public MyStack()
{
var testRole = new Aws.Iam.Role("testRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @" {
""Version"": ""2012-10-17"",
""Statement"": {
""Effect"": ""Allow"",
""Principal"": {""Service"": ""ssm.amazonaws.com""},
""Action"": ""sts:AssumeRole""
}
}
",
});
var testAttach = new Aws.Iam.RolePolicyAttachment("testAttach", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
Role = testRole.Name,
});
var foo = new Aws.Ssm.Activation("foo", new Aws.Ssm.ActivationArgs
{
Description = "Test",
IamRole = testRole.Id,
RegistrationLimit = 5,
}, new CustomResourceOptions
{
DependsOn =
{
"aws_iam_role_policy_attachment.test_attach",
},
});
}
public MyStack()
{
var example = new Aws.Iam.Role("example", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""eks.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}
]
}
",
});
var example_AmazonEKSClusterPolicy = new Aws.Iam.RolePolicyAttachment("example-AmazonEKSClusterPolicy", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
Role = example.Name,
});
var example_AmazonEKSServicePolicy = new Aws.Iam.RolePolicyAttachment("example-AmazonEKSServicePolicy", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
Role = example.Name,
});
}
public MyStack()
{
var exampleRole = new Aws.Iam.Role("exampleRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Action"": [""sts:AssumeRole""],
""Effect"": ""allow"",
""Principal"": {
""Service"": [""backup.amazonaws.com""]
}
}
]
}
",
});
var exampleRolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("exampleRolePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
Role = exampleRole.Name,
});
var exampleSelection = new Aws.Backup.Selection("exampleSelection", new Aws.Backup.SelectionArgs
{
IamRoleArn = exampleRole.Arn,
});
}
public MyStack()
{
var exampleRole = new Aws.Iam.Role("exampleRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""appsync.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}
]
}
",
});
var exampleRolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("exampleRolePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
Role = exampleRole.Name,
});
var exampleGraphQLApi = new Aws.AppSync.GraphQLApi("exampleGraphQLApi", new Aws.AppSync.GraphQLApiArgs
{
LogConfig = new Aws.AppSync.Inputs.GraphQLApiLogConfigArgs
{
CloudwatchLogsRoleArn = exampleRole.Arn,
FieldLogLevel = "ERROR",
},
});
}
public MyStack()
{
var example = new Aws.Iam.Role("example", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary <string, object?>
{
{ "Statement", new[]
{
new Dictionary <string, object?>
{
{ "Action", "sts:AssumeRole" },
{ "Effect", "Allow" },
{ "Principal", new Dictionary <string, object?>
{
{ "Service", "eks-fargate-pods.amazonaws.com" },
} },
},
} },
{ "Version", "2012-10-17" },
}),
});
var example_AmazonEKSFargatePodExecutionRolePolicy = new Aws.Iam.RolePolicyAttachment("example-AmazonEKSFargatePodExecutionRolePolicy", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy",
Role = example.Name,
});
}
private iam.Role createRedshiftRole()
{
var redShiftRole = new iam.Role("dend-redshift-role", new iam.RoleArgs
{
Description = "Role Created for Udacity's DEND",
Path = "/service-role/redshift.amazonaws.com/dend/",
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": [
""redshift.amazonaws.com""
]
},
""Action"": ""sts:AssumeRole""
}
]
}",
}, this.CustomResourceOptions);
var redShiftRolePolicyAttachment = new iam.RolePolicyAttachment("redshift-s3-readonly-attachment", new iam.RolePolicyAttachmentArgs
{
Role = redShiftRole.Name,
PolicyArn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
}, this.CustomResourceOptions);
return(redShiftRole);
}
public MyStack()
{
var exampleRole = new Aws.Iam.Role("exampleRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""codedeploy.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}
]
}
",
});
var aWSCodeDeployRole = new Aws.Iam.RolePolicyAttachment("aWSCodeDeployRole", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole",
Role = exampleRole.Name,
});
var exampleApplication = new Aws.CodeDeploy.Application("exampleApplication", new Aws.CodeDeploy.ApplicationArgs
{
});
var exampleTopic = new Aws.Sns.Topic("exampleTopic", new Aws.Sns.TopicArgs
{
});
var exampleDeploymentGroup = new Aws.CodeDeploy.DeploymentGroup("exampleDeploymentGroup", new Aws.CodeDeploy.DeploymentGroupArgs
{
AlarmConfiguration = new Aws.CodeDeploy.Inputs.DeploymentGroupAlarmConfigurationArgs
{
Alarms =
{
"my-alarm-name",
},
Enabled = true,
},
AppName = exampleApplication.Name,
AutoRollbackConfiguration = new Aws.CodeDeploy.Inputs.DeploymentGroupAutoRollbackConfigurationArgs
{
Enabled = true,
Events =
{
"DEPLOYMENT_FAILURE",
},
},
DeploymentGroupName = "example-group",
Ec2TagSets =
{
new Aws.CodeDeploy.Inputs.DeploymentGroupEc2TagSetArgs
{
Ec2TagFilter =
{
{
{ "key", "filterkey1" },
public MyStack()
{
var fooRecorderStatus = new Aws.Cfg.RecorderStatus("fooRecorderStatus", new Aws.Cfg.RecorderStatusArgs
{
IsEnabled = true,
}, new CustomResourceOptions
{
DependsOn =
{
"aws_config_delivery_channel.foo",
},
});
var role = new Aws.Iam.Role("role", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Action"": ""sts:AssumeRole"",
""Principal"": {
""Service"": ""config.amazonaws.com""
},
""Effect"": ""Allow"",
""Sid"": """"
}
]
}
",
});
var rolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("rolePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
Role = role.Name,
});
var bucket = new Aws.S3.Bucket("bucket", new Aws.S3.BucketArgs
{
});
var fooDeliveryChannel = new Aws.Cfg.DeliveryChannel("fooDeliveryChannel", new Aws.Cfg.DeliveryChannelArgs
{
S3BucketName = bucket.BucketName,
});
var fooRecorder = new Aws.Cfg.Recorder("fooRecorder", new Aws.Cfg.RecorderArgs
{
RoleArn = role.Arn,
});
var rolePolicy = new Aws.Iam.RolePolicy("rolePolicy", new Aws.Iam.RolePolicyArgs
{
Policy = Output.Tuple(bucket.Arn, bucket.Arn).Apply(values =>
{
var bucketArn = values.Item1;
var bucketArn1 = values.Item2;
return(@$ "{{
" "Version" ": " "2012-10-17" ",
" "Statement" ": [
public MyStack()
{
var testLambda = new Aws.Lambda.Function("testLambda", new Aws.Lambda.FunctionArgs
{
}, new CustomResourceOptions
{
DependsOn =
{
"aws_cloudwatch_log_group.example",
"aws_iam_role_policy_attachment.lambda_logs",
},
});
// This is to optionally manage the CloudWatch Log Group for the Lambda Function.
