Appendix E: Ivanti Connect Secure Terraform Template for AWS

#Terraform version
terraform {
required_version = ">= v0.12.24"
}
#Region
provider "aws" {
region = var.region
#zone = var.zone
}
#Create a VPC
resource "aws_vpc" "vpc" {
tags = {
Name = var.vpc
}
cidr_block = "10.22.0.0/16"
}
#Create Subnet for zone-1
#Internal Port
resource "aws_subnet" "vsw-zone-1-pcs-int-port-subnet" {
vpc_id = aws_vpc.vpc.id
cidr_block = var.subnet_map[var.zone_1]["pcs_int_port"]["cidr"]
availability_zone = var.zone_1
tags = {
Name = var.subnet_map[var.zone_1]["pcs_int_port"]["name"]
}
}
#External Port
resource "aws_subnet" "vsw-zone-1-pcs-ext-port-subnet" {
vpc_id = aws_vpc.vpc.id
cidr_block = var.subnet_map[var.zone_1]["pcs_ext_port"]["cidr"]
availability_zone = var.zone_1
tags = {
Name = var.subnet_map[var.zone_1]["pcs_ext_port"]["name"]
}
}
#Management Port
resource "aws_subnet" "vsw-zone-1-pcs-mgmt-port-subnet" {
vpc_id = aws_vpc.vpc.id
cidr_block = var.subnet_map[var.zone_1]["pcs_mgmt_port"]["cidr"]
availability_zone = var.zone_1
tags = {
Name = var.subnet_map[var.zone_1]["pcs_mgmt_port"]["name"]
}
}
#Tunnel Subnet
resource "aws_subnet" "vsw-zone-1-pcs-tunnel-subnet" {
vpc_id = aws_vpc.vpc.id
cidr_block = var.subnet_map[var.zone_1]["pcs_tunnel_subnet"]["cidr"]
availability_zone = var.zone_1
tags = {
Name = var.subnet_map[var.zone_1]["pcs_tunnel_subnet"]["name"]
}
}
#Create Subnet for zone-2
#Internal Port
resource "aws_subnet" "vsw-zone-2-pcs-int-port-subnet" {
vpc_id = aws_vpc.vpc.id
cidr_block = var.subnet_map[var.zone_2]["pcs_int_port"]["cidr"]
availability_zone = var.zone_2
tags = {
Name = var.subnet_map[var.zone_2]["pcs_int_port"]["name"]
}
}
#External Port
resource "aws_subnet" "vsw-zone-2-pcs-ext-port-subnet" {
vpc_id = aws_vpc.vpc.id
cidr_block = var.subnet_map[var.zone_2]["pcs_ext_port"]["cidr"]
availability_zone = var.zone_2
tags = {
Name = var.subnet_map[var.zone_2]["pcs_ext_port"]["name"]
}
}
#Management Port
resource "aws_subnet" "vsw-zone-2-pcs-mgmt-port-subnet" {
vpc_id = aws_vpc.vpc.id
cidr_block = var.subnet_map[var.zone_2]["pcs_mgmt_port"]["cidr"]
availability_zone = var.zone_2
tags = {
Name = var.subnet_map[var.zone_2]["pcs_mgmt_port"]["name"]
}
}
#Tunnel Port
resource "aws_subnet" "vsw-zone-2-pcs-tunnel-subnet" {
vpc_id = aws_vpc.vpc.id
cidr_block = var.subnet_map[var.zone_2]["pcs_tunnel_subnet"]["cidr"]
availability_zone = var.zone_2
tags = {
Name = var.subnet_map[var.zone_2]["pcs_tunnel_subnet"]["name"]
}
}
#Create Security Group for PCS Internal Port
resource "aws_security_group" "sg_pcs_int_port" {
name = var.security_group_map["pcs_int_port"]
description = "Security Group rules for PCS Internal Port"
vpc_id = aws_vpc.vpc.id
tags = {
Name = var.security_group_map["pcs_int_port"]
}
#HTTP
ingress {
description = "HTTP Port 80"
from_port = 80
to_port = 80
protocol = "tcp"
