Terraform modules for provisioning cloud instances

# Discover default VPC
module "default_vpc" {
  source = "../../modules/aws/default-vpc"
}

# Create IAM role for EC2 instances
aws iam create-role --role-name EC2-S3-Access-Role --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "ec2.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }
  ]
}'

# Attach S3 access policy (adjust permissions as needed)
aws iam attach-role-policy --role-name EC2-S3-Access-Role \
    --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# Create instance profile
aws iam create-instance-profile --instance-profile-name EC2-S3-Access-Profile

# Associate role with instance profile
aws iam add-role-to-instance-profile \
    --instance-profile-name EC2-S3-Access-Profile \
    --role-name EC2-S3-Access-Role

module "web_server" {
  source = "../../modules/aws/instance"
  
  ami           = "ami-0c94855ba95b798c7"  # Ubuntu 22.04 LTS
  instance_type = "t3.micro"
  key_name      = "my-key-pair"
  subnet_id     = "subnet-12345678"
  
  vpc_security_group_ids = ["sg-87654321"]
  
  # IAM instance profile for AWS service access (optional)
  iam_instance_profile = "EC2-S3-Access-Profile"
  
  tags = {
    Name        = "web-server-01"
    Environment = "Production"
    Purpose     = "WebServer"
  }
}

module "public_instance" {
  source = "../../modules/aws/instance"
  
  ami                         = "ami-0c94855ba95b798c7"
  instance_type              = "t3.small"
  key_name                   = "my-keypair"
  subnet_id                  = module.default_vpc.subnet_id
  vpc_security_group_ids     = [module.security_group.id]
  associate_public_ip_address = true
  source_dest_check          = false  # For NAT instances
  
  # IAM instance profile for S3 access
  iam_instance_profile = "EC2-S3-Access-Profile"
  
  tags = {
    Name        = "public-instance"
    Environment = "Development"
    Owner       = "team@company.com"
    Purpose     = "Development Server"
  }
}

{
  from_port   = number
  to_port     = number
  protocol    = string
  cidr_blocks = list(string)
  description = string
}

module "web_security_group" {
  source = "../../modules/aws/security_group"
  
  name   = "web-server-sg"
  vpc_id = "vpc-12345678"
  
  ingress_rules = [
    {
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/8"]
      description = "SSH from internal networks"
    },
    {
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTP from anywhere"
    },
    {
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTPS from anywhere"
    }
  ]
  
  egress_rules = [
    {
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
      description = "All outbound traffic"
    }
  ]
  
  tags = {
    Name        = "web-server-sg"
    Environment = "Production"
    Purpose     = "WebServer"
  }
}

module "database_security_group" {
  source = "../../modules/aws/security_group"
  
  name   = "database-sg"
  vpc_id = "vpc-12345678"
  
  ingress_rules = [
    {
      from_port   = 3306
      to_port     = 3306
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/16"]
      description = "MySQL from application tier"
    },
    {
      from_port   = 5432
      to_port     = 5432
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/16"]
      description = "PostgreSQL from application tier"
    }
  ]
  
  egress_rules = [
    {
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTPS for updates"
    }
  ]
}

# Create the service account
gcloud iam service-accounts create instance-sa \
    --display-name="Instance Service Account" \
    --project=your-project-id

# Assign required storage roles
gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:instance-sa@your-project-id.iam.gserviceaccount.com" \
    --role="roles/storage.objectViewer"

gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:instance-sa@your-project-id.iam.gserviceaccount.com" \
    --role="roles/storage.bucketViewer"

module "web_server" {
  source = "../../modules/gcp/instance"
  
  gcp_project_id      = "my-project-123"
  gcp_zone           = "us-central1-a"
  vm_name            = "web-server-01"
  vm_type            = "e2-medium"
  vm_image_family    = "ubuntu-minimal-2204-lts"
  vm_image_project   = "ubuntu-os-cloud"
  
  network_name       = "default"
  subnetwork_name    = "default"
  
  ssh_user           = "ubuntu"
  ssh_public_key_path = "./id_rsa.pub"
  
  # Service Account Configuration (Required)
  gcp_service_account_email = "web-server-sa@my-project-123.iam.gserviceaccount.com"
  gcp_service_account_scopes = ["cloud-platform"]
  
  vm_labels = {
    environment = "production"
    purpose     = "webserver"
    team        = "engineering"
  }
}

module "app_server" {
  source = "../../modules/gcp/instance"
  
  gcp_project_id      = var.gcp_project_id
  gcp_zone           = "us-central1-b"
  vm_name            = "app-server-01"
  vm_type            = "n2-standard-2"
  vm_image_family    = "ubuntu-2204-lts"
  vm_image_project   = "ubuntu-os-cloud"
  vm_disk_size       = 50
  vm_disk_type       = "pd-ssd"
  vm_status          = "RUNNING"
  
  network_name       = "my-custom-network"
  subnetwork_name    = "my-custom-subnet"
  
  ssh_user           = "appuser"
  ssh_public_key_path = var.ssh_public_key_path
  
  # Service Account Configuration (Required)
  gcp_service_account_email = var.gcp_service_account_email
  gcp_service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
  
  vm_labels = {
    environment     = "staging"
    purpose         = "application"
    team           = "development"
    cost_center    = "engineering"
  }
}

module "web_firewall" {
  source = "../../modules/gcp/firewall"
  
  name     = "allow-web-traffic"
  network  = "default"
  protocol = "tcp"
  ports    = ["80", "443"]
  
  source_ranges = ["0.0.0.0/0"]
  direction     = "INGRESS"
}

module "ssh_firewall" {
  source = "../../modules/gcp/firewall"
  
  name     = "allow-ssh"
  network  = "default"
  protocol = "tcp"
  ports    = ["22"]
  
  source_ranges = ["10.0.0.0/8"]
  target_tags   = ["ssh-server"]
  direction     = "INGRESS"
}

module "app_firewall" {
  source = "../../modules/gcp/firewall"
  
  name     = "allow-geneos-gateway"
  network  = "my-custom-network"
  protocol = "tcp"
  ports    = ["7000-7100"]
  
  source_ranges = ["192.168.1.0/24"]
  target_tags   = ["geneos-gateway"]
  direction     = "INGRESS"
}