lenape
2 months ago
3 changed files with 470 additions and 2097 deletions
@ -0,0 +1,241 @@ |
|||||||
|
# Configure the Azure Provider |
||||||
|
terraform { |
||||||
|
required_providers { |
||||||
|
azurerm = { |
||||||
|
source = "hashicorp/azurerm" |
||||||
|
version = "~> 3.0" |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
provider "azurerm" { |
||||||
|
features {} |
||||||
|
} |
||||||
|
|
||||||
|
data "azurerm_client_config" "current" {} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# Naming Conventions |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
locals { |
||||||
|
vm_names = ["Quetzalcoatl", "Huitzilopochtli", "Pachamama", "Viracocha", "Inti"] |
||||||
|
network_names = ["Aztec", "Inca", "Maya", "Mississippian", "Anasazi"] |
||||||
|
resource_groups = { |
||||||
|
eastus2 = "muscogee-rg" |
||||||
|
westus2 = "sioux-rg" |
||||||
|
centralus = "cherokee-rg" |
||||||
|
} |
||||||
|
location_default = "eastus2" |
||||||
|
location_quetzalcoatl = "westus2" |
||||||
|
location_centralus = "centralus" |
||||||
|
admin_username = "lenape" |
||||||
|
key_vault_name_prefix = "kv-secure-creds" |
||||||
|
storage_account_name = "povertypoint" |
||||||
|
container_name = "tfstate" |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 1. Resource Groups |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
resource "azurerm_resource_group" "rg" { |
||||||
|
for_each = local.resource_groups |
||||||
|
name = each.value |
||||||
|
location = local.location_default |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 2. Azure Key Vault for Secure Password Management |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
resource "azurerm_key_vault" "kv" { |
||||||
|
name = "${local.key_vault_name_prefix}-${random_string.kv_suffix.result}" |
||||||
|
location = azurerm_resource_group.rg["eastus2"].location |
||||||
|
resource_group_name = azurerm_resource_group.rg["eastus2"].name |
||||||
|
tenant_id = data.azurerm_client_config.current.tenant_id |
||||||
|
sku_name = "standard" |
||||||
|
|
||||||
|
access_policy { |
||||||
|
tenant_id = data.azurerm_client_config.current.tenant_id |
||||||
|
object_id = data.azurerm_client_config.current.object_id |
||||||
|
key_permissions = ["Get"] |
||||||
|
secret_permissions = ["Get", "Set"] |
||||||
|
storage_permissions = ["Get"] |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
resource "random_string" "kv_suffix" { |
||||||
|
length = 8 |
||||||
|
lower = true |
||||||
|
numeric = true |
||||||
|
special = false |
||||||
|
} |
||||||
|
|
||||||
|
resource "random_password" "admin_password" { |
||||||
|
length = 20 |
||||||
|
special = true |
||||||
|
override_special = "!#$%&*()-_=+[]{}<>:?" |
||||||
|
} |
||||||
|
|
||||||
|
resource "azurerm_key_vault_secret" "admin_password_secret" { |
||||||
|
name = "linux-admin-password" |
||||||
|
value = random_password.admin_password.result |
||||||
|
key_vault_id = azurerm_key_vault.kv.id |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 3. Virtual Networks, Subnets, and Network Security Groups |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
resource "azurerm_virtual_network" "vnet" { |
||||||
|
for_each = toset([local.location_default, local.location_quetzalcoatl, local.location_centralus]) |
||||||
|
name = "${local.network_names[0]}-vnet-${each.key}" |
||||||
|
location = each.key |
||||||
|
resource_group_name = azurerm_resource_group.rg[each.key].name |
||||||
|
address_space = ["10.0.0.0/16"] |
||||||
|
} |
||||||
|
|
||||||
|
resource "azurerm_subnet" "subnet" { |
||||||
|
for_each = azurerm_virtual_network.vnet |
