CC-1993: Templated user_data.

terraform/environments/ccms-ebs/ccms-ec2-clamav.tf

@@ -1,5 +1,3 @@
-# Build EC2 for ClamAV
-
 resource "aws_instance" "ec2_clamav" {
   instance_type               = local.application_data.accounts[local.environment].ec2_instance_type_clamav
   ami                         = local.application_data.accounts[local.environment].clamav_ami_id
@@ -11,7 +9,7 @@ resource "aws_instance" "ec2_clamav" {
   associate_public_ip_address = false
   iam_instance_profile        = aws_iam_instance_profile.iam_instace_profile_ccms_base.name
 
-  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below
+  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
   lifecycle {
     ignore_changes = [
       ebs_block_device,
@@ -21,35 +19,10 @@ resource "aws_instance" "ec2_clamav" {
     ]
   }
   user_data_replace_on_change = false
-  user_data                   = <<EOF
-#!/bin/bash
-
-exec > /tmp/userdata.log 2>&1
-
-yum install -y wget unzip vsftpd jq s3fs-fuse
-yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip awscliv2.zip
-./aws/install
-wget https://s3.amazonaws.com/amazoncloudwatch-agent/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm
-rpm -U ./amazon-cloudwatch-agent.rpm
-amazon-linux-extras install -y epel
-
-/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:cloud-watch-config
-
-systemctl stop amazon-ssm-agent
-rm -rf /var/lib/amazon/ssm/ipc/
-systemctl start amazon-ssm-agent
-
-yum install -y clamav clamav-update clamd
-
-freshclam
-
-systemctl enable [email protected]
-
-systemctl start [email protected]
+  user_data = base64encode(templatefile("./templates/ec2_user_data_clamav.sh", {
+    hostname = "clamav"
+  }))
 
-EOF
   metadata_options {
     http_endpoint = "enabled"
     http_tokens   = "required"

terraform/environments/ccms-ebs/ccms-ec2-ftp.tf

@@ -1,4 +1,3 @@
-# Build EC2 
 resource "aws_instance" "ec2_ftp" {
   instance_type               = local.application_data.accounts[local.environment].ec2_instance_type_ftp
   ami                         = local.application_data.accounts[local.environment].ftp_ami_id
@@ -10,7 +9,7 @@ resource "aws_instance" "ec2_ftp" {
   associate_public_ip_address = false
   iam_instance_profile        = aws_iam_instance_profile.iam_instace_profile_ccms_base.name
 
-  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below
+  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
   lifecycle {
     ignore_changes = [
       ebs_block_device,
@@ -20,85 +19,13 @@ resource "aws_instance" "ec2_ftp" {
     ]
   }
   user_data_replace_on_change = false
-  user_data                   = <<EOF
-#!/bin/bash
+  user_data = base64encode(templatefile("./templates/ec2_user_data_ftp.sh", {
+    environment               = "${local.environment}"
+    lz_aws_account_id_env     = "${local.application_data.accounts[local.environment].lz_aws_account_id_env}"
+    lz_ftp_bucket_environment = "${local.application_data.accounts[local.environment].lz_ftp_bucket_environment}"
+    hostname                  = "ftp"
+  }))
 
