Giter Club home page Giter Club logo

nanlabs / terraform-aws-starter Goto Github PK

View Code? Open in Web Editor NEW
15.0 6.0 3.0 1.21 MB

Get started quickly with AWS infrastructure using a robust Terraform starter kit incorporating secure state management, VPC configuration, security groups, RDS provisioning, secrets management, SSM parameter store, and GitHub Actions integration!

License: MIT License

HCL 89.36% TypeScript 8.56% Python 2.08%
aws boilerplate diagrams-as-code github-actions infrastructure-as-code rds-database rds-postgres secrets-manager security terraform

terraform-aws-starter's Introduction

Terraform AWS Starter Kit ๐Ÿ”ฅ ๐Ÿš€

Welcome to the Terraform AWS Starter Kit! This comprehensive and robust starter kit will empower you to quickly and confidently set up your AWS infrastructure. With secure state management, scalable VPC configuration, enhanced security features, database provisioning, secrets management, SSM parameter store integration, and GitHub Actions integration, this starter kit incorporates proven best practices for building reliable and maintainable AWS environments.

๐Ÿ“– CLICK OR TAP โฒโ˜ฐโณ TO SHOW TABLE-OF-CONTENTS ๐Ÿ“–

Motivation

The Terraform AWS Starter Kit solves the most challenging aspect of AWS infrastructure building by providing a powerful solution for our clients. Our goal is to simplify the process of setting up a reliable and scalable AWS environment, allowing you to focus on developing and deploying your applications swiftly and confidently.

Key Features

Secure State Management ๐Ÿ”’

The Terraform AWS Starter Kit includes secure state management configurations. Your Terraform state is stored in an S3 bucket with a DynamoDB table for state locking. This ensures the security of your infrastructure's state and facilitates easy management and sharing among team members.

Scalable VPC Configuration ๐ŸŒ

Our starter kit provisions a Virtual Private Cloud (VPC) with public and private subnets across three availability zones. This scalable VPC configuration enables the segregation of application and database resources, providing high availability for your infrastructure components.

Enhanced Security ๐Ÿ”

The starter kit implements security groups for the bastion host and database instances, ensuring controlled access to your resources. The bastion host allows secure access to private resources within the VPC, providing an additional layer of security.

Database Provisioning ๐Ÿ—ƒ๏ธ

We have included configurations to provision an RDS PostgreSQL instance and other database resources. This allows you to easily set up and manage your database infrastructure in a consistent and reproducible manner.

Secrets Management ๐Ÿ”‘

The Terraform AWS Starter Kit integrates with AWS Secrets Manager to securely store and manage your database credentials. This ensures that sensitive information, such as usernames and passwords, is not exposed in your Terraform code or version control system.

Parameter Management ๐Ÿ”ง

Our starter kit leverages AWS Systems Manager (SSM) Parameter Store to store and manage various parameters required for your infrastructure, such as VPC ID, subnet IDs, and other configuration details. This centralizes the management of configuration parameters, making it easier to update and maintain your infrastructure as it evolves.

GitHub Actions Integration ๐Ÿš€

We have preconfigured GitHub Actions workflows that provide linting, security checks, and more for your Terraform code. This integration enables automated checks and validation, ensuring adherence to coding standards and identifying potential security vulnerabilities early in the development process.

By using the Terraform AWS Starter Kit, you can expedite the initial setup of your AWS infrastructure while incorporating proven best practices. It empowers you to focus on building and deploying your applications while providing a solid foundation for scalability, security, and maintainability.

We welcome contributions and feedback to improve this starter kit further, making it a valuable resource for the community.

Quick Start

Check the Live Infrastructure section for more information about existing infrastructure modules and how to use them.

Once you have chosen the infrastructure module you want to use, move to the module directory and follow the instructions in the README file.

Live Infrastructure

The live directory houses our live infrastructure. This is where you'll find our Terraform variables, backend configuration, and Terraform root modules.

It is recommended to create a separate directory for each environment (e.g., dev, staging, prod) and region (e.g., us-east-1, us-west-2, eu-west-1). This allows you to easily manage and deploy your infrastructure.

Module Description
Prod App Infrastructure (us-west-2) Terraform root module for our prod infrastructure.
Staging App Infrastructure (us-west-2) Terraform root module for our staging infrastructure.

Terraform Modules

We have created custom Terraform modules to bootstrap our infrastructure, which are located in the modules directory.

Module Description
Amplify App Terraform module for bootstrapping an Amplify app.
Bastion Terraform module for bootstrapping a bastion host.
MongoDB Atlas Cluster Terraform module for bootstrapping a MongoDB Atlas Cluster. It makes it possible to create a VPC Peering between the VPC and the MongoDB Atlas Cluster.
RDS Instance Terraform module for bootstrapping an RDS Instance.
RDS Aurora Cluster Terraform module for bootstrapping an RDS Aurora Cluster.
VPC Terraform module for bootstrapping a VPC for use with our shared infrastructure.

