hervekhg’s gists

hervekhg / cloudwatch_event_target_lambda.tf

Created January 17, 2020 16:24

	resource "aws_cloudwatch_event_target" "target_lambda" {
	rule = aws_cloudwatch_event_rule.daily.name
	target_id = "enforce_bucket_kms_encryption"
	arn = aws_lambda_function.force_bucket_encryption.arn
	}

hervekhg / cloudwatch_event_rule.tf

Created January 17, 2020 16:23

	resource "aws_cloudwatch_event_rule" "daily" {
	name = "daily_enforce_bucket_kms_encryption"
	description = "run everyday"

	#schedule_expression = "${var.cron_schedule_enforce_bucket_encryption} "
	event_pattern = <<PATTERN
	{
	"source": [
	"aws.s3"
	],

hervekhg / lambda.tf

Last active January 17, 2020 16:34

	resource "aws_lambda_layer_version" "dep" {
	layer_name = "force_bucket_encryption"
	s3_bucket = var.lambda_s3_bucket
	s3_key = "force_bucket_encryption/lib.zip"

	compatible_runtimes = ["python3.6"]
	}

	resource "aws_lambda_function" "force_bucket_encryption" {
	s3_bucket = var.lambda_s3_bucket

hervekhg / iam_policies.tf

Created January 17, 2020 16:21

	resource "aws_iam_policy" "lambda_policy" {
	name = aws_iam_role.force_bucket_encryption.name
	path = "/"
	policy = data.aws_iam_policy_document.lambda_policy_doc.json
	}

	resource "aws_iam_role_policy_attachment" "ec2_tags_enforced" {
	role = aws_iam_role.force_bucket_encryption.name
	policy_arn = aws_iam_policy.lambda_policy.arn
	}

hervekhg / policy_doc.tf

Created January 17, 2020 16:20

	data "aws_iam_policy_document" "lambda_policy_doc" {
	statement {
	effect = "Allow"

	actions = [
	"logs:CreateLogGroup",
	"logs:CreateLogStream",
	"logs:PutLogEvents",
	"config:PutEvaluations",
	]

hervekhg / var.tf

Created January 17, 2020 16:19

	variable "lambda_s3_bucket" {
	type = string
	default = "BUCKET-THAT-CONTAIN-LAMBDAZIPCODE"
	}

	variable "kms_key_id" {
	type = string
	default = "KMSKEY-ARN3"
	}

hervekhg / cloudwatch-event-rules.tf

Created January 17, 2020 16:12

	resource "aws_cloudwatch_event_rule" "daily" {
	name = "daily_enforce_bucket_kms_encryption"
	description = "run everyday"

	#schedule_expression = "${var.cron_schedule_enforce_bucket_encryption} "
	event_pattern = <<PATTERN
	{
	"source": [
	"aws.s3"
	],

hervekhg / vpc.tf

Created September 18, 2019 14:26

	# --------------------------------------------------------------
	#### Step 1: Create VPC
	# --------------------------------------------------------------
	resource "aws_vpc" "hg_vpc" {
	cidr_block = "10.20.0.0/16"
	enable_dns_hostnames = true
	enable_dns_support = true

	tags = {
	BillingBusinessApp = "hg-devops"

hervekhg / user_data.sh.tpl

Created May 13, 2019 13:34

	# Install ansible
	easy_install pip

	# Instance name and ID
	AWS_REGION="${region}"
	INSTANCE_ID="$( curl http://169.254.169.254/1.0/meta-data/instance-id )"

	#Download Ansible scripts
	if [ ! -d "/home/ec2-user/${project_name}" ]; then
	su - ec2-user -c "mkdir /home/ec2-user/${project_name}"

hervekhg / autoscalinggroup_with_launchtemplate.tf

Created May 13, 2019 11:52

	# ---------------------------------------------------------------------
	# Auto Scaling Group Edeal
	# ---------------------------------------------------------------------
	resource "aws_autoscaling_group" "ec2-edeal" {

	#launch_configuration = "${aws_launch_template.ec2_launch.id}"
	name = "${data.consul_keys.ck.var.project_name}-${var.install_name}-${var.env}-edeal"
	max_size = "${data.consul_keys.ck.var.asg_max_size}"
	min_size = "${data.consul_keys.ck.var.asg_min_size}"
	desired_capacity = "${data.consul_keys.ck.var.asg_desired_capacity}"

Herve hervekhg