Gitingest

Include files under: 50kB

Private Repository NEW

Summary

Repository: meshhq/terraform-meshhq-ecs-cluster
Files analyzed: 23

Estimated tokens: 6.8k

Download

Directory Structure

Directory structure:

└── meshhq-terraform-meshhq-ecs-cluster/

    ├── README.md

    ├── main.tf

    ├── terraform.md

    ├── variables.tf

    ├── ec2/

    │   ├── autoscaling-group.tf

    │   ├── elastic-load-balancer.tf

    │   ├── launch-configuration.tf

    │   ├── user-data.tpl

    │   └── variables.tf

    ├── ecs/

    │   ├── cluster.tf

    │   ├── service.tf

    │   ├── task-definition.json

    │   ├── task-definition.tf

    │   └── variables.tf

    ├── iam/

    │   ├── ecs-instance-profile.tf

    │   ├── ecs-instance-role.tf

    │   └── ecs-service-role.tf

    └── vpc/

        ├── internet-gateway.tf

        ├── network-acl.tf

        ├── route-table.tf

        ├── security-group.tf

        ├── subnet.tf

        └── vpc.tf

Files Content

================================================
FILE: README.md
================================================
# Terraform ECS Cluster

This repository contains `Terrorform` configuration files that provide for standing up an AWS Elastic Container Service Cluster, meant for deploying a docker image. 

## Use 

Configure a new VPC.

```
terraform apply -target=module.vpc
```

Configure a new ECS Cluster with a service.

```
terraform apply -target=module.ecs
```

Configure the auto scaling group and launch configuration via EC2.

```
terraform apply -target=module.ec2
```


================================================
FILE: main.tf
================================================
provider "aws" {
  region = "us-east-1"
}

module "iam" {
    source = "./iam"
}

module "vpc" {
    source = "./vpc"
}

module "ec2" {
    source = "./ec2"

    vpc-id                      = "${module.vpc.id}"
    security-group-id           = "${module.vpc.security-group-id}"
    subnet-id-1                 = "${module.vpc.subnet1-id}"
    subnet-id-2                 = "${module.vpc.subnet2-id}"
    ecs-instance-role-name      = "${module.iam.ecs-instance-role-name}"
    ecs-instance-profile-name   = "${module.iam.ecs-instance-profile-name}"
    ecs-cluster-name            = "${var.ecs-cluster-name}"
    ecs-key-pair-name           = "${var.ecs-key-pair-name}"
}

module "ecs" {
    source = "./ecs"

    ecs-cluster-name            = "${var.ecs-cluster-name}"
    ecs-load-balancer-name      = "${module.ec2.ecs-load-balancer-name}"
    ecs-target-group-arn        = "${module.ec2.ecs-target-group-arn}"
    ecs-service-role-arn        = "${module.iam.ecs-service-role-arn}"
}



================================================
FILE: terraform.md
================================================
# Automating ECS Deployments with Terraform

We make liberal use of AWS's Elastic Container Service at Mesh. Wether we are standing up a cluster for one of our consulting customers or one of our in house products, we interact with the service on a near daily basis.

As the AWS marketing page describes, ECS is:

**a highly scalable, high performance container management service that supports Docker containers and allows you to easily run applications on a managed cluster of Amazon EC2 instances.**

The operative word here being "Easy". While we love the robustness, reliability and peace of mind that ECS brings, standing up an ECS cluster and deploying a Dockerized application via the AWS dashboard is far from easy. As is often the case with AWS, the dashboard can leave developers scratching their heads and wondering why things need to be so difficult.

## Tooling to the resuce

We are always on the lookout for opportunities to build tooling that will allow us to automate difficult, repetitive, and/or error prone tasks. Tools have the potential to save developers significant amounts of time and increase efficiency. We get to pass those savings on to our customers as well.

Deploying an ECS Cluster is indeed a difficult, repetitive and error prone process. As such, the process was a perfect candidate for automation via tooling. To build this tooling, we leveraged one of our favorite DevOps frameworks, `Terraform`.