-exec > /tmp/userdata.log 2>&1
-
-yum install -y wget unzip vsftpd jq s3fs-fuse
-yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip awscliv2.zip
-./aws/install
-wget https://s3.amazonaws.com/amazoncloudwatch-agent/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm
-rpm -U ./amazon-cloudwatch-agent.rpm
-amazon-linux-extras install -y epel
-
-/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:cloud-watch-config
-
-systemctl stop amazon-ssm-agent
-rm -rf /var/lib/amazon/ssm/ipc/
-systemctl start amazon-ssm-agent
-
-useradd -m s3xfer
-
-echo "pasv_enable=YES" >> /etc/vsftpd/vsftpd.conf
-echo "pasv_min_port=3000" >> /etc/vsftpd/vsftpd.conf
-echo "pasv_max_port=3010" >> /etc/vsftpd/vsftpd.conf
-
-systemctl restart vsftpd.service
-
-cat > /etc/mount_s3.sh <<- EOM
-#!/bin/bash
-
-B=(laa-ccms-inbound-${local.application_data.accounts[local.environment].lz_ftp_bucket_environment} laa-ccms-outbound-${local.application_data.accounts[local.environment].lz_ftp_bucket_environment} laa-cis-outbound-${local.application_data.accounts[local.environment].lz_ftp_bucket_environment} laa-cis-inbound-${local.application_data.accounts[local.environment].lz_ftp_bucket_environment} bacway-${local.application_data.accounts[local.environment].lz_ftp_bucket_environment}-eu-west-2-${local.application_data.accounts[local.environment].lz_aws_account_id_env})
-
-C=\$(aws secretsmanager get-secret-value --secret-id ftp-s3-${local.environment}-aws-key --region eu-west-2)
-K=\$(jq -r '.SecretString' <<< \$${C} |cut -d'"' -f2)
-S=\$(jq -r '.SecretString' <<< \$${C} |cut -d'"' -f4)
-U=\$(id -u s3xfer)
-G=\$(id -g s3xfer)
-F=/etc/passwd-s3fs
-echo "\$${K}:\$${S}" > "\$${F}"
-chmod 600 \$${F}
-
-for b in "\$${B[@]}"; do
-  D=/s3xfer/S3/\$${b}
-
-  if [[ -d \$${D} ]]; then
-    echo "\$${D} exists."
-  else
-    mkdir -p \$${D}
-  fi
-
-  chown -R s3xfer:users \$${D}
-  chmod 755 \$${D}
-
-  s3fs \$${b} \$${D} -o passwd_file=\$${F} -o _netdev,allow_other,use_cache=/tmp,url=https://s3-eu-west-2.amazonaws.com,endpoint=eu-west-2,umask=022,uid=\$${U},gid=\$${G}
-  if [[ \$? -eq 0 ]]; then
-    s3fs \$${b} \$${D} -o passwd_file=\$${F}
-    echo "\$${b} has been mounted in \$${D}"
-  else
-    echo "\$${b} has not been mounted! Please investigate."
-  fi
-done
-
-ln -s /s3xfer/S3/laa-ccms-inbound-${local.application_data.accounts[local.environment].lz_ftp_bucket_environment}/CCMS_PRD_TDX/Inbound /home/s3xfer/CCMS_PRD_TDX_Inbound
-ln -s /s3xfer/S3/laa-ccms-outbound-${local.application_data.accounts[local.environment].lz_ftp_bucket_environment}/CCMS_PRD_TDX/Outbound /home/s3xfer/CCMS_PRD_TDX_Outbound
-
-chown -h s3xfer:s3xfer /home/s3xfer/CCMS_PRD_TDX_Inbound
-chown -h s3xfer:s3xfer /home/s3xfer/CCMS_PRD_TDX_Outbound
-
-rm \$${F}
-EOM
-
-chmod +x /etc/mount_s3.sh
-
-chmod +x /etc/rc.d/rc.local
-echo "/etc/mount_s3.sh" >> /etc/rc.local
-systemctl start rc-local.service
-
-EOF
   metadata_options {
     http_endpoint = "enabled"
     http_tokens   = "required"

terraform/environments/ccms-ebs/ccms-ec2-oracle_accessgate.tf

@@ -26,26 +26,9 @@ resource "aws_instance" "ec2_accessgate" {
     ]
   }
   user_data_replace_on_change = false
-  user_data                   = <<EOF
-#!/bin/bash
-
-exec > /tmp/userdata.log 2>&1
-yum update -y
-yum install -y wget unzip
-yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip awscliv2.zip
-./aws/install
-wget https://s3.amazonaws.com/amazoncloudwatch-agent/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm
-rpm -U ./amazon-cloudwatch-agent.rpm
-/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:cloud-watch-config
-
-systemctl stop amazon-ssm-agent
-rm -rf /var/lib/amazon/ssm/ipc/
-systemctl start amazon-ssm-agent
-mount -a
-
-EOF
+  user_data = base64encode(templatefile("./templates/ec2_user_data_accessgate.sh", {
+    hostname = "accessgate"
+  }))
 
   # AMI ebs mappings from /dev/sd[a-d]
   # root

terraform/environments/ccms-ebs/ccms-ec2-oracle_ebs.tf

@@ -1,4 +1,3 @@
-# Build EC2 
 resource "aws_instance" "ec2_oracle_ebs" {
   instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsdb
   #ami                         = data.aws_ami.oracle_db.id
@@ -14,7 +13,7 @@ resource "aws_instance" "ec2_oracle_ebs" {
   cpu_core_count       = local.application_data.accounts[local.environment].ec2_oracle_instance_cores_ebsdb
   cpu_threads_per_core = local.application_data.accounts[local.environment].ec2_oracle_instance_threads_ebsdb
 
-  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below
+  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
   #lifecycle {
   #  ignore_changes = [ebs_block_device]
   #}
@@ -28,40 +27,10 @@ resource "aws_instance" "ec2_oracle_ebs" {
     ]
   }
   user_data_replace_on_change = false
-  user_data                   = <<EOF
-#!/bin/bash
-
-exec > /tmp/userdata.log 2>&1
-yum update -y
-yum install -y wget unzip automake fuse fuse-devel gcc-c++ git libcurl-devel libxml2-devel make openssl-devel
-
-# AWS CW Agent
-wget https://s3.amazonaws.com/amazoncloudwatch-agent/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm
-rpm -U ./amazon-cloudwatch-agent.rpm
-/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:cloud-watch-config
-
-# AWS SSM Agent
-yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip awscliv2.zip
-./aws/install
-systemctl stop amazon-ssm-agent
-rm -rf /var/lib/amazon/ssm/ipc/
-systemctl start amazon-ssm-agent
-
-# s3Fuse
-git clone https://github.com/s3fs-fuse/s3fs-fuse.git
-cd s3fs-fuse/
-./autogen.sh
-./configure
-make
-make install
-cd /
-mkdir /rman
-s3fs -o iam_role="role_stsassume_oracle_base" -o url="https://s3.eu-west-2.amazonaws.com" -o endpoint=eu-west-2 -o dbglevel=info -o curldbg -o allow_other ccms-ebs-${local.environment}-dbbackup /rman
-echo "ccms-ebs-${local.environment}-dbbackup /rman fuse.s3fs _netdev,allow_other,url=https://s3.eu-west-2.amazonaws.com,iam_role=role_stsassume_oracle_base 0 0" >> /etc/fstab
-
-EOF
+  user_data = base64encode(templatefile("./templates/ec2_user_data_ebs.sh", {
+    environment = "${local.environment}"
+    hostname    = "ebs"
+  }))
 
