sg, eks, iam 모듈추가

prod-hq/.terraform.lock.hcl

@@ -0,0 +1,20 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "2.70.1"
+  constraints = "~> 2.0"
+  hashes = [
+    "h1:SQR8egOmFbwBHOSMzUYg/Mt4e0LsQe91ma9I2Ug3lmY=",
+    "zh:04137cdf128cf21dcd190bbba4d4bba43c7868c52ad646b0eaa54a8b8b8160a7",
+    "zh:30c9f956133a102b4a426d76dd3ef1a42332d9875261a06aa877409aa6b2b556",
+    "zh:3107a43647454a3d6d847fba6aa593650af0f6a353272c04450408af5f4d353a",
+    "zh:3f17285478313af822447b453fa4e37f30ef221f0b0e8f2e4655f1ac9f9de1a2",
+    "zh:5a626f7a3c4a9fea3bdfde63aedbf6eea73760f3b228f776f1132b61d00c7ff2",
+    "zh:6aafc9dd79b511b9e3d0ec49f7df1d1fd697c3c873d1d70a2be1a12475b50206",
+    "zh:6fb29b48ccc85f7e9dfde3867ce99d6d65fb76bea68c97d404fae431758a8f03",
+    "zh:c47be92e1edf2e8675c932030863536c1a79decf85b2baa4232e5936c5f7088f",
+    "zh:cd0a4b28c5e4b5092043803d17fd1d495ecb926c2688603c4cdab4c20f3a91f4",
+    "zh:fb0ff763cb5d7a696989e58e0e4b88b1faed2a62b9fb83f4f7c2400ad6fabb84",
+  ]
+}

prod-hq/main.tf

@@ -1,15 +1,4 @@
 // prod - main
-terraform {
-  backend "remote"{
-    hostname = "app.terraform.io"
-    organization = "22shop"
-
-    workspaces {
-      name = "tf-cloud-backend"
-    }
-  }
-
-}
 provider "aws" {
   region = "ap-northeast-2"
 
@@ -21,34 +10,64 @@ provider "aws" {
 locals {
   common_tags = {
     project = "22shop"
-    owner = "icurfer"
+    owner   = "icurfer"
 
   }
 }
+
+// GET 계정정보
+data "aws_caller_identity" "this" {}
+
+// eks를 위한 iam역할 생성 데이터 조회
+data "aws_iam_policy_document" "eks-assume-role-policy" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["eks.amazonaws.com"]
+    }
+  }
+}
+data "aws_iam_policy_document" "eks_node_group_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["eks-nodegroup.amazonaws.com"]
+    }
+  }
+}
+
 # module "vpc_hq" {
 module "vpc_hq" {
-  source     = "../modules/vpc"
-#   source = "github.com/Seong-dong/team_prj/tree/main/modules/vpc"
+  source = "../modules/vpc"
+  #   source = "github.com/Seong-dong/team_prj/tree/main/modules/vpc"
   tag_name   = "${local.common_tags.project}-vpc"
   cidr_block = "10.3.0.0/16"
 
 }
 
 module "vpc_igw" {
-  source   = "../modules/igw"
-  
-  vpc_id   = module.vpc_hq.vpc_hq_id
+  source = "../modules/igw"
+
+  vpc_id = module.vpc_hq.vpc_hq_id
 
   tag_name = "${local.common_tags.project}-vpc_igw"
+
+  depends_on = [
+    module.vpc_hq
+  ]
 }
 
 module "subnet_public" {
   source = "../modules/vpc-subnet"
 
   vpc_id         = module.vpc_hq.vpc_hq_id
-  subnet-az-list = var.subnet-az-list
-  public_ip_on = true
-  vpc_name = "${local.common_tags.project}-public"
+  subnet-az-list = var.subnet-az-public
+  public_ip_on   = true
+  vpc_name       = "${local.common_tags.project}-public"
 }
 
 // public route
@@ -68,11 +87,86 @@ module "route_add" {
 module "route_association" {
   source         = "../modules/route-association"
   route_table_id = module.route_public.route_public_id
-  
+
   association_count = 2
-  subnet_ids     = [module.subnet_public.subnet.zone-a.id, module.subnet_public.subnet.zone-c.id]
+  subnet_ids        = [module.subnet_public.subnet.zone-a.id, module.subnet_public.subnet.zone-c.id]
 }
 