// If skipping this resource configuration, also add "logs:CreateLogGroup" to the IAM policy below.
var example = new Aws.CloudWatch.LogGroup("example", new Aws.CloudWatch.LogGroupArgs
{
RetentionInDays = 14,
});
// See also the following AWS managed policy: AWSLambdaBasicExecutionRole
var lambdaLogging = new Aws.Iam.Policy("lambdaLogging", new Aws.Iam.PolicyArgs
{
Description = "IAM policy for logging from a lambda",
Path = "/",
Policy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Action"": [
""logs:CreateLogGroup"",
""logs:CreateLogStream"",
""logs:PutLogEvents""
],
""Resource"": ""arn:aws:logs:*:*:*"",
""Effect"": ""Allow""
}
]
}
",
});
var lambdaLogs = new Aws.Iam.RolePolicyAttachment("lambdaLogs", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = lambdaLogging.Arn,
Role = aws_iam_role.Iam_for_lambda.Name,
});
}
public MyStack()
{
var role = new Aws.Iam.Role("role", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @" {
""Version"": ""2012-10-17"",
""Statement"": [
{
""Action"": ""sts:AssumeRole"",
""Principal"": {
""Service"": ""ec2.amazonaws.com""
},
""Effect"": ""Allow"",
""Sid"": """"
}
]
}
",
});
var policy = new Aws.Iam.Policy("policy", new Aws.Iam.PolicyArgs
{
Description = "A test policy",
Policy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Action"": [
""ec2:Describe*""
],
""Effect"": ""Allow"",
""Resource"": ""*""
}
]
}
",
});
var test_attach = new Aws.Iam.RolePolicyAttachment("test-attach", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = policy.Arn,
Role = role.Name,
});
}
public MyStack()
{
var organizationRole = new Aws.Iam.Role("organizationRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""config.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}
]
}
",
});
var organizationConfigurationAggregator = new Aws.Cfg.ConfigurationAggregator("organizationConfigurationAggregator", new Aws.Cfg.ConfigurationAggregatorArgs
{
OrganizationAggregationSource = new Aws.Cfg.Inputs.ConfigurationAggregatorOrganizationAggregationSourceArgs
{
AllRegions = true,
RoleArn = organizationRole.Arn,
},
}, new CustomResourceOptions
{
DependsOn =
{
"aws_iam_role_policy_attachment.organization",
},
});
var organizationRolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("organizationRolePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AWSConfigRoleForOrganizations",
Role = organizationRole.Name,
});
}
public MyStack()
{
var example = new Aws.Iam.Role("example", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary <string, object?>
{
{ "Statement", new[]
{
new Dictionary <string, object?>
{
{ "Action", "sts:AssumeRole" },
{ "Effect", "Allow" },
{ "Principal", new Dictionary <string, object?>
{
{ "Service", "ec2.amazonaws.com" },
} },
},
} },
{ "Version", "2012-10-17" },
}),
});
var example_AmazonEKSWorkerNodePolicy = new Aws.Iam.RolePolicyAttachment("example-AmazonEKSWorkerNodePolicy", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
Role = example.Name,
});
var example_AmazonEKSCNIPolicy = new Aws.Iam.RolePolicyAttachment("example-AmazonEKSCNIPolicy", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
Role = example.Name,
});
var example_AmazonEC2ContainerRegistryReadOnly = new Aws.Iam.RolePolicyAttachment("example-AmazonEC2ContainerRegistryReadOnly", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
Role = example.Name,
});
}
public MyStack()
{
var ecsInstanceRoleRole = new Aws.Iam.Role("ecsInstanceRoleRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Action"": ""sts:AssumeRole"",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""ec2.amazonaws.com""
}
}
]
}
",
});
var ecsInstanceRoleRolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("ecsInstanceRoleRolePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
Role = ecsInstanceRoleRole.Name,
});
var ecsInstanceRoleInstanceProfile = new Aws.Iam.InstanceProfile("ecsInstanceRoleInstanceProfile", new Aws.Iam.InstanceProfileArgs
{
Role = ecsInstanceRoleRole.Name,
});
var awsBatchServiceRoleRole = new Aws.Iam.Role("awsBatchServiceRoleRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2012-10-17"",
""Statement"": [
{
""Action"": ""sts:AssumeRole"",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""batch.amazonaws.com""
}
}
]
}
",
});
var awsBatchServiceRoleRolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("awsBatchServiceRoleRolePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole",
Role = awsBatchServiceRoleRole.Name,
});
var sampleSecurityGroup = new Aws.Ec2.SecurityGroup("sampleSecurityGroup", new Aws.Ec2.SecurityGroupArgs
{
Egress =
{
new Aws.Ec2.Inputs.SecurityGroupEgressArgs
{
CidrBlocks =
{
"0.0.0.0/0",
},
FromPort = 0,
Protocol = "-1",
ToPort = 0,
},
},
});
var sampleVpc = new Aws.Ec2.Vpc("sampleVpc", new Aws.Ec2.VpcArgs
{
CidrBlock = "10.1.0.0/16",
});
var sampleSubnet = new Aws.Ec2.Subnet("sampleSubnet", new Aws.Ec2.SubnetArgs
{
CidrBlock = "10.1.1.0/24",
VpcId = sampleVpc.Id,
});
var sampleComputeEnvironment = new Aws.Batch.ComputeEnvironment("sampleComputeEnvironment", new Aws.Batch.ComputeEnvironmentArgs
{
ComputeEnvironmentName = "sample",
ComputeResources = new Aws.Batch.Inputs.ComputeEnvironmentComputeResourcesArgs
{
InstanceRole = ecsInstanceRoleInstanceProfile.Arn,
InstanceType =
{
"c4.large",
},
MaxVcpus = 16,
MinVcpus = 0,
SecurityGroupIds =
{
sampleSecurityGroup.Id,
},
Subnets =
{
sampleSubnet.Id,
},
Type = "EC2",
},
ServiceRole = awsBatchServiceRoleRole.Arn,
Type = "MANAGED",
}, new CustomResourceOptions
{
DependsOn =
{
"aws_iam_role_policy_attachment.aws_batch_service_role",
},
});
}
public MyStack()
{
// Read back the default VPC and public subnets, which we will use.