   metadata_options {
     http_endpoint = "enabled"

terraform/environments/ccms-ebs/ccms-ec2-oracle_ebs_apps.tf

@@ -14,7 +14,7 @@ resource "aws_instance" "ec2_ebsapps" {
   cpu_core_count       = local.application_data.accounts[local.environment].ec2_oracle_instance_cores_ebsapps
   cpu_threads_per_core = local.application_data.accounts[local.environment].ec2_oracle_instance_threads_ebsapps
 
-  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below
+  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
   lifecycle {
     ignore_changes = [
       ebs_block_device,
@@ -23,26 +23,9 @@ resource "aws_instance" "ec2_ebsapps" {
     ]
   }
   user_data_replace_on_change = false
-  user_data                   = <<EOF
-#!/bin/bash
-
-exec > /tmp/userdata.log 2>&1
-yum update -y
-yum install -y wget unzip
-yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip awscliv2.zip
-./aws/install
-wget https://s3.amazonaws.com/amazoncloudwatch-agent/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm
-rpm -U ./amazon-cloudwatch-agent.rpm
-/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:cloud-watch-config
-
-systemctl stop amazon-ssm-agent
-rm -rf /var/lib/amazon/ssm/ipc/
-systemctl start amazon-ssm-agent
-mount -a
-
-EOF
+  user_data = base64encode(templatefile("./templates/ec2_user_data_ebs_apps.sh", {
+    hostname = "ebs-apps"
+  }))
 
   # AMI ebs mappings from /dev/sd[a-d]
   # root

terraform/environments/ccms-ebs/ccms-ec2-oracle_webgate.tf

@@ -14,7 +14,7 @@ resource "aws_instance" "ec2_webgate" {
   cpu_core_count       = local.application_data.accounts[local.environment].ec2_oracle_instance_cores_webgate
   cpu_threads_per_core = local.application_data.accounts[local.environment].ec2_oracle_instance_threads_webgate
 
-  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below
+  # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
   # Also includes ebs_optimized and cpu_core_count due to changing instance family from c5d.2xlarge to m5d.large
   lifecycle {
     ignore_changes = [
@@ -26,26 +26,9 @@ resource "aws_instance" "ec2_webgate" {
     ]
   }
   user_data_replace_on_change = false
-  user_data                   = <<EOF
-#!/bin/bash
-
-exec > /tmp/userdata.log 2>&1
-yum update -y
-yum install -y wget unzip
-yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip awscliv2.zip
-./aws/install
-wget https://s3.amazonaws.com/amazoncloudwatch-agent/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm
-rpm -U ./amazon-cloudwatch-agent.rpm
-/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:cloud-watch-config
-
-systemctl stop amazon-ssm-agent
-rm -rf /var/lib/amazon/ssm/ipc/
-systemctl start amazon-ssm-agent
-mount -a
-
-EOF
+  user_data = base64encode(templatefile("./templates/ec2_user_data_webgate.sh", {
+    hostname = "webgate"
+  }))
 
   # AMI ebs mappings from /dev/sd[a-d]
   # root

terraform/environments/ccms-ebs/templates/ec2_user_data_accessgate.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+exec > /tmp/userdata.log 2>&1
+yum update -y
+yum install -y wget unzip
+yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
+
+curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+unzip awscliv2.zip
+./aws/install
+
+wget https://s3.amazonaws.com/amazoncloudwatch-agent/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm
+rpm -U ./amazon-cloudwatch-agent.rpm
+/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:cloud-watch-config
+
+systemctl stop amazon-ssm-agent
+rm -rf /var/lib/amazon/ssm/ipc/
+systemctl start amazon-ssm-agent
+
+mount -a

terraform/environments/ccms-ebs/templates/ec2_user_data_clamav.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+exec > /tmp/userdata.log 2>&1
+
+yum install -y wget unzip vsftpd jq s3fs-fuse
+
+yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
+curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+unzip awscliv2.zip
+./aws/install
+
+wget https://s3.amazonaws.com/amazoncloudwatch-agent/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm
+rpm -U ./amazon-cloudwatch-agent.rpm
+amazon-linux-extras install -y epel
+
+/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:cloud-watch-config
+
+systemctl stop amazon-ssm-agent
+rm -rf /var/lib/amazon/ssm/ipc/
+systemctl start amazon-ssm-agent
+
+yum install -y clamav clamav-update clamd
+freshclam
+
+systemctl enable [email protected]
+systemctl start [email protected]