AWS EC2

This module creates a dual-stack (IPv4 + Amazon-provided IPv6) EC2 instance and its associated resources.

Dependencies

When using wireguard, this module depends on bash, jq and wg.

Usage example

module "ec2" {
  source = "git@adyxax.org:adyxax.org/tofu-module-aws-ec2?depth=1&ref=1.0.0"

  instance_type = "m7a.large"
  name          = "test"
  network = {
    fqdn      = "test.adyxax.org"
    subnet_id = aws_subnet.main[data.aws_availability_zones.main.names[0]].id
  }
  operating_system = "FreeBSD-15"
  vpc_id           = aws_vpc.main.id
}

Post installation configuration steps

• The instance SSH private key is published to Secrets Manager under a secret which name is stored as the ssh_private_key_secret instance tag. Load it into ssh-agent with:

  aws --profile tests secretsmanager get-secret-value \
      --secret-id "ec2/test/ssh-private-key" \
      --query SecretString --output text | ssh-add -
  

• When wireguard is enabled, the wireguard private key is published under a secret which name is stored as the wireguard_private_key_secret instance tag), so playbooks can fetch it without hardcoding the naming scheme:

  terraform_wireguard_private_key: >-
    {{ lookup('amazon.aws.aws_secret', tags.wireguard_private_key_secret) }}
  

The configure stage only needs ec2:Describe* (inventory) and secretsmanager:GetSecretValue scoped to ec2/* (keys).