var vpc = Output.Create(Ec2.GetVpc.InvokeAsync(new Ec2.GetVpcArgs {
Default = true
}));
var vpcId = vpc.Apply(vpc => vpc.Id);
var subnet = vpcId.Apply(id => Ec2.GetSubnetIds.InvokeAsync(new Ec2.GetSubnetIdsArgs {
VpcId = id
}));
var subnetIds = subnet.Apply(s => s.Ids);
// Create an IAM role that can be used by our service's task.
var eksRole = new Iam.Role("eks-iam-eksRole", new Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2008-10-17"",
""Statement"": [{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""eks.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}]
}"
});
var eksPolicies = new Dictionary <string, string>
{
{ "service-policy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy" },
{ "cluster-policy", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" }
};
foreach (var(name, policy) in eksPolicies)
{
var taskExecAttach = new Iam.RolePolicyAttachment($"rpa-{name}",
new Iam.RolePolicyAttachmentArgs
{
Role = eksRole.Name,
PolicyArn = policy,
});
}
// Create an IAM role that can be used by our service's task.
var nodeGroupRole = new Iam.Role("nodegroup-iam-role", new Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2008-10-17"",
""Statement"": [{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""ec2.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}]
}"
});
var nodeGroupPolicies = new Dictionary <string, string>
{
{ "worker", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy" },
{ "cni", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy" },
{ "registry", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" }
};
foreach (var(name, policy) in nodeGroupPolicies)
{
var taskExecAttach = new Iam.RolePolicyAttachment($"ngpa-{name}",
new Iam.RolePolicyAttachmentArgs
{
Role = nodeGroupRole.Name,
PolicyArn = policy,
});
}
var clusterSg = new Ec2.SecurityGroup("cluster-sg", new Ec2.SecurityGroupArgs
{
VpcId = vpcId,
Egress =
{
new Ec2.Inputs.SecurityGroupEgressArgs
{
Protocol = "-1",
FromPort = 0,
ToPort = 0,
CidrBlocks ={ "0.0.0.0/0" }
}
},
Ingress =
{
new Ec2.Inputs.SecurityGroupIngressArgs
{
Protocol = "tcp",
FromPort = 80,
ToPort = 80,
CidrBlocks ={ "0.0.0.0/0" }
}
}
});
var cluster = new Eks.Cluster("eks-cluster", new Eks.ClusterArgs
{
RoleArn = eksRole.Arn,
VpcConfig = new ClusterVpcConfigArgs
{
PublicAccessCidrs =
{
"0.0.0.0/0",
},
SecurityGroupIds =
{
clusterSg.Id,
},
SubnetIds = subnetIds,
},
});
var nodeGroup = new Eks.NodeGroup("node-group", new Eks.NodeGroupArgs
{
ClusterName = cluster.Name,
NodeGroupName = "demo-eks-nodegroup",
NodeRoleArn = nodeGroupRole.Arn,
SubnetIds = subnetIds,
ScalingConfig = new NodeGroupScalingConfigArgs
{
DesiredSize = 2,
MaxSize = 2,
MinSize = 2
},
});
this.Kubeconfig = GenerateKubeconfig(cluster.Endpoint,
cluster.CertificateAuthority.Apply(x => x.Data),
cluster.Name);
}
public MyStack()
{
var cluster = new Pulumi.Aws.Ecs.Cluster("app-cluster");
// Read back the default VPC and public subnets, which we will use.
var vpc = Output.Create(Pulumi.Aws.Ec2.GetVpc.InvokeAsync(new Pulumi.Aws.Ec2.GetVpcArgs {
Default = true
}));
var vpcId = vpc.Apply(vpc => vpc.Id);
var subnet = vpcId.Apply(id => Pulumi.Aws.Ec2.GetSubnetIds.InvokeAsync(new Pulumi.Aws.Ec2.GetSubnetIdsArgs {
VpcId = id
}));
var subnetIds = subnet.Apply(s => s.Ids);
// Create a SecurityGroup that permits HTTP ingress and unrestricted egress.
var webSg = new Pulumi.Aws.Ec2.SecurityGroup("web-sg", new Pulumi.Aws.Ec2.SecurityGroupArgs
{
VpcId = vpcId,
Egress =
{
new Pulumi.Aws.Ec2.Inputs.SecurityGroupEgressArgs
{
Protocol = "-1",
FromPort = 0,
ToPort = 0,
CidrBlocks ={ "0.0.0.0/0" }
}
},
Ingress =
{
new Pulumi.Aws.Ec2.Inputs.SecurityGroupIngressArgs
{
Protocol = "tcp",
FromPort = 80,
ToPort = 80,
CidrBlocks ={ "0.0.0.0/0" }
}
}
});
// Create a load balancer to listen for HTTP traffic on port 80.
var webLb = new Pulumi.Aws.LB.LoadBalancer("web-lb", new Pulumi.Aws.LB.LoadBalancerArgs
{
Subnets = subnetIds,
SecurityGroups = { webSg.Id }
});
var webTg = new Pulumi.Aws.LB.TargetGroup("web-tg", new Pulumi.Aws.LB.TargetGroupArgs
{
Port = 80,
Protocol = "HTTP",
TargetType = "ip",
VpcId = vpcId
});
var webListener = new Pulumi.Aws.LB.Listener("web-listener", new Pulumi.Aws.LB.ListenerArgs
{
LoadBalancerArn = webLb.Arn,
Port = 80,
DefaultActions =
{
new Pulumi.Aws.LB.Inputs.ListenerDefaultActionsArgs
{
Type = "forward",
TargetGroupArn = webTg.Arn,
}
}
});
// Create an IAM role that can be used by our service's task.
