21832: Allows to control whether RDS should be snapshotted before deletion.
[arvados.git] / tools / salt-install / terraform / aws / services / main.tf
1 # Copyright (C) The Arvados Authors. All rights reserved.
2 #
3 # SPDX-License-Identifier: CC-BY-SA-3.0
4
5 terraform {
6   required_version = "~> 1.3.0"
7   required_providers {
8     aws = {
9       source = "hashicorp/aws"
10       version = "~> 4.38.0"
11     }
12   }
13 }
14
15 provider "aws" {
16   region = local.region_name
17   default_tags {
18     tags = merge(local.custom_tags, {
19       Arvados = local.cluster_name
20       Terraform = true
21     })
22   }
23 }
24
25 provider "random" {}
26
27 resource "random_string" "default_rds_password" {
28   count = (local.use_rds && var.rds_password == "") ? 1 : 0
29   length  = 32
30   special = false
31 }
32
33 resource "aws_iam_instance_profile" "keepstore_instance_profile" {
34   name = "${local.cluster_name}-keepstore-00-iam-role"
35   role = data.terraform_remote_state.data-storage.outputs.keepstore_iam_role_name
36 }
37
38 resource "aws_iam_instance_profile" "compute_node_instance_profile" {
39   name = "${local.cluster_name}-compute-node-00-iam-role"
40   role = local.compute_node_iam_role_name
41 }
42
43 resource "aws_iam_instance_profile" "dispatcher_instance_profile" {
44   name = "${local.cluster_name}_dispatcher_instance_profile"
45   role = aws_iam_role.cloud_dispatcher_iam_role.name
46 }
47
48 resource "aws_secretsmanager_secret" "ssl_password_secret" {
49   name = local.ssl_password_secret_name
50   recovery_window_in_days = 0
51 }
52
53 resource "aws_iam_instance_profile" "default_instance_profile" {
54   name = "${local.cluster_name}_default_instance_profile"
55   role = aws_iam_role.default_iam_role.name
56 }
57
58 resource "aws_instance" "arvados_service" {
59   for_each = toset(concat(local.public_hosts, local.private_hosts))
60   ami = local.instance_ami_id
61   instance_type = try(var.instance_type[each.value], var.instance_type.default)
62   user_data = templatefile("user_data.sh", {
63     "hostname": each.value,
64     "deploy_user": var.deploy_user,
65     "ssh_pubkey": file(local.pubkey_path)
66   })
67   private_ip = local.private_ip[each.value]
68   subnet_id = contains(local.user_facing_hosts, each.value) ? local.public_subnet_id : local.private_subnet_id
69   vpc_security_group_ids = [ local.arvados_sg_id ]
70   iam_instance_profile = try(local.instance_profile[each.value], local.instance_profile.default).name
71   tags = {
72     Name = "${local.cluster_name}_arvados_service_${each.value}"
73   }
74   root_block_device {
75     volume_type = "gp3"
76     volume_size = try(var.instance_volume_size[each.value], var.instance_volume_size.default)
77   }
78   metadata_options {
79     # Sets IMDSv2 to required. Default is "optional".
80     http_tokens = "required"
81     http_endpoint = "enabled"
82   }
83   lifecycle {
84     ignore_changes = [
85       # Avoids recreating the instance when the latest AMI changes.
86       # Use 'terraform taint' or 'terraform apply -replace' to force
87       # an AMI change.
