 0
41+
certificate_arn = var.alb_certificate_arn
42+
load_balancer_arn = aws_lb.this.arn
43+
port = "443"
44+
protocol = "HTTPS"
45+
ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
46+
1447
default_action {
15-
type = "forward"
1648
target_group_arn = aws_lb_target_group.this.arn
49+
type = "forward"
1750
}
1851
}
1952

2053
resource "aws_lb_listener_rule" "this" {
21-
listener_arn = aws_lb_listener.this.arn
54+
listener_arn = var.alb_certificate_arn != null ? aws_lb_listener.https[0].arn : aws_lb_listener.http.arn
2255
priority = 1
2356

2457
action {
@@ -49,4 +82,4 @@ resource "aws_lb_target_group" "this" {
4982
healthy_threshold = 3
5083
unhealthy_threshold = 2
5184
}
52-
}
85+
}

‎modules/aws_ecs/locals.tf‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -49,40 +49,40 @@ locals {
4949
},
5050
# Workflows-specific
5151
{
52-
"name": "WORKFLOW_BACKEND_HOST",
53-
"value": "http://workflow-backend.retoolsvc:3000"
52+
"name" : "WORKFLOW_BACKEND_HOST",
53+
"value" : "http://workflow-backend.retoolsvc:3000"
5454
},
5555
{
56-
"name": "WORKFLOW_TEMPORAL_CLUSTER_NAMESPACE",
57-
"value": var.temporal_cluster_config.namespace
56+
"name" : "WORKFLOW_TEMPORAL_CLUSTER_NAMESPACE",
57+
"value" : var.temporal_cluster_config.namespace
5858
},
5959
{
60-
"name": "WORKFLOW_TEMPORAL_CLUSTER_FRONTEND_HOST",
61-
"value": var.temporal_cluster_config.host
60+
"name" : "WORKFLOW_TEMPORAL_CLUSTER_FRONTEND_HOST",
61+
"value" : var.temporal_cluster_config.host
6262
},
6363
{
64-
"name": "WORKFLOW_TEMPORAL_CLUSTER_FRONTEND_PORT",
65-
"value": var.temporal_cluster_config.port
64+
"name" : "WORKFLOW_TEMPORAL_CLUSTER_FRONTEND_PORT",
65+
"value" : var.temporal_cluster_config.port
6666
},
6767
{
68-
"name": "WORKFLOW_TEMPORAL_TLS_ENABLED",
69-
"value": tostring(var.temporal_cluster_config.tls_enabled)
68+
"name" : "WORKFLOW_TEMPORAL_TLS_ENABLED",
69+
"value" : tostring(var.temporal_cluster_config.tls_enabled)
7070
}
7171
]
7272
)
7373

7474
temporal_mtls_config = (
75-
var.temporal_cluster_config.tls_enabled && var.temporal_cluster_config.tls_crt != null && var.temporal_cluster_config.tls_key != null ?
76-
[
77-
{
78-
"name": "WORKFLOW_TEMPORAL_TLS_CRT",
79-
"value": var.temporal_cluster_config.tls_crt
80-
},
81-
{
82-
"name": "WORKFLOW_TEMPORAL_TLS_KEY",
83-
"value": var.temporal_cluster_config.tls_key
84-
}
85-
] :
86-
[]
75+
var.temporal_cluster_config.tls_enabled && var.temporal_cluster_config.tls_crt != null && var.temporal_cluster_config.tls_key != null ?
76+
[
77+
{
78+
"name" : "WORKFLOW_TEMPORAL_TLS_CRT",
79+
"value" : var.temporal_cluster_config.tls_crt
80+
},
81+
{
82+
"name" : "WORKFLOW_TEMPORAL_TLS_KEY",
83+
"value" : var.temporal_cluster_config.tls_key
84+
}
85+
] :
86+
[]
8787
)
8888
}

‎modules/aws_ecs/main.tf‎

Lines changed: 62 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ resource "aws_cloudwatch_log_group" "this" {
1717
}
1818

1919
resource "aws_db_subnet_group" "this" {
20-
name = "${var.deployment_name}-retool"
20+
name = "${var.deployment_name}-retool"
2121
subnet_ids = var.subnet_ids
2222
}
2323