# Please restrict your ingress to only necessary IPs and ports.
# Opening to 0.0.0.0/0 can lead to security vulnerabilities.
#cidr_blocks = # add your IP address here
cidr_blocks = [ "0.0.0.0/0" ]
}
#HTTPS
ingress {
description = "HTTPS port 443"
from_port = 443
to_port = 443
protocol = "tcp"
# Please restrict your ingress to only necessary IPs and ports.
# Opening to 0.0.0.0/0 can lead to security vulnerabilities.
#cidr_blocks = # add your IP address here
cidr_blocks = [ "0.0.0.0/0" ]
}
#SSh
ingress {
description = "SSh port 6667"
from_port = 6667
to_port = 6667
protocol = "tcp"
# Please restrict your ingress to only necessary IPs and ports.
# Opening to 0.0.0.0/0 can lead to security vulnerabilities.
#cidr_blocks = # add your IP address here
cidr_blocks = [ "0.0.0.0/0" ]
}
#SSh
ingress {
description = "SSh port 22"
from_port = 22
to_port = 22
protocol = "tcp"
# Please restrict your ingress to only necessary IPs and ports.
# Opening to 0.0.0.0/0 can lead to security vulnerabilities.
#cidr_blocks = # add your IP address here
cidr_blocks = [ "0.0.0.0/0" ]
}
#DMI Netconf port
ingress {
description = "DMI Netconf port"
from_port = 830
to_port = 830
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#Allow All ICMP
ingress {
description = "Allow All ICMP"
from_port = -1
to_port = -1
protocol = "icmp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#TCP Ports for Cluster Communication
ingress {
description = "TCP Ports for Cluster Communication"
from_port = 11000
to_port = 11099
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#TCP Ports 4808 and 4809 for Cluster Communication
ingress {
description = "TCP Ports 4808 and 4809 for Cluster Communication"
from_port = 4808
to_port = 4809
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#TCP Ports 4900 - 4910 for Cluster Key Exchange and State Sync
ingress {
description = "TCP Ports 4900 - 4910 for Cluster Key Exchange and State Sync"
from_port = 4900
to_port = 4910
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#UDP Ports for Cluster Communication
ingress {
description = "UDP Ports for Cluster Communication"
from_port = 4803
to_port = 4803
protocol = "udp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#UDP Ports for Cluster HeartBeat
ingress {
description = "UDP Ports for Cluster HeartBeat"
from_port = 4804
to_port = 4804
protocol = "udp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#UDP Ports for L3 Connection
ingress {
description = "UDP Ports for Pulse L3 Connection"
from_port = 4500
to_port = 4500
protocol = "udp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#Allow all Outbound connections(this is needed for AWS)
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
#Create Security Group for External Port
resource "aws_security_group" "sg_pcs_ext_port" {
name = var.security_group_map["pcs_ext_port"]
description = "Security Group rules for PCS External Port"
vpc_id = aws_vpc.vpc.id
tags = {
Name = var.security_group_map["pcs_ext_port"]
}
#HTTP
ingress {
description = "HTTP Port 80"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#HTTPS
ingress {
description = "HTTPS port 443"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#Allow All ICMP
ingress {
description = "Allow All ICMP"
from_port = -1
to_port = -1
protocol = "icmp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#UDP Ports for L3 Connection
ingress {
description = "UDP Ports for L3 Connection"
from_port = 4500
