📚 Your containerized application with IAC on AWS — Pt.3

🕛 Zeit seit Veröffentlichung: 23 Tage, 19 Stunden 49 Minuten
📆 Veröffentlicht am: 23.05.2024 um 15:24 Uhr
💡 Newskategorie: Programmierung
🔗 Quelle: dev.to

Hi Folks! This will be the final post in our series on infrastructure and containers. We will utilize Terragrunt and our infrastructure in this section, and at the conclusion, we will have our application operating on Fargate on AWS.

The docker image I’ll be using in this lesson comes from Sonic, an old game that many people associate with their early years. You may use this image or find it on my dockerhub, whichever you would like.

DIRECTORIES

Again, I’ll leave our directory structure here so you can guide yourself:

app
modules
    ├── amazon_vpc
    ├── aws_loadbalancer
    ├── aws_fargate
    ├── aws_roles
    ├── aws_ecs_cluster
    └── aws_targetgroup
    └── aws_certificate_manager

terragrunt
    └── dev
        └── us-east-1
            ├── aws_ecs
            │   ├── cluster
            │   └── service
            ├── aws_loadbalancer
            ├── amazon_vpc
            ├── aws_targetgroup
            ├── aws_roles
            ├── aws_certificate_manager
            └── terragrunt.hcl

TERRAGRUNT

First, let’s look at our terragrunt.hcl, located in us-east-1. It will be used for all common variables in our code, as well as for creating our backend settings and the lock in the dynamodb database.

Typical variables are going to be region, project_name, domain_name, env, host_headers and container_port.

terragrunt.hcl

remote_state {
  backend = "s3"
  generate = {
    path      = "backend.tf"
    if_exists = "overwrite"
  }
  config = {
    bucket           = "sonic-iac-series"
    key              = "dev/${path_relative_to_include()}/terraform.tfstate"
    region           = "us-east-1"
    encrypt          = true
    dynamodb_table   = "terraform-state-lock"
  }
}

inputs = {
   region            = "us-east-1"
   project_name      = "sonic-iac"
   env               = "dev"
   domain_name       = "your domain"
   host_headers      = "sonic.your domain"
   container_port    = "8080"

  tags = {
     ambiente        = "dev"
     projeto         = "sonic-iac"
     plataforma      = "aws"
     gerenciado      = "terraform/terragrunt"
   }
}

generate "provider" {
    path      = "provider.tf"
    if_exists = "overwrite"
    contents = <<EOF
provider "aws" {
  profile   = "default"
  region    = "us-east-1"
}
EOF
}

VPC

The first resource to be created will be the VPC, as it will be needed for most of our resources.

terragrunt
    └── dev
        └── us-east-1
             └── amazon_vpc
                 └── terragrunt.hcl

We will use a range of /25, starting with IP 172.35.0.221, to construct our VPC. Four subnets — two public and two private — will be created inside it.

VPC: 172.35.0.128/25
Public Subnet 1: 172.35.0.128/27
Public Subnet 2: 172.35.0.160/27
Private Subnet 1: 172.35.0.192/27
Private Subnet 2: 172.35.0.224/27 These code files will be created within:

terragrunt.hcl

include {
  path = find_in_parent_folders()
}

inputs = {
    vpc_cidr_block              = "172.35.0.128/25"
    public_subnet1_cidr_block   = "172.35.0.128/27"
    public_subnet2_cidr_block   = "172.35.0.160/27"
    private_subnet1_cidr_block  = "172.35.0.192/27"
    private_subnet2_cidr_block  = "172.35.0.224/27"
    availability_zone1 = "us-east-1a"
    availability_zone2 = "us-east-1b"
}
terraform {
  source = "../../../../modules/amazon_vpc"
  extra_arguments "custom_vars" {
    commands = [
        "apply",
        "plan",
        "import",
        "push",
        "refresh"
    ]
  }
}

IAM PERMISSIONS

The next thing to be created will be permissions for our resources.

terragrunt
    └── dev
        └── us-east-1
             └── aws_roles
                 └── terragrunt.hcl

terragrunt.hcl

include {
  path = find_in_parent_folders()
}

terraform {
  source = "../../../../modules/aws_roles"
  extra_arguments "custom_vars" {
    commands = [
        "apply",
        "plan",
        "import",
        "push",
        "refresh"
    ]
  }
}

