CI/CD in AWS Cloud Automation

Building AWS Infrastructure using Jenkins-Terraform Automation

Set-Up Global Variables

Variable File	Variables	Values
Global	aws_region_	ap-south-1
Global	aws_iam_user	deployer_user_
Global	assume_role_	deployer_role_
Global	s3_backend_bucket	terraform-tfstate-mumba-1
EC2	ec2_instance_profile	ec2_instance_profile
Lambda	lambda_deployer_role	lambda_deployer_role

Pre-Requistics in AWS IAM Set-Up

Steps to follow

Create Policy : ec2_cw_kms_s3_sns_r53_rds_full_access
Create User : deployer_user
Create Role : ec2_instance_profile
Create Role : deployer_role
Create Role : lambda_deployer_role

1) Create Policy : ec2_cw_kms_s3_sns_r53_rds_full_access and attach to deployer_role

IAM :  List READ Tagging
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "acm:*",
                "sns:*",
                "rds:*",
                "s3:*",
                "cloudwatch:*",
                "kms:*",
                "logs:*",
                "route53:*",
                "ec2:*",
                "events:*",
                "lambda:*",
                "iam:CreateServiceLinkedRole",
                "iam:GetInstanceProfile",
                "ses:*"
            ],
            "Resource": "*"
        }
    ]
}

2) Create User : deployer_user and attach below policy

Attach Policy : IAMUserChangePassword
Attach Policy : AmazonS3FullAccess
Attach Policy : assume_role

3) Create Role : ec2_instance_profile and Trust Relations

Attach Policy : AmazonEC2ContainerServiceFullAccess
Attach Policy : ec2_cw_kms_s3_sns_r53_full_access

{
  "Version"	: "2012-10-17",
  "Statement"	: [{
    "Effect"	: "Allow",
    "Action"    : "sts:AssumeRole",
    "Principal"	: {
      "Service"	: "ec2.amazonaws.com",
      "AWS"	: "arn:aws:iam::210315133748:role/deployer_role"
      }
    }]
}

4) Create Role deployer_role and Attach policy (1) also Trust Relations

Attach Policy : AmazonVPCReadOnlyAccess
Attach Policy : AmazonEC2ContainerServiceFullAccess
Attach Policy : IAMReadOnlyAccess
Attach Policy : AWSCloudFormationReadOnlyAccess
Attach Policy : ec2_cw_kms_s3_sns_r53_full_access
Attach Policy : AWSDataExchangeSubscriberFullAccess


{
  "Version"	: "2012-10-17",
  "Action"	: "sts:AssumeRole"
  "Statement"	: [{
    "Effect"	: "Allow",
    "Principal"	: {
      "AWS"	: [
        "arn:aws:iam::210315133748:role/ec2_instance_profile",
        "arn:aws:iam::210315133748:user/deployer_user"
        ],
      "Service"	: "ec2.amazonaws.com"
      },
  }]
}

5) Create policy lambda_deployer_policy and attach to lambda_deployer_role

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeInstances",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeSnapshots",
                "ec2:DeleteSnapshot",
                "ec2:DescribeVolumes",
                "rds:DescribeDBSnapshots",
                "rds:DeleteDBSnapshot",
                "rds:ListTagsForResource",
                "rds:DescribeDBInstances",
                "rds:StopDBInstance",
                "rds:StartDBInstance"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:*:*:log-group:/aws/lambda/*:*:*",
                "arn:aws:ec2:*:*:instance/*"
            ]
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*:*:*"
        }
    ]
}

6) Create Profile : assume_role Attach it to deployer_user

{
  "Version"	: "2012-10-17",
  "Statement"	: {
    "Effect"	: "Allow",
    "Action"	: "sts:AssumeRole",
    "Resource"	: "arn:aws:iam::210315133748:role/deployer_role"
  }
}

Pre-Requistics for Terraform Set-Up

Create S3 Bucket terraform-tfstate-mumbai-1

How to configure AWS Credentials and Role

~/.aws/credentials

[deployer_role]
aws_access_key_id = <AWS_ACCESS_KEY>
aws_secret_access_key = <AWS_SECRET_ACCESS_KEY>
region = ap-south-1

