Vengala Vinay

Having 9+ Years of Experience in Software Development

Home » Infrastructure as Code: Provisioning Secure C Clusters on AWS Using Terraform

Infrastructure as Code: Provisioning Secure C Clusters on AWS Using Terraform

Terraform Provider Configuration for AWS

To begin provisioning infrastructure on AWS using Terraform, we first need to configure the AWS provider. This involves specifying the AWS region and potentially authentication credentials. For production environments, it’s highly recommended to manage AWS credentials securely, typically through environment variables, IAM roles for EC2 instances, or shared credential files, rather than hardcoding them directly in the Terraform configuration.

Here’s a basic `provider.tf` file:

# provider.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1" # Example region, change as needed
  # Credentials can be configured via environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
  # or via shared credential files (~/.aws/credentials) or IAM roles.
}

Designing the C Cluster Network Infrastructure

A secure C cluster requires a well-defined network architecture. This typically involves a Virtual Private Cloud (VPC), subnets (both public and private), an Internet Gateway (IGW) for public access, NAT Gateways for outbound internet access from private subnets, and Security Groups to control traffic flow.

We’ll start by defining the VPC and its associated networking components in a `network.tf` file.

# network.tf

# VPC
resource "aws_vpc" "c_cluster_vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "c-cluster-vpc"
  }
}

# Internet Gateway
resource "aws_internet_gateway" "c_cluster_igw" {
  vpc_id = aws_vpc.c_cluster_vpc.id

  tags = {
    Name = "c-cluster-igw"
  }
}

# Public Subnet (for NAT Gateways and potentially load balancers)
resource "aws_subnet" "public_subnet" {
  vpc_id                  = aws_vpc.c_cluster_vpc.id
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = true # Instances launched here will get public IPs
  availability_zone       = "us-east-1a" # Example AZ

  tags = {
    Name = "c-cluster-public-subnet"
  }
}

# Private Subnet (for C cluster nodes)
resource "aws_subnet" "private_subnet" {
  vpc_id                  = aws_vpc.c_cluster_vpc.id
  cidr_block              = "10.0.2.0/24"
  map_public_ip_on_launch = false # Instances launched here will NOT get public IPs
  availability_zone       = "us-east-1b" # Example AZ, ideally different from public subnet

  tags = {
    Name = "c-cluster-private-subnet"
  }
}

# Elastic IP for NAT Gateway
resource "aws_eip" "nat_gateway_eip" {
  domain = "vpc"
}

# NAT Gateway
resource "aws_nat_gateway" "nat_gateway" {
  allocation_id = aws_eip.nat_gateway_eip.id
  subnet_id     = aws_subnet.public_subnet.id # NAT Gateway resides in the public subnet

  tags = {
    Name = "c-cluster-nat-gateway"
  }

  depends_on = [aws_internet_gateway.c_cluster_igw]
}

# Public Route Table
resource "aws_route_table" "public_rt" {
  vpc_id = aws_vpc.c_cluster_vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.c_cluster_igw.id
  }

  tags = {
    Name = "c-cluster-public-rt"
  }
}

# Associate Public Subnet with Public Route Table
resource "aws_route_table_association" "public_subnet_assoc" {
  subnet_id      = aws_subnet.public_subnet.id
  route_table_id = aws_route_table.public_rt.id
}

# Private Route Table
resource "aws_route_table" "private_rt" {
  vpc_id = aws_vpc.c_cluster_vpc.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.nat_gateway.id # Outbound internet access via NAT Gateway
  }

  tags = {
    Name = "c-cluster-private-rt"
  }
}

# Associate Private Subnet with Private Route Table
resource "aws_route_table_association" "private_subnet_assoc" {
  subnet_id      = aws_subnet.private_subnet.id
  route_table_id = aws_route_table.private_rt.id
}

Provisioning EC2 Instances for C Cluster Nodes

Now, let’s define the EC2 instances that will form our C cluster. We’ll create an EC2 instance in the private subnet. For a production-ready cluster, you would typically use Auto Scaling Groups and potentially multiple instances across different Availability Zones for high availability. For simplicity, this example provisions a single instance.

We’ll also define a Security Group to control inbound and outbound traffic to these instances. For a C cluster, you’ll likely need to allow SSH access (port 22) and any specific ports your C application uses.