||||||
|
name = "default" |
||||||
|
resource_group_name = azurerm_resource_group.rg[each.key].name |
||||||
|
virtual_network_name = each.value.name |
||||||
|
address_prefixes = ["10.0.1.0/24"] |
||||||
|
} |
||||||
|
|
||||||
|
resource "azurerm_network_security_group" "nsg" { |
||||||
|
for_each = azurerm_virtual_network.vnet |
||||||
|
name = "${local.network_names[0]}-nsg-${each.key}" |
||||||
|
location = each.key |
||||||
|
resource_group_name = azurerm_resource_group.rg[each.key].name |
||||||
|
security_rule { |
||||||
|
name = "AllowSSH" |
||||||
|
priority = 100 |
||||||
|
direction = "Inbound" |
||||||
|
access = "Allow" |
||||||
|
protocol = "Tcp" |
||||||
|
source_port_range = "*" |
||||||
|
destination_port_range = "22" |
||||||
|
source_address_prefix = "*" |
||||||
|
destination_address_prefix = "*" |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 4. Public IPs for VMs |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
resource "azurerm_public_ip" "public_ip" { |
||||||
|
for_each = toset(local.vm_names) |
||||||
|
name = "${each.value}-pip" |
||||||
|
location = azurerm_resource_group.rg[local.location_default].location |
||||||
|
resource_group_name = azurerm_resource_group.rg[local.location_default].name |
||||||
|
allocation_method = "Dynamic" |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 5. Load Balancer Setup (Blue-Green with Frontend IPs and Backend Pools) |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
resource "azurerm_lb" "load_balancer" { |
||||||
|
for_each = toset([local.location_default, local.location_centralus]) |
||||||
|
name = "lb-${each.key}" |
||||||
|
location = each.key |
||||||
|
resource_group_name = azurerm_resource_group.rg[each.key].name |
||||||
|
sku = "Basic" |
||||||
|
} |
||||||
|
|
||||||
|
resource "azurerm_lb_frontend_ip_configuration" "frontend_ip" { |
||||||
|
for_each = azurerm_lb.load_balancer |
||||||
|
name = "frontend-${each.key}" |
||||||
|
resource_group_name = each.value.resource_group_name |
||||||
|
loadbalancer_id = each.value.id |
||||||
|
private_ip_address = "10.0.0.4" |
||||||
|
private_ip_address_allocation = "Dynamic" |
||||||
|
} |
||||||
|
|
||||||
|
resource "azurerm_lb_backend_address_pool" "backend_pool" { |
||||||
|
for_each = azurerm_lb.load_balancer |
||||||
|
name = "backend-${each.key}" |
||||||
|
resource_group_name = each.value.resource_group_name |
||||||
|
loadbalancer_id = each.value.id |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 6. Network Interface and VM Configurations (Blue-Green) |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
resource "azurerm_network_interface" "nic" { |
||||||
|
for_each = toset(local.vm_names) |
||||||
|
name = "${each.value}-nic" |
||||||
|
location = azurerm_resource_group.rg[local.location_default].location |
||||||
|
resource_group_name = azurerm_resource_group.rg[local.location_default].name |
||||||
|
ip_configuration { |
||||||
|
name = "internal" |
||||||
|
subnet_id = azurerm_subnet.subnet["eastus2"].id |
||||||
|
private_ip_address_allocation = "Dynamic" |
||||||
|
public_ip_address_id = azurerm_public_ip.public_ip[each.value].id |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
resource "azurerm_linux_virtual_machine" "vm" { |
||||||
|
for_each = toset(local.vm_names) |
||||||
|
name = each.value |
||||||
|
location = azurerm_resource_group.rg[local.location_default].location |
||||||
|
resource_group_name = azurerm_resource_group.rg[local.location_default].name |
||||||
|
network_interface_ids = [azurerm_network_interface.nic[each.value].id] |
||||||
