Infrastructure as Code with Terraform & AWS

Key Takeaways

infrastructure as code is an awesome way to help automatically provision deploy and manage whether it's just a couple virtual machines or an entire network environment in a declarative way typically you see this best done with terraform and I'll admit hey I don't think I even have any videos on terraform other than hacking it breaking it doing some stuff in some strange misconfigurations but honestly we use terraform I use terraform to help put together the entire ncon Capture the Flag competition or any ctfs that I host we build this all out as infrastructure as code so it's written down it's established and super easy to streamline and automate and maybe one of the coolest things about terraform is just how easily it is extensible like if you wanted to you could get or add create Even build your own right terraform providers for anything else anything that you might be able to hook up some apis to and have it do what you would like normally you see this in the case of the big three Cloud hosting providers things like Google Cloud platform whether it's Microsoft Azure or AWS Amazon web services servers service a AWS so what I would like to do in this video is show you just how easy it is hey slapping together some syntax putting together some code to automate deploying some AWS resources aside from the initial setup hey getting key and configuration put in place you really never have to go into the AWS user interface anymore so so I'm inside of a Linux virtual machine I am just running Cali Linux as usual but say I want to download terraform now this brings me into the documentation but ultimately it says oh you know what if you want to go download and install terraform you can do this super duper easy we have this Mac OS package manager syntax if we'd like binaries for Windows if we'd like but I am over on Linux you could copy and paste these commands to just add it into I believe your yeah repository package manager setup or we could just grab the biner if we wanted to download the real thing I'm good with getting that amd64 version now over on Cali Linux let me hit Control Alt T to open up a terminal I'll hit F1 to full screen that and I'm going to change directory actually just into my opt folder I like to work in here for just other tools that I might add hey things that I just want to put into that operating system so let me go grab from my downloads the terraform doz file that we just downloaded I can bring that into the current directory with the period and simply unzip that with terraform now this is pretty easy it just gives us this file for terraform and if I were to run the file command on that just to get an idea it's the binary itself that's all it is it's just an executable binary I could make sure it is executable I believe it might already be with that whoops let me make sure I do that on actual terraform not the zip file we minus X that one and I could just simply run that terraform binary do slash for my current directory and take a look here's all the help all the things we can do SUB commands we can work with ultimately we'll need to do some simple ones in it validate plan apply and Destroy we can keep invoking terraform just like this out of the current directory with the dot slash and a relative path if we'd like to but it might be more worthwhile to add this into your current whole system path that environment variable we could go ahead and Export that say look search for binaries in these given locations separated by a colon I'll use the dollar sign there to retain the original value of that variable and then add in our directory you could put this in your bash RC file or your zshrc file whatever you'd like but look let me make sure to actually do that now even in that directory I should be able to Simply run terraform and you will see all that help output one more time now I don't need to dot slash it I can run it anywhere on my file system now with that all set up back over in the documentation we should be able to see scrolling down hey all the other things it can run on and then a couple next steps there are tons of resources tons of tutorials and documentation out on terraform but look super duper easy we could go ahead and spin up some infrastructure as code in AWS we've already installed terraform so we don't need to worry about some of those but if we wanted to build infrastructure hey we could even watch a video if anyone is interested seriously recommend you go take a look at these and if I were to try and speed run us here look first thing we'd want to do is probably spit together an ec2 instance or like a cloud virtual machine within AWS from the guy you'd normally just navigate over to that easy to to instance hey go ahead and say I want to launch a new box you could work with all the things here but honestly we don't need to do that we'll have terraform do it for us but first we need to give it some keys some configuration so that it's able to connect to our AWS account one of the easiest ways to set up that connection and communication is with the AWS CLI or the command line interface if you don't have that installed on Linux it is pretty easy you can just pip install AWS CLI that should put it all together there for you and I could go ahead and run AWS just as the command line interface to get us cruising first thing you really want to do is AWS configure that would ask for your AWS access key maybe none as a placeholder if you didn't already have that configured your secret key default region name and then whatever output format you might prefer Json works just fine so we could cruise through that entering things as they're needed in this case I do already have those configured but if you want if you haven't set that up before you can find those and create some security credentials for yourself clicking on the top right for your name and the security credentials page another option is hey putting that together in an AM Ro a little bit more Access Control better than just a giant root you know root user key so now that we have terraform installed we have AWS CLI set up and some of the connections configured we could really just let terraform work off of that and go ahead and create our infrastructure