AWS Amazon EC2 Instance

aws_instance (Terraform)

The Instance in Amazon EC2 can be configured in Terraform with the resource name aws_instance. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

N4gato/tfgitflow

resource "aws_instance" "web" {
  ami           = "ami-a1b2c3d4"
  instance_type = "t2.micro"
}

resource "aws_instance" "web1" {

gilyas/infracost

resource "aws_instance" "instance1" {
  ami           = "fake_ami"
  instance_type = "m3.medium"

  root_block_device {
    volume_size = 10

terraform-docs/terraform-config-inspect

resource "aws_instance" "foo" {
}

resource "aws_instance" "bar" {
  provider = notaws
}

nisinghvmware/nitin

resource "aws_instance" "machine1" {
 ami = "ami-04b9e92b5572fa0d1"
 instance_type = "t2.micro"
}
resource "aws_instance" "machine2" {
 ami = "ami-04b9e92b5572fa0d1"

nisinghvmware/nitin

resource "aws_instance" "machine1" {
 ami = "ami-04b9e92b5572fa0d1"
 instance_type = "t2.micro"
}
resource "aws_instance" "machine2" {
 ami = "ami-04b9e92b5572fa0d1"

Security Best Practices for aws_instance

There are 2 settings in aws_instance that should be taken care of for security reasons. The following section explain an overview and example code.

Ensure to avoid storing AWS access keys in user data

It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.

Ensure HTTP tokens are required for IMDS

It is better to require session tokens for all access to IMDS. IMDS (Instance Metadata Service) allows access without session tokens, which could be abused by several attacks like server-side request forgery (SSRF).

Parameters

• ami required - string
• arn optional computed - string
• associate_public_ip_address optional computed - bool
• availability_zone optional computed - string
• cpu_core_count optional computed - number
• cpu_threads_per_core optional computed - number
• disable_api_termination optional - bool
• ebs_optimized optional - bool
• get_password_data optional - bool
• hibernation optional - bool
• host_id optional computed - string
• iam_instance_profile optional - string
• id optional computed - string
• instance_initiated_shutdown_behavior optional - string
• instance_state optional computed - string
• instance_type required - string
• ipv6_address_count optional computed - number
• ipv6_addresses optional computed - list of string
• key_name optional computed - string
• monitoring optional - bool
• outpost_arn optional computed - string
• password_data optional computed - string
• placement_group optional computed - string
• primary_network_interface_id optional computed - string
• private_dns optional computed - string
• private_ip optional computed - string
• public_dns optional computed - string
• public_ip optional computed - string
• secondary_private_ips optional computed - set of string
• security_groups optional computed - set of string
• source_dest_check optional - bool
• subnet_id optional computed - string
• tags optional - map from string to string
• tenancy optional computed - string
• user_data optional - string
• user_data_base64 optional - string
• volume_tags optional - map from string to string
• vpc_security_group_ids optional computed - set of string
• credit_specification list block
  • cpu_credits optional - string
• ebs_block_device set block
  • delete_on_termination optional - bool
  • device_name required - string
  • encrypted optional computed - bool
  • iops optional computed - number
  • kms_key_id optional computed - string
  • snapshot_id optional computed - string
  • tags optional - map from string to string
  • throughput optional computed - number
  • volume_id optional computed - string
  • volume_size optional computed - number
  • volume_type optional computed - string
• enclave_options list block
  • enabled optional computed - bool
• ephemeral_block_device set block
  • device_name required - string
  • no_device optional - bool
  • virtual_name optional - string
• metadata_options list block
  • http_endpoint optional computed - string
  • http_put_response_hop_limit optional computed - number
  • http_tokens optional computed - string
• network_interface set block
  • delete_on_termination optional - bool
  • device_index required - number
  • network_interface_id required - string
• root_block_device list block
  • delete_on_termination optional - bool
  • device_name optional computed - string
  • encrypted optional computed - bool
  • iops optional computed - number
  • kms_key_id optional computed - string
  • tags optional - map from string to string
  • throughput optional computed - number
  • volume_id optional computed - string
  • volume_size optional computed - number
  • volume_type optional computed - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • update optional - string

Explanation in Terraform Registry

Provides an EC2 instance resource. This allows instances to be created, updated, and deleted. Instances also support provisioning.

Tips: Best Practices for The Other AWS Amazon EC2 Resources

In addition to the aws_default_vpc, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_default_vpc

Ensure to avoid using default VPC

It is better to define the own VPC and use it.

aws_network_acl_rule

Ensure your network ACL rule blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.

aws_ebs_volume

Ensure to use a customer-managed key for EBS volume encryption

It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).

aws_security_group

Ensure your security group blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.