# compute.tf

# Security Group for C Cluster Nodes
resource "aws_security_group" "c_cluster_sg" {
  name        = "c-cluster-sg"
  description = "Allow SSH and C application ports"
  vpc_id      = aws_vpc.c_cluster_vpc.id

  # Allow SSH access from anywhere (for management). In production, restrict this to specific IPs.
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Allow traffic for your C application (example: port 8080)
  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # Restrict this in production
  }

  # Allow all outbound traffic
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "c-cluster-sg"
  }
}

# EC2 Instance for C Cluster Node
resource "aws_instance" "c_node_1" {
  ami           = "ami-0c55b159cbfafe1f0" # Example: Amazon Linux 2 AMI (us-east-1). Find the latest for your region.
  instance_type = "t3.micro"
  subnet_id     = aws_subnet.private_subnet.id
  vpc_security_group_ids = [aws_security_group.c_cluster_sg.id]
  key_name      = "your-ssh-key-pair-name" # Replace with your actual SSH key pair name

  # User data for initial setup (e.g., installing C compiler, dependencies, and your application)
  user_data = <<-EOF
              #!/bin/bash
              # Update packages
              sudo yum update -y

              # Install C compiler and build tools
              sudo yum groupinstall "Development Tools" -y

              # Example: Download and compile a simple C application
              # In a real scenario, you'd likely use a more robust deployment method
              # like fetching from a Git repo, using a configuration management tool,
              # or deploying a pre-built binary.
              echo '#include <stdio.h>\nint main() { printf("Hello from C Cluster Node!\\n"); return 0; }' > hello.c
              gcc hello.c -o hello
              nohup ./hello > /var/log/hello.log 2>&1 &

              # Example: Install and run a web server if your C app is a web service
              # sudo yum install -y nginx
              # sudo systemctl start nginx
              # sudo systemctl enable nginx
              # Configure nginx to proxy to your C app if needed
              EOF

  tags = {
    Name = "c-node-1"
  }

  # Ensure network resources are created before the instance
  depends_on = [
    aws_subnet.private_subnet,
    aws_security_group.c_cluster_sg,
    aws_nat_gateway.nat_gateway # Ensure NAT Gateway is up for outbound access if needed by user_data
  ]
}

Securing the C Cluster with IAM Roles

For enhanced security, EC2 instances should not rely on static access keys. Instead, they should assume an IAM Role with the necessary permissions. This is particularly important if your C application needs to interact with other AWS services (e.g., S3, DynamoDB).

# iam.tf

# IAM Policy for C Cluster Nodes
resource "aws_iam_policy" "c_cluster_policy" {
  name        = "c-cluster-node-policy"
  description = "Policy for C cluster nodes to access specific AWS services"
  policy      = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:ListBucket",
          "s3:GetObject"
        ]
        Resource = "arn:aws:s3:::your-c-app-bucket/*" # Replace with your S3 bucket ARN
      },
      {
        Effect = "Allow"
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Resource = "arn:aws:logs:*:*:*" # Example: Allow logging to CloudWatch Logs
      }
    ]
  })
}

# IAM Role for EC2 Instances
resource "aws_iam_role" "c_cluster_role" {
  name = "c-cluster-node-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

# Attach the policy to the role
resource "aws_iam_role_policy_attachment" "c_cluster_policy_attach" {
  role       = aws_iam_role.c_cluster_role.name
  policy_arn = aws_iam_policy.c_cluster_policy.arn
}

# IAM Instance Profile
resource "aws_iam_instance_profile" "c_cluster_profile" {
  name = "c-cluster-instance-profile"
  role = aws_iam_role.c_cluster_role.name
}

# Associate the instance profile with the EC2 instance
resource "aws_instance" "c_node_1" {
  # ... other configurations ...
  iam_instance_profile = aws_iam_instance_profile.c_cluster_profile.name
  # ... rest of the configuration ...
}

Deployment and Management Workflow

Once you have all your Terraform files (`provider.tf`, `network.tf`, `compute.tf`, `iam.tf`) in a directory, the deployment workflow is standard Terraform:

  • Initialize Terraform: Run terraform init in your project directory. This downloads the AWS provider and any other necessary modules.
  • Review the Plan: Run terraform plan. This will show you exactly what AWS resources Terraform will create, modify, or destroy. Carefully review this output to ensure it aligns with your expectations.
  • Apply the Configuration: Run terraform apply. Terraform will prompt you to confirm the changes. Type yes to proceed with provisioning the infrastructure on AWS.
  • Destroy Resources: When you no longer need the cluster, run terraform destroy to tear down all provisioned resources and avoid ongoing costs.

For managing the C application itself on the instances, consider integrating tools like Ansible, Chef, or Puppet, or using containerization with Docker and orchestrating with Kubernetes (though this example focuses on raw EC2 provisioning).