to_port = 4500
protocol = "udp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#Allow all Outbound connections
egress {
description = "Allow all outbound connections"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
#Create Security Group for Management Port
resource "aws_security_group" "sg_pcs_mgmt_port" {
name = var.security_group_map["pcs_mgmt_port"]
description = "Security Group rules for Management Port"
vpc_id = aws_vpc.vpc.id
tags = {
Name = var.security_group_map["pcs_mgmt_port"]
}
#HTTP
ingress {
description = "Allow all HTTP"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#HTTPS
ingress {
description = "Allow all HTTPS"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#DMI Netconf port
ingress {
description = "Allow DMI Netconf"
from_port = 830
to_port = 830
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#Allow All ICMP
ingress {
description = "Allow All ICMP"
from_port = -1
to_port = -1
protocol = "icmp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#Allow all Outbound connections
egress {
description = "Allow all outbound connections"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
#Create Security Group for Backend Servers
resource "aws_security_group" "sg_backend_svr" {
name = var.security_group_map["backend_svr"]
description = "Security Group for backend servers in protected network"
vpc_id = aws_vpc.vpc.id
tags = {
Name = var.security_group_map["backend_svr"]
}
#HTTPS
ingress {
description = "Allow all HTTPS"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#HTTP
ingress {
description = "Allow all HTTP"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#SSH
ingress {
description = "Allow all SSH"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#Allow All ICMP
ingress {
description = "Allow all ICMP"
from_port = -1
to_port = -1
protocol = "icmp"
cidr_blocks = [ "0.0.0.0/0" ]
}
#Allow all Outbound connections
egress {
description = "Allow all outbound connections"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
#Create internet gateway, so instances can connect to internet
resource "aws_internet_gateway" "internet_gateway" {
vpc_id = aws_vpc.vpc.id
tags = {
#Name = "vpc-internet-gateway"
Name = "${aws_vpc.vpc.tags["Name"]}-igw"
}
}
#Create route to internet in VPC default route table through internet gateway created in Internet Gateway Block
resource "aws_route" "route_to_internet" {
route_table_id = aws_vpc.vpc.default_route_table_id
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.internet_gateway.id
#depends_on = ["aws_route_table.testing"]
}

#Terraform version
terraform {
required_version = ">= v0.12.24"
}
#Region
provider "aws" {
region = var.region
#zone = var.zone
}
#Data sources
#VPCs
#Available VPCs in the region
data "aws_vpcs" "ds_vpcs" {
}
#VPC of interest
data "aws_vpcs" "ds_vpc" {
filter {
name = "tag:Name"
values = [var.vpc]
}
}
data "aws_vpc" "ds_vpc" {
tags = {
Name = var.vpc
}
}
#Security Group for Internal Port
data "aws_security_group" "sg_pcs_int_port" {
name = var.security_group_map["pcs_int_port"]
vpc_id = local.vpc_id
}
#Security Group for External Port
data "aws_security_group" "sg_pcs_ext_port" {
name = var.security_group_map["pcs_ext_port"]
vpc_id = local.vpc_id
}
#Security Group for Management Port
data "aws_security_group" "sg_pcs_mgmt_port" {
name = var.security_group_map["pcs_mgmt_port"]
vpc_id = local.vpc_id
}
#Security Group for Backend Servers