AWS CERTIFICATE MANAGER

These are the configurations for applying our certificate; we will generate the certificate and use our domain to validate it.

terragrunt
    └── dev
        └── us-east-1
             └── aws_certificate_manager
                 └── terragrunt.hcl

terragrunt.hcl

include {
  path = find_in_parent_folders()
}

terraform {
  source = "../../../../modules/aws_certificate_manager"
  extra_arguments "custom_vars" {
    commands = [
        "apply",
        "plan",
        "import",
        "push",
        "refresh"
    ]
  }
}

AWS LOAD BALANCER

Let’s set up our loadbalancer using Terragrunt now. This will help distribute our traffic and guarantee that our application is highly available.

terragrunt
    └── dev
        └── us-east-1
             └── aws_loadbalancer
                 └── terragrunt.hcl

Our Terragrunt setup looks like this. It’s important to note that in order to increase everything’s dynamic nature, we use dependencies between modules.

terragrunt.hcl

include {
  path = find_in_parent_folders()
}

dependency "vpc" {
  config_path = "../amazon_vpc"
}

dependency "acm" {
  config_path = "../aws_certificate_manager"
}

inputs = {
  vpc_id       = dependency.vpc.outputs.vpc_id
  subnet_id_1  = dependency.vpc.outputs.public_subnet1_id
  subnet_id_2  = dependency.vpc.outputs.public_subnet2_id
  alb_internal = false
  certificate_arn = dependency.acm.outputs.acm_arn
  priority_listener_rule  = "1"
}
terraform {
  source = "../../../../modules/aws_loadbalancer"
  extra_arguments "custom_vars" {
    commands = [
      "apply",
      "plan",
      "import",
      "push",
      "refresh"
    ]
  }
}

AWS TARGET GROUP

Here we will configure our Target Group with Terragrunt, it is super essential for directing traffic to the correct servers for our application.

terragrunt
    └── dev
        └── us-east-1
             └── aws_targetgroup
                 └── terragrunt.hcl

terragrunt.hcl

include {
  path = find_in_parent_folders()
}
dependency "loadbalancer" {
  config_path = "../aws_loadbalancer"
}  
  dependency "vpc" {
  config_path = "../amazon_vpc"
}

dependency "acm" {
  config_path = "../aws_certificate_manager"
}

inputs = {
  vpc_id                  = dependency.vpc.outputs.vpc_id
  subnet_id_1             = dependency.vpc.outputs.public_subnet1_id
  subnet_id_2             = dependency.vpc.outputs.public_subnet2_id
  certificate_arn         = dependency.acm.outputs.acm_arn
  listener_ssl_arn        = dependency.loadbalancer.outputs.listener_ssl_arn
  priority_listener_rule  = "2"
  health_check_path       = "/"
}

terraform {
  source = "../../../../modules/aws_targetgroup"
  extra_arguments "custom_vars" {
    commands = [
      "apply",
      "plan",
      "import",
      "push",
      "refresh"
    ]
  }
}

ECS CLUSTER

In this step we will create our ECS cluster that will host our application.

terragrunt
    └── dev
        └── us-east-1
             └── aws_ecs
                 └── cluster
                       └── terragrunt.hcl

terragrunt.hcl

include {
  path = find_in_parent_folders()
}

terraform {
  source = "../../../../../modules/aws_ecs_cluster"
  extra_arguments "custom_vars" {
    commands = [
        "apply",
        "plan",
        "import",
        "push",
        "refresh"
    ]
  }
}

FARGATE AND ECR

We will construct our fargate service, the repository in the ECR, and a record on our domain as the final configuration file.

terragrunt
    └── dev
        └── us-east-1
             └── aws_ecs
                 └── service
                       └── terragrunt.hcl

terragrunt.hcl

include {
  path = find_in_parent_folders()
}
dependency "loadbalancer" {
  config_path = "../../aws_loadbalancer"
}  
  dependency "vpc" {
  config_path = "../../amazon_vpc"
}
dependency "role" {
  config_path = "../../aws_roles"
}