## Configuration with Terraform 

As Terraform states on their website, the tool allows you to "safely and predictably create, change, and improve production infrastructure." 

In plain english, Terraform allows you to describe you infrastrucutre via configuration files. Once you have your configuration files in place, the terraform CLI then allows you to spin up your cloud resources from the command line. As an added bonus, it also allows us to avoid the AWS dashboard ;). 

When we deploy ECS Clusters, they are typically configured in a simalar manner. This makes it very easy for us to express our default configuration with Terraform. Our typical configuration is as follows:

* Cluster Instances - Min of 3, Max of 5
* Load Balancing - Via an Application Load Balancer
* Security - Ingress on 80 (HTTP), 443 (HTTPS) and 22 (SSH), All Egress.

Our default Terraform configuration files for provisioning an ECS instance can be found in the following repository:

https://github.com/meshhq/terraform-ecs-cluster

## Single Command Deployments

We have an in house CLI that all of our developers use on a daily basis. So we set out to build functionality that would allow us to deploy a docker image on a newly provisioned ECS Cluster with a single command. We achieved this via the following:

```bash 
$ mesh cluster deploy --name "mesh-docker-sample" --image "meshhq/sample-node-container"
```

While this command looks simple to the consuming devloper, there is a ton going on underneath the hood. Lets break it down.

### IAM Roles

Before deploying an ECS Cluster, we need create two different IAM roles, and then attach specific policies to each of these roles. The roles are the following:

* [ECS Container Instance IAM Role](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html)
* [ECS Service Scheduler IAM Role](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/service_IAM_role.html)

We can provision these roles via the Mesh CLI.

```bash
$ mesh iam build --ecs
```

Underneath the hood, the Mesh CLI is generating these roles via Terraform config files.

[ecs-instance-role.tf](https://github.com/meshhq/terraform-ecs-cluster/blob/master/iam/ecs-instance-role.tf)

```tf
data "aws_iam_policy_document" "ecs-instance-policy" {
    statement {
        actions = ["sts:AssumeRole"]

        principals {
            type        = "Service"
            identifiers = ["ecs.amazonaws.com"]
        }
    }
}

resource "aws_iam_role" "ecs-instance-role" {
    name                = "ecs-instance-role"
    path                = "/"
    assume_role_policy  = "${data.aws_iam_policy_document.ecs-instance-policy.json}"
}

resource "aws_iam_role_policy_attachment" "ecs-instance-role-attachment" {
    role       = "${aws_iam_role.ecs-instance-role.name}"
    policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
}

output "ecs-instance-role-id" {
  value = "${aws_security_group.mesh-vpc-security-group.id}"
}
```

[ecs-service-role.tf](https://github.com/meshhq/terraform-ecs-cluster/blob/master/iam/ecs-service-role.tf)

```tf
data "aws_iam_policy_document" "ecs-service-policy" {
    statement {
        actions = ["sts:AssumeRole"]

        principals {
            type        = "Service"
            identifiers = ["ec2.amazonaws.com"]
        }
    }
}

resource "aws_iam_role" "ecs-service-role" {
    name                = "ecs-service-role"
    path                = "/"
    assume_role_policy  = "${data.aws_iam_policy_document.ecs-service-policy.json}"
}

resource "aws_iam_role_policy_attachment" "ecs-service-role-attachment" {
    role       = "${aws_iam_role.ecs-service-role.name}"
    policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
}

output "ecs-service-role-arn" {
  value = "${aws_iam_role.ecs-service-role.arn}"
}
```

### Virtual Private Cloud

Next we need to provision a number of [Virtual Private Cloud (VPC)](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html) resources. This involves the following:

* [VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/getting-started-ipv4.html)
* [Subnets](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html)
* [Internet Gateway](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.html)
* [Route Table](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html)
* [Network ACL](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html)
* [Security Groups](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html)

We can provision these VPC components via the following command.

```bash
$ mesh vpc build --name "mesh"
```

Underneath the hood, the Mesh CLI is generating the following via Terraform config files.

