kunduso / add-aws-elb-ec2-terraform

Add an application load balancer to three Amazon EC2 instances belonging to three separate availability zones in a public subnet using Terraform and GitHub Actions.

Motivation

My objectives was to create an application load balancer and attach that to three Amazon EC2 instances hosted in three different availability zones in a region using Terraform and GitHub Actions.

If you are interested in learning about how to create an external application load balancer with Amazon EC2 instances in a private subnet, check out the code in this repository: add-aws-elb-ec2-private-subnet-terraform
Later, I also automated the process of provisioning the resources using GitHub Actions pipeline and I discussed that in detail at -CI-CD with Terraform and GitHub Actions to deploy to AWS.
If you are interested in learning about how to create an external application load balancer with Amazon EC2 instances in a private subnet, check out the code in this repository: add-aws-elb-ec2-terraform
I also added Infracost estimates to this repository. You can checkout the monthly cost badge at the top of this ReadMe file with the cost details. If you are interested in learning about that, checkout my note on - estimate AWS Cloud resource cost with Infracost, Terraform, and GitHub Actions.

Note: I did not include the concepts of creating the EC2 instances, or installing a certificate, or route53 in this note.

Prerequisites

For this code to function without errors, I created an OpenID connect identity provider in Amazon Identity and Access Management that has a trust relationship with this GitHub repository. You can read about it here to get a detailed explanation with steps.
I stored the ARN of the IAM Role as a GitHub secret which is referred in the terraform.yml file.
As part of the Infracost integration, I also created a INFRACOST_API_KEY and stored that as a GitHub Actions secret. I also managed the cost estimate process using a GitHub Actions variable INFRACOST_SCAN_TYPE where the value is either hcl_code or tf_plan, depending on the type of scan desired.

Usage

Ensure that the policy attached to the IAM role whose credentials are being used in this configuration has permission to create and manage all the resources that are included in this repository.

Review the code including the terraform.yml to understand the steps in the GitHub Actions pipeline. Also review the terraform code to understand all the concepts associated with creating an AWS VPC, subnets, internet gateway, route table, and route table association.
If you want to check the pipeline logs, click on the Build Badge (terrform-infra-provisioning) above the image in this ReadMe.

License

This code is released under the Unlincse License. See LICENSE.

add-aws-elb-ec2-terraform's Issues

Update the `provider aws {}` version

Update the aws provider version to: 5.31.0

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = "5.31.0"
    }
  }
} 

Add `source` tag for all resources

Add a source tag with a link to this repository to easily identify which resource is provisioned from which IAC code.

Checkov:CKV2_AWS_11: Ensure VPC flow logging is enabled in all VPCs

Add license info to the repository readme

Although the license file is added to the repository, the readme file lacks a reference. This issue is to add a reference to the readme file.

Add Infracost badge to the repo

Add code scanning capability

automate using github actions

Update the terraform output to show the correct url

The output url does not have the http:// and hence by default, it tends to take https://

Add `count` argument to the `aws_instance` resource type

Update pipeline command

As part of the aws provider upgrade in PR #29 the pipeline command of terraform init was changed to terraform init -upgrade. The issue is to revert the pipeline command.

Update ReadMe with GitHub Actions details

Add `infracost` to estimate AWS resource cost via `TFPlan` file review

Add elastic load balancing to the existing three EC2 instances

Add `tags` for each subnet

Currently, all the subnets get the same tag and I have to navigate to the az to find out which is which. I want to add a count to the subnets tag so that each subnet has a unique tag.

Add the three EC2 instances to an auto scaling group behind an Elastic load balancer.

Research new security group

Create a new security group with the source as the load balancer and attach that to the ec2 instances

Manage Infracost using the flag variable

Update the GitHub actions to apply the changes in the PR

Currently, the terraform apply step is not running because the condition returns a false.