Skip to content

Commit 2afc4ed

Browse files
leroyguillaumeleroyguillaume
committed
feat: add support of TLS/DB encryption/custom SG rules
1 parent 664d281 commit 2afc4ed

File tree

15 files changed

+530
-281
lines changed

15 files changed

+530
-281
lines changed

‎modules/aws_ec2_standalone/main.tf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@ provider "aws" {
1313

1414
data "aws_ami" "this" {
1515
most_recent = true # get the latest version
16-
filter {
17-
name = "name"
18-
values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
16+
filter {
17+
name = "name"
18+
values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
1919
}
2020

2121
filter {
22-
name = "virtualization-type"
23-
values = ["hvm"]
22+
name = "virtualization-type"
23+
values = ["hvm"]
2424
}
2525

2626
owners = [

‎modules/aws_ecs/ecs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ resource "aws_ecs_cluster_capacity_providers" "this" {
2323
# Required setup for EC2 instances (if not using Fargate)
2424
data "aws_ami" "this" {
2525
most_recent = true # get the latest version
26-
name_regex = "^amzn2-ami-ecs-hvm-\\d\\.\\d\\.\\d{8}-x86_64-ebs$"
26+
name_regex = "^amzn2-ami-ecs-hvm-\\d\\.\\d\\.\\d{8}-x86_64-ebs$"
2727

2828
filter {
2929
name = "virtualization-type"
@@ -67,7 +67,7 @@ resource "aws_launch_configuration" "this" {
6767

6868
# Allow the EC2 instances to access AWS resources on your behalf, using this instance profile and the permissions defined there
6969
iam_instance_profile = aws_iam_instance_profile.ec2[0].arn
70-
70+
7171
lifecycle {
7272
create_before_destroy = true
7373
}

‎modules/aws_ecs/loadbalancers.tf‎

Lines changed: 37 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,54 @@ resource "aws_lb" "this" {
33
idle_timeout = var.alb_idle_timeout
44

55
security_groups = [aws_security_group.alb.id]
6-
subnets = var.subnet_ids
6+
subnets = var.alb_subnet_ids != null ? var.alb_subnet_ids : var.subnet_ids
77
}
88

9-
resource "aws_lb_listener" "this" {
9+
resource "aws_lb_listener" "http" {
1010
load_balancer_arn = aws_lb.this.arn
1111
port = 80
1212
protocol = "HTTP"
1313

14+
dynamic "default_action" {
15+
for_each = var.alb_certificate_arn == null ? [1] : []
16+
17+
content {
18+
type = "forward"
19+
target_group_arn = aws_lb_target_group.this.arn
20+
}
21+
}
22+
23+
dynamic "default_action" {
24+
for_each = var.alb_certificate_arn != null ? [1] : []
25+
26+
content {
27+
type = "redirect"
28+
29+
redirect {
30+
port = "443"
31+
protocol = "HTTPS"
32+
status_code = "HTTP_301"
33+
}
34+
}
35+
}
36+
}
37+
38+
resource "aws_lb_listener" "https" {
39+
count = var.alb_certificate_arn != null ? 1 : 0
40+
certificate_arn = var.alb_certificate_arn
41+
load_balancer_arn = aws_lb.this.arn
42+
port = "443"
43+
protocol = "HTTPS"
44+
ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
45+
1446
default_action {
15-
type = "forward"
1647
target_group_arn = aws_lb_target_group.this.arn
48+
type = "forward"
1749
}
1850
}
1951

2052
resource "aws_lb_listener_rule" "this" {
21-
listener_arn = aws_lb_listener.this.arn
53+
listener_arn = var.alb_certificate_arn != null ? aws_lb_listener.https[0].arn : aws_lb_listener.http.arn
2254
priority = 1
2355

2456
action {
@@ -49,4 +81,4 @@ resource "aws_lb_target_group" "this" {
4981
healthy_threshold = 3
5082
unhealthy_threshold = 2
5183
}
52-
}
84+
}