|
size = "Standard_B1ls" |
||||||
|
os_disk { |
||||||
|
caching = "ReadWrite" |
||||||
|
storage_account_type = "Standard_LRS" |
||||||
|
} |
||||||
|
source_image_reference { |
||||||
|
publisher = "Canonical" |
||||||
|
offer = "UbuntuServer" |
||||||
|
sku = "18.04-LTS" |
||||||
|
version = "latest" |
||||||
|
} |
||||||
|
computer_name = lower(each.value) |
||||||
|
admin_username = local.admin_username |
||||||
|
disable_password_authentication = false |
||||||
|
admin_password = azurerm_key_vault_secret.admin_password_secret.value |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 7. Load Balancer Backend Pool Associations (VMs to Backend) |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
resource "azurerm_lb_backend_address_pool_association" "backend_pool_association" { |
||||||
|
for_each = toset(local.vm_names) |
||||||
|
network_interface_id = azurerm_network_interface.nic[each.value].id |
||||||
|
backend_address_pool_id = azurerm_lb_backend_address_pool.backend_pool["eastus2"].id |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 8. Storage Account and Blob Container for tfstate |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
resource "azurerm_storage_account" "storage" { |
||||||
|
name = local.storage_account_name |
||||||
|
resource_group_name = azurerm_resource_group.rg["eastus2"].name |
||||||
|
location = azurerm_resource_group.rg["eastus2"].location |
||||||
|
account_tier = "Standard" |
||||||
|
account_replication_type = "LRS" |
||||||
|
} |
||||||
|
|
||||||
|
resource "azurerm_storage_container" "tfstate_container" { |
||||||
|
name = local.container_name |
||||||
|
storage_account_name = azurerm_storage_account.storage.name |
||||||
|
container_access_type = "private" |
||||||
|
} |
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
# 9. Output the Public IP Addresses and Key Vault Name |
||||||
|
# ----------------------------------------------------------------------------- |
||||||
|
output "public_ips" { |
||||||
|
value = azurerm_public_ip.public_ip[*].ip_address |
||||||
|
} |
||||||
|
|
||||||
|
output "key_vault_name" { |
||||||
|
value = azurerm_key_vault.kv.name |
||||||
|
} |
||||||
|
|
||||||
|
output "storage_account_name" { |
||||||
|
value = azurerm_storage_account.storage.name |
||||||
|
} |
||||||
|
|
||||||
|
output "storage_container_name" { |
||||||
|
value = azurerm_storage_container.tfstate_container.name |
||||||
|
} |
||||||
@ -0,0 +1,226 @@ |
|||||||
|
{ |
||||||
|
"version": 4, |
||||||
|
"terraform_version": "1.11.3", |
||||||
|
"serial": 80, |
||||||
|
"lineage": "22565f98-f6c8-a960-466f-9dfb72683787", |
||||||
|
"outputs": {}, |
||||||
|
"resources": [ |
||||||
|
{ |
||||||
|
"mode": "data", |
||||||
|
"type": "azurerm_client_config", |
||||||
|
"name": "current", |
||||||
|
"provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]", |
||||||
|
"instances": [ |
||||||
|
{ |
||||||
|
"schema_version": 0, |
||||||
|
"attributes": { |
||||||
|
"client_id": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", |
||||||
|
"id": "Y2xpZW50Q29uZmlncy9jbGllbnRJZD0wNGIwNzc5NS04ZGRiLTQ2MWEtYmJlZS0wMmY5ZTFiZjdiNDY7b2JqZWN0SWQ9MTNkOWE2OGYtYTlmZi00ZjllLWJiYWMtNWMzNDE2NDQyOWQ2O3N1YnNjcmlwdGlvbklkPWUzZjY2M2U4LTk5YjEtNGUwYS1iMjM2LWEyYTZlNGRjZWNhYTt0ZW5hbnRJZD1lMmMwNWQ3Ni1hNTMwLTQxZTUtYWUwNC1lNjBmN2VmYTFmNzg=", |
||||||
|
"object_id": "13d9a68f-a9ff-4f9e-bbac-5c34164429d6", |
||||||
|
"subscription_id": "e3f663e8-99b1-4e0a-b236-a2a6e4dcecaa", |
||||||
|
"tenant_id": "e2c05d76-a530-41e5-ae04-e60f7efa1f78", |
||||||
|
"timeouts": null |
||||||
|
}, |
||||||
|