var taskExecRole = new Pulumi.Aws.Iam.Role("task-exec-role", new Pulumi.Aws.Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2008-10-17"",
""Statement"": [{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""ecs-tasks.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}]
}"
});
var taskExecAttach = new Pulumi.Aws.Iam.RolePolicyAttachment("task-exec-policy", new Pulumi.Aws.Iam.RolePolicyAttachmentArgs
{
Role = taskExecRole.Name,
PolicyArn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
});
// Spin up a load balanced service running our container image.
var appTask = new Pulumi.Aws.Ecs.TaskDefinition("app-task", new Pulumi.Aws.Ecs.TaskDefinitionArgs
{
Family = "fargate-task-definition",
Cpu = "256",
Memory = "512",
NetworkMode = "awsvpc",
RequiresCompatibilities = { "FARGATE" },
ExecutionRoleArn = taskExecRole.Arn,
ContainerDefinitions = @"[{
""name"": ""my-app"",
""image"": ""nginx"",
""portMappings"": [{
""containerPort"": 80,
""hostPort"": 80,
""protocol"": ""tcp""
}]
}]",
});
var appSvc = new Pulumi.Aws.Ecs.Service("app-svc", new Pulumi.Aws.Ecs.ServiceArgs
{
Cluster = cluster.Arn,
DesiredCount = 1,
LaunchType = "FARGATE",
TaskDefinition = appTask.Arn,
NetworkConfiguration = new Pulumi.Aws.Ecs.Inputs.ServiceNetworkConfigurationArgs
{
AssignPublicIp = true,
Subnets = subnetIds,
SecurityGroups = { webSg.Id }
},
LoadBalancers =
{
new Pulumi.Aws.Ecs.Inputs.ServiceLoadBalancersArgs
{
TargetGroupArn = webTg.Arn,
ContainerName = "my-app",
ContainerPort = 80
}
}
}, new CustomResourceOptions {
DependsOn = { webListener }
});
// Export the resulting web address.
this.Url = Output.Format($"http://{webLb.DnsName}");
}
public EksStack()
{
// Read back the default VPC and public subnets, which we will use.
var vpc = Output.Create(Ec2.GetVpc.InvokeAsync(new Ec2.GetVpcArgs {
Default = true
}));
var vpcId = vpc.Apply(vpc => vpc.Id);
var subnet = vpcId.Apply(id => Ec2.GetSubnetIds.InvokeAsync(new Ec2.GetSubnetIdsArgs {
VpcId = id
}));
var subnetIds = subnet.Apply(s => s.Ids);
// Create an IAM role that can be used by our service's task.
var eksRole = new Iam.Role("eks-iam-eksRole", new Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2008-10-17"",
""Statement"": [{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""eks.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}]
}"
});
var eksPolicies = new Dictionary <string, string>
{
{ "service-policy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy" },
{ "cluster-policy", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" }
};
foreach (var(name, policy) in eksPolicies)
{
var taskExecAttach = new Iam.RolePolicyAttachment($"rpa-{name}",
new Iam.RolePolicyAttachmentArgs
{
Role = eksRole.Name,
PolicyArn = policy,
});
}
// Create an IAM role that can be used by our service's task.
var nodeGroupRole = new Iam.Role("nodegroup-iam-role", new Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2008-10-17"",
""Statement"": [{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""ec2.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}]
}"
});
var nodeGroupPolicies = new Dictionary <string, string>
{
{ "worker", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy" },
{ "cni", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy" },
{ "registry", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" }
};
foreach (var(name, policy) in nodeGroupPolicies)
{
var taskExecAttach = new Iam.RolePolicyAttachment($"ngpa-{name}",
new Iam.RolePolicyAttachmentArgs
{
Role = nodeGroupRole.Name,
PolicyArn = policy,
});
}
var clusterSg = new Ec2.SecurityGroup("cluster-sg", new Ec2.SecurityGroupArgs
{
VpcId = vpcId,
Egress =
{
new Ec2.Inputs.SecurityGroupEgressArgs
{
Protocol = "-1",
FromPort = 0,
ToPort = 0,
CidrBlocks ={ "0.0.0.0/0" }
}
},
Ingress =
{
new Ec2.Inputs.SecurityGroupIngressArgs
{
Protocol = "tcp",
FromPort = 80,
ToPort = 80,
CidrBlocks ={ "0.0.0.0/0" }
}
}
});
var cluster = new Eks.Cluster("eks-cluster", new Eks.ClusterArgs
{
RoleArn = eksRole.Arn,
VpcConfig = new ClusterVpcConfigArgs
{
PublicAccessCidrs =
{
"0.0.0.0/0",
},
SecurityGroupIds =
{
clusterSg.Id,
},
SubnetIds = subnetIds,
},
});
var nodeGroup = new Eks.NodeGroup("node-group", new Eks.NodeGroupArgs
{
ClusterName = cluster.Name,
NodeGroupName = "demo-eks-nodegroup",
NodeRoleArn = nodeGroupRole.Arn,
SubnetIds = subnetIds,
ScalingConfig = new NodeGroupScalingConfigArgs
{
DesiredSize = 2,
MaxSize = 2,
MinSize = 2
},
});
this.Kubeconfig = GenerateKubeconfig(cluster.Endpoint,
cluster.CertificateAuthority.Apply(x => x.Data),
cluster.Name);
var k8sProvider = new K8s.Provider("k8s-provider", new K8s.ProviderArgs
{
KubeConfig = this.Kubeconfig
}, new CustomResourceOptions
{
DependsOn = { nodeGroup },
});
var appNamespace = new CoreV1.Namespace("app-ns", new NamespaceArgs
{
Metadata = new ObjectMetaArgs
{
Name = "joe-duffy",
},
}, new CustomResourceOptions
{
Provider = k8sProvider,
});
var appLabels = new InputMap <string>
{
{ "app", "iac-workshop" }
};
var deployment = new AppsV1.Deployment("app-dep", new DeploymentArgs
{
Metadata = new ObjectMetaArgs
{
Namespace = appNamespace.Metadata.Apply(x => x.Name),
},
Spec = new DeploymentSpecArgs
{
Selector = new LabelSelectorArgs
{
MatchLabels = appLabels
},
Replicas = 1,
Template = new PodTemplateSpecArgs
{
Metadata = new ObjectMetaArgs
{
Labels = appLabels
},
Spec = new PodSpecArgs
{
Containers =
{
new ContainerArgs
{
Name = "iac-workshop",
Image = "jocatalin/kubernetes-bootcamp:v2",
}
}
}
}
},
}, new CustomResourceOptions
{
Provider = k8sProvider,
});
var service = new CoreV1.Service("app-service", new ServiceArgs
{
Metadata = new ObjectMetaArgs
{
Namespace = appNamespace.Metadata.Apply(x => x.Name),
Labels = deployment.Spec.Apply(spec => spec.Template.Metadata.Labels),
},
Spec = new ServiceSpecArgs
{
Type = "LoadBalancer",
Ports =
{
new ServicePortArgs
{
Port = 80,
TargetPort = 8080
},
},
Selector = deployment.Spec.Apply(spec => spec.Template.Metadata.Labels)
},
}, new CustomResourceOptions
{
Provider = k8sProvider,
});
this.Url = service.Status.Apply(status => status.LoadBalancer.Ingress[0].Hostname);
}
private static void ConfigureEcsCluster()
{
cluster = new Ecs.Cluster($"{baseName}-cluster", null, new CustomResourceOptions());
// Create a SecurityGroup that permits HTTP ingress and unrestricted egress.
