A script for setting up jenkins slaves in a private subnet.

slaves.tf

// variables
variable availability_zone {
  type = "string"
  default = "ap-southeast-2a"
}

variable vpc_id {
  type = "string"
  default = "vpc-xxx"
}

variable ami_id {
  type = "string"
  default = "ami-xxx"
}

variable subnet_id {
  type = "string"
  default = "subnet-xxx"
}

// instance
resource "aws_instance" "jenkins_slave" {
  count = 2
  ami = "${var.ami_id}"
  instance_type = "m4.large"
  availability_zone = "${var.availability_zone}"
  security_groups = [
    "${aws_security_group.jenkins_slave.id}"
  ]
  root_block_device {
    volume_type = "gp2"
    volume_size = "50"
  }
  subnet_id = "${aws_subnet.jenkins_slave.id}"
  key_name = "jenkins"
  tags = {
    Name = "jenkins-slave-${count.index + 1}"
  }
  user_data = <<EOF
#!/bin/bash
sudo apt-get update
sudo apt-get install -y openjdk-8-jdk
sudo mkdir -p /var/lib/jenkins
sudo chown -R ubuntu:ubuntu /var/lib/jenkins
  EOF
}

// security group
resource "aws_security_group" "jenkins_slave" {
  name = "jenkins-slave-sg"
  description = "Security group for jenkins slaves"
  vpc_id = "${var.vpc_id}"
  tags {
    Name = "sg-jenkins-slave"
  }
}

resource "aws_security_group_rule" "in_ssh" {
  description = "Allow incoming SSH traffic"
  type = "ingress"
  from_port = 22
  to_port = 22
  protocol = "tcp"
  cidr_blocks = [
    "0.0.0.0/0"
  ]
  security_group_id = "${aws_security_group.jenkins_slave.id}"
}

resource "aws_security_group_rule" "out_all" {
  description = "Allow all outoging traffic"
  type = "egress"
  from_port = 0
  to_port = 65535
  protocol = "All"
  cidr_blocks = [
    "0.0.0.0/0"
  ]
  security_group_id = "${aws_security_group.jenkins_slave.id}"
}

// subnet
resource "aws_subnet" "jenkins_slave" {
  availability_zone = "${var.availability_zone}"
  cidr_block = "10.0.1.0/24"
  vpc_id = "${var.vpc_id}"
  tags = {
    Name = "sn-jenkins-slave"
  }
}

resource "aws_route" "jenkins_slave" {
  route_table_id = "${aws_route_table.jenkins_slave.id}"
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id = "${aws_nat_gateway.jenkins_slave.id}"
}

resource "aws_route_table_association" "jenkins_slave" {
  route_table_id = "${aws_route_table.jenkins_slave.id}"
  subnet_id = "${aws_subnet.jenkins_slave.id}"
}

resource "aws_route_table" "jenkins_slave" {
  vpc_id = "${var.vpc_id}"
  tags {
    Name = "rt-jenkins-slave"
  }
}

resource "aws_nat_gateway" "jenkins_slave" {
  allocation_id = "${aws_eip.jenkins_slave.id}"
  subnet_id = "${var.subnet_id}"
  tags {
    Name = "ngw-jenkins-slave"
  }
}

resource "aws_eip" "jenkins_slave" {
  vpc = true
  tags {
    Name = "eip-jenkins-slave"
  }
}