~/.aws/config

[deployer_role]
region = ap-south-1
output = text
role_arn = arn:aws:iam::161047494551:role/deployer_role
source_profile = deployer_role

Policy and its uses

Role	Policy to Attach	Uses
role	AmazonVPCReadOnlyAccess	VPC RO `To create EC2 in VPC`
role	IAMReadOnlyAccess	IAM RO `To attach instance profile in EC2`
role	AWSCloudFormationReadOnlyAccess	CF RO `SNS Creation using CloudFormation`
role	AWSDataExchangeSubscriberFullAccess	EC2 AMI Filter
role, profile	AmazonEC2ContainerServiceFullAccess	EC2 Creation
role, profile		S3 Full access
role, profile		SNS Full access
role, profile		Route53 Full access
role, profile		RDS Full access
role, profile	CloudWatchAgentServerPolicy	CW Custom metrics `Optional`
role, profile	AWSKeyManagementServicePowerUser	KMS `Optional`
role	AmazonEC2RoleforAWSCodeDeploy	EC2 Creation `Optional`

Terraform Commands

#####S3

Create S3 Bucket terraform-tfstate-mumbai-1

#####SQS

terraform init -backend=true -backend-config='bucket=main-s3-bucket-tfstate' -backend-config='key=simple/sqs/test_sqs_creation_1.tfstate'
terraform plan -out=tfplan -var-file=/root/terraform_practice_codes/global_vars.tfvars
terraform apply tfplan

#####KMS

terraform init  -backend=true -backend-config='bucket=main-s3-bucket-tfstate' -backend-config='key=simple/kms/test_kms_key_creation_1.tfstate'
terraform plan  -var-file=/root/terraform_practice_codes/global_vars.tfvars
terraform apply -var-file=/root/terraform_practice_codes/global_vars.tfvars

Resources Implemented - Terraform

Route53 Zone
S3
SQS
KMS
Security Group
SNS

ENI
EBS
EC2
EBS Attachment
Cloud-Watch
Route53 C Record

RDS Master
RDS Slave
Route53 A record

16.1) Lambda - EC2 Stop
16.2) Lambda - Snapshot Deletion

ALB
ASG
AMI
EFS

Name		Name	Last commit message	Last commit date
Latest commit History 57 Commits
modules		modules
variables		variables
.gitignore		.gitignore
README.md		README.md

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

modules

modules

variables

variables

.gitignore

.gitignore

README.md

README.md

Repository files navigation

CI/CD in AWS Cloud Automation

Set-Up Global Variables

Pre-Requistics in AWS IAM Set-Up

1) Create Policy : ec2_cw_kms_s3_sns_r53_rds_full_access and attach to deployer_role

2) Create User : deployer_user and attach below policy

3) Create Role : ec2_instance_profile and Trust Relations

4) Create Role deployer_role and Attach policy (1) also Trust Relations

5) Create policy lambda_deployer_policy and attach to lambda_deployer_role

6) Create Profile : assume_role Attach it to deployer_user

Pre-Requistics for Terraform Set-Up

How to configure AWS Credentials and Role

Policy and its uses

Terraform Commands

Resources Implemented - Terraform

About

Releases

Packages

Languages

vigneshpalanivelr/terraform_practice_codes

Folders and files

Latest commit

History

Repository files navigation

CI/CD in AWS Cloud Automation

Set-Up Global Variables

Pre-Requistics in AWS IAM Set-Up

1) Create Policy : ec2_cw_kms_s3_sns_r53_rds_full_access and attach to deployer_role

2) Create User : deployer_user and attach below policy

3) Create Role : ec2_instance_profile and Trust Relations

4) Create Role deployer_role and Attach policy (1) also Trust Relations

5) Create policy lambda_deployer_policy and attach to lambda_deployer_role

6) Create Profile : assume_role Attach it to deployer_user

Pre-Requistics for Terraform Set-Up

How to configure AWS Credentials and Role

Policy and its uses

Terraform Commands

Resources Implemented - Terraform

About

Resources

Stars

Watchers

Forks

Languages