+// eks 클러스터 역할 생성
+module "eks_cluster_iam" {
+  source   = "../modules/iam"
+  iam_name = "eks-cluster-test"
+  policy   = data.aws_iam_policy_document.eks-assume-role-policy.json
+  tag_name = local.common_tags.project
+}
+
+// eks 클러스터 역할 정책 추가
+module "eks_cluster_iam_att" {
+  source    = "../modules/iam-policy-attach"
+  iam_name  = "eks-cluster-att"
+  role_name = module.eks_cluster_iam.iam_name
+  arn       = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
+
+  depends_on = [
+    module.eks_cluster_iam
+  ]
+}
+module "eks_cluster_iam_att2" {
+  source    = "../modules/iam-policy-attach"
+  iam_name  = "eks-cluster-att"
+  role_name = module.eks_cluster_iam.iam_name
+  arn       = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
+
+  depends_on = [
+    module.eks_cluster_iam
+  ]
+}
+
+// eks 노드그룹 역할 생성 및 추가
+module "eks_nodegroup_iam" {
+  source   = "../modules/iam"
+  iam_name = "eks-nodegroup-test"
+  policy   = data.aws_iam_policy_document.eks_node_group_role.json
+  tag_name = local.common_tags.project
+}
+module "eks_nodegroup_iam_att_1" {
+  source    = "../modules/iam-policy-attach"
+  iam_name  = "eks-nodegroup-att"
+  role_name = module.eks_nodegroup_iam.iam_name
+  arn       = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
+
+  depends_on = [
+    module.eks_nodegroup_iam
+  ]
+}
+module "eks_nodegroup_iam_att_2" {
+  source    = "../modules/iam-policy-attach"
+  iam_name  = "eks-nodegroup-att"
+  role_name = module.eks_nodegroup_iam.iam_name
+  arn       = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
+
+  depends_on = [
+    module.eks_nodegroup_iam
+  ]
+}
+module "eks_nodegroup_iam_att_3" {
+  source    = "../modules/iam-policy-attach"
+  iam_name  = "eks-nodegroup-att"
+  role_name = module.eks_nodegroup_iam.iam_name
+  arn       = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+
+  depends_on = [
+    module.eks_nodegroup_iam
+  ]
+}
+
+// 보안그룹 생성
+module "eks_sg" {
+  source  = "../modules/sg"
+  sg_name = "${local.common_tags.project}-sg"
+}
+
+module "eks_sg_ingress"
 # EKS테스트 할때 활성
 # module "ecr" {
 #     source = "../modules/ecr"
@@ -80,3 +174,19 @@ module "route_association" {
 #     names_list = ["web", "nginx", "mariadb"]
 # }
 
+/* 
+terraform_remote_state reference method
+terraform cloud
+*/
+# data "terraform_remote_state" "foo" {
+#   backend = "remote"
+
+#   config = {
+#     organization = "company"
+
+#     workspaces = {
+#       name = "workspace"
+#     }
+#   }
+# }
+

prod-hq/outputs.tf

@@ -1,4 +1,9 @@
-//modules-subnet-outputs
+//main-outputs
+output "aws_id" {
+  description = "The AWS Account ID."
+  value       = data.aws_caller_identity.this.account_id
+}
+
 output "subnet" {
   description = "The name of vpc hq id"
   value       = module.subnet_public.subnet

prod-hq/valiables.tf

@@ -15,7 +15,7 @@ variable "prod_name" {
 #     type = string
 # }
 
-variable "subnet-az-list" {
+variable "subnet-az-public" {
   description = "Subnet available zone & cidr"
   type        = map(map(string))
   default = {
@@ -23,18 +23,23 @@ variable "subnet-az-list" {
       name = "ap-northeast-2a"
       cidr = "10.3.1.0/24"
     }
-    "zone-b" = {
-      name = "ap-northeast-2b"
-      cidr = "10.3.2.0/24"
-    }
     "zone-c" = {
       name = "ap-northeast-2c"
       cidr = "10.3.3.0/24"
     }
+  }
+}
+variable "subnet-az-private" {
+  description = "Subnet available zone & cidr"
+  type        = map(map(string))
+  default = {
+    "zone-b" = {
+      name = "ap-northeast-2b"
+      cidr = "10.3.2.0/24"
+    }
     "zone-d" = {
       name = "ap-northeast-2d"
       cidr = "10.3.4.0/24"
     }
   }
-
-}
+}