‎modules/aws_ecs/locals.tf‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -49,40 +49,40 @@ locals {
4949
},
5050
# Workflows-specific
5151
{
52-
"name": "WORKFLOW_BACKEND_HOST",
53-
"value": "http://workflow-backend.retoolsvc:3000"
52+
"name" : "WORKFLOW_BACKEND_HOST",
53+
"value" : "http://workflow-backend.retoolsvc:3000"
5454
},
5555
{
56-
"name": "WORKFLOW_TEMPORAL_CLUSTER_NAMESPACE",
57-
"value": var.temporal_cluster_config.namespace
56+
"name" : "WORKFLOW_TEMPORAL_CLUSTER_NAMESPACE",
57+
"value" : var.temporal_cluster_config.namespace
5858
},
5959
{
60-
"name": "WORKFLOW_TEMPORAL_CLUSTER_FRONTEND_HOST",
61-
"value": var.temporal_cluster_config.host
60+
"name" : "WORKFLOW_TEMPORAL_CLUSTER_FRONTEND_HOST",
61+
"value" : var.temporal_cluster_config.host
6262
},
6363
{
64-
"name": "WORKFLOW_TEMPORAL_CLUSTER_FRONTEND_PORT",
65-
"value": var.temporal_cluster_config.port
64+
"name" : "WORKFLOW_TEMPORAL_CLUSTER_FRONTEND_PORT",
65+
"value" : var.temporal_cluster_config.port
6666
},
6767
{
68-
"name": "WORKFLOW_TEMPORAL_TLS_ENABLED",
69-
"value": tostring(var.temporal_cluster_config.tls_enabled)
68+
"name" : "WORKFLOW_TEMPORAL_TLS_ENABLED",
69+
"value" : tostring(var.temporal_cluster_config.tls_enabled)
7070
}
7171
]
7272
)
7373

7474
temporal_mtls_config = (
75-
var.temporal_cluster_config.tls_enabled && var.temporal_cluster_config.tls_crt != null && var.temporal_cluster_config.tls_key != null ?
76-
[
77-
{
78-
"name": "WORKFLOW_TEMPORAL_TLS_CRT",
79-
"value": var.temporal_cluster_config.tls_crt
80-
},
81-
{
82-
"name": "WORKFLOW_TEMPORAL_TLS_KEY",
83-
"value": var.temporal_cluster_config.tls_key
84-
}
85-
] :
86-
[]
75+
var.temporal_cluster_config.tls_enabled && var.temporal_cluster_config.tls_crt != null && var.temporal_cluster_config.tls_key != null ?
76+
[
77+
{
78+
"name" : "WORKFLOW_TEMPORAL_TLS_CRT",
79+
"value" : var.temporal_cluster_config.tls_crt
80+
},
81+
{
82+
"name" : "WORKFLOW_TEMPORAL_TLS_KEY",
83+
"value" : var.temporal_cluster_config.tls_key
84+
}
85+
] :
86+
[]
8787
)
8888
}

‎modules/aws_ecs/main.tf‎

Lines changed: 58 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ resource "aws_cloudwatch_log_group" "this" {
1717
}
1818

1919
resource "aws_db_subnet_group" "this" {
20-
name = "${var.deployment_name}-retool"
20+
name = "${var.deployment_name}-retool"
2121
subnet_ids = var.subnet_ids
2222
}
2323

2424
resource "aws_db_instance" "this" {
25-
identifier = "${var.deployment_name}-rds-instance"
25+
identifier = "${var.deployment_name}-rds-instance"
2626
allocated_storage = 80
2727
instance_class = var.rds_instance_class
2828
engine = "postgres"
@@ -35,9 +35,13 @@ resource "aws_db_instance" "this" {
3535
vpc_security_group_ids = [aws_security_group.rds.id]
3636
db_subnet_group_name = aws_db_subnet_group.this.id
3737
performance_insights_enabled = var.rds_performance_insights_enabled
38-
39-
skip_final_snapshot = true
40-
apply_immediately = true
38+
kms_key_id = var.rds_kms_key_id
39+
storage_encrypted = var.rds_kms_key_id != null
40+
backup_window = var.rds_backup_window
41+
backup_retention_period = var.rds_backup_retention_in_days
42+
43+
skip_final_snapshot = true
44+
apply_immediately = true
4145
}
4246

