-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathmain.tf
264 lines (205 loc) · 8.58 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
terraform {
backend "s3" {
region = "eu-west-2"
bucket = "pttp-ci-infrastructure-ima-client-core-tf-state"
lock_table = "pttp-ci-infrastructure-ima-client-core-tf-lock-table"
}
}
provider "aws" {
region = var.aws_region
alias = "env"
profile = terraform.workspace
assume_role {
role_arn = var.assume_role
}
}
locals {
vpc_cidr_range = "10.180.100.0/22"
}
provider "grafana" {
url = var.grafana_url
auth = "${var.grafana_admin_username}:${var.grafana_admin_password}"
}
resource "aws_route53_zone" "internal" {
name = terraform.workspace == "production" ? "mojo-ima.internal.justice.gov.uk" : "${module.label_mojo.id}.${"internal.justice.gov.uk"}"
vpc {
vpc_id = module.monitoring_platform_v2.vpc_id
}
tags = module.label_mojo.tags
provider = aws.env
}
module "label_pttp" {
source = "./modules/label"
label_namespace = "pttp"
owner-email = var.owner-email
is-production = var.is-production
label_status = "pre CIDR change infrastructure"
}
module "label" {
source = "./modules/label"
label_namespace = "staff-infra"
owner-email = var.owner-email
is-production = var.is-production
}
module "label_mojo" {
source = "./modules/label"
label_namespace = "mojo"
owner-email = var.owner-email
is-production = var.is-production
}
module "monitoring_platform_v2" {
source = "./modules/monitoring_platform"
prefix = module.label_mojo.id
tags = module.label_mojo.tags
transit_gateway_id = var.transit_gateway_id
enable_transit_gateway = var.enable_transit_gateway
transit_gateway_route_table_id = var.transit_gateway_route_table_id
vpc_cidr_block = local.vpc_cidr_range
private_subnet_cidr_blocks = [for cidr_block in cidrsubnets("10.180.100.0/22", 2, 2, 2) : cidrsubnets(cidr_block, 1, 1)[0]]
public_subnet_cidr_blocks = [for cidr_block in cidrsubnets("10.180.100.0/22", 2, 2, 2) : cidrsubnets(cidr_block, 1, 1)[1]]
network_services_cidr_block = "10.180.104.0/22"
is_eks_enabled = var.is_eks_enabled
is_production = var.is-production == "true"
storage_bucket_arn = module.prometheus-thanos-store.bucket_arn
storage_bucket_name = module.prometheus-thanos-store.bucket_name
storage_key_arn = module.prometheus-thanos-store.kms_key_arn
vpc_flow_log_bucket_arn = module.vpc_flow_logging.bucket_arn
cloudwatch_exporter_access_role_arns = compact(split(",", trimspace(var.cloudwatch_exporter_access_role_arns)))
byoip_pool_id = var.byoip_pool_id
enable_ima_dns_resolver = var.enable_ima_dns_resolver
gsi_domain = var.gsi_domain
mojo_dns_ip_1 = var.mojo_dns_ip_1
mojo_dns_ip_2 = var.mojo_dns_ip_2
dom1_dns_range_1 = var.dom1_dns_range_1
dom1_dns_range_2 = var.dom1_dns_range_2
quantum_dns_range_1 = var.quantum_dns_range_1
quantum_dns_range_2 = var.quantum_dns_range_2
quantum_dns_ip_1 = var.quantum_dns_ip_1
quantum_dns_ip_2 = var.quantum_dns_ip_2
psn_team_protected_range_1 = var.psn_team_protected_range_1
psn_team_protected_range_2 = var.psn_team_protected_range_2
sop_oci_range = var.sop_oci_range
farnborough_5260_ip = var.farnborough_5260_ip
corsham_5260_ip = var.corsham_5260_ip
corsham_mgmt_range = "${var.corsham_mgmt_range}.0/24"
farnborough_mgmt_range = "${var.farnborough_mgmt_range}.0/24"
providers = {
aws = aws.env
}
}
module "grafana_v2" {
source = "./modules/grafana"
aws_region = var.aws_region
prefix_pttp = module.label_mojo.id
prefix = module.label_mojo.id
tags = module.label_mojo.tags
short_prefix = module.label_mojo.stage
vpc = module.monitoring_platform_v2.vpc_id
vpc_cidr_range = local.vpc_cidr_range
cluster_id = module.monitoring_platform_v2.cluster_id
public_subnet_ids = module.monitoring_platform_v2.public_subnet_ids
private_subnet_ids = module.monitoring_platform_v2.private_subnet_ids
execution_role_arn = module.monitoring_platform_v2.execution_role_arn
rds_monitoring_role_arn = module.monitoring_platform_v2.rds_monitoring_role_arn