88       ami,
89     ]
90   }
91 }
92
93 resource "aws_db_subnet_group" "arvados_db_subnet_group" {
94   count = local.use_rds ? 1 : 0
95   name       = "${local.cluster_name}_db_subnet_group"
96   subnet_ids = [local.private_subnet_id, local.additional_rds_subnet_id]
97 }
98
99 resource "aws_db_instance" "postgresql_service" {
100   count = local.use_rds ? 1 : 0
101   allocated_storage = local.rds_allocated_storage
102   max_allocated_storage = local.rds_max_allocated_storage
103   engine = "postgres"
104   engine_version = local.rds_postgresql_version
105   instance_class = local.rds_instance_type
106   db_name = "${local.cluster_name}_arvados"
107   username = local.rds_username
108   password = local.rds_password
109   skip_final_snapshot  = !local.rds_backup_before_deletion
110   final_snapshot_identifier = local.rds_final_backup_name
111
112   vpc_security_group_ids = [local.arvados_sg_id]
113   db_subnet_group_name = aws_db_subnet_group.arvados_db_subnet_group[0].name
114
115   backup_retention_period = local.rds_backup_retention_period
116   publicly_accessible = false
117   storage_encrypted = true
118   multi_az = false
119
120   lifecycle {
121     ignore_changes = [
122       username,
123     ]
124   }
125
126   tags = {
127     Name = "${local.cluster_name}_postgresql_service"
128   }
129 }
130
131 resource "aws_iam_policy" "compute_node_ebs_autoscaler" {
132   name = "${local.cluster_name}_compute_node_ebs_autoscaler"
133   policy = jsonencode({
134     Version: "2012-10-17",
135     Id: "compute-node EBS Autoscaler policy",
136     Statement: [{
137       Effect: "Allow",
138       Action: [
139           "ec2:AttachVolume",
140           "ec2:DescribeVolumeStatus",
141           "ec2:DescribeVolumes",
142           "ec2:DescribeTags",
143           "ec2:ModifyInstanceAttribute",
144           "ec2:DescribeVolumeAttribute",
145           "ec2:CreateVolume",
146           "ec2:DeleteVolume",
147           "ec2:CreateTags"
148       ],
149       Resource: "*"
150     }]
151   })
152 }
153
154 resource "aws_iam_policy_attachment" "compute_node_ebs_autoscaler_attachment" {
155   name = "${local.cluster_name}_compute_node_ebs_autoscaler_attachment"
156   roles = [ local.compute_node_iam_role_name ]
157   policy_arn = aws_iam_policy.compute_node_ebs_autoscaler.arn
158 }
159
160 resource "aws_iam_policy" "cloud_dispatcher_ec2_access" {
161   name = "${local.cluster_name}_cloud_dispatcher_ec2_access"
162   policy = jsonencode({
163     Version: "2012-10-17",
164     Id: "arvados-dispatch-cloud policy",
165     Statement: [{
166       Effect: "Allow",
167       Action: [
168         "ec2:DescribeKeyPairs",
169         "ec2:ImportKeyPair",
170         "ec2:RunInstances",
171         "ec2:DescribeInstances",
172         "ec2:CreateTags",
173         "ec2:TerminateInstances"
174       ],
175       Resource: "*"
176     },
177     {
178       Effect: "Allow",
179       Action: [
180         "iam:PassRole",
181       ],
182       Resource: "arn:aws:iam::*:role/${aws_iam_instance_profile.compute_node_instance_profile.name}"
183     }]
184   })
185 }
186
187 resource "aws_iam_role" "cloud_dispatcher_iam_role" {
188   name = "${local.cluster_name}-dispatcher-00-iam-role"
189   assume_role_policy = "${file("../assumerolepolicy.json")}"
190 }
191
192 resource "aws_iam_policy_attachment" "cloud_dispatcher_ec2_access_attachment" {
193   name = "${local.cluster_name}_cloud_dispatcher_ec2_access_attachment"
194   roles = [ aws_iam_role.cloud_dispatcher_iam_role.name ]
195   policy_arn = aws_iam_policy.cloud_dispatcher_ec2_access.arn
196 }
197
198 resource "aws_eip_association" "eip_assoc" {
199   for_each = local.private_only ? [] : toset(local.public_hosts)
200   instance_id = aws_instance.arvados_service[each.value].id
201   allocation_id = local.eip_id[each.value]
202 }
203
204 resource "aws_iam_role" "default_iam_role" {
205   name = "${local.cluster_name}-default-iam-role"
206   assume_role_policy = "${file("../assumerolepolicy.json")}"
207 }
208
209 resource "aws_iam_policy" "ssl_privkey_password_access" {
210   name = "${local.cluster_name}_ssl_privkey_password_access"
211   policy = jsonencode({
212     Version: "2012-10-17",
213     Statement: [{
214       Effect: "Allow",
215       Action: "secretsmanager:GetSecretValue",
216       Resource: "${aws_secretsmanager_secret.ssl_password_secret.arn}"
217     }]
218   })
219 }
220
221 # Every service node needs access to the SSL privkey password secret for
222 # nginx to be able to use it.
223 resource "aws_iam_policy_attachment" "ssl_privkey_password_access_attachment" {
224   name = "${local.cluster_name}_ssl_privkey_password_access_attachment"
225   roles = [
226     aws_iam_role.cloud_dispatcher_iam_role.name,
227     aws_iam_role.default_iam_role.name,
228     local.keepstore_iam_role_name,
229   ]
230   policy_arn = aws_iam_policy.ssl_privkey_password_access.arn
231 }