Establishing a Secure Remote Development Environment with AWS EC2 and Terraform

### VPC  
resource "aws_vpc" "vpc-dev" {  
  cidr_block            = "10.10.0.0/21"  
  enable_dns_support   = true  
  enable_dns_hostnames = true  
  tags                 = merge(tomap({  
    Name = "dev-vpc",  
  }), local.common_tags)  
}  
  
### Public subnet  
resource "aws_subnet" "public-subnet" {  
  cidr_block              = "10.10.1.0/24"  
  vpc_id                  = aws_vpc.vpc-dev.id  
  availability_zone       = "eu-west-2a"  
  map_public_ip_on_launch = true  
  
  tags = merge(tomap({  
    Name = "dev-public"  
  }), local.common_tags)  
}  
  
### Route tables for the subnet
resource "aws_route_table" "public-route-table-dev" {  
  vpc_id = aws_vpc.vpc-dev.id  
  tags   = merge(tomap({  
    Name = "public-route-table",  
  }), local.common_tags)  
}  
  
### Associate the newly created route tables to the subnet
resource "aws_route_table_association" "public-route-association" {  
  route_table_id = aws_route_table.public-route-table-dev.id  
  subnet_id      = aws_subnet.public-subnet.id  
}  

### Internet Gateway for the public subnet  
resource "aws_internet_gateway" "igw-dev" {  
  vpc_id = aws_vpc.vpc-dev.id  
  tags   = merge(tomap({  
    Name = "publick-igw",  
  }), local.common_tags)  
}  
  
### Route the public subnet traffic through the Internet Gateway  
resource "aws_route" "public-internet-igw-route-dev" {  
  route_table_id         = aws_route_table.public-route-table-dev.id  
  gateway_id             = aws_internet_gateway.igw-dev.id  
  destination_cidr_block = "0.0.0.0/0"  
}

### Dev Environment Security group (traffic Local ssh -> EC2) 
resource "aws_security_group" "dev_environment" {  
  name        = "Dev Environment Security Group"  
  description = "Allows inbound access from the SSH only"  
  vpc_id      = aws_vpc.vpc-dev.id  
  
  # For connecting to your EC2 from your local machine, you need to add your IP address  
  ingress {  
    from_port   = 22  
    to_port     = 22  
    protocol    = "tcp"  
    cidr_blocks = [  
      "192.168.0.1/32"  
    ]  
  }  
  
  egress {  
    from_port   = 0  
    to_port     = 0  
    protocol    = "-1"  
    cidr_blocks = [  
      "0.0.0.0/0"  
    ]  
  }  
  tags = merge(tomap({  
    Name = "Dev Environment Security Group"  
  }), local.common_tags)  
}  

resource "aws_key_pair" "ssh_key_dev_environment" {  
  key_name   = "ssh_key_dev_environment"  
  public_key = "ssh-rsa AAAAB3Nza"  
}  
  
# instance data  
data "aws_ami" "ubuntu_22_04" {  
  most_recent = true  
  
  filter {  
    name   = "name"  
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]  
  }  
  
  filter {  
    name   = "architecture"  
    values = ["x86_64"]  
  }  
  owners = ["099720109477"] # Canonical  
}  
  
locals {  
  development_environment_user_data = <<EOT  
#!/bin/bash  
# on_cloud_init.sh  
# ----------------------------------------------------------------------------  
# This script is passed as user data during EC2 launch and executed  
# when the EC2 instance is booted for the first time.  
# Since all user data scripts are executed as root there's not need for sudo  
# ----------------------------------------------------------------------------  
set -eu  
  
installPackages() {  
  echo '*** Installing packages ***'  
  sudo apt-get update  
  sudo apt-get install awscli net-tools mc -y  
}  
  
installPackages  
  
export AWS_REGION=eu-central-1  
export PROJECT_DATA_VOLUME_MARKER=/data/.data_volume  
  
mountDataVolume() {  
  
  DATA_BLOCK_DEVICE=/dev/xvdf  
  echo '*** Mounting data volume ***'  
  
  echo "Wait for data volume to be attached"  
  while ! lsblk $DATA_BLOCK_DEVICE ; do  
    echo "/dev/xvdf is not attached yet. Waiting 5 seconds"  
    sleep 5  
  done  
  
  
  echo "Check if filesystem ext is on data volume"  
  if [ "$(lsblk -f $DATA_BLOCK_DEVICE -o FSTYPE -n)" == "ext4" ]  
  then  
    echo "filesystem ext4 is already on data volume"  
  else  
    echo "creating filesystem ext4 on data volume"  
    sudo mkfs -t ext4 $DATA_BLOCK_DEVICE  
  fi  
  
  echo "mount data volume at /data"  
  sudo mkdir -p /data  
  echo "UUID=$(blkid -s UUID -o value $DATA_BLOCK_DEVICE)  /data  ext4  defaults,nofail  0  2" | sudo tee /etc/fstab -a  
  mount -a  
  sudo mount | grep '/data'  
}  
  
echo "Check if data volume is already mounted"  
if [ -e "$PROJECT_DATA_VOLUME_MARKER" ]  
then  
  echo '*** project data volume already mounted ***'  
else  
  mountDataVolume  
  echo "Marking data volumes as mounted"  
  echo "DO NOT DELETE OR RENAME THIS FILE\!" > $PROJECT_DATA_VOLUME_MARKER  
fi  
  
EOT  
}  
  
resource "aws_instance" "development_environment" {  
  ami           = data.aws_ami.ubuntu_22_04.id  
  instance_type = "t2.micro"  
  
  
  subnet_id = aws_subnet.public-subnet.id  
  
  vpc_security_group_ids = [  
    aws_security_group.dev_environment.id,  
  ]  
  
  
  root_block_device {  
    volume_size = 10  
    volume_type = "gp3"  
  }  
  
  user_data            = local.development_environment_user_data  
  
  key_name   = aws_key_pair.ssh_key_dev_environment.key_name  
  monitoring = false  
  
  tags = merge(tomap({  
    Name = "Development Environment"  
  }), local.common_tags)  
}  
  
  
# Create and attache EBS  
  
resource aws_ebs_volume application_data {  
  availability_zone = "eu-west-2a"  
  encrypted         = true  
  size              = 100  
  type              = "gp3"  
  tags              = merge({  
    Name    = "vol-remote-dev-data"  
  }, local.common_tags)  
}  
  
resource aws_volume_attachment env_data {  
  device_name = "/dev/sdf"  
  instance_id = aws_instance.development_environment.id  
  volume_id   = aws_ebs_volume.application_data.id  
}

$ terraform plan
$ terraform apply

ssh -N -L <LOCAL PORT>:localhost:<REMOTE PORT> ubuntu@<IP ADDRESS>