data "aws_security_group" "sg_backend_svr" {
name = var.security_group_map["backend_svr"]
vpc_id = local.vpc_id
}
#Internal Port Subnet for zone_1
data "aws_subnet" "zone_1_pcs_int_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_int_port"]["name"]]
}
}
#External Port Subnet for zone_1
data "aws_subnet" "zone_1_pcs_ext_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_ext_port"]["name"]]
}
}
#Management Port Subnet for zone_1
data "aws_subnet" "zone_1_pcs_mgmt_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_mgmt_port"]["name"]]
}
}
#Internal Port Subnet for zone_2
data "aws_subnet" "zone_2_pcs_int_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_int_port"]["name"]]
}
}
#External Port Subnet for zone_2
data "aws_subnet" "zone_2_pcs_ext_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_ext_port"]["name"]]
}
}
#Management Port Subnet for zone_2
data "aws_subnet" "zone_2_pcs_mgmt_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_mgmt_port"]["name"]]
}
}
#AMI ID corresponding to the image name passed
data "aws_ami_ids" "ds_image" {
owners = ["self"]
filter {
name = "tag:Name"
values = [var.image_name]
}
}
data "aws_ami" "ds_pcs_image_info_for_ami_id" {
//executable_users = ["self"]
most_recent = true
//name_regex = "^ami-"
#owners = ["self"]
owners = [var.image_from]
filter {
name = "image-id"
values = [ var.ami_id ]
}
}
#Local variables
locals {
#vpcs_list = "${data.alicloud_vpcs.vpcs_ds.vpcs}"
vpc_id = data.aws_vpc.ds_vpc.id
#vsws_list_in_vpc = "${data.alicloud_vswitches.vswitches_ds.vswitches}"
#sec_groups_list = "${data.alicloud_security_groups.sec_groups_ds.groups}"
subnet_id_map = {
"${var.zone_1}" = {
"pcs_int_port" = data.aws_subnet.zone_1_pcs_int_port_subnet.id
"pcs_ext_port" = data.aws_subnet.zone_1_pcs_ext_port_subnet.id
"pcs_mgmt_port" = data.aws_subnet.zone_1_pcs_mgmt_port_subnet.id
},
"${var.zone_2}" = {
"pcs_int_port" = data.aws_subnet.zone_2_pcs_int_port_subnet.id
"pcs_ext_port" = data.aws_subnet.zone_2_pcs_ext_port_subnet.id
"pcs_mgmt_port" = data.aws_subnet.zone_2_pcs_mgmt_port_subnet.id
},
}
security_group_id_map = {
"pcs_int_port" = data.aws_security_group.sg_pcs_int_port.id
"pcs_ext_port" = data.aws_security_group.sg_pcs_ext_port.id
"pcs_mgmt_port" = data.aws_security_group.sg_pcs_mgmt_port.id
"backend_svr" = data.aws_security_group.sg_backend_svr.id
}
}
#Create AWS Key Pair that can be used to connect to VM console on AWS cloud
resource "aws_key_pair" "aws_public_key" {
key_name = "${var.instance_name}-${var.ssh_key_map["name"]}"
public_key = var.ssh_key_map["public_key"]
}
#Create a instance on AWS
resource "aws_instance" "pcs_instance" {
#ami = data.aws_ami.ds_image_info.image_id
ami = var.ami_id
#instance_type = "t2.micro"
#instance_type = var.instance_type #ecs.hfc5.large
instance_type = var.instance_type_map["2_nics"]
#key name that has to be associated with this PCS instance
#key_name = var.ssh_key_map["name"] #this should be same as the key_name used as part of aws_key_pair resource
key_name = aws_key_pair.aws_public_key.key_name
tags = {
Name = var.instance_name
}
#instance_name = var.instance_name
availability_zone = var.zone
#subnet from which pcs int port has to be created
subnet_id = local.subnet_id_map[var.zone]["pcs_int_port"]
#security group to assign to PCS internal port(primary interface)
#security_groups = [ local.security_group_id_map["pcs_int_port"] ]
vpc_security_group_ids = [ local.security_group_id_map["pcs_int_port"] ]
