Ejercicio: Aplicación Escalable con EKS, Aurora y WAF ​

# infrastructure/terraform/vpc/main.tf
provider "aws" {
  region = var.aws_region
}

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"
  
  name = "eks-vpc"
  cidr = "10.0.0.0/16"
  
  azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
  
  enable_nat_gateway = true
  single_nat_gateway = false
  
  tags = {
    Environment = var.environment
    Project     = "EKS-Aurora-Demo"
  }
  
  private_subnet_tags = {
    "kubernetes.io/cluster/${var.cluster_name}" = "shared"
    "kubernetes.io/role/internal-elb"           = "1"
  }
  
  public_subnet_tags = {
    "kubernetes.io/cluster/${var.cluster_name}" = "shared"
    "kubernetes.io/role/elb"                    = "1"
  }
}

# infrastructure/terraform/vpc/variables.tf
variable "aws_region" {
  description = "AWS region"
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Environment name"
  type        = string
  default     = "production"
}

variable "cluster_name" {
  description = "Name of the EKS cluster"
  type        = string
  default     = "eks-demo-cluster"
}

# infrastructure/terraform/eks/main.tf
provider "aws" {
  region = var.aws_region
}

module "eks" {
  source = "terraform-aws-modules/eks/aws"
  
  cluster_name    = var.cluster_name
  cluster_version = "1.27"
  
  vpc_id          = var.vpc_id
  subnet_ids      = var.private_subnet_ids
  
  eks_managed_node_groups = {
    primary = {
      desired_size = 2
      min_size     = 1
      max_size     = 4
      
      instance_types = ["t3.medium"]
      capacity_type  = "ON_DEMAND"
      
      update_config = {
        max_unavailable_percentage = 50
      }
      
      labels = {
        Environment = var.environment
        NodeGroup  = "primary"
      }
    }
  }
  
  cluster_endpoint_private_access = true
  cluster_endpoint_public_access  = true
  
  manage_aws_auth_configmap = true
}

# infrastructure/terraform/aurora/main.tf
module "aurora" {
  source = "terraform-aws-modules/rds-aurora/aws"

  name            = "eks-aurora-cluster"
  engine          = "aurora-postgresql"
  engine_version  = "13.8"
  instance_class  = "db.r5.large"
  
  instances = {
    primary = {}
    replica = {
      count = 1
    }
  }

  vpc_id                 = var.vpc_id
  db_subnet_group_name   = aws_db_subnet_group.aurora.name
  create_security_group  = true
  allowed_cidr_blocks    = var.private_subnet_cidrs

  database_name     = "appdb"
  master_username   = var.db_username
  master_password   = var.db_password

  backup_retention_period = 7
  preferred_backup_window = "02:00-03:00"
  
  enabled_cloudwatch_logs_exports = ["postgresql"]

  tags = {
    Environment = var.environment
    Project     = "EKS-Aurora-Demo"
  }
}

resource "aws_db_subnet_group" "aurora" {
  name       = "aurora-subnet-group"
  subnet_ids = var.private_subnet_ids
}

# infrastructure/terraform/aurora/security.tf
resource "aws_security_group" "aurora" {
  name_prefix = "aurora-security-group"
  vpc_id      = var.vpc_id

  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [var.eks_security_group_id]
  }
}

# infrastructure/terraform/iam/aurora-access.tf
resource "aws_iam_role" "aurora_access" {
  name = "eks-aurora-access"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "eks.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "aurora_access" {
  name = "aurora-access-policy"
  role = aws_iam_role.aurora_access.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "rds-db:connect",
          "rds:DescribeDBClusters"
        ]
        Resource = [module.aurora.cluster_arn]
      }
    ]
  })
}

# infrastructure/terraform/monitoring/aurora-monitoring.tf
resource "aws_cloudwatch_metric_alarm" "aurora_cpu" {
  alarm_name          = "aurora-high-cpu"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "2"
  metric_name         = "CPUUtilization"
  namespace           = "AWS/RDS"
  period              = "300"
  statistic           = "Average"
  threshold           = "80"
  alarm_description   = "High CPU utilization"
  alarm_actions       = [aws_sns_topic.alerts.arn]

  dimensions = {
    DBClusterIdentifier = module.aurora.cluster_id
  }
}

# infrastructure/terraform/waf/main.tf
resource "aws_wafv2_web_acl" "main" {
  name        = "eks-protection"
  description = "WAF rules for EKS cluster"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name     = "RateLimit"
    priority = 1

    override_action {
      none {}
    }

    statement {
      rate_based_statement {
        limit              = 2000
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name               = "RateLimitRule"
      sampled_requests_enabled  = true
    }
  }

  rule {
    name     = "SQLInjectionProtection"
    priority = 2

    override_action {
      none {}
    }

    statement {
      sql_injection_match_statement {
        field_to_match {
          body {}
        }
        text_transformation {
          priority = 1
          type     = "URL_DECODE"
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name               = "SQLInjectionRule"
      sampled_requests_enabled  = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name               = "EKSProtectionMetrics"
    sampled_requests_enabled  = true
  }
}

# infrastructure/terraform/waf/alb.tf
resource "aws_wafv2_web_acl_association" "alb" {
  resource_arn = var.alb_arn
  web_acl_arn  = aws_wafv2_web_acl.main.arn
}

resource "aws_wafv2_logging_configuration" "main" {
  log_destination_configs = [aws_kinesis_firehose_delivery_stream.waf_logs.arn]
  resource_arn           = aws_wafv2_web_acl.main.arn
}

# infrastructure/terraform/monitoring/logs.tf
resource "aws_cloudwatch_log_group" "waf_logs" {
  name              = "/aws/waf/eks"
  retention_in_days = 30

  tags = {
    Environment = var.environment
    Project     = "EKS-Aurora-Demo"
  }
}

resource "aws_kinesis_firehose_delivery_stream" "waf_logs" {
  name        = "aws-waf-logs-eks"
  destination = "s3"

  s3_configuration {
    role_arn   = aws_iam_role.firehose_role.arn
    bucket_arn = aws_s3_bucket.waf_logs.arn
  }
}