Add practice/aws-networking-with-3-tier (p1)

.gitignore

@@ -32,4 +32,7 @@ override.tf.json
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
-*.zip
+*.zip
+
+# Ignore lock files
+.terraform.lock.hcl

README.md

@@ -37,18 +37,19 @@
 
 ## Labs
 
-| ID   | Category    | Name                                     | URL                                                            | Status |
-| :--- | :---------- | :--------------------------------------- | :------------------------------------------------------------- | :----- |
-| 01   | get-started | EC2 Create Simple Instance               | [Explore](./getting-started/ec2/create-simple-instance)        | ✔️ Done |
-| 02   | get-started | S3 Create Simple Bucket                  | [Explore](./getting-started/s3/create-new-bucket)              | ✔️ Done |
-| 03   | get-started | Execute command on localhost             | [Explore](./getting-started/local-exec/single-command)         | ✔️ Done |
-| 04   | get-started | AWS Codebuild demo                       | [Explore](./getting-started/cicd/codebuild)                    | ✔️ Done |
-| 05   | get-started | AWS CodePipeline demo                    | [Explore](./getting-started/cicd/codepipeline)                 | ✔️ Done |
-| 06   | tutorial    | S3 Static Website                        | [Explore](./tutorial/s3-static-website)                        | ✔️ Done |
-| 07   | tutorial    | Serverless Basic Application             | [Explore](./tutorial/serverless-basic-application)             | ✔️ Done |
-| 08   | tutorial    | WordPress Instance With Amazon Lightsail | [Explore](./tutorial/wordPress-instance-with-amazon-lightsail) | ✔️Done  |
-| 09   | workshop    | AWS 3 tier web application               | [Explore](./workshop/aws-3-tier-web)                           | ✔️ Done |
-| 10   | self-hosted | Focalboard App Basic on AWS EC2 Ubuntu   | [Explore](./selfhosted/focalboard/simple-focalboard)           | ✔️ Done |
+| ID  | Category    | Name                                     | URL                                                            | Status  |
+| :-- | :---------- | :--------------------------------------- | :------------------------------------------------------------- | :------ |
+| 01  | get-started | EC2 Create Simple Instance               | [Explore](./getting-started/ec2/create-simple-instance)        | ✔️ Done |
+| 02  | get-started | S3 Create Simple Bucket                  | [Explore](./getting-started/s3/create-new-bucket)              | ✔️ Done |
+| 03  | get-started | Execute command on localhost             | [Explore](./getting-started/local-exec/single-command)         | ✔️ Done |
+| 04  | get-started | AWS Codebuild demo                       | [Explore](./getting-started/cicd/codebuild)                    | ✔️ Done |
+| 05  | get-started | AWS CodePipeline demo                    | [Explore](./getting-started/cicd/codepipeline)                 | ✔️ Done |
+| 06  | tutorial    | S3 Static Website                        | [Explore](./tutorial/s3-static-website)                        | ✔️ Done |
+| 07  | tutorial    | Serverless Basic Application             | [Explore](./tutorial/serverless-basic-application)             | ✔️ Done |
+| 08  | tutorial    | WordPress Instance With Amazon Lightsail | [Explore](./tutorial/wordPress-instance-with-amazon-lightsail) | ✔️Done  |
+| 09  | workshop    | AWS 3 tier web application               | [Explore](./workshop/aws-3-tier-web)                           | ✔️ Done |
+| 10  | self-hosted | Focalboard App Basic on AWS EC2 Ubuntu   | [Explore](./selfhosted/focalboard/simple-focalboard)           | ✔️ Done |
+| 11  | practice    | AWS Networking with sample 3 tiers web   | [Explore](./practice/aws-networking-with-3-tier/)              | ✔️ Done |
 
 And more upcoming content...⏩ you can follow this repository to get more up-to-dated content ⭐
 

practice/aws-networking-with-3-tier/README.md

@@ -0,0 +1,31 @@
+# AWS networking with 3 tier web app
+
+## Prepare
+
+Create your own terraform.tfvars file:
+
+```bash
+cp terraform.tfvars.sample terraform.tfvars
+```
+
+## TF init
+
+```bash
+terraform init
+```
+
+## TF plan out
+
+```bash
+terraform plan -out="tfplan.out"
+```
+
+## TF apply
+
+```bash
+terraform apply "tfplan.out"
+```
+
+## Troubleshooting
+
+- https://stackoverflow.com/questions/31569910/terraform-throws-groupname-cannot-be-used-with-the-parameter-subnet-or-vpc-se