#Associate a public ip address with the PCS instance(instead of Elastic IP)
#associate_public_ip_address = true
#user-data to be used for PCS initial config
user_data = "<pulse-config><primary-dns>8.8.8.8</primary-dns><secondary-dns>8.8.8.9</secondary-dns><wins-server>1.1.1.1</wins-server><dns-domain>pcsqa.psecure.net</dns-domain><admin-username>admindb</admin-username><admin-password>********</admin-password><cert-common-name>aws-pcs.psecure.net</cert-common-name><cert-random-text>fdsfpisonvsfnms</cert-random-text><cert-organisation>Psecure Org</cert-organisation><config-download-url></config-download-url><config-data></config-data><auth-code-license></auth-code-license><enable-license-server>n</enable-license-server><accept-license-agreement>y</accept-license-agreement></pulse-config>"
}
#Create External Port and attach to instance
resource "aws_network_interface" "pcs_ext_port" {
description = "External port"
subnet_id = local.subnet_id_map[var.zone]["pcs_ext_port"]
security_groups = [ local.security_group_id_map["pcs_ext_port"] ]
attachment {
instance = aws_instance.pcs_instance.id
device_index = 1 #Integer to define the devices index (1 indicates eth1, 2 indicates eth2)
}
}
#Create a new EIP for Internal Port
resource "aws_eip" "pcs_int_port_eip" {
vpc = true
#make a reference to aws_internet_gateway
#depends_on = [ aws_internet_gateway.internet_gateway ]
}
#Assign the EIP to the instance (this will get assigned to the default interface, which is internal port)
resource "aws_eip_association" "pcs_int_port_eip_asso" {
allocation_id = aws_eip.pcs_int_port_eip.id
#instance_id = aws_instance.pcs_instance.id
network_interface_id = aws_instance.pcs_instance.primary_network_interface_id
}
#Create a new EIP for External port
resource "aws_eip" "pcs_ext_port_eip" {
vpc = true
}
#Assign the EIP to the External Port(do not assign to VM instance, since it is used by internal port)
resource "aws_eip_association" "pcs_ext_port_eip_asso" {
allocation_id = aws_eip.pcs_ext_port_eip.id
network_interface_id = aws_network_interface.pcs_ext_port.id
}
#Output
#output "vswitch_id_map" {
# value = local.vswitch_id_map
#}
#output "security_group_id_map" {
# value = local.security_group_id_map
#}
#available images loaded by the user
output "aws_ami_id" {
value = data.aws_ami.ds_pcs_image_info_for_ami_id
}
#details of instance deployed on AWS
output deployed_pcs_info {
value = aws_instance.pcs_instance
}

#Terraform version
terraform {
required_version = ">= v0.12.24"
}
#Region
provider "aws" {
region = var.region
#zone = var.zone
}
#Data sources
#VPCs
#Available VPCs in the region
data "aws_vpcs" "ds_vpcs" {

}
#VPC of interest
data "aws_vpcs" "ds_vpc" {
filter {
name = "tag:Name"
values = [var.vpc]
}
}
data "aws_vpc" "ds_vpc" {
tags = {
Name = var.vpc
}
}

#Security Group for Internal Port
data "aws_security_group" "sg_pcs_int_port" {
name = var.security_group_map["pcs_int_port"]
vpc_id = local.vpc_id
}
#Security Group for External Port
data "aws_security_group" "sg_pcs_ext_port" {
name = var.security_group_map["pcs_ext_port"]
vpc_id = local.vpc_id
}
#Security Group for Management Port
data "aws_security_group" "sg_pcs_mgmt_port" {
name = var.security_group_map["pcs_mgmt_port"]
vpc_id = local.vpc_id
}
#Security Group for Backend Servers
data "aws_security_group" "sg_backend_svr" {
name = var.security_group_map["backend_svr"]
vpc_id = local.vpc_id
}
