OCTO Shared Terraform Modules

Documentation for all the Terraform modules shared by OCTO.

aws_acm_cert

Just a wrapper around terraform-aws-modules/acm/aws which reduces the parameters even further.

Terraform Module Source

module "aws_acm_cert" {
  source = "https://tfmodules.matillion-cto.matillion.com/aws_acm_cert.tar.gz"
  ...
}

Resources

NameType
aws_route53_zone.zonedata source

Inputs

NameDescriptionTypeDefaultRequired
urln/a
object({
subdomain = string,
domain = string
})
n/ayes
includeWildcardn/aboolfalseno

Outputs

NameDescription
certificate_arnn/a
urln/a
zone_idn/a

aws_eb_service

This module creates an elastic beanstalk service, with associated route53 entry, acm certificate for https and appropriate IAM policies.

Terraform Module Source

module "aws_eb_service" {
  source = "https://tfmodules.matillion-cto.matillion.com/aws_eb_service.tar.gz"
  ...
}

Resources

NameType
aws_elastic_beanstalk_application.eb_applicationresource
aws_elastic_beanstalk_environment.eb_environmentresource
aws_iam_instance_profile.eb_profileresource
aws_iam_policy.service_policyresource
aws_iam_role.eb_roleresource
aws_iam_role.service_roleresource
aws_s3_bucket.deployment_bucketresource
aws_security_group.security_groupresource
random_id.indexresource
aws_caller_identity.awsdata source
aws_elastic_beanstalk_hosted_zone.currentdata source
aws_elastic_beanstalk_solution_stack.solution_stackdata source
aws_iam_policy_document.empty_policydata source
aws_subnets.subnetsdata source
aws_vpc.vpcdata source

Inputs

NameDescriptionTypeDefaultRequired
serviceNameThe name of the servicestringn/ayes
serviceUrlNameThe first part of the URL, this gets combined with zone to be serviceUrlName.zonestringn/ayes
bucketNamen/astring""no
bucketPrefixn/astring"mtln-"no
bucketSlugn/astring""no
bucketSuffixn/astring"-deployment-"no
ebPolicyJsonn/astring""no
envVarsn/amap{}no
instanceTypen/astring"t3.small"no
internalPortn/anumber8080no
maxInstancesThe maximum number of instances that should be creatednumber2no
minInstancesThe minimum number of instances that should be creatednumber2no
profileThe spring profile that should be enabledstring"preprod"no
subnet_idThe subnet to deploy the service tostring""no
vpc_namen/astring"public"no
zoneThe name of the Route53 zone to usestring"matillion-cto.matillion.com"no

Outputs

NameDescription
eb_profile_arnn/a
output_valuesn/a

aws_ecs_task_definition_with_datadog

This module is a simple wrapper module around aws_ecs_task_definition which adds a datadog agent sidecar container to the task definition.

Terraform Module Source

module "aws_ecs_task_definition_with_datadog" {
  source = "https://tfmodules.matillion-cto.matillion.com/aws_ecs_task_definition_with_datadog.tar.gz"
  ...
}

Resources

NameType
aws_ecs_task_definition.aws_ecs_task_definition_with_datadogresource
aws_iam_role.aws_ecs_task_roleresource

Inputs

NameDescriptionTypeDefaultRequired
container_definitionsA list of valid container definitions provided as a single valid JSON document. Please note that you should only provide values that are part of the container definition document. For a detailed description of what parameters are available, see the Task Definition Parameters section from the official Developer Guide.stringn/ayes
cpuNumber of cpu units used by the task. If the requires_compatibilities is FARGATE this field is required.stringn/ayes
dd_api_key_secretThe secret to expose to the container. The supported values are either the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the AWS Systems Manager Parameter Store.stringn/ayes
dd_envThe env tag to be attached to all data sent to Datadog.stringn/ayes
dd_service_nameThe service name to be attached to all data sent to Datadog.stringn/ayes
dd_teamThe team tag to be attached to all data sent to Datadog.stringn/ayes
dd_versionThe version tag to be attached to all data sent to Datadog.stringn/ayes
execution_role_arnARN of the task execution role that the Amazon ECS container agent and the Docker daemon can assume.stringn/ayes
familyA unique name for your task definition.stringn/ayes
memoryAmount (in MiB) of memory used by the task. If the requires_compatibilities is FARGATE this field is required.stringn/ayes
network_modeDocker networking mode to use for the containers in the task. Valid values are none, bridge, awsvpc, and host.stringn/ayes
task_role_inline_policiesThe inline policies to use for the task role.set(object({name: string, policy: string}))n/ayes
dd_siteCan also use datadoghq.eustring"datadoghq.com"no

Outputs

NameDescription
arnn/a

aws_efs_kube

Creates an efs volume and mounts it to a kubernetes cluster as a persistent volume.

