Acme's Infrastructure - Terragrunt Reference Architecture
This repository contains rather complete infrastructure configurations where
Terragrunt
is used to manage infrastructure for
Acme Corporation
.
This code is very close to the one produced by
modules.tf
-
open-source
infrastructure as code generator from visual diagrams created with
Cloudcraft.co
.
Acme has several environments (prod, staging and dev) entirely separated by AWS accounts.
Infrastructure in each environment consists of multiple layers (autoscaling, alb, vpc, ...) where each layer is configured using one of
Terraform AWS modules
with arguments specified in
terraform.tfvars
in layer's directory.
Terragrunt
is used to work with Terraform configurations which allows to orchestrate dependent layers, update arguments dynamically and keep configurations
DRY
.
Primary AWS region for all environments is
eu-central-1 (Frankfurt)
:
-
acme-prod
- Production configurations (AWS account - 111111111111)
-
acme-staging
- Staging configurations (AWS account - 444444444444)
-
acme-master
- Master AWS account (333333333333) contains:
- AWS Organizations
- IAM entities (users, groups)
- ECR repositories
- Route53 zones
If you are using Mac you can install all dependencies using Homebrew:
$ brew install terraform terraform-docs terragrunt pre-commit direnv
$ brew install https://raw.githubusercontent.com/antonbabenko/tfvars-annotations/master/HomebrewFormula/tfvars-annotations.rb
AWS accounts and IAM relations
Acme has dedicated AWS account where IAM users, groups and roles are managed. This AWS account is used as a jump account, where IAM users are logged in and then they assume role in other AWS account.
AWS access credentials should be set using environment variables:
$ export AWS_DEFAULT_REGION=eu-central-1
$ export AWS_ACCESS_KEY_ID=...
$ export AWS_SECRET_ACCESS_KEY=...
aws-vault
,
vaulted
or other tool can be used to manage your AWS credentials securely locally and switch roles.
Go to directory for the environment and region you want to work with:
$ cd acme-staging/eu-central-1
Initialize the dependencies (download providers and modules). This command is enough to run once:
To create infrastructure in all layers in a single region:
Alternatively, you can create infrastructure in a single layer (eg,
vpc
):
$ cd vpc
$ terragrunt apply
See
official Terragrunt documentation
for all available commands and features.
This project is created and maintained by
Anton Babenko
.
This work is licensed under MIT License. See LICENSE for full details.
Copyright (c) 2019 Anton Babenko