### vpc.tf

```tf
resource "aws_vpc" "mesh-vpc" {
  cidr_block = "10.0.0.0/16"
  enable_dns_hostnames = "true"

  tags {
    Name = "mesh-vpc"
  }
}

output "id" {
  value = "${aws_vpc.mesh-vpc.id}"
}
```

### subnet.tf

```tf
resource "aws_subnet" "mesh-vpc-subnet1" {
    vpc_id     = "${aws_vpc.mesh-vpc.id}"
    cidr_block = "10.0.0.0/24"
    availability_zone = "us-east-1a"

    tags {
        Name = "mesh-vpc-subnet"
    }
}

resource "aws_subnet" "mesh-vpc-subnet2" {
    vpc_id     = "${aws_vpc.mesh-vpc.id}"
    cidr_block = "10.0.1.0/24"
    availability_zone = "us-east-1b"

    tags {
        Name = "mesh-vpc-subnet"
    }
}

output "subnet1-id" {
  value = "${aws_subnet.mesh-vpc-subnet1.id}"
}

output "subnet2-id" {
  value = "${aws_subnet.mesh-vpc-subnet2.id}"
}
```

### Elastic Container Service

Once we have our VPC setup, its time to create an ECS Cluster. In order to create an ECS cluster, we provision the following:

* [Cluster](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_clusters.html)
* [Service](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html)
* [Task Definition](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definitions.html)

We can provision these ECS components via the following command.

```bash
$ mesh ecs build --name "mesh-docker"
```
Underneath the hood, the Mesh CLI is generating the following via Terraform config files.

[cluster.tf](https://github.com/meshhq/terraform-ecs-cluster/blob/master/ecs/cluster.tf)

```tf
variable "cluster-name" {}

resource "aws_ecs_cluster" "mesh-ecs-cluster" {
  name = "${var.cluster-name}"
}
```

[service.tf](https://github.com/meshhq/terraform-ecs-cluster/blob/master/ecs/service.tf)

```tf
variable "ecs-service-role-arn" {}

resource "aws_ecs_service" "mesh-ecs-service" {
  name            = "mesh-ecs-service"
  cluster         = "${aws_ecs_cluster.mesh-ecs-cluster.id}"
  task_definition = "${aws_ecs_task_definition.mesh-sample-definition.arn}"
  iam_role        = "${aws_iam_role.ecs-service-role-arn}"
  desired_count   = 1
}
```

[task-definition.tf](https://github.com/meshhq/terraform-ecs-cluster/blob/master/ecs/task-definition.tf)

```tf
resource "aws_ecs_task_definition" "mesh-sample-definition" {
  family                = "mesh-sample-definition"
  container_definitions = "${file("./ecs/task-definition.json")}"
}
```

## Elastic Compute Instances 

Once our ECS Cluster is configured, the last step is to deploy some actual EC2 instances into our cluster. We do this by configuring an Auto Scaling Group with an Elastic Load Balancer. This involves the following:

* [Auto Scaling Group](http://docs.aws.amazon.com/autoscaling/latest/userguide/GettingStartedTutorial.html)
* [Launch Configuration](http://docs.aws.amazon.com/autoscaling/latest/userguide/LaunchConfiguration.html)
* [Application Load Balancer](http://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html)

```bash
$ mesh ec2 deploy
```

[autoscaling-group.tf](https://github.com/meshhq/terraform-ecs-cluster/blob/master/ec2/autoscaling-group.tf)

```tf
variable "subnet-id-1" {}
variable "subnet-id-2" {}

resource "aws_autoscaling_group" "mesh-ecs-asg" {
    name                        = "mesh-ecs-asg"
    max_size                    = 5
    min_size                    = 3
    health_check_grace_period   = 300
    health_check_type           = "ELB"
    desired_capacity            = 2
    force_delete                = true
    launch_configuration        = "${aws_launch_configuration.mesh-ecs-launch-config.name}"
    vpc_zone_identifier         = ["${var.subnet-id-1}", "${var.subnet-id-2}"]
}
```