4347
resource "aws_ecs_service" "retool" {
@@ -65,7 +69,7 @@ resource "aws_ecs_service" "retool" {
6569
dynamic "network_configuration" {
6670
for_each = var.launch_type == "FARGATE" ? toset([1]) : toset([])
6771

68-
content {
72+
content {
6973
subnets = var.subnet_ids
7074
security_groups = [
7175
aws_security_group.containers.id
@@ -92,7 +96,7 @@ resource "aws_ecs_service" "jobs_runner" {
9296

9397
for_each = var.launch_type == "FARGATE" ? toset([1]) : toset([])
9498

95-
content {
99+
content {
96100
subnets = var.subnet_ids
97101
security_groups = [
98102
aws_security_group.containers.id
@@ -108,7 +112,7 @@ resource "aws_ecs_service" "workflows_backend" {
108112
cluster = aws_ecs_cluster.this.id
109113
desired_count = 1
110114
task_definition = aws_ecs_task_definition.retool_workflows_backend[0].arn
111-
115+
112116
# Need to explictly set this in aws_ecs_service to avoid destructive behavior: https://github.com/hashicorp/terraform-provider-aws/issues/22823
113117
capacity_provider_strategy {
114118
base = 1
@@ -123,7 +127,7 @@ resource "aws_ecs_service" "workflows_backend" {
123127

124128
for_each = var.launch_type == "FARGATE" ? toset([1]) : toset([])
125129

126-
content {
130+
content {
127131
subnets = var.subnet_ids
128132
security_groups = [
129133
aws_security_group.containers.id
@@ -150,7 +154,7 @@ resource "aws_ecs_service" "workflows_worker" {
150154

151155
for_each = var.launch_type == "FARGATE" ? toset([1]) : toset([])
152156

153-
content {
157+
content {
154158
subnets = var.subnet_ids
155159
security_groups = [
156160
aws_security_group.containers.id
@@ -161,13 +165,13 @@ resource "aws_ecs_service" "workflows_worker" {
161165
}
162166

163167
resource "aws_ecs_task_definition" "retool_jobs_runner" {
164-
family = "retool-jobs-runner"
165-
task_role_arn = aws_iam_role.task_role.arn
166-
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
168+
family = "retool-jobs-runner"
169+
task_role_arn = aws_iam_role.task_role.arn
170+
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
167171
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
168-
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
169-
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["jobs_runner"]["cpu"] : null
170-
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["jobs_runner"]["memory"] : null
172+
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
173+
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["jobs_runner"]["cpu"] : null
174+
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["jobs_runner"]["memory"] : null
171175
container_definitions = jsonencode(
172176
[
173177
{
@@ -211,13 +215,13 @@ resource "aws_ecs_task_definition" "retool_jobs_runner" {
211215
)
212216
}
213217
resource "aws_ecs_task_definition" "retool" {
214-
family = "retool"
215-
task_role_arn = aws_iam_role.task_role.arn
216-
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
218+
family = "retool"
219+
task_role_arn = aws_iam_role.task_role.arn
220+
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
217221
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
218-
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
219-
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["main"]["cpu"] : null
220-
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["main"]["memory"] : null
222+
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
223+
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["main"]["cpu"] : null
224+
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["main"]["memory"] : null
221225
container_definitions = jsonencode(
222226
[
223227
{
@@ -266,14 +270,14 @@ resource "aws_ecs_task_definition" "retool" {
266270
}
267271

