aws_config.tf

variable "region" {}
variable "shared_credentials_file" {}
variable "profile" {}
variable "role_arn" {}
variable "session_name" {}
variable "keypair" {}

variable "azs" {
  description = "Run the EC2 Instances in these Availability Zones"
  type        = "list"
  default     = ["us-east-2a", "us-east-2b", "us-east-2c"]
}

/*
variable "private_ips" {
  description = "Private IPs to be assigned"
  type = "list"
  default = ["172.16.10.100","172.16.10.101","172.16.10.102" ]
}
*/

variable "vpc_cidr" {
  description = "CIDR for the whole VPC"
  default     = "10.0.0.0/16"
}

variable "public_subnet_cidr" {
  description = "CIDR for the Public Subnet"
  default     = "10.0.0.0/24"
}

variable "private_subnet_cidr" {
  description = "CIDR for the Private Subnet"
  default     = "10.0.1.0/24"
}

variable "private_subnet_2_cidr" {
  description = "CIDR for the Private Subnet"
  default     = "10.0.2.0/24"
}

variable "private_subnet_3_cidr" {
  description = "CIDR for the Private Subnet"
  default     = "10.0.3.0/24"
}

data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  ########################################################################################
  # https://askubuntu.com/questions/53582/how-do-i-know-what-ubuntu-ami-to-launch-on-ec2 #  
  ########################################################################################
  owners = ["099720109477"] # Canonical
}

provider "aws" {
  region                  = "${var.region}"
  shared_credentials_file = "${var.shared_credentials_file}"
  profile                 = "${var.profile}"

  assume_role {
    role_arn     = "${var.role_arn}"
    session_name = "${var.session_name}"
  }
}

resource "aws_vpc" "Prometheus_Stack_VPC" {
  enable_dns_hostnames = true
  cidr_block           = "${var.vpc_cidr}"

  tags {
    Name = "Prometheus-stack-vpc"
  }
}

resource "aws_internet_gateway" "Prometheus_Stack_gateway" {
  vpc_id = "${aws_vpc.Prometheus_Stack_VPC.id}"
}

/*
  NAT Instance
*/
resource "aws_security_group" "nat" {
  name        = "vpc_nat"
  description = "Allow traffic to pass from the private subnet to the internet"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["${var.private_subnet_cidr}"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["${var.private_subnet_cidr}"]
  }

  #ssh access
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = -1
    to_port     = -1
    protocol    = "icmp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  /* send to only VPC CIDR */
  egress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["${var.vpc_cidr}"]
  }

  egress {
    from_port   = -1
    to_port     = -1
    protocol    = "icmp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  vpc_id = "${aws_vpc.Prometheus_Stack_VPC.id}"

  tags {
    Name = "Security_Group_NAT"
  }
}

/*
  Prometheus Servers
*/
resource "aws_security_group" "prometheus" {
    name = "vpc_prometheus"
    description = "Allow incoming SSH connections from vpc cidr only + manage egress for other telemetry components along with prometheus"

    ingress {
        from_port = 22
        to_port = 22
        protocol = "tcp"
        cidr_blocks = ["${var.vpc_cidr}"]
    }
    ingress {
        from_port = -1
        to_port = -1
        protocol = "icmp"
        cidr_blocks = ["${var.vpc_cidr}"]
    }
    egress {
        from_port = 9090 /* Prometheus server */
        to_port = 9090
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }
    egress {
        from_port = 9091 /* Push gateway */
        to_port = 9091
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }
    egress { /* Alert Manager */
        from_port = 9093
        to_port = 9093
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }
    egress {
        from_port = 80
        to_port = 80
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }
    egress {
        from_port = 443
        to_port = 443
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

    vpc_id = "${aws_vpc.Prometheus_Stack_VPC.id}"

    tags {
        Name = "PrometehusServersSG"
    }
}

resource "aws_instance" "prometheus" {
  subnet_id     = "${aws_subnet.Prometheus_private_subnet.id}"
  ami           = "${data.aws_ami.ubuntu.id}"
  key_name      = "${var.keypair}"
  instance_type = "t2.micro"
  vpc_security_group_ids = ["${aws_security_group.prometheus.id}"] 
  source_dest_check = false
  count         = 3

  #availability_zone  = "${element(var.azs, count.index)}"
  tags {
    Name = "Prometheus-stack-instance-${count.index}"
  }
}

resource "aws_instance" "bastion" {
  subnet_id                   = "${aws_subnet.Prometheus_public_subnet.id}"
  vpc_security_group_ids      = ["${aws_security_group.nat.id}"]
  ami                         = "${data.aws_ami.ubuntu.id}"
  key_name                    = "${var.keypair}"
  instance_type               = "t2.micro"
  associate_public_ip_address = "true"
  source_dest_check           = false

  tags {
    Name = "Prometheus-stack-bastion"
  }
}

resource "aws_instance" "nat" {
  ami                         = "ami-07fdd962"                              # this is a special ami preconfigured to do NAT
  instance_type               = "t2.micro"
  key_name                    = "${var.keypair}"
  vpc_security_group_ids      = ["${aws_security_group.nat.id}"]
  subnet_id                   = "${aws_subnet.Prometheus_public_subnet.id}"
  associate_public_ip_address = true
  source_dest_check           = false

  tags {
    Name = "VPC NAT"
  }
}

resource "aws_eip" "nat" {
  instance = "${aws_instance.nat.id}"
  vpc      = true
}

/* Public Subnet */

resource "aws_subnet" "Prometheus_public_subnet" {
  vpc_id            = "${aws_vpc.Prometheus_Stack_VPC.id}"
  cidr_block        = "${var.public_subnet_cidr}"
  availability_zone = "us-east-2b"

  tags {
    Name = "Prometheus stack public subnet"
  }
}

resource "aws_route_table" "Prometheus_public_route_table" {
  vpc_id = "${aws_vpc.Prometheus_Stack_VPC.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.Prometheus_Stack_gateway.id}"
  }

  tags {
    Name = "Prometheus stack public subnet's internet gateway"
  }
}

resource "aws_route_table_association" "Prometheus_public_route_stable_association" {
  subnet_id      = "${aws_subnet.Prometheus_public_subnet.id}"
  route_table_id = "${aws_route_table.Prometheus_public_route_table.id}"
}

/*  Private Subnet */
resource "aws_subnet" "Prometheus_private_subnet" {
  vpc_id            = "${aws_vpc.Prometheus_Stack_VPC.id}"
  cidr_block        = "${var.private_subnet_cidr}"
  availability_zone = "us-east-2c"

  tags {
    Name = "Prometheus stack private subnet"
  }
}

resource "aws_route_table" "Prometheus_private_route_table" {
  vpc_id = "${aws_vpc.Prometheus_Stack_VPC.id}"

  route {
    cidr_block  = "0.0.0.0/0"
    instance_id = "${aws_instance.nat.id}"
  }

  tags {
    Name = "Private Subnet"
  }
}

resource "aws_route_table_association" "Prometheus_private_route_stable_association" {
  subnet_id      = "${aws_subnet.Prometheus_private_subnet.id}"
  route_table_id = "${aws_route_table.Prometheus_private_route_table.id}"
}

/*
resource "aws_network_interface" "Prometheus_Stack_Network_Interface" {
  subnet_id = "${aws_subnet.Prometheus_Stack_Subnet.id}"
  description = "Description for the network interface"
  #private_ips =  "${element(var.private_ips, count.index)}"
  #private_ips_count = 3
  tags {
    Name = "Prometheus-stack-network-interface"
  }
}
*/