Merge pull request #22 from optiop/feature/private-subnet

Use private subnet for containers

Author: mehr74

ops/ecs/main.tf

@@ -8,6 +8,7 @@ module "cluster" {
   name                  = "ecs-cluster"
   vpc_security_group_id = module.vpc.security_group_id
   vpc_public_subnets    = module.vpc.public_subnets
+  vpc_private_subnets   = module.vpc.private_subnets
 
   depends_on = [module.vpc]
 }
@@ -18,6 +19,7 @@ module "grafana" {
   cluster_id          = module.cluster.cluster_id
   vpc_id              = module.vpc.vpc_id
   vpc_public_subnets  = module.vpc.public_subnets
+  vpc_private_subnets = module.vpc.private_subnets
   security_group_id   = module.vpc.security_group_id
   namespace_id        = module.vpc.namespace_id
   secret_manager_name = var.secret_manager_name
@@ -30,7 +32,7 @@ module "postgres" {
   repository_name     = "postgres-grafana-on-ecs-postgres-repo"
   cluster_id          = module.cluster.cluster_id
   vpc_id              = module.vpc.vpc_id
-  vpc_public_subnets  = module.vpc.public_subnets
+  vpc_private_subnets = module.vpc.private_subnets
   security_group_id   = module.vpc.security_group_id
   namespace_id        = module.vpc.namespace_id
   secret_manager_name = var.secret_manager_name

ops/ecs/modules/cluster/main.tf

@@ -11,7 +11,7 @@ resource "aws_ecs_cluster" "cluster" {
 resource "aws_launch_configuration" "ecs_cfg" {
   name          = "ecs-instance"
   image_id      = "ami-06581a55723db5feb"
-  instance_type = "t2.small"
+  instance_type = var.instance_type
 
   iam_instance_profile = aws_iam_instance_profile.ecsInstanceRole.name
 
@@ -28,7 +28,7 @@ resource "aws_launch_configuration" "ecs_cfg" {
 resource "aws_autoscaling_group" "ecs_instance_asg" {
   launch_configuration = aws_launch_configuration.ecs_cfg.name
 
-  vpc_zone_identifier = var.vpc_public_subnets
+  vpc_zone_identifier = concat(var.vpc_public_subnets, var.vpc_private_subnets)
   min_size            = 2
   max_size            = 2
   desired_capacity    = 2

ops/ecs/modules/cluster/variables.tf

@@ -3,6 +3,12 @@ variable "name" {
   description = "The name of the cluster"
 }
 
+variable "instance_type" {
+  type        = string
+  description = "The instance type for the ECS instances"
+  default     = "t2.small"
+}
+
 variable "vpc_security_group_id" {
   type        = string
   description = "The security group id for the ECS instances"
@@ -11,4 +17,9 @@ variable "vpc_security_group_id" {
 variable "vpc_public_subnets" {
   type        = list(string)
   description = "The public subnets for the ECS instances"
+}
+
+variable "vpc_private_subnets" {
+  type        = list(string)
+  description = "The private subnets for the ECS instances"
 }

ops/ecs/modules/grafana/main.tf

@@ -93,7 +93,7 @@ resource "aws_ecs_service" "service" {
 
   network_configuration {
     security_groups = [var.security_group_id]
-    subnets         = var.vpc_public_subnets
+    subnets         = var.vpc_private_subnets
   }
 
   load_balancer {

ops/ecs/modules/grafana/variables.tf

@@ -19,9 +19,14 @@ variable "vpc_id" {
   description = "The ID of the VPC to which the container should be deployed."
 }
 
+variable "vpc_private_subnets" {
+  type        = list(string)
+  description = "The private subnets to which the container should be deployed."
+}
+
 variable "vpc_public_subnets" {
   type        = list(string)
-  description = "The subnets to which the container should be deployed."
+  description = "The public subnets to which the container should be deployed."
 }
 
 variable "security_group_id" {

ops/ecs/modules/postgres/main.tf

@@ -87,7 +87,7 @@ resource "aws_ecs_service" "service" {
 
   network_configuration {
     security_groups = [var.security_group_id]
-    subnets         = var.vpc_public_subnets
+    subnets         = var.vpc_private_subnets
   }
 
   service_registries {

ops/ecs/modules/postgres/variables.tf

@@ -13,7 +13,7 @@ variable "vpc_id" {
   description = "The ID of the VPC to which the container should be deployed."
 }
 
-variable "vpc_public_subnets" {
+variable "vpc_private_subnets" {
   type        = list(string)
   description = "The public subnets to which the container should be deployed."
 }

ops/ecs/modules/vpc/output.tf

@@ -6,6 +6,10 @@ output "public_subnets" {
   value = module.vpc.public_subnets
 }
 
+output "private_subnets" {
+  value = module.vpc.private_subnets
+}
+
 output "security_group_id" {
   value = aws_security_group.sg.id
 }

ops/ecs/modules/vpc/vpc.tf

@@ -14,8 +14,11 @@ module "vpc" {
   cidr = "10.0.0.0/16"
   azs  = slice(data.aws_availability_zones.available.names, 0, 2)
 
-  public_subnets = ["10.0.4.0/24", "10.0.5.0/24"]
+  public_subnets  = ["10.0.4.0/24", "10.0.5.0/24"]
+  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
 
+  enable_nat_gateway   = true
+  single_nat_gateway   = true
   enable_dns_hostnames = true
 }