268272
resource "aws_ecs_task_definition" "retool_workflows_backend" {
269-
count = var.workflows_enabled ? 1 : 0
270-
family = "retool-workflows-backend"
271-
task_role_arn = aws_iam_role.task_role.arn
272-
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
273-
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
274-
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
275-
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_backend"]["cpu"] : null
276-
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_backend"]["memory"] : null
273+
count = var.workflows_enabled ? 1 : 0
274+
family = "retool-workflows-backend"
275+
task_role_arn = aws_iam_role.task_role.arn
276+
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
277+
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
278+
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
279+
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_backend"]["cpu"] : null
280+
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_backend"]["memory"] : null
277281
container_definitions = jsonencode(
278282
[
279283
{
@@ -321,14 +325,14 @@ resource "aws_ecs_task_definition" "retool_workflows_backend" {
321325
)
322326
}
323327
resource "aws_ecs_task_definition" "retool_workflows_worker" {
324-
count = var.workflows_enabled ? 1 : 0
325-
family = "retool-workflows-worker"
326-
task_role_arn = aws_iam_role.task_role.arn
327-
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
328-
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
329-
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
330-
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_worker"]["cpu"] : null
331-
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_worker"]["memory"] : null
328+
count = var.workflows_enabled ? 1 : 0
329+
family = "retool-workflows-worker"
330+
task_role_arn = aws_iam_role.task_role.arn
331+
execution_role_arn = var.launch_type == "FARGATE" ? aws_iam_role.execution_role[0].arn : null
332+
requires_compatibilities = var.launch_type == "FARGATE" ? ["FARGATE"] : null
333+
network_mode = var.launch_type == "FARGATE" ? "awsvpc" : "bridge"
334+
cpu = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_worker"]["cpu"] : null
335+
memory = var.launch_type == "FARGATE" ? var.ecs_task_resource_map["workflows_worker"]["memory"] : null
332336
container_definitions = jsonencode(
333337
[
334338
{
@@ -381,13 +385,13 @@ resource "aws_ecs_task_definition" "retool_workflows_worker" {
381385
}
382386

383387
resource "aws_service_discovery_private_dns_namespace" "retoolsvc" {
384-
count = var.workflows_enabled ? 1 : 0
388+
count = var.workflows_enabled ? 1 : 0
385389
name = "retoolsvc"
386390
description = "Service Discovery namespace for Retool deployment"
387391
vpc = var.vpc_id
388392
}
389393

390-
resource "aws_service_discovery_service" "retool_workflow_backend_service" {
394+
resource "aws_service_discovery_service" "retool_workflow_backend_service" {
391395
count = var.workflows_enabled ? 1 : 0
392396
name = "workflow-backend"
393397

@@ -408,17 +412,20 @@ resource "aws_service_discovery_service" "retool_workflow_backend_service" {
408412
}
409413

410414
module "temporal" {
411-
count = var.workflows_enabled && !var.use_exising_temporal_cluster ? 1 : 0
415+
count = var.workflows_enabled && !var.use_exising_temporal_cluster ? 1 : 0
412416
source = "./temporal"
413-
414-
deployment_name = "${var.deployment_name}-temporal"
415-
vpc_id = var.vpc_id
416-
subnet_ids = var.subnet_ids
417-
private_dns_namespace_id = aws_service_discovery_private_dns_namespace.retoolsvc[0].id
418-
aws_cloudwatch_log_group_id = aws_cloudwatch_log_group.this.id
419-
aws_region = var.aws_region
420-
aws_ecs_cluster_id = aws_ecs_cluster.this.id
421-
launch_type = var.launch_type
422-
container_sg_id = aws_security_group.containers.id
417+
418+
deployment_name = "${var.deployment_name}-temporal"
419+
vpc_id = var.vpc_id
420+
subnet_ids = var.subnet_ids
421+
private_dns_namespace_id = aws_service_discovery_private_dns_namespace.retoolsvc[0].id
422+
aws_cloudwatch_log_group_id = aws_cloudwatch_log_group.this.id
423+
aws_region = var.aws_region
424+
aws_ecs_cluster_id = aws_ecs_cluster.this.id
425+
launch_type = var.launch_type
426+
container_sg_id = aws_security_group.containers.id
423427
aws_ecs_capacity_provider_name = var.launch_type == "EC2" ? aws_ecs_capacity_provider.this[0].name : null
428+
kms_key_id = var.temporal_aurora_kms_key_id
429+
backup_window = var.temporal_aurora_backup_window
430+
backup_retention_in_days = var.temporal_aurora_backup_retention_in_days
424431
}

‎modules/aws_ecs/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,7 @@ output "rds_instance_name" {
4242
value = aws_db_instance.this.db_name
4343
description = "Name of RDS instance"
4444
}
45+
46+
output "sg_containers_id" {
47+
value = aws_security_group.containers.id
48+
}

0 commit comments

Comments
 (0)