Major changes

terraform/iac/aws/backend.tf

@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "a13labs.infra.eu"
+    key    = "aws.core.infra.tfstate"
+    region = "eu-west-1"
+  }
+}

terraform/iac/aws/billing.tf

@@ -0,0 +1,34 @@
+resource "aws_cloudwatch_metric_alarm" "billing_alarm" {
+
+  alarm_name          = "billing_alarm"
+  comparison_operator = "GreaterThanThreshold"
+  metric_name         = "EstimatedCharges"
+  namespace           = "AWS/Billing"
+  evaluation_periods  = "1"
+  period              = "21600"
+  statistic           = "Maximum"
+  threshold           = local.billing_alarm_limit
+  alarm_description   = "Billing alarm"
+
+  alarm_actions = [aws_sns_topic.billing_alarm_topic.arn]
+
+  tags = {
+    Name        = "billing_alarm_topic_cf"
+    CreatedBy   = "terraform"
+    Environment = "aws-alarms"
+  }
+}
+
+# The SNS topic with email subscriptions
+# https://medium.com/@raghuram.arumalla153/aws-sns-topic-subscription-with-email-protocol-using-terraform-ed05f4f19b73
+resource "aws_sns_topic" "billing_alarm_topic" {
+  name = "billing_alarm_topic"
+  provisioner "local-exec" {
+    command = "sh ${path.module}/scripts/sns_subscription.sh"
+    environment = {
+      AWS_DEFAULT_REGION = var.region
+      sns_arn            = self.arn
+      sns_emails         = local.billing_alarm_emails
+    }
+  }
+}

terraform/iac/aws/buckets.tf

@@ -0,0 +1,51 @@
+resource "aws_s3_bucket" "infra_bucket" {
+  bucket        = "a13labs.infra.eu"
+  force_destroy = true
+}
+
+resource "aws_s3_bucket_public_access_block" "infra_bucket" {
+  bucket = aws_s3_bucket.infra_bucket.id
+
+  block_public_acls       = true
+  ignore_public_acls      = true
+  block_public_policy     = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_versioning" "infra_bucket" {
+  bucket = aws_s3_bucket.infra_bucket.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "infra_bucket" {
+  bucket = aws_s3_bucket.infra_bucket.id
+
+  rule {
+    id     = "clenaup"
+    status = "Enabled"
+    filter {
+      prefix = "/"
+    }
+    expiration {
+      days = 30
+    }
+  }
+}
+
+import {
+  id = "a13labs.infra.eu"
+  to = aws_s3_bucket.infra_bucket
+}
+
+import {
+  id = "a13labs.infra.eu"
+  to = aws_s3_bucket_public_access_block.infra_bucket
+}
+
+import {
+  id = "a13labs.infra.eu"
+  to = aws_s3_bucket_versioning.infra_bucket
+}

terraform/iac/aws/config.tf

@@ -0,0 +1,25 @@
+locals {
+  billing_alarm_limit  = 20
+  billing_alarm_emails = "c.alexandre.pires@alexpires.me"
+  instance_ips = [
+    "${local.vps_1.ip}/32",
+  ]
+
+  vps_1 = {
+    id   = data.terraform_remote_state.contabo.outputs.instances[0].id
+    name = data.terraform_remote_state.contabo.outputs.instances[0].name
+    ip   = data.terraform_remote_state.contabo.outputs.instances[0].ip_config[0].v4[0].ip
+  }
+}
+
+data "terraform_remote_state" "contabo" {
+  backend = "s3"
+  config = {
+    bucket = "a13labs.infra.eu"
+    key    = "contabo.core.infra.tfstate"
+    region = "eu-west-1"
+  }
+}
+
+data "aws_caller_identity" "current" {}
+

terraform/iac/aws/kms.tf

@@ -0,0 +1,83 @@
+data "aws_iam_policy_document" "kms_key_policy" {
+  statement {
+    sid       = "Enable IAM User Permissions"
+    effect    = "Allow"
+    actions   = ["kms:*"]
+    resources = ["*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
+    }
+  }
+
+  statement {
+    sid    = "Allow IAM User Access"
+    effect = "Allow"
+    actions = [
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:ReEncrypt*",
+      "kms:GenerateDataKey*",
+      "kms:DescribeKey"
+    ]
+    resources = ["*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = [aws_iam_user.k8s_secrets_user.arn]
+    }
+
+    condition {
+      # Only allow from specific IP addresses
+      test     = "IpAddress"
+      variable = "aws:SourceIp"
+      values   = ["${join(",", local.instance_ips)}"]
+    }
+  }
+}
+
+resource "aws_kms_key" "k8s_secrets" {
+  description             = "KMS key for encrypting Kubernetes secrets"
+  deletion_window_in_days = 30
+  enable_key_rotation     = true
+
+  policy = data.aws_iam_policy_document.kms_key_policy.json
+}
+
+resource "aws_iam_user" "k8s_secrets_user" {
+  name = "alexpires-me-microk8s"
+}
+
+resource "aws_iam_access_key" "k8s_secrets_user_key" {
+  user = aws_iam_user.k8s_secrets_user.name
+}
+
+data "aws_iam_policy_document" "k8s_secrets_user_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:ReEncrypt*",
+      "kms:GenerateDataKey*",
+      "kms:DescribeKey"
+    ]
+
+    resources = [aws_kms_key.k8s_secrets.arn]
+    condition {
+      # Only allow from specific IP addresses
+      test     = "IpAddress"
+      variable = "aws:SourceIp"
+      values   = ["${join(",", local.instance_ips)}"]
+    }
+  }
+}
+
+resource "aws_iam_user_policy" "k8s_secrets_user_policy" {
+  name   = "alexpires-me-microk8s-policy"
+  user   = aws_iam_user.k8s_secrets_user.name
+  policy = data.aws_iam_policy_document.k8s_secrets_user_policy.json
+}
+

terraform/iac/aws/provider.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">1.9"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~>5.70"
+    }
+  }
+}
+
+# Configure the AWS Provider
+provider "aws" {
+  region = var.region
+}

terraform/iac/aws/scripts/sns_subscription.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+
+for email in $sns_emails; do
+  echo $email
+  aws sns subscribe --topic-arn "$sns_arn" --protocol email --notification-endpoint "$email"
+done

terraform/iac/aws/sectool.env

@@ -0,0 +1,2 @@
+AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY
+AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY

terraform/iac/aws/variables.tf

@@ -0,0 +1,4 @@
+variable "region" {
+  description = "AWS Default region"
+  default     = "eu-west-1"
+}