#Internal Port Subnet for zone_1
data "aws_subnet" "zone_1_pcs_int_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_int_port"]["name"]]
}
}
#External Port Subnet for zone_1
data "aws_subnet" "zone_1_pcs_ext_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_ext_port"]["name"]]
}
}
#Management Port Subnet for zone_1
data "aws_subnet" "zone_1_pcs_mgmt_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_mgmt_port"]["name"]]
}
}
#Internal Port Subnet for zone_2
data "aws_subnet" "zone_2_pcs_int_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_int_port"]["name"]]
}
}
#External Port Subnet for zone_2
data "aws_subnet" "zone_2_pcs_ext_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_ext_port"]["name"]]
}
}

#Management Port Subnet for zone_2
data "aws_subnet" "zone_2_pcs_mgmt_port_subnet" {
vpc_id = local.vpc_id
filter {
name = "tag:Name"
values = [ var.subnet_map[var.zone_1]["pcs_mgmt_port"]["name"]]
}
}
#==================================================================
#AMI ID corresponding to the image name passed
data "aws_ami_ids" "ds_image" {
owners = ["self"]
filter {
name = "tag:Name"
values = [var.image_name]
}
}
data "aws_ami" "ds_pcs_image_info_for_ami_id" {
//executable_users = ["self"]
most_recent = true
//name_regex = "^ami-"
#owners = ["self"]
owners = [var.image_from]

filter {
name = "image-id"
values = [ var.ami_id ]
}
}
#Local variables
locals {
#vpcs_list = "${data.alicloud_vpcs.vpcs_ds.vpcs}"
vpc_id = data.aws_vpc.ds_vpc.id
#vsws_list_in_vpc = "${data.alicloud_vswitches.vswitches_ds.vswitches}"
#sec_groups_list = "${data.alicloud_security_groups.sec_groups_ds.groups}"
subnet_id_map = {
"${var.zone_1}" = {
"pcs_int_port" = data.aws_subnet.zone_1_pcs_int_port_subnet.id
"pcs_ext_port" = data.aws_subnet.zone_1_pcs_ext_port_subnet.id
"pcs_mgmt_port" = data.aws_subnet.zone_1_pcs_mgmt_port_subnet.id
},
"${var.zone_2}" = {
"pcs_int_port" = data.aws_subnet.zone_2_pcs_int_port_subnet.id
"pcs_ext_port" = data.aws_subnet.zone_2_pcs_ext_port_subnet.id
"pcs_mgmt_port" = data.aws_subnet.zone_2_pcs_mgmt_port_subnet.id
},
}
security_group_id_map = {
"pcs_int_port" = data.aws_security_group.sg_pcs_int_port.id
"pcs_ext_port" = data.aws_security_group.sg_pcs_ext_port.id
"pcs_mgmt_port" = data.aws_security_group.sg_pcs_mgmt_port.id
"backend_svr" = data.aws_security_group.sg_backend_svr.id
}
}
#Create AWS Key Pair that can be used to connect to VM console on AWS cloud
resource "aws_key_pair" "aws_public_key" {
key_name = "${var.instance_name}-${var.ssh_key_map["name"]}"
public_key = var.ssh_key_map["public_key"]
}
#Create a instance on AWS
resource "aws_instance" "pcs_instance" {
#ami = data.aws_ami.ds_image_info.image_id
ami = var.ami_id
#instance_type = "t2.micro"
#instance_type = var.instance_type #ecs.hfc5.large
instance_type = var.instance_type_map["2_nics"]
#key name that has to be associated with this PCS instance
#key_name = var.ssh_key_map["name"] #this should be same as the key_name used as part of aws_key_pair resource
key_name = aws_key_pair.aws_public_key.key_name
tags = {
Name = var.instance_name
}
#instance_name = var.instance_name
availability_zone = var.zone

#subnet from which pcs int port has to be created
subnet_id = local.subnet_id_map[var.zone]["pcs_int_port"]
#security group to assign to PCS internal port(primary interface)
#security_groups = [ local.security_group_id_map["pcs_int_port"] ]
vpc_security_group_ids = [ local.security_group_id_map["pcs_int_port"] ]

