1 # Copyright (C) The Arvados Authors. All rights reserved.
3 # SPDX-License-Identifier: CC-BY-SA-3.0
6 required_version = "~> 1.3.0"
9 source = "hashicorp/aws"
16 region = local.region_name
18 tags = merge(local.custom_tags, {
19 Arvados = local.cluster_name
27 resource "random_string" "default_rds_password" {
28 count = (local.use_rds && var.rds_password == "") ? 1 : 0
33 resource "aws_iam_instance_profile" "keepstore_instance_profile" {
34 name = "${local.cluster_name}-keepstore-00-iam-role"
35 role = data.terraform_remote_state.data-storage.outputs.keepstore_iam_role_name
38 resource "aws_iam_instance_profile" "compute_node_instance_profile" {
39 name = "${local.cluster_name}-compute-node-00-iam-role"
40 role = local.compute_node_iam_role_name
43 resource "aws_iam_instance_profile" "dispatcher_instance_profile" {
44 name = "${local.cluster_name}_dispatcher_instance_profile"
45 role = aws_iam_role.cloud_dispatcher_iam_role.name
48 resource "aws_secretsmanager_secret" "ssl_password_secret" {
49 name = local.ssl_password_secret_name
50 recovery_window_in_days = 0
53 resource "aws_iam_instance_profile" "default_instance_profile" {
54 name = "${local.cluster_name}_default_instance_profile"
55 role = aws_iam_role.default_iam_role.name
58 resource "aws_instance" "arvados_service" {
59 for_each = toset(concat(local.public_hosts, local.private_hosts))
60 ami = local.instance_ami_id
61 instance_type = try(var.instance_type[each.value], var.instance_type.default)
62 user_data = templatefile("user_data.sh", {
63 "hostname": each.value,
64 "deploy_user": var.deploy_user,
65 "ssh_pubkey": file(local.pubkey_path)
67 private_ip = local.private_ip[each.value]
68 subnet_id = contains(local.user_facing_hosts, each.value) ? local.public_subnet_id : local.private_subnet_id
69 vpc_security_group_ids = [ local.arvados_sg_id ]
70 iam_instance_profile = try(local.instance_profile[each.value], local.instance_profile.default).name
72 Name = "${local.cluster_name}_arvados_service_${each.value}"
76 volume_size = try(var.instance_volume_size[each.value], var.instance_volume_size.default)
79 # Sets IMDSv2 to required. Default is "optional".
80 http_tokens = "required"
81 http_endpoint = "enabled"
85 # Avoids recreating the instance when the latest AMI changes.
86 # Use 'terraform taint' or 'terraform apply -replace' to force
93 resource "aws_db_subnet_group" "arvados_db_subnet_group" {
94 count = local.use_rds ? 1 : 0
95 name = "${local.cluster_name}_db_subnet_group"
96 subnet_ids = [local.private_subnet_id, local.additional_rds_subnet_id]
99 resource "aws_db_instance" "postgresql_service" {
100 count = local.use_rds ? 1 : 0
101 allocated_storage = local.rds_allocated_storage
102 max_allocated_storage = local.rds_max_allocated_storage
104 engine_version = "15"
105 instance_class = local.rds_instance_type
106 db_name = "${local.cluster_name}_arvados"
107 username = local.rds_username
108 password = local.rds_password
109 skip_final_snapshot = true
111 vpc_security_group_ids = [local.arvados_sg_id]
112 db_subnet_group_name = aws_db_subnet_group.arvados_db_subnet_group[0].name
114 backup_retention_period = local.rds_backup_retention_period
115 publicly_accessible = false
116 storage_encrypted = true
126 Name = "${local.cluster_name}_postgresql_service"
130 resource "aws_iam_policy" "compute_node_ebs_autoscaler" {
131 name = "${local.cluster_name}_compute_node_ebs_autoscaler"
132 policy = jsonencode({
133 Version: "2012-10-17",
134 Id: "compute-node EBS Autoscaler policy",
139 "ec2:DescribeVolumeStatus",
140 "ec2:DescribeVolumes",
142 "ec2:ModifyInstanceAttribute",
143 "ec2:DescribeVolumeAttribute",
153 resource "aws_iam_policy_attachment" "compute_node_ebs_autoscaler_attachment" {
154 name = "${local.cluster_name}_compute_node_ebs_autoscaler_attachment"
155 roles = [ local.compute_node_iam_role_name ]
156 policy_arn = aws_iam_policy.compute_node_ebs_autoscaler.arn
159 resource "aws_iam_policy" "cloud_dispatcher_ec2_access" {
160 name = "${local.cluster_name}_cloud_dispatcher_ec2_access"
161 policy = jsonencode({
162 Version: "2012-10-17",
163 Id: "arvados-dispatch-cloud policy",
167 "ec2:DescribeKeyPairs",
170 "ec2:DescribeInstances",
172 "ec2:TerminateInstances"
181 Resource: "arn:aws:iam::*:role/${aws_iam_instance_profile.compute_node_instance_profile.name}"
186 resource "aws_iam_role" "cloud_dispatcher_iam_role" {
187 name = "${local.cluster_name}-dispatcher-00-iam-role"
188 assume_role_policy = "${file("../assumerolepolicy.json")}"
191 resource "aws_iam_policy_attachment" "cloud_dispatcher_ec2_access_attachment" {
192 name = "${local.cluster_name}_cloud_dispatcher_ec2_access_attachment"
193 roles = [ aws_iam_role.cloud_dispatcher_iam_role.name ]
194 policy_arn = aws_iam_policy.cloud_dispatcher_ec2_access.arn
197 resource "aws_eip_association" "eip_assoc" {
198 for_each = local.private_only ? [] : toset(local.public_hosts)
199 instance_id = aws_instance.arvados_service[each.value].id
200 allocation_id = local.eip_id[each.value]
203 resource "aws_iam_role" "default_iam_role" {
204 name = "${local.cluster_name}-default-iam-role"
205 assume_role_policy = "${file("../assumerolepolicy.json")}"
208 resource "aws_iam_policy" "ssl_privkey_password_access" {
209 name = "${local.cluster_name}_ssl_privkey_password_access"
210 policy = jsonencode({
211 Version: "2012-10-17",
214 Action: "secretsmanager:GetSecretValue",
215 Resource: "${aws_secretsmanager_secret.ssl_password_secret.arn}"
220 # Every service node needs access to the SSL privkey password secret for
221 # nginx to be able to use it.
222 resource "aws_iam_policy_attachment" "ssl_privkey_password_access_attachment" {
223 name = "${local.cluster_name}_ssl_privkey_password_access_attachment"
225 aws_iam_role.cloud_dispatcher_iam_role.name,
226 aws_iam_role.default_iam_role.name,
227 local.keepstore_iam_role_name,
229 policy_arn = aws_iam_policy.ssl_privkey_password_access.arn