db_name = var.grafana_db_name
db_endpoint = var.grafana_db_endpoint_v2
db_username = var.grafana_db_username
db_password = var.grafana_db_password
admin_username = var.grafana_admin_username
admin_password = var.grafana_admin_password
vpn_hosted_zone_id = var.vpn_hosted_zone_id
vpn_hosted_zone_domain = var.vpn_hosted_zone_domain
domain_prefix = var.domain_prefix
azure_ad_auth_url = var.azure_ad_auth_url
azure_ad_token_url = var.azure_ad_token_url
azure_ad_client_id = var.azure_ad_client_id
azure_ad_client_secret = var.azure_ad_client_secret
smtp_user = var.smtp_user
smtp_password = var.smtp_password
sns_subscribers = split(",", var.sns_subscribers)
storage_bucket_name = module.grafana-image-storage.bucket_name
lb_access_logging_bucket_name = module.grafana_lb_access_logging.bucket_name
providers = {
aws = aws.env
}
}
module "prometheus_v2" {
source = "./modules/prometheus"
enable_compactor = "true"
aws_region = var.aws_region
prefix_pttp = module.label_mojo.id
prefix = module.label_mojo.id
tags = module.label_mojo.tags
vpc = module.monitoring_platform_v2.vpc_id
cluster_id = module.monitoring_platform_v2.cluster_id
public_subnet_ids = module.monitoring_platform_v2.public_subnet_ids
private_subnet_ids = module.monitoring_platform_v2.private_subnet_ids
fargate_count = 1
execution_role_arn = module.monitoring_platform_v2.execution_role_arn
thanos_image_repository_url = var.thanos_image_repository_url
storage_bucket_name = module.prometheus-thanos-store.bucket_name
storage_key_arn = module.prometheus-thanos-store.kms_key_arn
storage_key_id = module.prometheus-thanos-store.kms_key_id
lb_access_logging_bucket_name = module.prometheus_lb_access_logging.bucket_name
providers = {
aws = aws.env
}
}
module "snmp_exporter_v2" {
source = "./modules/snmp_exporter"
aws_region = var.aws_region
prefix_pttp = module.label_mojo.id
prefix = module.label_mojo.id
tags = module.label_mojo.tags
vpc = module.monitoring_platform_v2.vpc_id
cluster_id = module.monitoring_platform_v2.cluster_id
public_subnet_ids = module.monitoring_platform_v2.public_subnet_ids
private_subnet_ids = module.monitoring_platform_v2.private_subnet_ids
vpc_subnet_cidr_blocks = concat(module.monitoring_platform_v2.private_subnet_cidr_blocks, module.monitoring_platform_v2.public_subnet_cidr_blocks)
execution_role_arn = module.monitoring_platform_v2.execution_role_arn
lb_access_logging_bucket_name = module.snmp_exporter_lb_access_logging.bucket_name
providers = {
aws = aws.env
}
}
module "blackbox_exporter_v2" {
source = "./modules/blackbox_exporter"
aws_region = var.aws_region
prefix_pttp = module.label_mojo.id
prefix = module.label_mojo.id
tags = module.label_mojo.tags
vpc = module.monitoring_platform_v2.vpc_id
cluster_id = module.monitoring_platform_v2.cluster_id
public_subnet_ids = module.monitoring_platform_v2.public_subnet_ids
private_subnet_ids = module.monitoring_platform_v2.private_subnet_ids
vpc_subnet_cidr_blocks = concat(module.monitoring_platform_v2.private_subnet_cidr_blocks, module.monitoring_platform_v2.public_subnet_cidr_blocks)
execution_role_arn = module.monitoring_platform_v2.execution_role_arn
lb_access_logging_bucket_name = module.blackbox_exporter_lb_access_logging.bucket_name
providers = {
aws = aws.env
}
}
module "cloudwatch_exporter" {
source = "./modules/cloudwatch_exporter"
production_account_id = var.production_account_id
prefix = module.label_mojo.id
cloudwatch_access_policy_arn = module.monitoring_platform_v2.cloudwatch_access_policy
tags = module.label_mojo.tags
providers = {
aws = aws.env
}
}
module "test_bastion" {
source = "./modules/test_bastion"
subnets = module.monitoring_platform_v2.public_subnet_ids
vpc_id = module.monitoring_platform_v2.vpc_id
tags = module.label_mojo.tags
bastion_allowed_ingress_ip = var.bastion_allowed_ingress_ip
depends_on = [
module.monitoring_platform_v2
]
providers = {
aws = aws.env
}
count = var.enable_test_bastion == true ? 1 : 0
}