2424
resource "aws_db_instance" "this" {
25-
identifier = "${var.deployment_name}-rds-instance"
25+
identifier = "${var.deployment_name}-rds-instance"
2626
allocated_storage = 80
2727
instance_class = var.rds_instance_class
2828
engine = "postgres"
@@ -35,9 +35,17 @@ resource "aws_db_instance" "this" {
3535
vpc_security_group_ids = [aws_security_group.rds.id]
3636
db_subnet_group_name = aws_db_subnet_group.this.id
3737
performance_insights_enabled = var.rds_performance_insights_enabled
38-
39-
skip_final_snapshot = true
40-
apply_immediately = true
38+
kms_key_id = var.rds_kms_key_id
39+
storage_encrypted = var.rds_kms_key_id != null
40+
backup_window = var.rds_backup_window
41+
backup_retention_period = var.rds_backup_retention_in_days
42+
43+
skip_final_snapshot = true
44+
apply_immediately = true
45+
46+
lifecycle {
47+
ignore_changes = [engine_version]
48+
}
4149
}
4250

4351
resource "aws_ecs_service" "retool" {
@@ -65,7 +73,7 @@ resource "aws_ecs_service" "retool" {
6573
dynamic "network_configuration" {
6674
for_each = var.launch_type == "FARGATE" ? toset([1]) : toset([])
6775

68-
content {
76+
content {
6977
subnets = var.subnet_ids
7078
security_groups = [
7179
aws_security_group.containers.id
@@ -92,7 +100,7 @@ resource "aws_ecs_service" "jobs_runner" {
92100

93101
for_each = var.launch_type == "FARGATE" ? toset([1]) : toset([])
94102

95-
content {
103+
content {
96104
subnets = var.subnet_ids
97105
security_groups = [
98106
aws_security_group.containers.id
@@ -108,7 +116,7 @@ resource "aws_ecs_service" "workflows_backend" {
108116
cluster = aws_ecs_cluster.this.id
109117
desired_count = 1
110118
task_definition = aws_ecs_task_definition.retool_workflows_backend[0].arn
111-
119+
112120
# Need to explictly set this in aws_ecs_service to avoid destructive behavior: https://github.com/hashicorp/terraform-provider-aws/issues/22823
113121
capacity_provider_strategy {
114122
base = 1
@@ -123,7 +131,7 @@ resource "aws_ecs_service" "workflows_backend" {
123131

124132
for_each = var.launch_type == "FARGATE" ? toset([1]) : toset([])
125133

126-
content {
134+
content {
127135
subnets = var.subnet_ids
128136
security_groups = [
129137
aws_security_group.containers.id
@@ -150,7 +158,7 @@ resource "aws_ecs_service" "workflows_worker" {
150158

151159
for_each = var.launch_type == "FARGATE" ? toset([1]) : toset([])
152160

153-
content {
161+
content {
154162
subnets = var.subnet_ids
155163
security_groups = [
156164
aws_security_group.containers.id
@@ -161,13 +169,13 @@ resource "aws_ecs_service" "workflows_worker" {
161169
}
162170

163171
resource "aws_ecs_task_definition" "retool_jobs_runner" {
164-
family = "retool-jobs-runner"
165-
task_role_arn = aws_iam_role.task_role.arn
166-
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
172+
family = "retool-jobs-runner"
173+
task_role_arn = aws_iam_role.task_role.arn
174+
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
167175
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
168-
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
169-
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["jobs_runner"]["cpu"] : null
170-
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["jobs_runner"]["memory"] : null
176+
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
177+
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["jobs_runner"]["cpu"] : null
178+
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["jobs_runner"]["memory"] : null
171179
container_definitions = jsonencode(
172180
[
173181
{
@@ -211,13 +219,13 @@ resource "aws_ecs_task_definition" "retool_jobs_runner" {
211219
)
212220
}
213221
resource "aws_ecs_task_definition" "retool" {
214-
family = "retool"
215-
task_role_arn = aws_iam_role.task_role.arn
216-
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
222+
family = "retool"
223+
task_role_arn = aws_iam_role.task_role.arn
224+
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
217225
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
218-
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
219-
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["main"]["cpu"] : null
220-
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["main"]["memory"] : null
226+
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
227+
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["main"]["cpu"] : null
228+
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["main"]["memory"] : null
221229
container_definitions = jsonencode(
222230
[
223231
{
@@ -266,14 +274,14 @@ resource "aws_ecs_task_definition" "retool" {
266274
}
267275