as code so what we'll need to do is open up a text editor like Sublime Text that I like to use and we could call something a main file. TF that file extension for terraform if you are using Sublime teex you can go ahead and install a package for terraform in case that's worthwhile for you for terraform format the fmt sub command you could run or even just simple syntax highlighting worth getting that spun up now first things first is we'll need to specify the provider that we want to use remember this could be using and hey hooking up terraform to the Google Cloud platform or Azure or anything else really but we're using it for AWS so we'll provide the syntax provide lier and AWS is what we'll include in strings here now terraform is really big on this block structure where we're using these curly braces to Define hey some of the parameters some of the variables and things that you'll actually configure and set for any of these blocks in this case you might include some of the credentials like access variables you could use to work with that provider but because AWS CLI is handling that for us all we really need to provide here is the region that we want to work in in my case I'm going to be working in US West two then in terraform we'll go ahead and create all the different resources now you might have a ton of these in fact you can spread them out across multiple different TF files but let's specify that syntax resource and then the kind of resource that we want to create since we pulled in this AWS provider we could actually work with an AWS unor instance then we'll set up the name that we might like this can be like an example or our VM whatever and again we'll Define another block structure and what we need to Define here inside of that resource block is pretty easy for an AWS instance first of all we need to say the instance type like what kind of size hey how big how many resources and what sort of classification of resources are we setting up this box to be using so in this case I'll just keep it simple t2. micro is usually I think a pretty tiny safe size and then we'll also need to specify the Ami or the Amazon machine image like the kind of ISO and maybe a whole another world we can compare that to paralleling it to look what operating system do you want what image what genuine like base setup structure operating system do you want for this ec2 instance now we'll need to supply the actual ID for that Ami so we need to go track it down we could find them online especially using AWS as sort of our map and Compass here but that is something that we need to go choose if I were to get back to AWS again navigating the guey for a little bit just to kind of get our ings for us if we wanted to go hey check out the ac2 section scrolling over to the images we do have Amis either we've set up configured for ourself or the whole Ami catalog if we want to go track down and find some that are available for us we could filter on things like oh do we only want windows or do we only want Linux uh is it free is it something that actually is behind whatever I don't know money price tag coin in the mix but look let's go choose a 64-bit AWS Ami image and I'm fine with just using Ubuntu here like if I click this button to select I know my face is in the way but that'll bring it up to the top here and now we'll be able to see hey the selected Ami has this actual ID value so we'll include this for terraform get back over to Sublime Tex we'll just slap that in now we can move that just a little bit so for one thing you see the full syntax and because I want to add some other tags now this is an interesting one that should be a block set sort of again using these curly braces but now we'll be able to Define more of these sort of like variables or properties all encapsulated in the logic group there so the tags in this case well I'll just say the name that I want for that ec2 instance that AWS entity that I've created we can just call that like example and let me say this isn't a secret by any means again if you're willing to go take a look online at the documentation you could see this exact same setup this exact same structure all the same syntax and a little bit of a better explanation as to the different logic con Concepts here like a block like a provider like resources again I'd like I hope this video can be a springboard for you but seriously a th% go take a look at the documentation now I know this is a super tiny barebones and basic example but with this we're pretty much done now we just let terraform do it spit it up and create all the things there's not a lot that's going to spin up in this case but we do need to terraform in it or initialize things so it'll go grab that provider in this case AWS should all be set up and pretty easy to Stage terraform will always give you this nice and pretty hey green output looking like things are good I appreciate the use of good color in that now we could really plan and at least get a baseline idea as to what terraform will create for us since this is working with like real infrastructure it's probably pretty good to get that idea ahead of time like hey plan review actually validate that everything you're either building or destroying in some cases is actually what you want it to be so with that we'll just terraform plan it takes a little bit but that will then showcase all the things that terraform will do for us take a look this includes all of the data everything set here and hey stuff that will be figured out after it's all built like the IP address that's created like oh any other specific information about the virtual machine but ultimately our VM that instance will be created thanks to terraform now to tell terraform to just shut up and do it actually build all the stuff that we've set up structured declared and defined with our infrastructure as code is simply one command here terraform apply and this will present us with all the same output that terraform plan did but now actually validate look do you want to do this are you sure you want to perform these actions in this case we'll enter yes and then we'll start to spin stuff up it'll create our VM that AWS instance the resource that we set and structured in that main.tf terraform file this is pretty cool