[launch-configuration.tf](https://github.com/meshhq/terraform-ecs-cluster/blob/master/ec2/launch-configuration.tf)

```tf
variable "cluster-name" {}
variable "security-group-id" {}
variable "ecs-instance-role" {}

resource "aws_launch_configuration" "mesh-ecs-launch-config" {
    name          = "mesh-ecs-launch-config"
    image_id      = "ami-d61027ad"
    instance_type = "t2.medium"
    iam_instance_profile = "${ecs-instance-role}"
    user_data = "${template_file.user_data.rendered}"
    security_groups = ["${var.security-group-id}"]
    associate_public_ip_address = "true"
    key_name = "kevin-test-pair"
}

resource "template_file" "user_data" {
    template = "${file("${path.module}/user-data.tpl")}"

    vars {
        ecs-cluster-name = "${var.cluster-name}"
    }
}
```
[application-load-balanacer.tf](https://github.com/meshhq/terraform-ecs-cluster/blob/master/ec2/elastic-load-balancer.tf)

```tf
variable "vpc-id" {}

resource "aws_alb" "mesh-load-balancer" {
    name                = "mesh-load-balancer"
    security_groups     = ["${var.security-group-id}"]
    subnets             = ["${var.subnet-id-1}", "${var.subnet-id-2}"]
}

resource "aws_alb_target_group" "mesh-target_group" {
    name                = "mesh-target-group"
    port                = "80"
    protocol            = "HTTP"
    vpc_id              = "${var.vpc-id}"

    health_check {
        healthy_threshold   = "5"
        unhealthy_threshold = "2"
        interval            = "30"
        matcher             = "200"
        path                = "/"
        port                = "traffic-port"
        protocol            = "HTTP"
        timeout             = "5"
    }
}

resource "aws_alb_listener" "mesh-alb-listener" {
    load_balancer_arn = "${aws_alb.mesh-load-balancer.arn}"
    port              = "80"
    protocol          = "HTTP"

    default_action {
        target_group_arn = "${aws_alb_target_group.mesh-target_group.arn}"
        type             = "forward"
    }
}
```



================================================
FILE: variables.tf
================================================
variable "ecs-cluster-name" {
    description = "The name for the cluster."
    default = "mesh-ecs-cluster"
}

variable "ecs-key-pair-name" {
    description = "The name for the cluster."
    default = "kevin-test-pair"
}


================================================
FILE: ec2/autoscaling-group.tf
================================================
resource "aws_autoscaling_group" "ecs-autoscaling-group" {
    name                        = "${var.autoscaling-group-name}"
    max_size                    = "${var.max-instance-size}"
    min_size                    = "${var.min-instance-size}"
    desired_capacity            = "${var.desired-capacity}"
    vpc_zone_identifier         = ["${var.subnet-id-1}", "${var.subnet-id-2}"]
    launch_configuration        = "${aws_launch_configuration.ecs-launch-configuration.name}"
    health_check_type           = "ELB"
}


================================================
FILE: ec2/elastic-load-balancer.tf
================================================
resource "aws_alb" "ecs-load-balancer" {
    name                = "${var.load-balancer-name}"
    security_groups     = ["${var.security-group-id}"]
    subnets             = ["${var.subnet-id-1}", "${var.subnet-id-2}"]
}

resource "aws_alb_target_group" "ecs-target_group" {
    name                = "${var.target-group-name}"
    port                = "80"
    protocol            = "HTTP"
    vpc_id              = "${var.vpc-id}"

    health_check {
        healthy_threshold   = "5"
        unhealthy_threshold = "2"
        interval            = "30"
        matcher             = "200"
        path                = "/"
        port                = "traffic-port"
        protocol            = "HTTP"
        timeout             = "5"
    }
}