practice/aws-networking-with-3-tier/ec2.tf

@@ -0,0 +1,37 @@
+# ec2.tf
+
+resource "aws_instance" "web_instance" {
+  ami           = var.ami_id
+  instance_type = var.instance_type
+  subnet_id     = aws_subnet.public_subnet.id
+  security_groups = [aws_security_group.web_sg.id]
+  user_data     = file("${path.module}/scripts/web.sh")
+
+  tags = {
+    Name = "${var.app_name}-web-instance"
+  }
+}
+
+resource "aws_instance" "app_instance" {
+  ami           = var.ami_id
+  instance_type = var.instance_type
+  subnet_id     = aws_subnet.private_subnet.id
+  security_groups = [aws_security_group.app_sg.id]
+  user_data     = file("${path.module}/scripts/app.sh")
+
+  tags = {
+    Name = "${var.app_name}-app-instance"
+  }
+}
+
+resource "aws_instance" "db_instance" {
+  ami           = var.ami_id
+  instance_type = var.instance_type
+  subnet_id     = aws_subnet.private_subnet.id
+  security_groups = [aws_security_group.db_sg.id]
+  user_data     = file("${path.module}/scripts/db.sh")
+
+  tags = {
+    Name = "${var.app_name}-db-instance"
+  }
+}

practice/aws-networking-with-3-tier/iam.tf

@@ -0,0 +1,45 @@
+# iam.tf
+
+resource "aws_iam_role" "app_role" {
+  name = "${var.app_name}_role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "ec2.amazonaws.com"
+        }
+      },
+    ]
+  })
+}
+
+resource "aws_iam_policy" "app_s3_policy" {
+  name = "${var.app_name}_s3_policy"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "s3:PutObject",
+          "s3:GetObject",
+          "s3:ListBucket"
+        ]
+        Effect   = "Allow"
+        Resource = [
+          aws_s3_bucket.app_bucket.arn,
+          "${aws_s3_bucket.app_bucket.arn}/*"
+        ]
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "app_role_attachment" {
+  role       = aws_iam_role.app_role.name
+  policy_arn = aws_iam_policy.app_s3_policy.arn
+}

practice/aws-networking-with-3-tier/main.tf.wip

@@ -0,0 +1,45 @@
+# main.tf
+
+provider "aws" {
+  region = var.aws_region
+}
+
+# Include the individual component files
+# terraform {
+#   source = "./"
+# }
+
+# VPC Configuration
+module "vpc" {
+  source = "./vpc.tf"
+}
+
+# Subnets Configuration
+module "subnets" {
+  source = "./subnets.tf"
+}
+
+# NACL Configuration
+module "nacl" {
+  source = "./nacl.tf"
+}
+
+# Security Groups Configuration
+module "security_groups" {
+  source = "./security_groups.tf"
+}
+
+# EC2 Instances Configuration
+module "ec2" {
+  source = "./ec2.tf"
+}
+
+# S3 Bucket Configuration
+module "s3" {
+  source = "./s3.tf"
+}
+
+# IAM Role Configuration
+module "iam" {
+  source = "./iam.tf"
+}