var webSg = new Ec2.SecurityGroup($"{baseName}-web-sg", new Ec2.SecurityGroupArgs
{
VpcId = vpcId,
Egress =
{
new Ec2.Inputs.SecurityGroupEgressArgs
{
Protocol = "-1",
FromPort = 0,
ToPort = 0,
CidrBlocks ={ "0.0.0.0/0" },
},
},
Ingress =
{
new Ec2.Inputs.SecurityGroupIngressArgs
{
Protocol = "tcp",
FromPort = 80,
ToPort = 80,
CidrBlocks ={ "0.0.0.0/0" },
},
},
});
// Create an IAM role that can be used by our service's task.
var taskExecRole = new Iam.Role($"{baseName}-task-exec-role", new Iam.RoleArgs
{
AssumeRolePolicy = File.ReadAllText("perm.json"),
});
var taskExecAttach = new Iam.RolePolicyAttachment($"{baseName}-task-exec-policy", new Iam.RolePolicyAttachmentArgs
{
Role = taskExecRole.Name,
PolicyArn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
});
// Create a load balancer to listen for HTTP traffic on port 80.
var webLb = new Elb.LoadBalancer($"{baseName}-web-lb", new Elb.LoadBalancerArgs
{
Subnets = new InputList <string>()
{
subnetId, subnetTwoId
},
SecurityGroups = { webSg.Id },
});
var webTg = new Elb.TargetGroup($"{baseName}-web-tg", new Elb.TargetGroupArgs
{
Port = 80,
Protocol = "HTTP",
TargetType = "ip",
VpcId = vpcId,
});
var webListener = new Elb.Listener($"{baseName}-web-listener", new Elb.ListenerArgs
{
LoadBalancerArn = webLb.Arn,
Port = 80,
DefaultActions =
{
new Elb.Inputs.ListenerDefaultActionsArgs
{
Type = "forward",
TargetGroupArn = webTg.Arn,
},
},
});
var launchConfig = new Ec2.LaunchConfiguration($"{baseName}-launchconfig", new Ec2.LaunchConfigurationArgs()
{
ImageId = "ami-a1491ad2",
InstanceType = "t2.nano",
AssociatePublicIpAddress = true,
SecurityGroups = webSg.Id,
});
var scalingGroup = new Group($"{baseName}-autoscaling", new GroupArgs()
{
AvailabilityZones = new InputList <string>()
{
"eu-west-1a", "eu-west-1b"
},
VpcZoneIdentifiers = new InputList <string>()
{
subnetId, subnetTwoId
},
DesiredCapacity = 1,
LaunchConfiguration = launchConfig.Id,
MaxSize = 1,
MinSize = 0,
});
// Spin up a load balanced service running our container image.
var appTask = new Ecs.TaskDefinition($"{baseName}-app-task", new Ecs.TaskDefinitionArgs
{
Family = "fargate-task-definition",
Cpu = "256",
Memory = "512",
NetworkMode = "awsvpc",
RequiresCompatibilities = { "FARGATE", "EC2" },
ExecutionRoleArn = taskExecRole.Arn,
ContainerDefinitions = @"[{
""name"": ""my-app"",
""image"": ""nginx"",
""portMappings"": [{
""containerPort"": 80,
""hostPort"": 80,
""protocol"": ""tcp""
}]
}]",
});
var ec2Svc = new Ecs.Service($"{baseName}-ec2-svc", new Ecs.ServiceArgs()
{
Cluster = cluster.Arn,
DesiredCount = 1,
LaunchType = "EC2",
TaskDefinition = appTask.Arn,
NetworkConfiguration = new Ecs.Inputs.ServiceNetworkConfigurationArgs
{
Subnets = new InputList <string>()
{
subnetId, subnetTwoId
},
SecurityGroups = { webSg.Id },
},
LoadBalancers =
{
new Ecs.Inputs.ServiceLoadBalancersArgs
{
TargetGroupArn = webTg.Arn,
ContainerName = "my-app",
ContainerPort = 80,
},
},
}, new CustomResourceOptions {
DependsOn = { webListener }
});
}
public MyStack()
{
var vpc = Output.Create(Aws.Ec2.GetVpc.InvokeAsync(new Aws.Ec2.GetVpcArgs
{
Default = true,
}));
var subnets = vpc.Apply(vpc => Output.Create(Aws.Ec2.GetSubnetIds.InvokeAsync(new Aws.Ec2.GetSubnetIdsArgs
{
VpcId = vpc.Id,
})));
// Create a security group that permits HTTP ingress and unrestricted egress.
var webSecurityGroup = new Aws.Ec2.SecurityGroup("webSecurityGroup", new Aws.Ec2.SecurityGroupArgs
{
VpcId = vpc.Apply(vpc => vpc.Id),
Egress =
{
new Aws.Ec2.Inputs.SecurityGroupEgressArgs
{
Protocol = "-1",
FromPort = 0,
ToPort = 0,
CidrBlocks =
{
"0.0.0.0/0",
},
},
},
Ingress =
{
new Aws.Ec2.Inputs.SecurityGroupIngressArgs
{
Protocol = "tcp",
FromPort = 80,
ToPort = 80,
CidrBlocks =
{
"0.0.0.0/0",
},
},
},
});
// Create an ECS cluster to run a container-based service.