Apps and Services

In addition to infrastructure provisioning, we have included a few apps and services to help you get started.

These apps and services are located in the apps directory. In there you can find useful examples of how to use the infrastructure we have provisioned.

Service Description
Start and Stop EC2 Instance This is a Serverless Framework based project to start and stop EC2 instances based on a schedule.

Contributing

We appreciate contributions from the open-source community. Any contributions you make are truly appreciated. Please refer to our contribution guidelines for more information.

Contributors

Contributors

Made with contributors-img.

terraform-aws-starter's People

Contributors

aguspk avatar dependabot[bot] avatar github-actions[bot] avatar ulises-jeremias avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

terraform-aws-starter's Issues

Switch to super-linter for CI Linting using GitHub Actions

Describe the feature

I propose switching our CI linting setup, which includes shellcheck, markdownlint, eslint, and others, to use super-linter exclusively for GitHub Actions. super-linter is a comprehensive and centralized linter that supports multiple languages, providing a unified linting experience.

Use Case

There are some benefits of super-linter:

  • Unified Linting: super-linter supports a wide range of languages and linters, providing a unified linting solution for our GitHub Actions workflow.

  • Easy Configuration: Simplifies configuration by having a single .github/linters configuration file.

  • Consistent Output: Standardizes the output format for linting results across different languages and linters.

  • Extensibility: Supports adding or customizing linters easily, making it adaptable to our specific requirements.

Proposed Solution

  1. Configure super-linter:

    • Create or update the .github/workflows configuration file to specify the linters and configurations needed.
  2. GitHub Actions Workflows:

    • Update the GitHub Actions workflow files to use super-linter for linting instead of the actual implementation
  3. Testing:

    • Thoroughly test the linting process with super-linter in the GitHub Actions workflow to ensure it covers all relevant languages and provides accurate results. You can test this by submitting a PR

Other Information

No response

Acknowledgements

  • I may be able to implement this feature request
  • This feature might incur a breaking change

Version used

latest

Environment details (OS name and version, etc.)

any

Enable bastion host to access secrets manager

Describe the feature

the bastion host should have the permissions to read secrets from secrets manager, that way it would be possible to access database credentials or other sensitive information

Use Case

  • to test a database connection from inside the bastion host
  • to run migrations for a project from inside the bastion host

Proposed Solution

adding the following lines to the file https://github.com/nanlabs/terraform-aws-starter/blob/main/modules/bastion/iam.tf should do the trick
{ "Effect" : "Allow", "Action" : [ "secretsmanager:GetSecretValue" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:*" }

Other Information

No response

Acknowledgements

  • I may be able to implement this feature request
  • This feature might incur a breaking change

Version used

.

Environment details (OS name and version, etc.)

any!

When running the existing example under live/core, Error creating in VPC endpoint

Describe the bug

When run for the first time with the default configuration. It fails creating a secrets manager linked to the VPC

Expected Behavior

Be able to attach secrets manager to the VPC endpoint

Current Behavior

throws an error with this message

 Error: creating EC2 VPC Endpoint (com.amazonaws.us-west-2.secretsmanager): InvalidParameter: Subnet IDs are only supported for Interface and GatewayLoadBalancer type VPC Endpoints.
โ”‚       status code: 400, request id: c3858cb1-8278-4dea-a6d2-177948dcf477
โ”‚
โ”‚   with module.vpc.aws_vpc_endpoint.secrets_manager,
โ”‚   on ..\..\modules\vpc\endpoints.tf line 3, in resource "aws_vpc_endpoint" "secrets_manager":
โ”‚    3: resource "aws_vpc_endpoint" "secrets_manager" {

Reproduction Steps

Run through the default example

Possible Solution

No response

Additional Information/Context

No response

Version used

latest

Environment details (OS name and version, etc.)

windows 10

Add VPC endpoint to connect to secrets managers

Describe the feature

We should have a VPC endpoint to connect from the private subnets to Secrets Manager without having internet access, this way is more secure and would avoid the cost of having a NAT gateway for cases when internet access is not required

Use Case

This will be useful for applications stored in AWS lambda that need to connect to an RDS instance where the secrets to connect are stored in Secrets Manager

Proposed Solution

No response

Other Information

No response

Acknowledgements

  • I may be able to implement this feature request
  • This feature might incur a breaking change

Version used

.

Environment details (OS name and version, etc.)

any!

Add secured access to private RDS DB Instance using Amazon EC2 Instance Connect Endpoint

Describe the feature

We need to dig into new ways of connecting to the private DB Instance to make it easier for the developers to run migrations and more

Use Case

Connect to the database from outside the AWS Console and/or bastion host instance to run migrations and/or simple queries.

Proposed Solution

Use the following new feature!

Other Information

No response

Acknowledgements

  • I may be able to implement this feature request
  • This feature might incur a breaking change

Version used

Environment details (OS name and version, etc.)

any!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.