#Associate a public ip address with the instance(instead of Elastic IP)
#associate_public_ip_address = true

#user-data to be used for initial config
user_data = "<pulse-config><primary-dns>8.8.8.8</primary-dns><secondary-dns>8.8.8.9</secondary-dns><wins-server>1.1.1.1</wins-server><dns-domain>pcsqa.psecure.net</dns-domain><admin-username>admindb</admin-username><admin-password>*******</admin-password><cert-common-name>aws-pcs.psecure.net</cert-common-name><cert-random-text>fdsfpisonvsfnms</cert-random-text><cert-organisation>Psecure Org</cert-organisation><config-download-url>https://ss-pcs-qa.s3.ap-south-1.amazonaws.com/import-config-snat-enabled.xml</config-download-url><config-data></config-data><auth-code-license></auth-code-license><enable-license-server>n</enable-license-server><accept-license-agreement>y</accept-license-agreement></pulse-config>"
}
#Create External Port and attach to instance
resource "aws_network_interface" "pcs_ext_port" {
description = "PCS external port"
subnet_id = local.subnet_id_map[var.zone]["pcs_ext_port"]
security_groups = [ local.security_group_id_map["pcs_ext_port"] ]
attachment {
instance = aws_instance.pcs_instance.id
device_index = 1 #Integer to define the devices index (1 indicates eth1, 2 indicates eth2)
}
}
#Create Management Port and attach to instance
resource "aws_network_interface" "pcs_mgmt_port" {
description = "PCS management port"
subnet_id = local.subnet_id_map[var.zone]["pcs_mgmt_port"]
security_groups = [ local.security_group_id_map["pcs_mgmt_port"] ]
attachment {
instance = aws_instance.pcs_instance.id
device_index = 2 #Integer to define the devices index (1 indicates eth1, 2 indicates eth2)
}
}
#Create a new EIP for Internal port
resource "aws_eip" "pcs_int_port_eip" {
vpc = true
#make a reference to aws_internet_gateway
#depends_on = [ aws_internet_gateway.internet_gateway ]
}
#Assign the EIP to the instance (this will get assigned to the default interface, which is internal port)
resource "aws_eip_association" "pcs_int_port_eip_asso" {
allocation_id = aws_eip.pcs_int_port_eip.id
#instance_id = aws_instance.pcs_instance.id
network_interface_id = aws_instance.pcs_instance.primary_network_interface_id
}
#Create a new EIP for External Port
resource "aws_eip" "pcs_ext_port_eip" {
vpc = true
}
#Assign the EIP to the External Port(do not assign to VM instance, since it is used by internal port)
resource "aws_eip_association" "pcs_ext_port_eip_asso" {
allocation_id = aws_eip.pcs_ext_port_eip.id
network_interface_id = aws_network_interface.pcs_ext_port.id
}
#Create a new EIP for Management Port
resource "aws_eip" "pcs_mgmt_port_eip" {
vpc = true
}
#Assign the EIP to the management Port
resource "aws_eip_association" "pcs_mgmt_port_eip_asso" {
allocation_id = aws_eip.pcs_mgmt_port_eip.id
network_interface_id = aws_network_interface.pcs_mgmt_port.id
}
#Output
#output "vswitch_id_map" {
# value = local.vswitch_id_map
#}
#output "security_group_id_map" {
# value = local.security_group_id_map
#}
#available images loaded by the user
output "aws_ami_id" {
value = data.aws_ami.ds_pcs_image_info_for_ami_id
}
#details of the instance deployed on AWS
output deployed_pcs_info {
value = aws_instance.pcs_instance
}

variable region {
description = "The region where the resources(VPC, EC2) has to be created"
default = "ap-south-1"
}
variable zone {
description = "The availability zone where the EC2 resource has to be created"