resource "aws_alb_listener" "alb-listener" {
    load_balancer_arn = "${aws_alb.ecs-load-balancer.arn}"
    port              = "80"
    protocol          = "HTTP"
    
    default_action {
        target_group_arn = "${aws_alb_target_group.ecs-target_group.arn}"
        type             = "forward"
    }
}

output "ecs-load-balancer-name" {
  value = "${aws_alb.ecs-load-balancer.name}"
}

output "ecs-target-group-arn" {
  value = "${aws_alb_target_group.ecs-target_group.arn}"
}



================================================
FILE: ec2/launch-configuration.tf
================================================
resource "aws_launch_configuration" "ecs-launch-configuration" {
    name                        = "${var.launch-configuration-name}"
    image_id                    = "${var.image-id}"
    instance_type               = "${var.instance-type}"
    iam_instance_profile        = "${var.ecs-instance-profile-name}" 
    security_groups             = ["${var.security-group-id}"]
    associate_public_ip_address = "true"
    key_name                    = "${var.ecs-key-pair-name}"
    user_data                   = "${template_file.ecs-launch-configuration-user-data.rendered}"
}

resource "template_file" "ecs-launch-configuration-user-data" {
    template = "${file("${path.module}/user-data.tpl")}"

    vars {
        ecs-cluster-name = "${var.ecs-cluster-name}"
    }
}



================================================
FILE: ec2/user-data.tpl
================================================
#!/bin/bash

echo ECS_CLUSTER=${ecs-cluster-name} > /etc/ecs/ecs.config


================================================
FILE: ec2/variables.tf
================================================
//----------------------------------------------------------------------
// Shared Variables
//----------------------------------------------------------------------

variable "vpc-id" {}
variable "subnet-id-1" {}
variable "subnet-id-2" {}
variable "security-group-id" {}
variable "ecs-cluster-name" {}
variable "ecs-instance-role-name" {}
variable "ecs-instance-profile-name" {}
variable "ecs-key-pair-name" {}

//----------------------------------------------------------------------
// Autoscaling Group Variables
//----------------------------------------------------------------------

variable "autoscaling-group-name" {
    description = "The name for the autoscaling group for the cluster."
    default     = "mesh-ecs-asg"
}

variable "max-instance-size" {
    description = "The name for the autoscaling group for the cluster."
    default     = 5
}

variable "min-instance-size" {
    description = "The name for the autoscaling group for the cluster."
    default     = 2
}

variable "desired-capacity" {
    description = "The name for the autoscaling group for the cluster."
    default     = 3
}

variable "health-check-grace-period" {
    description = "The name for the autoscaling group for the cluster."
    default     = 300
}

//----------------------------------------------------------------------
// Application Load Balancer Variables
//----------------------------------------------------------------------

variable "load-balancer-name" {
    description = "The name for the autoscaling group for the cluster."
    default     = "mesh-ecs-load-balancer"
}

variable "target-group-name" {
    description = "The name for the autoscaling group for the cluster."
    default     = "mesh-ecs-target-group"
}

//----------------------------------------------------------------------
// Launch Configuration Variables
//----------------------------------------------------------------------

variable "launch-configuration-name" {
    description = "The name for the autoscaling group for the cluster."
    default = "mesh-ecs-launch-configuration"
}

variable "image-id" {
    description = "The name for the autoscaling group for the cluster."
    default = "ami-d61027ad"
}

variable "instance-type" {
    description = "The name for the autoscaling group for the cluster."
    default = "t2.medium"
}


================================================
FILE: ecs/cluster.tf
================================================
resource "aws_ecs_cluster" "mesh-ecs-cluster" {
    name = "${var.ecs-cluster-name}"
}


