Dns
Example: dns resource based on AWS Route 53
Configuration
This example configures a dns Resource Definition using AWS Route 53. A workload using the dns
resource to create dns records looks like:
resources:
...
dns:
type: dns
Infrastructure setup
graph TD;
subgraph AWS Hosted zone
record["record"]
end
subgraph EKS Cluster
pod[workload pod]
end
record --> pod
Orchestrator setup
graph LR;
workload_1 --> dns_1["dns_1, resource_type: dns"]
workload_2 --> dns_2["dns_2, resource_type: dns"]
workload_2 --> shared.dns_1["shared.dns_1, resource_type: dns"]
workload_3 --> shared.dns_1["shared.dns_1, resource_type: dns"]
Terraform docs
Requirements
Name | Version |
---|---|
terraform | >= 1.3.0 |
aws | ~> 5.0 |
humanitec | ~> 1.0 |
random | ~> 3.5 |
Providers
Name | Version |
---|---|
aws | ~> 5.0 |
humanitec | ~> 1.0 |
random | ~> 3.5 |
Modules
Name | Source | Version |
---|---|---|
route53 | ../../humanitec-resource-defs/dns/basic | n/a |
Resources
Name | Type |
---|---|
aws_iam_role.humanitec_provisioner | resource |
aws_iam_role_policy_attachment.humanitec_provisioner | resource |
humanitec_application.example | resource |
humanitec_resource_account.humanitec_provisioner | resource |
humanitec_resource_definition_criteria.dns | resource |
random_password.external_id | resource |
aws_iam_policy_document.instance_assume_role_policy | data source |
Inputs
Name | Description | Type | Default | Required |
---|---|---|---|---|
hosted_zone_id | The id of the hosted zone in which this record set will reside. | string |
n/a | yes |
region | AWS Region | string |
n/a | yes |
name | Name of the example application | string |
"hum-rp-dns-example" |
no |
prefix | Prefix of the created resources | string |
"hum-rp-dns-ex-" |
no |
resource_packs_aws_rev | AWS Resource Pack git branch | string |
"refs/heads/main" |
no |
resource_packs_aws_url | AWS Resource Pack git url | string |
"https://github.com/humanitec-architecture/resource-packs-aws.git" |
no |
main.tf
(view on GitHub)
:
# AWS IAM role used by Humanitec to provision resources
locals {
admin_policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
humanitec_user_arn = "arn:aws:iam::767398028804:user/humanitec"
}
resource "random_password" "external_id" {
length = 16
special = false
}
data "aws_iam_policy_document" "instance_assume_role_policy" {
statement {
actions = ["sts:AssumeRole"]
principals {
type = "AWS"
identifiers = [local.humanitec_user_arn]
}
condition {
test = "StringEquals"
variable = "sts:ExternalId"
values = [random_password.external_id.result]
}
}
}
resource "aws_iam_role" "humanitec_provisioner" {
name = var.name
assume_role_policy = data.aws_iam_policy_document.instance_assume_role_policy.json
}
resource "aws_iam_role_policy_attachment" "humanitec_provisioner" {
role = aws_iam_role.humanitec_provisioner.name
policy_arn = local.admin_policy_arn
}
resource "humanitec_resource_account" "humanitec_provisioner" {
id = var.name
name = var.name
type = "aws-role"
credentials = jsonencode({
aws_role = aws_iam_role.humanitec_provisioner.arn
external_id = random_password.external_id.result
})
depends_on = [
# Otherwise the account looses permissions before the resources are deleted
aws_iam_role_policy_attachment.humanitec_provisioner
]
}
# Example application and resource definition criteria
resource "humanitec_application" "example" {
id = var.name
name = var.name
}
module "route53" {
source = "github.com/humanitec-architecture/resource-packs-aws?ref=v2024-06-14//humanitec-resource-defs/dns/basic"
resource_packs_aws_url = var.resource_packs_aws_url
resource_packs_aws_rev = var.resource_packs_aws_rev
append_logs_to_error = true
driver_account = humanitec_resource_account.humanitec_provisioner.id
region = var.region
prefix = var.prefix
hosted_zone_id = var.hosted_zone_id
}
resource "humanitec_resource_definition_criteria" "dns" {
resource_definition_id = module.route53.id
app_id = humanitec_application.example.id
force_delete = true
}
providers.tf
(view on GitHub)
:
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.0"
}
humanitec = {
source = "humanitec/humanitec"
version = "~> 1.0"
}
random = {
source = "hashicorp/random"
version = "~> 3.5"
}
}
required_version = ">= 1.3.0"
}
provider "aws" {
default_tags {
tags = {
"managed_by" = "terraform"
"source" = "github.com/humanitec-architecture/resource-pack-aws"
}
}
}
provider "humanitec" {}
provider "random" {}
terraform.tfvars.example
(view on GitHub)
:
# The id of the hosted zone in which this record set will reside.
hosted_zone_id = ""
# Name of the example application
name = "hum-rp-dns-example"
# Prefix of the created resources
prefix = "hum-rp-dns-ex-"
# AWS Region
region = ""
# AWS Resource Pack git branch
resource_packs_aws_rev = "refs/tags/v2024-06-14"
# AWS Resource Pack git url
resource_packs_aws_url = "https://github.com/humanitec-architecture/resource-packs-aws.git"
variables.tf
(view on GitHub)
:
variable "region" {
description = "AWS Region"
type = string
}
variable "resource_packs_aws_url" {
description = "AWS Resource Pack git url"
type = string
default = "https://github.com/humanitec-architecture/resource-packs-aws.git"
}
variable "resource_packs_aws_rev" {
description = "AWS Resource Pack git branch"
type = string
default = "refs/tags/v2024-06-14"
}
variable "hosted_zone_id" {
description = "The id of the hosted zone in which this record set will reside."
type = string
}
variable "name" {
description = "Name of the example application"
type = string
default = "hum-rp-dns-example"
}
variable "prefix" {
description = "Prefix of the created resources"
type = string
default = "hum-rp-dns-ex-"
}