actually in fact if we were to open up another terminal let me show you some of the stuff that it did here because terraform DTF State we never created that file terraform it in fact that's how it was planning everything it would be willing to do in our case let me do a terraform show and because we'd already planned things out it'll be able to hey pull up and see everything that it intended on doing now in this case it created it created those resources and it shows us everything that might have came to life there everything including the private IP address the subnet that it chose anything specific to like a public IP address all the details that came from spinning up our virtual machine automatically with terraform now I could hop back over to AWS if I did want to go see the ec2 dashboard am I in the right uh I might need to refresh let me hit F5 there we go instance is running we do have one up and available for us and that is our example they've got a public IP address a private IP address and everything is set if we wanted to we could try to connect to it but we didn't really stage anything with Port 22 or SSH or the ec2 instance connect thing so if I were to even try to let me see if I can connect to that I don't know if it'll come to life for us but this is usually a fine conversation to have because you don't really want to have I don't know RDP especially in the windows World public and exposed to the open internet a lot of the access of services that you might need if you're building this out for your own home life lab environment or for a company for an environment for a business for some real Network infrastructure it's ideal for that stuff to be behind a little bit of gates and walls right in the Linux World SSH or the secure shell is an option right hey if you set that up with the public and private key pairing then you're at least somewhat secure but you've still got that open and exposed to the whole open internet and since we've been working with terraform and like I mentioned at the start terraform is easily extensible you could hook up to any other kinds of providers there is an awesome provider and hey solution out there called twin gate and that helps you roll out access controls like oh what can actually connect and access what you can Define that across multiple environments and multicloud deployments let me tell you a little bit about twin gate and then let me show you just how easily it is to create an ec2 or AWS instance like this keep it private accessible to you and not public to the whole wide world twin gate it's time to ditch your VPN you can protect corporate resour sources Cloud environments on-prem services and more with fine grain access controls based on user device and location with twin gate they make it easy to implement least privileged principles and require multiactor authentication alongside other security policies even to apps and services that don't naturally support them with Dynamic policies like ephemeral and usage based access you can automate a best-in-class security ecosystem twin gate offers extensive logging and analytics insights to provide visibility into network activity across the Enterprise System administrators can monitor for suspicious events trim access to network resources when no longer needed and get the insights needed for compliance audits it is seamless to get twin gate up and running with out of the box Integrations with idps MDM EDR seam Solutions and more you can even automate deployment with terraform palumi or admin API twin gate offers a 2-e free trial of their business plan and a completely free plan with up to five users for anyone looking to use twin gate on their own home network you can get started with twin gate using my link below in the video description jh. live twin gate huge thanks to Twin gate for sponsoring this video all right I got to be honest I think it's genuinely cool to be able to use infrastructure as code with this setup like to really have a secure network and environment that you can control and manage super duper easily and spin it all up deployed and provisioned automatically with terraform and sprinkling in a little bit of twin gate twin gate has their documentation where you could spin this up with gcp AWS and Azure and just as we had done with AWS look it gives you everything that you need to create the connector a remote Network and the virtual machines I had gone ahead and created some SSH Keys just so I'd have easy capability to access access the virtual machines that we create I set up the terraform providers in this case again keeping it easy really just need to have twin gate now included alongside AWS we set up a new token inside of twin gate and that way it knows to communicate and work with this infrastructure and finally we could start to set up the real main.tf terraform file and this is completely for free bear in mind like up to five users you can go ahead and kick the tires spin This Together hey just use terraform and twin gate to automatically spin up create provision and deploy This Cloud instance that can have whatever least privilege the access controls that you get to Define only accessible to you and your team I think that's pretty cool you get to see everything that terraform did and then of course you can play with it customize it make it whatever you want but now everything being created Access Control set up here I could go ahead and just SSH into that host but not exposed to the open internet and I can get into it do what I need to do best part is infrastructure is code all I need to do to tear it down if I wanted to make something quick and easy I can just terraform destroy and it will bring the house down enter a value yes I'm ready to take it all offline and that's all it takes hey thank you so much for watching I know we really just like scratch the surface this is like the tip of the iceberg for terraform but I hope you go play with it I hope you give it a try and please do give some love to our sponsor twin gate Link in the video description they have some really cool stuff and I love being able to pour in some infrastructure code along with it thanks so much for watching do all those YouTube algorithm things like comment subscribe and I'll see you in the next video