Terraform Module Source

module "aws_efs_kube" {
  source = "https://tfmodules.matillion-cto.matillion.com/aws_efs_kube.tar.gz"
  ...
}

Resources

NameType
aws_efs_file_system.efsresource
aws_efs_mount_target.mount_targetresource
aws_iam_policy.policyresource
aws_kms_key.new_keyresource
aws_security_group.efs_security_groupresource
aws_vpc_security_group_ingress_rule.efs_inboundresource
kubernetes_persistent_volume_claim_v1.pvcresource
kubernetes_persistent_volume_v1.pvresource
aws_iam_policy_document.efs_policydata source

Inputs

NameDescriptionTypeDefaultRequired
kube_confign/a
object({
oidc_provider_id = string,
cluster_name = string,
vpc = object({
id = string,
cidr_block = string
})
nodes = object({
subnets = set(string)
})
})
n/ayes
kube_namespacen/astringn/ayes
namen/astringn/ayes
create_service_rolen/abooltrueno
creation_tokenn/astring""no
efs_namen/astring""no
efs_throughput_moden/astring"bursting"no
encryptedn/abooltrueno
kms_key_arnn/astring""no
pv_capacity_storagen/astring"100Gi"no
pv_namen/astring""no
pvc_namen/astring""no
pvc_request_storagen/astring"1Gi"no
sg_namen/astring""no

Outputs

NameDescription
claimn/a
efs_idn/a
pvc_namen/a
service_role_namen/a
service_role_policyn/a

aws_react_frontend

Creates a bunch of resources like an s3 bucket and cloudfront distribution to host a SPA react app. It also sets up CF to forward API requests to the backend server and sets up the associated domain name and certificates.

Terraform Module Source

module "aws_react_frontend" {
  source = "https://tfmodules.matillion-cto.matillion.com/aws_react_frontend.tar.gz"
  ...
}

Resources

NameType
aws_cloudfront_distribution.cloudfrontresource
aws_cloudfront_origin_access_identity.web_distributionresource
aws_s3_bucket.s3_bucketresource
aws_s3_bucket_policy.s3_bucket_policyresource
aws_cloudfront_cache_policy.api_policydata source
aws_cloudfront_origin_request_policy.api_policydata source
aws_iam_policy_document.s3_bucket_policydata source

Inputs

NameDescriptionTypeDefaultRequired
backendUrlNameThe first part of the URL of the backend.stringn/ayes
serviceNameThe name of the servicestringn/ayes
serviceUrlNameThe first part of the URL, this gets combined with zone to be serviceUrlName.zonestringn/ayes
includeWildcardWhether to include a wildcard record for the serviceboolfalseno
zoneThe name of the Route53 zone to usestring"matillion-cto.matillion.com"no

Outputs

NameDescription
output_valuesn/a
s3_idn/a

aws_route53_domain

A small wrapper around route53. It handles getting the correct zone from the domain and constructing a correct url.

Terraform Module Source

module "aws_route53_domain" {
  source = "https://tfmodules.matillion-cto.matillion.com/aws_route53_domain.tar.gz"
  ...
}

Resources

NameType
aws_route53_record.dnsresource
aws_route53_zone.zonedata source

Inputs

NameDescriptionTypeDefaultRequired
targetn/a
object({
name = string
zone_id = string
evaluate_health = bool
})
n/ayes
urln/a
object({
subdomain = string,
domain = string
})
n/ayes

Outputs

NameDescription
urln/a

Kube Config

This module exports a bunch of config option to save repetition

Terraform Module Source

module "kube_config" {
  source = "https://tfmodules.matillion-cto.matillion.com/kube_config.tar.gz"
  ...
}

