Terraform with AWS

# CHAPTER 9

Terraform with AWS #

1. Introduction #

2. Learning Objectives #

• Authenticate the AWS Provider securely.

• Provision an S3 Bucket and configure security policies.

• Create an IAM User and assign permission policies.

• Provision an EC2 instance using a dynamic Data Source.

• Understand the relationship between Security Groups and EC2.

3. Beginner-Friendly Explanation #

• IAM (Identity and Access Management): The hotel security desk. It gives you a keycard and determines if you are allowed to enter the gym or only your room.

• S3 (Simple Storage Service): A secure locker in the basement where you can throw millions of files, pictures, and documents.

• EC2 (Elastic Compute Cloud): A hotel room with a computer in it that you can rent by the minute.

• Security Group: The bouncer standing directly outside your specific hotel room door, deciding who is allowed to knock.

4. Provisioning S3 (Storage) #

resource "aws_s3_bucket" "company_documents" {
  bucket = "my-unique-company-docs-bucket-9988" # Must be globally unique across ALL of AWS!
}

# In AWS Provider v4+, public access blocking is a separate resource
resource "aws_s3_bucket_public_access_block" "block_public" {
  bucket = aws_s3_bucket.company_documents.id # Implicit dependency!

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

5. Provisioning IAM (Security) #

resource "aws_iam_user" "developer" {
  name = "junior-dev-alice"
}

# Attach an existing AWS-managed policy to the user
resource "aws_iam_user_policy_attachment" "read_only" {
  user       = aws_iam_user.developer.name
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
}

6. Mini Project: Deploy AWS Infrastructure #

Step-by-Step Architecture Concept:

# 1. DATA SOURCE: Dynamically search AWS for the latest Ubuntu OS ID
data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"] # Canonical's official AWS Account ID

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
  }
}

# 2. SECURITY GROUP: The Firewall
resource "aws_security_group" "web_traffic" {
  name        = "allow_web"
  description = "Allow inbound HTTP traffic"

  # Inbound Rules (Ingress)
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # Allow from anywhere
  }

  # Outbound Rules (Egress)
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1" # All protocols
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# 3. EC2 INSTANCE: The Server
resource "aws_instance" "web_server" {
  # Use the ID found by the Data Source above!
  ami                    = data.aws_ami.ubuntu.id 
  instance_type          = "t2.micro"
  
  # Attach the Firewall!
  vpc_security_group_ids = [aws_security_group.web_traffic.id] 
  
  tags = {
    Name = "My-Web-Server"
  }
}

7. Real-World Scenarios #

1. 2. In the AWS Provider, why must the awss3bucket name be globally unique, not just unique within your own account?

13. Interview Questions #

• Q: Explain the operational advantage of utilizing an awsami data source with dynamic filtering rather than hardcoding an AMI ID string in an awsinstance resource block.

• Q: Describe the HCL structure required to provision an AWS EC2 instance and securely attach an explicitly defined Security Group. How does Terraform handle the dependency between these two resources?

14. Summary #

15. Next Chapter Recommendation #