268276
resource "aws_ecs_task_definition" "retool_workflows_backend" {
269-
count = var.workflows_enabled ? 1 : 0
270-
family = "retool-workflows-backend"
271-
task_role_arn = aws_iam_role.task_role.arn
272-
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
273-
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
274-
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
275-
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_backend"]["cpu"] : null
276-
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_backend"]["memory"] : null
277+
count = var.workflows_enabled ? 1 : 0
278+
family = "retool-workflows-backend"
279+
task_role_arn = aws_iam_role.task_role.arn
280+
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
281+
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
282+
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
283+
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_backend"]["cpu"] : null
284+
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_backend"]["memory"] : null
277285
container_definitions = jsonencode(
278286
[
279287
{
@@ -321,14 +329,14 @@ resource "aws_ecs_task_definition" "retool_workflows_backend" {
321329
)
322330
}
323331
resource "aws_ecs_task_definition" "retool_workflows_worker" {
324-
count = var.workflows_enabled ? 1 : 0
325-
family = "retool-workflows-worker"
326-
task_role_arn = aws_iam_role.task_role.arn
327-
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
328-
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
329-
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
330-
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_worker"]["cpu"] : null
331-
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_worker"]["memory"] : null
332+
count = var.workflows_enabled ? 1 : 0
333+
family = "retool-workflows-worker"
334+
task_role_arn = aws_iam_role.task_role.arn
335+
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
336+
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
337+
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
338+
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_worker"]["cpu"] : null
339+
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_worker"]["memory"] : null
332340
container_definitions = jsonencode(
333341
[
334342
{
@@ -381,13 +389,13 @@ resource "aws_ecs_task_definition" "retool_workflows_worker" {
381389
}
382390

383391
resource "aws_service_discovery_private_dns_namespace" "retoolsvc" {
384-
count = var.workflows_enabled ? 1 : 0
392+
count = var.workflows_enabled ? 1 : 0
385393
name = "retoolsvc"
386394
description = "Service Discovery namespace for Retool deployment"
387395
vpc = var.vpc_id
388396
}
389397

390-
resource "aws_service_discovery_service" "retool_workflow_backend_service" {
398+
resource "aws_service_discovery_service" "retool_workflow_backend_service" {
391399
count = var.workflows_enabled ? 1 : 0
392400
name = "workflow-backend"
393401

@@ -408,17 +416,20 @@ resource "aws_service_discovery_service" "retool_workflow_backend_service" {
408416
}
409417

410418
module "temporal" {
411-
count = var.workflows_enabled && !var.use_exising_temporal_cluster ? 1 : 0
419+
count = var.workflows_enabled && !var.use_exising_temporal_cluster ? 1 : 0
412420
source = "./temporal"
413-
414-
deployment_name = "${var.deployment_name}-temporal"
415-
vpc_id = var.vpc_id
416-
subnet_ids = var.subnet_ids
417-
private_dns_namespace_id = aws_service_discovery_private_dns_namespace.retoolsvc[0].id
418-
aws_cloudwatch_log_group_id = aws_cloudwatch_log_group.this.id
419-
aws_region = var.aws_region
420-
aws_ecs_cluster_id = aws_ecs_cluster.this.id
421-
launch_type = var.launch_type
422-
container_sg_id = aws_security_group.containers.id
421+
422+
deployment_name = "${var.deployment_name}-temporal"
423+
vpc_id = var.vpc_id
424+
subnet_ids = var.subnet_ids
425+
private_dns_namespace_id = aws_service_discovery_private_dns_namespace.retoolsvc[0].id
426+
aws_cloudwatch_log_group_id = aws_cloudwatch_log_group.this.id
427+
aws_region = var.aws_region
428+
aws_ecs_cluster_id = aws_ecs_cluster.this.id
429+
launch_type = var.launch_type
430+
container_sg_id = aws_security_group.containers.id
423431
aws_ecs_capacity_provider_name = var.launch_type == "EC2" ? aws_ecs_capacity_provider.this[0].name : null
432+
kms_key_id = var.temporal_aurora_kms_key_id
433+
backup_window = var.temporal_aurora_backup_window
434+
backup_retention_in_days = var.temporal_aurora_backup_retention_in_days
424435
}

‎modules/aws_ecs/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,7 @@ output "rds_instance_name" {
4242
value = aws_db_instance.this.db_name
4343
description = "Name of RDS instance"
4444
}
45+
46+
output "sg_containers_id" {
47+
value = aws_security_group.containers.id
48+
}

0 commit comments

Comments
 (0)