terraform-iam: profile a workstation for the archeologists (#296)
Jonas Chevalier committed
Oct 29, 2023 at 18:30 UTC
1b97b0293a80acd02c120caf33744375b34f253a
1 file changed
+80
-3
terraform-iam/archeologist.tf
+80
-3
@@ -1,4 +1,15 @@
1
+# Workspace to dump analysis data extracted from the cache and other places.
2
+resource "aws_s3_bucket" "archeologist" {
3
+ # Keep it in the same region as the cache
4
+ provider = aws.us
5
+
6
+ bucket = "nix-archeologist"
7
+}
8
+
9
+# This is the role that is given to the AWS Identity Center users
10
resource "aws_iam_policy" "archologist" {
11
+ provider = aws.us
12
+
13
name = "archeologist"
14
description = "used by the S3 archeologists"
15
@@ -35,9 +46,75 @@ resource "aws_iam_policy" "archologist" {
46
EOF
47
}
48
38
-resource "aws_s3_bucket" "archeologist" {
39
- # Keep it in the same region as the cache
49
+# Prepare this role to be attached to the EC2 instance
50
+resource "aws_iam_role" "archeologist-worker" {
51
provider = aws.us
52
42
- bucket = "nix-archeologist"
53
+ name = "archeologist-worker"
54
+
55
+ assume_role_policy = <<EOF
56
+ {
57
+ "Version": "2012-10-17",
58
+ "Statement": [
59
+ {
60
+ "Action": "sts:AssumeRole",
61
+ "Principal": {
62
+ "Service": "ec2.amazonaws.com"
63
+ },
64
+ "Effect": "Allow",
65
+ "Sid": ""
66
+ }
67
+ ]
68
+ }
69
+ EOF
70
+}
71
+
72
+resource "aws_iam_role_policy" "archeologist-worker" {
73
+ provider = aws.us
74
+
75
+ name = "archeologist-worker"
76
+ role = aws_iam_role.archeologist-worker.id
77
+
78
+ # The EC2 instance gets the same policy as the users
79
+ policy = aws_iam_policy.archologist.policy
80
+}
81
+
82
+resource "aws_iam_instance_profile" "archeologist" {
83
+ provider = aws.us
84
+
85
+ name = "archeologist-worker"
86
+ role = aws_iam_role.archeologist-worker.name
87
+ # Make sure the role is attached before continuing
88
+ depends_on = [aws_iam_role_policy.archeologist-worker]
89
+}
90
+
91
+resource "aws_key_pair" "edef" {
92
+ provider = aws.us
93
+
94
+ key_name = "edef-key"
95
+ public_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu/CiEnmhIthp0XaGhU1cB18t6Ta/51k1/7EeIzKFwm"
96
+}
97
+
98
+resource "aws_instance" "archeologist" {
99
+ provider = aws.us
100
+
101
+ ami = "ami-07df5833f04703a2a" # "23.05".us-east-1.x86_64-linux.hvm-ebs
102
+ associate_public_ip_address = true
103
+ iam_instance_profile = aws_iam_instance_profile.archeologist.id
104
+ instance_type = "r5a.2xlarge"
105
+ key_name = aws_key_pair.edef.key_name
106
+ subnet_id = "subnet-1eb22868" # default subnet us-east-1c
107
+
108
+ root_block_device {
109
+ volume_size = "256" # GB
110
+ }
111
+
112
+ vpc_security_group_ids = [
113
+ "sg-51d35d29", # default
114
+ "sg-b2ee60ca", # public-ssh
115
+ ]
116
+
117
+ tags = {
118
+ Name = "archeologist-workspace"
119
+ }
120
}