================================================
FILE: ecs/service.tf
================================================
resource "aws_ecs_service" "mesh-ecs-service" {
  	name            = "${var.ecs-service-name}"
  	iam_role        = "${var.ecs-service-role-arn}"
  	cluster         = "${aws_ecs_cluster.mesh-ecs-cluster.id}"
  	task_definition = "${aws_ecs_task_definition.mesh-sample-definition.arn}"
  	desired_count   = 1

  	load_balancer {
    	target_group_arn  = "${var.ecs-target-group-arn}"
    	container_port    = 80
    	container_name    = "simple-app"
	}
}


================================================
FILE: ecs/task-definition.json
================================================
[
    {
        "environment": [],
        "name": "simple-app",
        "image": "kcoleman731/amazon-ecs-sample",
        "cpu": 10,
        "memory": 500,
        "portMappings": [
            {
                "containerPort": 80,
                "hostPort": 80
            }
        ],
        "entryPoint": [
            "/usr/sbin/apache2",
            "-D",
            "FOREGROUND"
        ],
        "essential": true
    },
    {
        "name": "busybox",
        "image": "busybox",
        "cpu": 10,
        "memory": 500,
        "volumesFrom": [
        {
            "sourceContainer": "simple-app"
        }
        ],
        "entryPoint": [
            "sh",
            "-c"
        ],
        "command": [
            "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
        ],
        "essential": false
    }
]



================================================
FILE: ecs/task-definition.tf
================================================
resource "aws_ecs_task_definition" "mesh-sample-definition" {
    family                = "mesh-sample-definition"
    container_definitions = "${file("./ecs/task-definition.json")}"
}


================================================
FILE: ecs/variables.tf
================================================

variable "ecs-target-group-arn" {}

variable "ecs-cluster-name" {
    default = "mesh-ecs-cluster"
}

variable "ecs-service-role-arn" {
    default = "mesh-ecs-cluster"
}

variable "ecs-service-name" {
    default = "mesh-ecs-service"
}

variable "ecs-load-balancer-name" {
    default = "mesh-ecs-load-balancer"
}




================================================
FILE: iam/ecs-instance-profile.tf
================================================
resource "aws_iam_instance_profile" "ecs-instance-profile" {
    name = "ecs-instance-profile"
    path = "/"
    role = "${aws_iam_role.ecs-instance-role.name}"
}

output "ecs-instance-profile-name" {
  value = "${aws_iam_instance_profile.ecs-instance-profile.name}"
}



================================================
FILE: iam/ecs-instance-role.tf
================================================
resource "aws_iam_role" "ecs-instance-role" {
    name                = "ecs-instance-role"
    path                = "/"
    assume_role_policy  = "${data.aws_iam_policy_document.ecs-instance-policy.json}"
}

data "aws_iam_policy_document" "ecs-instance-policy" {
    statement {
        actions = ["sts:AssumeRole"]

        principals {
            type        = "Service"
            identifiers = ["ec2.amazonaws.com"]
        }
    }
}

resource "aws_iam_role_policy_attachment" "ecs-instance-role-attachment" {
    role       = "${aws_iam_role.ecs-instance-role.name}"
    policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
}

output "ecs-instance-role-name" {
  value = "${aws_iam_role.ecs-instance-role.name}"
}



================================================
FILE: iam/ecs-service-role.tf
================================================
resource "aws_iam_role" "ecs-service-role" {
    name                = "ecs-service-role"
    path                = "/"
    assume_role_policy  = "${data.aws_iam_policy_document.ecs-service-policy.json}"
}

resource "aws_iam_role_policy_attachment" "ecs-service-role-attachment" {
    role       = "${aws_iam_role.ecs-service-role.name}"
    policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole"
}

data "aws_iam_policy_document" "ecs-service-policy" {
    statement {
        actions = ["sts:AssumeRole"]

        principals {
            type        = "Service"
            identifiers = ["ecs.amazonaws.com"]
        }
    }
}

output "ecs-service-role-arn" {
  value = "${aws_iam_role.ecs-service-role.arn}"
}