dependency "targetgroup" {
  config_path = "../../aws_targetgroup"
}

dependency "cluster" {
  config_path = "../cluster"
}

inputs = {
  vpc_id                = dependency.vpc.outputs.vpc_id
  subnet_id_1           = dependency.vpc.outputs.private_subnet1_id
  subnet_id_2           = dependency.vpc.outputs.private_subnet2_id
  alb_dns_name          = dependency.loadbalancer.outputs.alb_dns_name
  sg_alb                = dependency.loadbalancer.outputs.alb_secgrp_id
  target_group_arn      = dependency.targetgroup.outputs.tg_alb_arn
  cluster_arn           = dependency.cluster.outputs.cluster_arn
  ecs_role_arn          = dependency.role.outputs.ecs_role_arn
  instance_count        = "1"
  container_vcpu        = "512"
  container_memory      = "1024"
  aws_account_id        = "your account number"
}

terraform {
  source = "../../../../../modules/aws_fargate"
  extra_arguments "custom_vars" {
    commands = [
        "apply",
        "plan",
        "import",
        "push",
        "refresh"
    ]
  }
}

APPLY

After the entire structure has been created, you must apply terragrunt to all directories that contain terragrunt.hcl in the following order.

terragrunt/dev/us-east-1
terragrunt/dev/us-east-1/amazon_vpc
terragrunt/dev/us-east-1/aws_roles
terragrunt/dev/us-east-1/aws_certificate_manager
terragrunt/dev/us-east-1/aws_loadbalancer
terragrunt/dev/us-east-1/aws_targetgroup
terragrunt/dev/us-east-1/aws_ecs/cluster
terragrunt/dev/us-east-1/aws_ecs/fargate
Use this command on terminal to apply. You need use in each directory

terragrunt apply

or in the root folder use:
terragrunt run-all apply

ECR

Now we have applied all our infrastructure and our ECR repository has been created, we must upload our image for use in our container.

The image must be downloaded from Docker Hub as an initial step. You can use another image if you prefer or your own from your application.

use this command to download my sonic image:
docker pull shescloud/sonic-the-hedgehog

TESTING

I used a domain I had and our application was temporarily hosted at sonic.shescloud.tech.

DESTROY
If you are using it for study, or as a way to complete a test, don’t forget to destroy all resources at the end to avoid unnecessary costs. To delete everything, we will do a process similar to apply, but in the opposite way.

Before deleting everything via terragrunt, you need to access your AWS account, go to the ECR service and delete the image from the repository. After completing this step, you can proceed with destroying each of the repositories.

Now, you must destroy to all directories that contain terragrunt.hcl in the following order.

terragrunt/dev/us-east-1/aws_ecs/fargate
terragrunt/dev/us-east-1/aws_ecs/cluster
terragrunt/dev/us-east-1/aws_targetgroup
terragrunt/dev/us-east-1/aws_loadbalancer
terragrunt/dev/us-east-1/aws_roles
terragrunt/dev/us-east-1/aws_certificate_manager
terragrunt/dev/us-east-1/amazon_vpc
terragrunt/dev/us-east-1

Use this command on terminal to destroy. You need use in each directory

terragrunt destroy

or in the root folder use:
`terragrunt run-all destroy

`

GITHUB

You can check the repository with the code on my github:
https://github.com/shescloud/terraform-terragrunt-fargate

And that’s it folks! I hope you enjoyed it and get a lot out of this code. See u soon!

...

Sharing is caring on Social Media

📌 Leveraging Infrastructure as Code (IaC) for AWS Lambda: A Comparative Analysis of AWS SAM, Terraform, and Serverless Framework

🕛 233 Tage, 9 Stunden 8 Minuten
📆 27.10.2023 um 03:16 Uhr
📈 31.37 Punkte

📌 Aws-Security-Assessment-Solution - An AWS Tool To Help You Create A Point In Time Assessment Of Your AWS Account Using Prowler And Scout As Well As Optional AWS Developed Ransomware Checks

🕛 494 Tage, 6 Stunden 33 Minuten
📆 07.02.2023 um 00:00 Uhr
📈 30.44 Punkte

Lösungen

Betriebssysteme

IT-Sicherheit

Cyberbedrohungen

Ressourcen

Videos

Sicherheitstipps

Häufig gesucht

📚 Your containerized application with IAC on AWS — Pt.3

DIRECTORIES

TERRAGRUNT

VPC

IAM PERMISSIONS

AWS CERTIFICATE MANAGER

AWS LOAD BALANCER

AWS TARGET GROUP

ECS CLUSTER

FARGATE AND ECR

APPLY

ECR

TESTING

`

GITHUB

Sharing is caring on Social Media

Join the Team IT Security Community