var cluster = new Aws.Ecs.Cluster("cluster", new Aws.Ecs.ClusterArgs
{
});
// Create an IAM role that can be used by our service's task.
var taskExecRole = new Aws.Iam.Role("taskExecRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary <string, object?>
{
{ "Version", "2008-10-17" },
{ "Statement", new[]
{
new Dictionary <string, object?>
{
{ "Sid", "" },
{ "Effect", "Allow" },
{ "Principal", new Dictionary <string, object?>
{
{ "Service", "ecs-tasks.amazonaws.com" },
} },
{ "Action", "sts:AssumeRole" },
},
} },
}),
});
var taskExecRolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("taskExecRolePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
Role = taskExecRole.Name,
PolicyArn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
});
// Create a load balancer to listen for HTTP traffic on port 80.
var webLoadBalancer = new Aws.ElasticLoadBalancingV2.LoadBalancer("webLoadBalancer", new Aws.ElasticLoadBalancingV2.LoadBalancerArgs
{
Subnets = subnets.Apply(subnets => subnets.Ids),
SecurityGroups =
{
webSecurityGroup.Id,
},
});
var webTargetGroup = new Aws.ElasticLoadBalancingV2.TargetGroup("webTargetGroup", new Aws.ElasticLoadBalancingV2.TargetGroupArgs
{
Port = 80,
Protocol = "HTTP",
TargetType = "ip",
VpcId = vpc.Apply(vpc => vpc.Id),
});
var webListener = new Aws.ElasticLoadBalancingV2.Listener("webListener", new Aws.ElasticLoadBalancingV2.ListenerArgs
{
LoadBalancerArn = webLoadBalancer.Arn,
Port = 80,
DefaultActions =
{
new Aws.ElasticLoadBalancingV2.Inputs.ListenerDefaultActionArgs
{
Type = "forward",
TargetGroupArn = webTargetGroup.Arn,
},
},
});
// Spin up a load balanced service running NGINX
var appTask = new Aws.Ecs.TaskDefinition("appTask", new Aws.Ecs.TaskDefinitionArgs
{
Family = "fargate-task-definition",
Cpu = "256",
Memory = "512",
NetworkMode = "awsvpc",
RequiresCompatibilities =
{
"FARGATE",
},
ExecutionRoleArn = taskExecRole.Arn,
ContainerDefinitions = JsonSerializer.Serialize(new[]
{
new Dictionary <string, object?>
{
{ "name", "my-app" },
{ "image", "nginx" },
{ "portMappings", new[]
{
new Dictionary <string, object?>
{
{ "containerPort", 80 },
{ "hostPort", 80 },
{ "protocol", "tcp" },
},
} },
},
}
),
});
var appService = new Aws.Ecs.Service("appService", new Aws.Ecs.ServiceArgs
{
Cluster = cluster.Arn,
DesiredCount = 5,
LaunchType = "FARGATE",
TaskDefinition = appTask.Arn,
NetworkConfiguration = new Aws.Ecs.Inputs.ServiceNetworkConfigurationArgs
{
AssignPublicIp = true,
Subnets = subnets.Apply(subnets => subnets.Ids),
SecurityGroups =
{
webSecurityGroup.Id,
},
},
LoadBalancers =
{
new Aws.Ecs.Inputs.ServiceLoadBalancerArgs
{
TargetGroupArn = webTargetGroup.Arn,
ContainerName = "my-app",
ContainerPort = 80,
},
},
}, new CustomResourceOptions
{
DependsOn =
{
webListener,
},
});
this.Url = webLoadBalancer.DnsName;
}
private async Task <IDictionary <string, Output <string> > > Initialize()
{
// VPC
var eksVpc = new Aws.Ec2.Vpc("eksVpc", new Aws.Ec2.VpcArgs
{
CidrBlock = "10.100.0.0/16",
InstanceTenancy = "default",
EnableDnsHostnames = true,
EnableDnsSupport = true,
Tags =
{
{ "Name", "pulumi-eks-vpc" },
},
});
var eksIgw = new Aws.Ec2.InternetGateway("eksIgw", new Aws.Ec2.InternetGatewayArgs
{
VpcId = eksVpc.Id,
Tags =
{
{ "Name", "pulumi-vpc-ig" },
},
});
var eksRouteTable = new Aws.Ec2.RouteTable("eksRouteTable", new Aws.Ec2.RouteTableArgs
{
VpcId = eksVpc.Id,
Routes =
{
new Aws.Ec2.Inputs.RouteTableRouteArgs
{
CidrBlock = "0.0.0.0/0",
GatewayId = eksIgw.Id,
},
},
Tags =
{
{ "Name", "pulumi-vpc-rt" },
},
});
// Subnets, one for each AZ in a region
var zones = await Aws.GetAvailabilityZones.InvokeAsync();
var vpcSubnet = new List <Aws.Ec2.Subnet>();
foreach (var range in zones.Names.Select((v, k) => new { Key = k, Value = v }))
{
vpcSubnet.Add(new Aws.Ec2.Subnet($"vpcSubnet-{range.Key}", new Aws.Ec2.SubnetArgs
{
AssignIpv6AddressOnCreation = false,
VpcId = eksVpc.Id,
MapPublicIpOnLaunch = true,
CidrBlock = $"10.100.{range.Key}.0/24",
AvailabilityZone = range.Value,
Tags =
{
{ "Name", $"pulumi-sn-{range.Value}" },
},
}));
}
var rta = new List <Aws.Ec2.RouteTableAssociation>();
foreach (var range in zones.Names.Select((v, k) => new { Key = k, Value = v }))
{
rta.Add(new Aws.Ec2.RouteTableAssociation($"rta-{range.Key}", new Aws.Ec2.RouteTableAssociationArgs
{
RouteTableId = eksRouteTable.Id,
SubnetId = vpcSubnet[range.Key].Id,
}));
}
var subnetIds = vpcSubnet.Select(__item => __item.Id).ToList();
var eksSecurityGroup = new Aws.Ec2.SecurityGroup("eksSecurityGroup", new Aws.Ec2.SecurityGroupArgs
{
VpcId = eksVpc.Id,
Description = "Allow all HTTP(s) traffic to EKS Cluster",
Tags =
{
{ "Name", "pulumi-cluster-sg" },
},
Ingress =
{
new Aws.Ec2.Inputs.SecurityGroupIngressArgs
{
CidrBlocks =
{
"0.0.0.0/0",
},
FromPort = 443,
ToPort = 443,
Protocol = "tcp",
Description = "Allow pods to communicate with the cluster API Server.",
},
new Aws.Ec2.Inputs.SecurityGroupIngressArgs
