consul.tf

module "aws_us_west_2" {
  source = "hashicorp/consul-enterprise-hvd/aws"

  # Instance Configuration
  ami_id                = data.aws_ami.ubuntu_numbat_24_04.id
  instance_type         = var.instance_type
  key_name              = "marsey-aws-vault"

  vpc_id                = "vpc-0b2ff27ad89ab605d"
  instance_subnets      = data.aws_subnets.us_west_2_private.ids
  internal_nlb_subnets  = data.aws_subnets.us_west_2_private.ids
  route53_resolver_pool = var.route53_resolver_pool
  permit_all_egress     = var.permit_all_egress
  associate_public_ip   = var.associate_public_ip

  # Cluster Details
  autopilot_health_enabled = var.autopilot_health_enabled
  consul_install_version   = var.consul_install_version
  consul_cluster_version   = "0.0.1"
  consul_nodes             = 3 # var.consul_nodes
  environment_name         = var.environment_name
  tag_owner                = var.tag_owner
  server_redundancy_zones  = var.server_redundancy_zones
  disk_params              = var.disk_params

  consul_agent = merge(var.consul_agent, {
    license_text_arn      = aws_ssm_parameter.consul_hclic.arn,
    ca_cert_arn           = aws_ssm_parameter.consul_ca_cert.arn,
    agent_cert_arn        = aws_ssm_parameter.consul_server_agent_cert.arn,
    agent_key_arn         = aws_ssm_parameter.consul_server_agent_key.arn,
    gossip_encryption_key = random_bytes.consul_gossip_encryption_key.base64,
    consul_log_level      = "ERROR",
  })

  snapshot_agent = var.snapshot_agent
}

data.tf

#------------------------------------------------------------------------------
# Machine Images
#------------------------------------------------------------------------------
data "aws_ami" "ubuntu_numbat_24_04" {
  most_recent = true
  owners      = ["099720109477"] # Canonical

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

data "aws_ami" "rhel_8" {
  filter {
    name   = "name"
    values = ["RHEL-8.6.0_HVM-20240521-x86_64-58-Hourly2-GP3"]
  }
}

data "aws_ami" "amazon_linux_2023" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}

main.tf

terraform {
  required_version = ">= 1.6.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6"
    }

    tls = {
      source  = "hashicorp/tls"
      version = "~> 4"
    }

    random = {
      source  = "hashicorp/random"
      version = "~> 3"
    }

    local = {
      source  = "hashicorp/local"
      version = "~> 2"
    }

    cloudinit = {
      source  = "hashicorp/cloudinit"
      version = "~> 2"
    }
  }
}

provider "aws" {
  region = "us-west-2"
}

provider "tls" {}

prereqs.tf

#------------------------------------------------------------------------------
# AWS SSM Parameter Store Secrets
#------------------------------------------------------------------------------
resource "aws_ssm_parameter" "consul_hclic" {
  type             = "SecureString"
  name             = "/consul-ent/consul.hclic"
  value_wo         = file("/Users/tbeyer/Documents/Projects/consul/.ase-consul.hclic")
  value_wo_version = 1
}

resource "aws_ssm_parameter" "consul_ca_cert" {
  type  = "SecureString"
  name  = "/consul-ent/consul-agent-ca.pem"
  value = file("/Users/tbeyer/Documents/Projects/consul/consul-agent-ca.pem")
}

resource "aws_ssm_parameter" "consul_server_agent_cert" {
  type  = "SecureString"
  name  = "/consul-ent/dc1-server-consul-0.pem"
  value = file("/Users/tbeyer/Documents/Projects/consul/dc1-server-consul-0.pem")
}

resource "aws_ssm_parameter" "consul_server_agent_key" {
  type             = "SecureString"
  name             = "/consul-ent/dc1-server-consul-0-key.pem"
  value_wo         = file("/Users/tbeyer/Documents/Projects/consul/dc1-server-consul-0-key.pem")
  value_wo_version = 1
}

resource "random_bytes" "consul_gossip_encryption_key" {
  length = 32
}

#------------------------------------------------------------------------------
# Network
#------------------------------------------------------------------------------
data "aws_vpc" "us_west_2" {
  id = "vpc-0b2ff27ad89ab605d"
}

data "aws_subnets" "us_west_2_private" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.us_west_2.id]
  }

  filter {
    name = "tag:Name"
    values = [
      "private01",
      "private02",
      "private03",
    ]
  }
}

data "aws_subnets" "us_west_2_public" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.us_west_2.id]
  }

  filter {
    name = "tag:Name"
    values = [
      "subnet01",
      "subnet02",
      "subnet03",
    ]
  }
}

data "aws_subnet" "private" {
  for_each = toset(data.aws_subnets.us_west_2_private.ids)
  id       = each.value
}

data "aws_subnet" "public" {
  for_each = toset(data.aws_subnets.us_west_2_public.ids)
  id       = each.value
}

terraform.tfvars

instance_type = "t2.micro"
environment_name = "tim-test"
tag_owner = "tbeyer@hashicorp.com"
route53_resolver_pool = {
  enabled = true
}

variables.tf

#------------------------------------------------------------------------------
# AWS SSM Parameter Store Secrets
#------------------------------------------------------------------------------
resource "aws_ssm_parameter" "consul_hclic" {
  type             = "SecureString"
  name             = "/consul-ent/consul.hclic"
  value_wo         = file("/Users/tbeyer/Documents/Projects/consul/.ase-consul.hclic")
  value_wo_version = 1
}

resource "aws_ssm_parameter" "consul_ca_cert" {
  type  = "SecureString"
  name  = "/consul-ent/consul-agent-ca.pem"
  value = file("/Users/tbeyer/Documents/Projects/consul/consul-agent-ca.pem")
}

resource "aws_ssm_parameter" "consul_server_agent_cert" {
  type  = "SecureString"
  name  = "/consul-ent/dc1-server-consul-0.pem"
  value = file("/Users/tbeyer/Documents/Projects/consul/dc1-server-consul-0.pem")
}

resource "aws_ssm_parameter" "consul_server_agent_key" {
  type             = "SecureString"
  name             = "/consul-ent/dc1-server-consul-0-key.pem"
  value_wo         = file("/Users/tbeyer/Documents/Projects/consul/dc1-server-consul-0-key.pem")
  value_wo_version = 1
}

resource "random_bytes" "consul_gossip_encryption_key" {
  length = 32
}

#------------------------------------------------------------------------------
# Network
#------------------------------------------------------------------------------
data "aws_vpc" "us_west_2" {
  id = "vpc-0b2ff27ad89ab605d"
}

data "aws_subnets" "us_west_2_private" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.us_west_2.id]
  }

  filter {
    name = "tag:Name"
    values = [
      "private01",
      "private02",
      "private03",
    ]
  }
}

data "aws_subnets" "us_west_2_public" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.us_west_2.id]
  }

  filter {
    name = "tag:Name"
    values = [
      "subnet01",
      "subnet02",
      "subnet03",
    ]
  }
}

data "aws_subnet" "private" {
  for_each = toset(data.aws_subnets.us_west_2_private.ids)
  id       = each.value
}

data "aws_subnet" "public" {
  for_each = toset(data.aws_subnets.us_west_2_public.ids)
  id       = each.value
}