================================================
FILE: vpc/internet-gateway.tf
================================================
resource "aws_internet_gateway" "mesh-vpc-internet-gateway" {
  vpc_id = "${aws_vpc.mesh-vpc.id}"

  tags {
    Name = "mesh-vpc-internet-gateway"
  }
}


================================================
FILE: vpc/network-acl.tf
================================================
resource "aws_network_acl" "mesh-vpc-network-acl" {
    vpc_id = "${aws_vpc.mesh-vpc.id}"
    subnet_ids = ["${aws_subnet.mesh-vpc-subnet1.id}", "${aws_subnet.mesh-vpc-subnet2.id}"]
    
    egress {
        protocol   = "-1"
        rule_no    = 100
        action     = "allow"
        cidr_block = "0.0.0.0/0"
        from_port  = 0
        to_port    = 0
    }

    ingress {
        protocol   = "-1"
        rule_no    = 100
        action     = "allow"
        cidr_block = "0.0.0.0/0"
        from_port  = 0
        to_port    = 0
    }

    tags {
        Name = "mesh-vpc-network-acl"
    }
}




================================================
FILE: vpc/route-table.tf
================================================
resource "aws_route_table" "mesh-vpc-route-table" {
  vpc_id = "${aws_vpc.mesh-vpc.id}"

  route {
    cidr_block = "10.0.0.0/0"
    gateway_id = "${aws_internet_gateway.mesh-vpc-internet-gateway.id}"
  }

  tags {
    Name = "mesh-vpc-route-table"
  }
}

resource "aws_route_table_association" "mesh-vpc-route-table-association1" {
  subnet_id      = "${aws_subnet.mesh-vpc-subnet1.id}"
  route_table_id = "${aws_route_table.mesh-vpc-route-table.id}"
}

resource "aws_route_table_association" "mesh-vpc-route-table-association2" {
  subnet_id      = "${aws_subnet.mesh-vpc-subnet2.id}"
  route_table_id = "${aws_route_table.mesh-vpc-route-table.id}"
}


================================================
FILE: vpc/security-group.tf
================================================
resource "aws_security_group" "mesh-vpc-security-group" {
    name        = "mesh-vpc-security-group"
    description = "Allow HTTP, HTTPS, and SSH"
    vpc_id = "${aws_vpc.mesh-vpc.id}"

    // HTTP
    ingress {
        from_port = 80
        to_port = 80
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

    // HTTPS
    ingress {
        from_port = 443
        to_port = 443
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

    // SSH
    ingress {
        from_port = 22
        to_port = 22
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

    egress {
        from_port = 0
        to_port = 0
        protocol = "-1"
        cidr_blocks = ["0.0.0.0/0"]
    }
}

output "security-group-id" {
  value = "${aws_security_group.mesh-vpc-security-group.id}"
}


================================================
FILE: vpc/subnet.tf
================================================
resource "aws_subnet" "mesh-vpc-subnet1" {
    vpc_id     = "${aws_vpc.mesh-vpc.id}"
    cidr_block = "10.0.0.0/24"
    availability_zone = "us-east-1a"

    tags {
        Name = "mesh-vpc-subnet"
    }
}

resource "aws_subnet" "mesh-vpc-subnet2" {
    vpc_id     = "${aws_vpc.mesh-vpc.id}"
    cidr_block = "10.0.1.0/24"
    availability_zone = "us-east-1b"

    tags {
        Name = "mesh-vpc-subnet"
    }
}

output "subnet1-id" {
  value = "${aws_subnet.mesh-vpc-subnet1.id}"
}

output "subnet2-id" {
  value = "${aws_subnet.mesh-vpc-subnet2.id}"
}


================================================
FILE: vpc/vpc.tf
================================================
resource "aws_vpc" "mesh-vpc" {
  cidr_block = "10.0.0.0/16"
  enable_dns_hostnames = "true"
  
  tags {
    Name = "mesh-vpc"
  }
}

output "id" {
  value = "${aws_vpc.mesh-vpc.id}"
}