"sensitive_attributes": [] |
||||||
|
} |
||||||
|
] |
||||||
|
}, |
||||||
|
{ |
||||||
|
"mode": "managed", |
||||||
|
"type": "azurerm_key_vault", |
||||||
|
"name": "kv", |
||||||
|
"provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]", |
||||||
|
"instances": [ |
||||||
|
{ |
||||||
|
"schema_version": 2, |
||||||
|
"attributes": { |
||||||
|
"access_policy": [ |
||||||
|
{ |
||||||
|
"application_id": "", |
||||||
|
"certificate_permissions": [], |
||||||
|
"key_permissions": [ |
||||||
|
"Get" |
||||||
|
], |
||||||
|
"object_id": "13d9a68f-a9ff-4f9e-bbac-5c34164429d6", |
||||||
|
"secret_permissions": [ |
||||||
|
"Get", |
||||||
|
"Set" |
||||||
|
], |
||||||
|
"storage_permissions": [ |
||||||
|
"Get" |
||||||
|
], |
||||||
|
"tenant_id": "e2c05d76-a530-41e5-ae04-e60f7efa1f78" |
||||||
|
} |
||||||
|
], |
||||||
|
"contact": [], |
||||||
|
"enable_rbac_authorization": false, |
||||||
|
"enabled_for_deployment": false, |
||||||
|
"enabled_for_disk_encryption": false, |
||||||
|
"enabled_for_template_deployment": false, |
||||||
|
"id": "/subscriptions/e3f663e8-99b1-4e0a-b236-a2a6e4dcecaa/resourceGroups/muscogee-rg/providers/Microsoft.KeyVault/vaults/kv-secure-creds-tlr5sYFS", |
||||||
|
"location": "eastus2", |
||||||
|
"name": "kv-secure-creds-tlr5sYFS", |
||||||
|
"network_acls": [ |
||||||
|
{ |
||||||
|
"bypass": "AzureServices", |
||||||
|
"default_action": "Allow", |
||||||
|
"ip_rules": [], |
||||||
|
"virtual_network_subnet_ids": [] |
||||||
|
} |
||||||
|
], |
||||||
|
"public_network_access_enabled": true, |
||||||
|
"purge_protection_enabled": false, |
||||||
|
"resource_group_name": "muscogee-rg", |
||||||
|
"sku_name": "standard", |
||||||
|
"soft_delete_retention_days": 90, |
||||||
|
"tags": {}, |
||||||
|
"tenant_id": "e2c05d76-a530-41e5-ae04-e60f7efa1f78", |
||||||
|
"timeouts": null, |
||||||
|
"vault_uri": "https://kv-secure-creds-tlr5syfs.vault.azure.net/" |
||||||
|
}, |
||||||
|
"sensitive_attributes": [], |
||||||
|
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfSwic2NoZW1hX3ZlcnNpb24iOiIyIn0=", |
||||||
|
"dependencies": [ |
||||||
|
"azurerm_resource_group.rg_eastus2", |
||||||
|
"data.azurerm_client_config.current", |
||||||
|
"random_string.kv_suffix" |
||||||
|
] |
||||||
|
} |
||||||
|
] |
||||||
|
}, |
||||||
|
{ |
||||||
|
"mode": "managed", |
||||||
|
"type": "azurerm_key_vault_secret", |
||||||
|
"name": "admin_password_secret", |
||||||
|
"provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]", |
||||||
|
"instances": [ |
||||||
|
{ |
||||||
|
"schema_version": 0, |
||||||
|
"attributes": { |
||||||
|
"content_type": "", |
||||||
|
"expiration_date": null, |
||||||
|
"id": "https://kv-secure-creds-tlr5syfs.vault.azure.net/secrets/linux-admin-password/0762d4e91c3d49e89f9c0b7ed2d6c02e", |
||||||
|
"key_vault_id": "/subscriptions/e3f663e8-99b1-4e0a-b236-a2a6e4dcecaa/resourceGroups/muscogee-rg/providers/Microsoft.KeyVault/vaults/kv-secure-creds-tlr5sYFS", |
||||||
|
"name": "linux-admin-password", |
||||||
|
"not_before_date": null, |
||||||
|
"resource_id": "/subscriptions/e3f663e8-99b1-4e0a-b236-a2a6e4dcecaa/resourceGroups/muscogee-rg/providers/Microsoft.KeyVault/vaults/kv-secure-creds-tlr5sYFS/secrets/linux-admin-password/versions/0762d4e91c3d49e89f9c0b7ed2d6c02e", |
||||||
|
"resource_versionless_id": "/subscriptions/e3f663e8-99b1-4e0a-b236-a2a6e4dcecaa/resourceGroups/muscogee-rg/providers/Microsoft.KeyVault/vaults/kv-secure-creds-tlr5sYFS/secrets/linux-admin-password", |
||||||
|
"tags": {}, |
||||||
|
"timeouts": null, |
||||||
|
"value": "-tv1k#:*pqQK7Sw1\u0026E\u003eS", |
||||||
|
