add auto-drive terraform resources

[DaMandal0rian]

PR Type

Enhancement

---

Description

• Added Terraform configuration for the "auto-drive" stack.

• Defined AWS resources including VPC, EC2 instances, RDS instance and security groups.

• Configured outputs for resource attributes like instance IDs and IPs.

• Introduced variables for customizable resource parameters.

---

Changes walkthrough 📝

	Relevant files
Configuration changes	backend.tf Add Terraform cloud backend configuration                                auto-drive/backend.tf Configured Terraform cloud backend for organization "subspace-sre". Defined workspace name as "auto-drive-aws". +9/-0      variables.tf Define variables for resource customization                            auto-drive/variables.tf Defined variables for AWS region, VPC CIDR, and tags. Added variables for instance types, counts, and volume sizes. Included variables for ingress rules and KMS key. +102/-0  versions.tf Specify Terraform and provider version requirements            auto-drive/versions.tf Specified required Terraform version (>= 1.0). Defined required AWS provider version (>= 4.66). +10/-0
Enhancement	main.tf Define AWS resources and modules for auto-drive                    auto-drive/main.tf Defined AWS provider and availability zones. Added modules for VPC, EC2 instances, and security groups. Configured Elastic IPs for instances. Included data source for Ubuntu AMI. +204/-0  outputs.tf Add outputs for resource attributes                                            auto-drive/outputs.tf Added outputs for auto-drive and gateway instances. Included outputs for instance IDs, ARNs, states, and IPs. Configured outputs for Elastic IPs. +77/-0

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 Security concerns Security Group Configuration: Allowing unrestricted ingress (0.0.0.0/0) for SSH, HTTP, and HTTPS could expose the infrastructure to unauthorized access. This should be restricted to trusted IP ranges or specific CIDR blocks.

⚡ Recommended focus areas for review Security Group Configuration The security group allows unrestricted ingress (0.0.0.0/0) for SSH (port 22), HTTP (port 80), and HTTPS (port 443). This could pose a security risk and should be reviewed to ensure it aligns with security best practices. resource "aws_security_group" "auto_drive_sg" { name = "auto_drive_sg" description = "auto drive security group" vpc_id = var.vpc_cidr # Ingress Rules ingress { from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] description = "Allow SSH" } ingress { from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] description = "Allow HTTP" } ingress { from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] description = "Allow HTTPS" } # Egress Rules egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] description = "Allow all outbound traffic" } tags = { Name = "auto-drive-sg" } } Hardcoded Subnet CIDRs The private and public subnets in the VPC module are hardcoded. Consider making these configurable to allow flexibility for different environments. module "vpc" { source = "../templates/terraform/aws/vpc" name = "${local.name}-vpc" cidr = var.vpc_cidr azs = local.azs private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enable_nat_gateway = true single_nat_gateway = true tags = local.tags } Default Open Ingress CIDR The ingress_cidr_blocks variable defaults to "0.0.0.0/0", which allows unrestricted access. This should be reviewed to ensure it is appropriate for the intended use case. variable "ingress_cidr_blocks" { description = "List of CIDR blocks for ingress" type = list(string) default = ["0.0.0.0/0"] # Open to all; adjust as needed

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Possible issue	Correct VPC ID reference in security group Validate that the vpc_id in the aws_security_group resource references the correct VPC ID, as var.vpc_cidr is not a valid VPC identifier. auto-drive/main.tf [46-50] resource "aws_security_group" "auto_drive_sg" { name = "auto_drive_sg" description = "auto drive security group" - vpc_id = var.vpc_cidr + vpc_id = module.vpc.vpc_id } Suggestion importance[1-10]: 10 Why: The current code incorrectly uses var.vpc_cidr as the VPC ID, which is invalid. Correcting this to reference module.vpc.vpc_id ensures the security group is associated with the correct VPC, preventing potential runtime errors.	10
Security	Restrict SSH access to specific IPs Restrict the SSH ingress rule in the aws_security_group resource to a specific IP range instead of allowing access from 0.0.0.0/0 to enhance security. auto-drive/main.tf [53-59] ingress { from_port = 22 to_port = 22 protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] + cidr_blocks = ["192.168.1.0/24"] # Replace with a specific IP range description = "Allow SSH" } Suggestion importance[1-10]: 9 Why: Restricting SSH access to a specific IP range significantly enhances security by reducing the attack surface. This is a critical improvement for securing the infrastructure.	9
General	Make ingress CIDR blocks configurable Use the var.ingress_cidr_blocks variable for the ingress cidr_blocks in the aws_security_group resource to allow configurable and dynamic IP ranges. auto-drive/main.tf [53-59] ingress { from_port = 22 to_port = 22 protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] + cidr_blocks = var.ingress_cidr_blocks description = "Allow SSH" } Suggestion importance[1-10]: 8 Why: Using a variable for ingress CIDR blocks improves configurability and flexibility, allowing dynamic adjustments without modifying the code. This is a valuable enhancement for maintainability and usability.	8
	Ensure AMIs are not deprecated Add a condition to ensure that the data.aws_ami.ubuntu_amd64 resource filters for AMIs that are not deprecated to avoid using outdated images. auto-drive/main.tf [94-114] data "aws_ami" "ubuntu_amd64" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } filter { name = "architecture" values = ["x86_64"] } + filter { + name = "state" + values = ["available"] + } owners = ["099720109477"] } Suggestion importance[1-10]: 7 Why: Adding a filter to exclude deprecated AMIs ensures that the infrastructure uses up-to-date and supported images. While not critical, this is a good practice to maintain reliability and security.	7

[DaMandal0rian]

closes #395