practice/aws-networking-with-3-tier/nacl.tf

@@ -0,0 +1,113 @@
+# nacl.tf
+
+# NACL for the Web Tier
+resource "aws_network_acl" "web_nacl" {
+  vpc_id = aws_vpc.custom_vpc.id
+
+  # Outbound rules (allow all outbound traffic)
+  egress {
+    rule_no    = 100
+    protocol   = "-1"
+    action     = "allow"
+    cidr_block = "0.0.0.0/0"
+    from_port  = 0
+    to_port    = 0
+  }
+
+  # Inbound rules (allow HTTP and HTTPS traffic)
+  ingress {
+    rule_no    = 100
+    protocol   = "6"
+    action     = "allow"
+    cidr_block = "0.0.0.0/0"
+    from_port  = 80
+    to_port    = 80
+  }
+
+  ingress {
+    rule_no    = 110
+    protocol   = "6"
+    action     = "allow"
+    cidr_block = "0.0.0.0/0"
+    from_port  = 443
+    to_port    = 443
+  }
+
+  tags = {
+    Name = "${var.app_name}-web-nacl"
+  }
+}
+
+# NACL for the App Tier
+resource "aws_network_acl" "app_nacl" {
+  vpc_id = aws_vpc.custom_vpc.id
+
+  # Outbound rules (allow all outbound traffic)
+  egress {
+    rule_no    = 100
+    protocol   = "-1"
+    action     = "allow"
+    cidr_block = "0.0.0.0/0"
+    from_port  = 0
+    to_port    = 0
+  }
+
+  # Inbound rules (allow traffic on port 8080 from the web subnet)
+  ingress {
+    rule_no    = 100
+    protocol   = "6"
+    action     = "allow"
+    cidr_block = aws_subnet.public_subnet.cidr_block
+    from_port  = 8080
+    to_port    = 8080
+  }
+
+  tags = {
+    Name = "${var.app_name}-app-nacl"
+  }
+}
+
+# NACL for the Database Tier
+resource "aws_network_acl" "db_nacl" {
+  vpc_id = aws_vpc.custom_vpc.id
+
+  # Outbound rules (allow all outbound traffic)
+  egress {
+    rule_no    = 100
+    protocol   = "-1"
+    action     = "allow"
+    cidr_block = "0.0.0.0/0"
+    from_port  = 0
+    to_port    = 0
+  }
+
+  # Inbound rules (allow traffic on port 5432 from the app subnet)
+  ingress {
+    rule_no    = 100
+    protocol   = "6"
+    action     = "allow"
+    cidr_block = aws_subnet.private_subnet.cidr_block
+    from_port  = 5432
+    to_port    = 5432
+  }
+
+  tags = {
+    Name = "${var.app_name}-db-nacl"
+  }
+}
+
+# Associating NACLs with Subnets
+resource "aws_network_acl_association" "web_nacl_assoc" {
+  subnet_id     = aws_subnet.public_subnet.id
+  network_acl_id = aws_network_acl.web_nacl.id
+}
+
+resource "aws_network_acl_association" "app_nacl_assoc" {
+  subnet_id     = aws_subnet.private_subnet.id
+  network_acl_id = aws_network_acl.app_nacl.id
+}
+
+resource "aws_network_acl_association" "db_nacl_assoc" {
+  subnet_id     = aws_subnet.private_subnet.id
+  network_acl_id = aws_network_acl.db_nacl.id
+}

practice/aws-networking-with-3-tier/outputs.tf.wip

@@ -0,0 +1,17 @@
+# outputs.tf
+
+output "vpc_id" {
+  value = aws_vpc.custom_vpc.id
+}
+
+output "public_subnet_id" {
+  value = aws_subnet.public_subnet.id
+}
+
+output "private_subnet_id" {
+  value = aws_subnet.private_subnet.id
+}
+
+output "s3_bucket_name" {
+  value = aws_s3_bucket.app_bucket.bucket
+}

practice/aws-networking-with-3-tier/providers.tf

@@ -0,0 +1,5 @@
+# providers.tf
+
+provider "aws" {
+  region = var.aws_region
+}

practice/aws-networking-with-3-tier/s3.tf

@@ -0,0 +1,13 @@
+# s3.tf
+
+resource "aws_s3_bucket" "app_bucket" {
+  bucket = "aws-networking-with-3-tier-${var.app_name}-bucket"
+
+  tags = {
+    Name = "${var.app_name}-bucket"
+  }
+}
+
+output "s3_bucket_name" {
+  value = aws_s3_bucket.app_bucket.bucket
+}

practice/aws-networking-with-3-tier/scripts/app.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# app.sh
+
+# Install Node.js
+sudo apt-get update
+sudo apt-get install -y nodejs npm
+
+# Create a simple Node.js app
+cat <<EOL > /home/ubuntu/app.js
+const http = require('http');
+const hostname = '0.0.0.0';
+const port = 8080;
+
+const server = http.createServer((req, res) => {
+  res.statusCode = 200;
+  res.setHeader('Content-Type', 'text/plain');
+  res.end('Hello from the App Tier\n');
+});
+
+server.listen(port, hostname, () => {
+  console.log(\`Server running at http://\${hostname}:\${port}/\`);
+});
+EOL
+
+# Run the Node.js app
+node /home/ubuntu/app.js &

practice/aws-networking-with-3-tier/scripts/db.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# db.sh
+
+# Install PostgreSQL
+sudo apt-get update
+sudo apt-get install -y postgresql postgresql-contrib
+
+# Start PostgreSQL
+sudo systemctl start postgresql
+sudo systemctl enable postgresql
+
+# Create a sample database and user
+sudo -u postgres psql -c "CREATE DATABASE sampledb;"
+sudo -u postgres psql -c "CREATE USER sampleuser WITH ENCRYPTED PASSWORD 'samplepass';"
+sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE sampledb TO sampleuser;"