{
CidrBlocks =
{
"0.0.0.0/0",
},
FromPort = 80,
ToPort = 80,
Protocol = "tcp",
Description = "Allow internet access to pods",
},
},
});
// EKS Cluster Role
var eksRole = new Aws.Iam.Role("eksRole", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary <string, object?>
{
{ "Version", "2012-10-17" },
{ "Statement", new[]
{
new Dictionary <string, object?>
{
{ "Action", "sts:AssumeRole" },
{ "Principal", new Dictionary <string, object?>
{
{ "Service", "eks.amazonaws.com" },
} },
{ "Effect", "Allow" },
{ "Sid", "" },
},
} },
}),
});
var servicePolicyAttachment = new Aws.Iam.RolePolicyAttachment("servicePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
Role = eksRole.Id,
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
});
var clusterPolicyAttachment = new Aws.Iam.RolePolicyAttachment("clusterPolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
Role = eksRole.Id,
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
});
// EC2 NodeGroup Role
var ec2Role = new Aws.Iam.Role("ec2Role", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary <string, object?>
{
{ "Version", "2012-10-17" },
{ "Statement", new[]
{
new Dictionary <string, object?>
{
{ "Action", "sts:AssumeRole" },
{ "Principal", new Dictionary <string, object?>
{
{ "Service", "ec2.amazonaws.com" },
} },
{ "Effect", "Allow" },
{ "Sid", "" },
},
} },
}),
});
var workerNodePolicyAttachment = new Aws.Iam.RolePolicyAttachment("workerNodePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
Role = ec2Role.Id,
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
});
var cniPolicyAttachment = new Aws.Iam.RolePolicyAttachment("cniPolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
Role = ec2Role.Id,
PolicyArn = "arn:aws:iam::aws:policy/AmazonEKSCNIPolicy",
});
var registryPolicyAttachment = new Aws.Iam.RolePolicyAttachment("registryPolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
{
Role = ec2Role.Id,
PolicyArn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
});
// EKS Cluster
var eksCluster = new Aws.Eks.Cluster("eksCluster", new Aws.Eks.ClusterArgs
{
RoleArn = eksRole.Arn,
Tags =
{
{ "Name", "pulumi-eks-cluster" },
},
VpcConfig = new Aws.Eks.Inputs.ClusterVpcConfigArgs
{
PublicAccessCidrs =
{
"0.0.0.0/0",
},
SecurityGroupIds =
{
eksSecurityGroup.Id,
},
SubnetIds = subnetIds,
},
});
var nodeGroup = new Aws.Eks.NodeGroup("nodeGroup", new Aws.Eks.NodeGroupArgs
{
ClusterName = eksCluster.Name,
NodeGroupName = "pulumi-eks-nodegroup",
NodeRoleArn = ec2Role.Arn,
SubnetIds = subnetIds,
Tags =
{
{ "Name", "pulumi-cluster-nodeGroup" },
},
ScalingConfig = new Aws.Eks.Inputs.NodeGroupScalingConfigArgs
{
DesiredSize = 2,
MaxSize = 2,
MinSize = 1,
},
});
var clusterName = eksCluster.Name;
var kubeconfig = Output.Tuple(eksCluster.Endpoint, eksCluster.CertificateAuthority, eksCluster.Name).Apply(values =>
{
var endpoint = values.Item1;
var certificateAuthority = values.Item2;
var name = values.Item3;
return(JsonSerializer.Serialize(new Dictionary <string, object?>
{
{ "apiVersion", "v1" },
{ "clusters", new[]
{
new Dictionary <string, object?>
{
{ "cluster", new Dictionary <string, object?>
{
{ "server", endpoint },
{ "certificate-authority-data", certificateAuthority.Data },
} },
{ "name", "kubernetes" },
},
} },
{ "contexts", new[]
{
new Dictionary <string, object?>
{
{ "contest", new Dictionary <string, object?>
{
{ "cluster", "kubernetes" },
{ "user", "aws" },
} },
},
} },
{ "current-context", "aws" },
{ "kind", "Config" },
{ "users", new[]
{
new Dictionary <string, object?>
{
{ "name", "aws" },
{ "user", new Dictionary <string, object?>
{
{ "exec", new Dictionary <string, object?>
{
{ "apiVersion", "client.authentication.k8s.io/v1alpha1" },
{ "command", "aws-iam-authenticator" },
} },
{ "args", new[]
{
"token",
"-i",
name,
} },
} },
},
} },
}));
});
return(new Dictionary <string, Output <string> >
{
{ "clusterName", clusterName },
{ "kubeconfig", kubeconfig },
});
}
public FargateStack()
{
// Read back the default VPC and public subnets, which we will use.
var vpc = Output.Create(Ec2.GetVpc.InvokeAsync(new Ec2.GetVpcArgs {
Default = true
}));
var vpcId = vpc.Apply(vpc => vpc.Id);
var subnet = vpcId.Apply(id => Ec2.GetSubnetIds.InvokeAsync(new Ec2.GetSubnetIdsArgs {
VpcId = id
}));
var subnetIds = subnet.Apply(s => s.Ids);
// Create a SecurityGroup that permits HTTP ingress and unrestricted egress.
var webSg = new Ec2.SecurityGroup("web-sg", new Ec2.SecurityGroupArgs
{
VpcId = vpcId,
Egress =
{
new Ec2.Inputs.SecurityGroupEgressArgs
{
Protocol = "-1",
FromPort = 0,
ToPort = 0,
CidrBlocks ={ "0.0.0.0/0" }
}
},
Ingress =
{
new Ec2.Inputs.SecurityGroupIngressArgs
{
Protocol = "tcp",
FromPort = 80,
ToPort = 80,
CidrBlocks ={ "0.0.0.0/0" }
}
}
});
// Create an ECS cluster to run a container-based service.
var cluster = new Ecs.Cluster("app-cluster");
// Create an IAM role that can be used by our service's task.