Resources

NameType
aws_eks_cluster.eks_clusterdata source
aws_eks_cluster_auth.clusterdata source
aws_vpc.vpcdata source

Inputs

NameDescriptionTypeDefaultRequired
environmentn/astringn/ayes
include_node_infon/aboolfalseno

Outputs

NameDescription
confign/a
provider_confign/a

Kube Service

A kube spring backend with route53 and such

Terraform Module Source

module "kube_service" {
  source = "https://tfmodules.matillion-cto.matillion.com/kube_service.tar.gz"
  ...
}

Resources

NameType
aws_ecr_repository.repositoryresource
aws_iam_policy.mainresource
kubernetes_deployment.deploymentresource
kubernetes_ingress_v1.kube_ingressresource
kubernetes_namespace.namespaceresource
kubernetes_service.serviceresource
kubernetes_service.service_newresource
aws_caller_identity.awsdata source
aws_elb_hosted_zone_id.elb_zone_iddata source
aws_iam_policy_document.empty_policydata source
aws_region.currentdata source

Inputs

NameDescriptionTypeDefaultRequired
kube_confign/a
object({
cluster_name = string
oidc_provider_id = string
provider_config = any
})
n/ayes
serviceNameThe name of the servicestringn/ayes
serviceUrlNameThe first part of the URL, this gets combined with zone to be serviceUrlName.zonestringn/ayes
create_ecr_repositoryn/abooltrueno
create_namespacen/abooltrueno
ebPolicyJsonn/astring""no
envVarsn/amap(string){}no
expose_pathn/astring"/api/"no
image_namen/astring""no
image_versionn/astring"latest"no
include_legacy_service_lbn/aboolfalseno
ingress_alternate_hostsn/alist(string)[]no
ingress_groupn/astring"shared-apis"no
internalPortn/anumber8080no
maxInstancesThe maximum number of instances that should be creatednumber2no
minInstancesThe minimum number of instances that should be creatednumber2no
namespacen/astring""no
persistent_volumesn/a
list(object({
name = string
claim_name = string
mount_path = string
}))
[]no
profileThe spring profile that should be enabledstring"preprod"no
prometheus_enabledn/aboolfalseno
prometheus_pathn/astring"/actuator/prometheus"no
prometheus_portn/anumber0no
use_legacy_service_dnsn/aboolfalseno
vpc_namen/astring"public"no
zoneThe name of the Route53 zone to usestring"matillion-cto.matillion.com"no

Outputs

NameDescription
service_accountn/a

Kube Service Role

Create a kube IAM service role

Terraform Module Source

module "kube_service_role" {
  source = "https://tfmodules.matillion-cto.matillion.com/kube_service_role.tar.gz"
  ...
}

Resources

NameType
aws_eks_pod_identity_association.pod_associationresource
aws_iam_role.mainresource
aws_iam_role_policy_attachment.attach_policyresource
kubernetes_service_account.serviceresource
aws_caller_identity.awsdata source
aws_region.currentdata source

Inputs

NameDescriptionTypeDefaultRequired
eks_clustern/astringn/ayes
kube_namespacen/astringn/ayes
namen/astringn/ayes
policy_arnn/astringn/ayes
oidc_provider_idn/astring"AB88EFEC40ADAB4358F8851BF7EDAE54"no
use_pod_identityn/aboolfalseno

Outputs

NameDescription
iam_rolen/a
iam_role_arnn/a
service_account_namen/a

Kube Simple Ingress

A simple module which combines some basic kube configuration and some aws configuration to make setting up an ingress a little easier

Terraform Module Source

module "kube_simple_ingress" {
  source = "https://tfmodules.matillion-cto.matillion.com/kube_simple_ingress.tar.gz"
  ...
}

Resources

NameType
kubernetes_ingress_v1.kube_ingressresource
aws_lb_hosted_zone_id.elb_zone_iddata source

Inputs

NameDescriptionTypeDefaultRequired
kube_namespacen/astringn/ayes
namen/astringn/ayes
service_namen/astringn/ayes
subdomainn/astringn/ayes
domainn/astring"matillion-cto.matillion.com"no
expose_pathn/astring"/"no
ingress_alternate_hostsn/alist(string)[]no
ingress_groupn/astring"shared-apis"no

Outputs

No outputs.