ios-cloudshell/main.tf at main · etoromol/ios-cloudshell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
# main.tf
# module ios-cloudshell
#
# Copyright (c) 2023 Eduardo Toro

locals {
  vpc = "vpc-${var.project["tag"]}"
  igw = "igw-${var.project["tag"]}"
  seg = "seg-${var.project["tag"]}"
  snt = "snt-${var.project["tag"]}"
  rtb = "rtb-${var.project["tag"]}"
  nic = "nic-${var.project["tag"]}"
  eip = "eip-${var.project["tag"]}"
}

terraform {
  required_version = ">=1.3.9"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">=3.75.1"
    }
    tls = {
      source  = "hashicorp/tls"
      version = ">=4.0.4"
    }
  }
}

provider "aws" {
  region = var.zone["uw1"]
}

resource "aws_vpc" "shell_vpc" {
  cidr_block       = var.netblock["network"]
  instance_tenancy = "default"
  tags = {
    Name = local.vpc
  }
}

resource "aws_internet_gateway" "shell_igw" {
  vpc_id = aws_vpc.shell_vpc.id
  tags = {
    Name = local.igw
  }
}

resource "aws_security_group" "shell_seg" {
  vpc_id = aws_vpc.shell_vpc.id
  ingress {
    description = "permit icmp from any"
    from_port   = 8
    to_port     = 0
    protocol    = "icmp"
    cidr_blocks = [var.netblock["default"]]
  }
  ingress {
    description = "permit ssh from any"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.netblock["default"]]
  }
  ingress {
    description = "permit tls from any"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [var.netblock["default"]]
  }
  egress {
    description      = "permit any to any"
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = [var.netblock["default"]]
    ipv6_cidr_blocks = ["::/0"]
  }
  tags = {
    Name = local.seg
  }
}

resource "aws_subnet" "shell_snt" {
  vpc_id            = aws_vpc.shell_vpc.id
  cidr_block        = var.netblock["cloud_subnet"]
  availability_zone = var.zone["uw1b"]
  tags = {
    Name = local.snt
  }
}

resource "aws_route_table" "shell_rtb" {
  vpc_id = aws_vpc.shell_vpc.id
  route {
    cidr_block = var.netblock["default"]
    gateway_id = aws_internet_gateway.shell_igw.id
  }
  tags = {
    Name = local.rtb
  }
}

resource "aws_route_table_association" "shell_ass" {
  subnet_id      = aws_subnet.shell_snt.id
  route_table_id = aws_route_table.shell_rtb.id
}

resource "aws_network_interface" "shell_nic" {
  subnet_id       = aws_subnet.shell_snt.id
  security_groups = [aws_security_group.shell_seg.id]
  private_ips     = ["10.0.1.117"]
  tags = {
    Name = local.nic
  }
}

resource "aws_eip" "shell_eip" {
  depends_on                = [aws_internet_gateway.shell_igw]
  instance                  = aws_instance.cloudshell.id
  associate_with_private_ip = "10.0.1.117"
  vpc                       = true
  tags = {
    Name = local.eip
  }
}

resource "tls_private_key" "shell_key" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_key_pair" "shell_key_pair" {
  key_name   = "ios-cloudshell-key" # name of the key in aws.
  public_key = tls_private_key.shell_key.public_key_openssh
  provisioner "local-exec" { # copy the key in current directory.
    command = <<EOT
      echo '${tls_private_key.shell_key.private_key_pem}' > ./ios-cloudshell-key.pem
      chmod 400 ./ios-cloudshell-key.pem
    EOT
  }
  provisioner "local-exec" {
    when    = destroy
    command = "rm ./ios-cloudshell-key.pem"
  }
}

resource "aws_instance" "cloudshell" {
  ami               = var.vm_06["ami"]
  instance_type     = var.vm_06["instance_type"]
  availability_zone = var.vm_06["availability_zone"]
  key_name          = aws_key_pair.shell_key_pair.key_name
  network_interface {
    device_index         = 0
    network_interface_id = aws_network_interface.shell_nic.id
  }
  tags = {
    Name = var.vm_06["name"]
  }
}