var taskExecRole = new Iam.Role("task-exec-role", new Iam.RoleArgs
{
AssumeRolePolicy = @"{
""Version"": ""2008-10-17"",
""Statement"": [{
""Sid"": """",
""Effect"": ""Allow"",
""Principal"": {
""Service"": ""ecs-tasks.amazonaws.com""
},
""Action"": ""sts:AssumeRole""
}]
}"
});
var taskExecAttach = new Iam.RolePolicyAttachment("task-exec-policy", new Iam.RolePolicyAttachmentArgs
{
Role = taskExecRole.Name,
PolicyArn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
});
// Create a load balancer to listen for HTTP traffic on port 80.
var webLb = new Elb.LoadBalancer("web-lb", new Elb.LoadBalancerArgs
{
Subnets = subnetIds,
SecurityGroups = { webSg.Id }
});
var webTg = new Elb.TargetGroup("web-tg", new Elb.TargetGroupArgs
{
Port = 80,
Protocol = "HTTP",
TargetType = "ip",
VpcId = vpcId
});
var webListener = new Elb.Listener("web-listener", new Elb.ListenerArgs
{
LoadBalancerArn = webLb.Arn,
Port = 80,
DefaultActions =
{
new Elb.Inputs.ListenerDefaultActionArgs
{
Type = "forward",
TargetGroupArn = webTg.Arn,
}
}
});
// Create a private ECR registry and build and publish our app's container image to it.
var appRepo = new Ecr.Repository("app-repo");
var appRepoCredentials = appRepo.RegistryId.Apply(async rid =>
{
var credentials = await Ecr.GetCredentials.InvokeAsync(new Ecr.GetCredentialsArgs {
RegistryId = rid
});
var data = Convert.FromBase64String(credentials.AuthorizationToken);
return(Encoding.UTF8.GetString(data).Split(":").ToImmutableArray());
});
var image = new Docker.Image("app-img", new Docker.ImageArgs
{
Build = "../App",
ImageName = appRepo.RepositoryUrl,
Registry = new Docker.ImageRegistry
{
Server = appRepo.RepositoryUrl,
Username = appRepoCredentials.GetAt(0),
Password = appRepoCredentials.GetAt(1)
}
});
// Spin up a load balanced service running our container image.
var appTask = new Ecs.TaskDefinition("app-task", new Ecs.TaskDefinitionArgs
{
Family = "fargate-task-definition",
Cpu = "256",
Memory = "512",
NetworkMode = "awsvpc",
RequiresCompatibilities = { "FARGATE" },
ExecutionRoleArn = taskExecRole.Arn,
ContainerDefinitions = image.ImageName.Apply(imageName => @"[{
""name"": ""my-app"",
""image"": """ + imageName + @""",
""portMappings"": [{
""containerPort"": 80,
""hostPort"": 80,
""protocol"": ""tcp""
}]
}]")
});
var appSvc = new Ecs.Service("app-svc", new Ecs.ServiceArgs
{
Cluster = cluster.Arn,
DesiredCount = 3,
LaunchType = "FARGATE",
TaskDefinition = appTask.Arn,
NetworkConfiguration = new Ecs.Inputs.ServiceNetworkConfigurationArgs
{
AssignPublicIp = true,
Subnets = subnetIds,
SecurityGroups = { webSg.Id }
},
LoadBalancers =
{
new Ecs.Inputs.ServiceLoadBalancerArgs
{
TargetGroupArn = webTg.Arn,
ContainerName = "my-app",
ContainerPort = 80
}
}
}, new CustomResourceOptions {
DependsOn = { webListener }
});
// Export the resulting web address.
this.Url = Output.Format($"http://{webLb.DnsName}");
}
public MyStack()
{
var dmsAssumeRole = Output.Create(Aws.Iam.GetPolicyDocument.InvokeAsync(new Aws.Iam.GetPolicyDocumentArgs
{
Statements =
{
new Aws.Iam.Inputs.GetPolicyDocumentStatementArgs
{
Actions =
{
"sts:AssumeRole",
},
Principals =
{
new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalArgs
{
Identifiers =
{
"dms.amazonaws.com",
},
Type = "Service",
},
},
},
},
}));
var dms_access_for_endpoint = new Aws.Iam.Role("dms-access-for-endpoint", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = dmsAssumeRole.Apply(dmsAssumeRole => dmsAssumeRole.Json),
});
var dms_access_for_endpoint_AmazonDMSRedshiftS3Role = new Aws.Iam.RolePolicyAttachment("dms-access-for-endpoint-AmazonDMSRedshiftS3Role", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role",
Role = dms_access_for_endpoint.Name,
});
var dms_cloudwatch_logs_role = new Aws.Iam.Role("dms-cloudwatch-logs-role", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = dmsAssumeRole.Apply(dmsAssumeRole => dmsAssumeRole.Json),
});
var dms_cloudwatch_logs_role_AmazonDMSCloudWatchLogsRole = new Aws.Iam.RolePolicyAttachment("dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole",
Role = dms_cloudwatch_logs_role.Name,
});
var dms_vpc_role = new Aws.Iam.Role("dms-vpc-role", new Aws.Iam.RoleArgs
{
AssumeRolePolicy = dmsAssumeRole.Apply(dmsAssumeRole => dmsAssumeRole.Json),
});
var dms_vpc_role_AmazonDMSVPCManagementRole = new Aws.Iam.RolePolicyAttachment("dms-vpc-role-AmazonDMSVPCManagementRole", new Aws.Iam.RolePolicyAttachmentArgs
{
PolicyArn = "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole",
Role = dms_vpc_role.Name,
});
// Create a new replication instance
var test = new Aws.Dms.ReplicationInstance("test", new Aws.Dms.ReplicationInstanceArgs
{
AllocatedStorage = 20,
ApplyImmediately = true,
AutoMinorVersionUpgrade = true,
AvailabilityZone = "us-west-2c",
EngineVersion = "3.1.4",
KmsKeyArn = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
MultiAz = false,
PreferredMaintenanceWindow = "sun:10:30-sun:14:30",
PubliclyAccessible = true,
ReplicationInstanceClass = "dms.t2.micro",
ReplicationInstanceId = "test-dms-replication-instance-tf",
ReplicationSubnetGroupId = aws_dms_replication_subnet_group.Test_dms_replication_subnet_group_tf.Id,
Tags =
{
{ "Name", "test" },
},
VpcSecurityGroupIds =
{
"sg-12345678",
},
});
}