"version": "0762d4e91c3d49e89f9c0b7ed2d6c02e", |
||||||
|
"versionless_id": "https://kv-secure-creds-tlr5syfs.vault.azure.net/secrets/linux-admin-password" |
||||||
|
}, |
||||||
|
"sensitive_attributes": [ |
||||||
|
[ |
||||||
|
{ |
||||||
|
"type": "get_attr", |
||||||
|
"value": "value" |
||||||
|
} |
||||||
|
] |
||||||
|
], |
||||||
|
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjE4MDAwMDAwMDAwMDAsInVwZGF0ZSI6MTgwMDAwMDAwMDAwMH19", |
||||||
|
"dependencies": [ |
||||||
|
"azurerm_key_vault.kv", |
||||||
|
"azurerm_resource_group.rg_eastus2", |
||||||
|
"data.azurerm_client_config.current", |
||||||
|
"random_password.admin_password", |
||||||
|
"random_string.kv_suffix" |
||||||
|
] |
||||||
|
} |
||||||
|
] |
||||||
|
}, |
||||||
|
{ |
||||||
|
"mode": "managed", |
||||||
|
"type": "azurerm_resource_group", |
||||||
|
"name": "rg_eastus2", |
||||||
|
"provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]", |
||||||
|
"instances": [ |
||||||
|
{ |
||||||
|
"schema_version": 0, |
||||||
|
"attributes": { |
||||||
|
"id": "/subscriptions/e3f663e8-99b1-4e0a-b236-a2a6e4dcecaa/resourceGroups/muscogee-rg", |
||||||
|
"location": "eastus2", |
||||||
|
"managed_by": "", |
||||||
|
"name": "muscogee-rg", |
||||||
|
"tags": {}, |
||||||
|
"timeouts": null |
||||||
|
}, |
||||||
|
"sensitive_attributes": [], |
||||||
|
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo1NDAwMDAwMDAwMDAwLCJkZWxldGUiOjU0MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjo1NDAwMDAwMDAwMDAwfX0=" |
||||||
|
} |
||||||
|
] |
||||||
|
}, |
||||||
|
{ |
||||||
|
"mode": "managed", |
||||||
|
"type": "random_password", |
||||||
|
"name": "admin_password", |
||||||
|
"provider": "provider[\"registry.terraform.io/hashicorp/random\"]", |
||||||
|
"instances": [ |
||||||
|
{ |
||||||
|
"schema_version": 3, |
||||||
|
"attributes": { |
||||||
|
"bcrypt_hash": "$2a$10$MuY.C09fQYh0IF.aEhLD.uUJbfv9JM1zpDq1f6aF2nXTs6oFBb/YS", |
||||||
|
"id": "none", |
||||||
|
"keepers": null, |
||||||
|
"length": 20, |
||||||
|
"lower": true, |
||||||
|
"min_lower": 0, |
||||||
|
"min_numeric": 0, |
||||||
|
"min_special": 0, |
||||||
|
"min_upper": 0, |
||||||
|
"number": true, |
||||||
|
"numeric": true, |
||||||
|
"override_special": "!#$%\u0026*()-_=+[]{}\u003c\u003e:?", |
||||||
|
"result": "-tv1k#:*pqQK7Sw1\u0026E\u003eS", |
||||||
|
"special": true, |
||||||
|
"upper": true |
||||||
|
}, |
||||||
|
"sensitive_attributes": [ |
||||||
|
[ |
||||||
|
{ |
||||||
|
"type": "get_attr", |
||||||
|
"value": "bcrypt_hash" |
||||||
|
} |
||||||
|
], |
||||||
|
[ |
||||||
|
{ |
||||||
|
"type": "get_attr", |
||||||
|
"value": "result" |
||||||
|
} |
||||||
|
] |
||||||
|
] |
||||||
|
} |
||||||
|
] |
||||||
|
}, |
||||||
|
{ |
||||||
|
"mode": "managed", |
||||||
|
"type": "random_string", |
||||||
|
"name": "kv_suffix", |
||||||
|
"provider": "provider[\"registry.terraform.io/hashicorp/random\"]", |
||||||
|
"instances": [ |
||||||
|
{ |
||||||
|
"schema_version": 2, |
||||||
|
"attributes": { |
||||||
|
"id": "tlr5sYFS", |
||||||
|
"keepers": null, |
||||||
|
"length": 8, |
||||||
|
"lower": true, |
||||||
|
"min_lower": 0, |
||||||
|
"min_numeric": 0, |
||||||
|
"min_special": 0, |
||||||
|
"min_upper": 0, |
||||||
|
"number": true, |
||||||
|
"numeric": true, |
||||||
|
"override_special": null, |
||||||
|
"result": "tlr5sYFS", |
||||||
|
"special": false, |
||||||
|
"upper": true |
||||||
|
}, |
||||||
|
"sensitive_attributes": [] |
||||||
|
} |
||||||
|
] |
||||||
|
} |
||||||
|
], |
||||||
|
"check_results": null |
||||||
|
} |
||||||
Loading…
Reference in new issue