default = "ap-south-1a"
}
variable zone_1 {
description = "The availability zone(zone-1) where the EC2 resource has to be created. Useful for creating resources in different zones"
default = "ap-south-1a"
}
variable zone_2 {
description = "The availability zone(zone-1) where the EC2 resource has to be created. Useful for creating resources in different zones"
default = "ap-south-1b"
}
variable vpc {
description = "The name of the VPC under which subnets has to be created"
default = "vpc-terra-sulthan2"
}
variable subnet_map {
description = "The names of subnets for int, ext and mgmt ports for both zone-1 and zone-2. Customise according to your environment"
type = map
default = {
"ap-south-1a" = {
"pcs_int_port" = {
"name" = "subnet-ap-south-1a-zone-pcs-int-port",
"cidr" = "10.22.0.0/24"
}
"pcs_ext_port" = {
"name" = "subnet-ap-south-1a-zone-pcs-ext-port",
"cidr" = "10.22.1.0/24"
}
"pcs_mgmt_port" = {
"name" = "subnet-ap-south-1a-zone-pcs-mgmt-port",
"cidr" = "10.22.2.0/24"
}
"pcs_tunnel_subnet" = {
"name" = "subnet-ap-south-1a-zone-pcs-tunnel-subnet",
"cidr" = "10.22.3.0/24"
}
}
"ap-south-1b" = {
"pcs_int_port" = {
"name" = "subnet-ap-south-1b-zone-pcs-int-port",
"cidr" = "10.22.4.0/24"
}
"pcs_ext_port" = {
"name" = "subnet-ap-south-1b-zone-pcs-ext-port",
"cidr" = "10.22.5.0/24"
}
"pcs_mgmt_port" = {
"name" = "subnet-ap-south-1b-zone-pcs-mgmt-port",
"cidr" = "10.22.6.0/24"
}
"pcs_tunnel_subnet" = {
"name" = "subnet-ap-south-1b-zone-pcs-tunnel-subnet",
"cidr" = "10.22.7.0/24"
}
}
}
}
variable security_group_map {
description = "The security group names for int, ext, mgmt ports and backend resources. Customise according to your environment"
type = map
default = {
"pcs_int_port" = "sg_pcs_int_port",
"pcs_ext_port" = "sg_pcs_ext_port",
"pcs_mgmt_port" = "sg_pcs_mgmt_port",
"backend_svr" = "sg_backend_svr",
}
}
variable image_name {
description = "Name you want to assign to this VM"
default = "pulse-connect-secure-91r1-1505-4dbe1804-0d2a-499b-bd67-01bfde746ec5-ami-0ea5eb502b988260a.4"
}
variable image_from {
description = "From where should I fetch the image from. can be self|aws-marketplace"
default = "aws-marketplace"
}
variable ami_id {
description = "AMI ID of the image in market place that you want to use to deploy this VM"
default = "ami-02fe67adcf0e0b82a"
}
variable instance_type_map {
description = "The instance types that should be assigned to 2 nics or 3 nics"
type = map
default = {
"2_nics" = "t2.medium",
"3_nics" = "t2.large",
}
}
variable ssh_key_map {
description = "The ssh public key to use to login to the VM instance on AWS cloud"
type = map
default = {
"name" = "aws-public-key",
"public_key" = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0MoRMdku5GQAKkOmfRzey5MNY9AsDHUXAtfIVvsShNxWXv4t43XjeOT6XhutzU2isYuhFteoA43nSnQ/kYJumO0TRi+cYQdz/KZohhlNcZqQMnlGaQF/ksjjWBSdulcSIRUv1rnEWaygU6VP3KXMAhrPR7710ReSdpth3HYJHROtFT8wFOaZUTwpi7Kjqc3h1q/IjNfe0rdSpyLdaK4XsOEYzRbk7mxddH/VHf+WNTvH2tgtkdMf+cQIMVj40W0aFbZp9bXZY3g2sotIZPViBzyMPaPkCcBm07ZiFFCjx7qUzqLk+IOrOTQNaTbsb3TFsKzKpiYXODRtOoGVXwjtD [email protected]",
}
}
variable instance_type {
default = "t2.medium"
}
variable instance_name {
default = "pcsaws21"
}
variable instance_name_1 {
default = "pcsawsnode1"
}
variable instance_name_2 {
default = "pcsawsnode2"
}
variable cpu_core_count {
default = "4"
}

variable memory_size {
default = "8"
}
variable eni_amount {
default = "2"
}