-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
5 changed files
with
304 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,282 @@ | ||
| package aws | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| "github.com/aws/aws-sdk-go-v2/aws" | ||
| "github.com/aws/aws-sdk-go-v2/config" | ||
| "github.com/aws/aws-sdk-go-v2/service/ec2" | ||
| "github.com/aws/aws-sdk-go-v2/service/iam" | ||
| "github.com/aws/aws-sdk-go-v2/service/secretsmanager" | ||
|
|
||
| "premai.io/Ayup/go/internal/terror" | ||
| ) | ||
|
|
||
| const ( | ||
| secretName = "ayup-preauth-conf" | ||
| iamRoleName = "ayup-read-preauth-secrets" | ||
| iamPolicyName = "ayup-read-preauth-secrets" | ||
| securityGroupName = "ayup-listen-tcp-50051" | ||
| vpcName = "ayup" | ||
| instanceProfileName = "ayup" | ||
| instanceType = "t2.micro" | ||
| keyName = "ayup-debug" | ||
| amiID = "ami-0abcdef1234567890" // Replace with a valid AMI ID | ||
| ) | ||
|
|
||
| func StartEc2(ctx context.Context) error { | ||
| cfg, err := config.LoadDefaultConfig(ctx) | ||
| if err != nil { | ||
| return terror.Errorf(ctx, "unable to load SDK config, %v", err) | ||
| } | ||
|
|
||
| // Create IAM policy | ||
| iamSvc := iam.NewFromConfig(cfg) | ||
| policyArn, err := createIAMPolicy(ctx, iamSvc) | ||
| if err != nil { | ||
| return terror.Errorf(ctx, "Failed to create IAM policy: %v", err) | ||
| } | ||
|
|
||
| // Create IAM role and attach policy | ||
| roleArn, err := createIAMRole(ctx, iamSvc, policyArn) | ||
| if err != nil { | ||
| return terror.Errorf(ctx, "Failed to create IAM role: %v", err) | ||
| } | ||
|
|
||
| // Create or get VPC | ||
| ec2Svc := ec2.NewFromConfig(cfg) | ||
| vpcID, err := getOrCreateVPC(ctx, ec2Svc) | ||
| if err != nil { | ||
| return terror.Errorf(ctx, "Failed to get or create VPC: %v", err) | ||
| } | ||
|
|
||
| // Create or get security group | ||
| securityGroupID, err := getOrCreateSecurityGroup(ctx, ec2Svc, vpcID) | ||
| if err != nil { | ||
| return terror.Errorf(ctx, "Failed to get or create security group: %v", err) | ||
| } | ||
|
|
||
| // Create secret in Secrets Manager | ||
| smSvc := secretsmanager.NewFromConfig(cfg) | ||
| err = createSecret(ctx, smSvc) | ||
| if err != nil { | ||
| return terror.Errorf(ctx, "Failed to create secret: %v", err) | ||
| } | ||
|
|
||
| // Launch EC2 instance | ||
| instanceID, err := launchEC2Instance(ctx, ec2Svc, roleArn, securityGroupID) | ||
| if err != nil { | ||
| return terror.Errorf(ctx, "Failed to launch EC2 instance: %v", err) | ||
| } | ||
|
|
||
| fmt.Printf("Successfully launched EC2 instance with ID: %s\n", instanceID) | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func createIAMPolicy(ctx context.Context, svc *iam.Client) (string, error) { | ||
| policyDocument := `{ | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": "secretsmanager:GetSecretValue", | ||
| "Resource": "*" | ||
| } | ||
| ] | ||
| }` | ||
|
|
||
| result, err := svc.CreatePolicy(ctx, &iam.CreatePolicyInput{ | ||
| PolicyName: aws.String(iamPolicyName), | ||
| PolicyDocument: aws.String(policyDocument), | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return *result.Policy.Arn, nil | ||
| } | ||
|
|
||
| func createIAMRole(ctx context.Context, svc *iam.Client, policyArn string) (string, error) { | ||
| assumeRolePolicyDocument := `{ | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "Service": "ec2.amazonaws.com" | ||
| }, | ||
| "Action": "sts:AssumeRole" | ||
| } | ||
| ] | ||
| }` | ||
|
|
||
| _, err := svc.CreateRole(ctx, &iam.CreateRoleInput{ | ||
| RoleName: aws.String(iamRoleName), | ||
| AssumeRolePolicyDocument: aws.String(assumeRolePolicyDocument), | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| _, err = svc.AttachRolePolicy(ctx, &iam.AttachRolePolicyInput{ | ||
| RoleName: aws.String(iamRoleName), | ||
| PolicyArn: aws.String(policyArn), | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| profileResult, err := svc.CreateInstanceProfile(ctx, &iam.CreateInstanceProfileInput{ | ||
| InstanceProfileName: aws.String(instanceProfileName), | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| _, err = svc.AddRoleToInstanceProfile(ctx, &iam.AddRoleToInstanceProfileInput{ | ||
| InstanceProfileName: aws.String(instanceProfileName), | ||
| RoleName: aws.String(iamRoleName), | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return *profileResult.InstanceProfile.Arn, nil | ||
| } | ||
|
|
||
| func getOrCreateVPC(ctx context.Context, svc *ec2.Client) (string, error) { | ||
| // Check if VPC exists | ||
| result, err := svc.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{ | ||
| Filters: []ec2types.Filter{ | ||
| { | ||
| Name: aws.String("tag:Name"), | ||
| Values: []string{vpcName}, | ||
| }, | ||
| }, | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| if len(result.Vpcs) > 0 { | ||
| return *result.Vpcs[0].VpcId, nil | ||
| } | ||
|
|
||
| // Create VPC if it doesn't exist | ||
| createResult, err := svc.CreateVpc(ctx, &ec2.CreateVpcInput{ | ||
| CidrBlock: aws.String("10.0.0.0/16"), | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| // Add Name tag to VPC | ||
| _, err = svc.CreateTags(ctx, &ec2.CreateTagsInput{ | ||
| Resources: []string{*createResult.Vpc.VpcId}, | ||
| Tags: []ec2types.Tag{ | ||
| { | ||
| Key: aws.String("Name"), | ||
| Value: aws.String(vpcName), | ||
| }, | ||
| }, | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return *createResult.Vpc.VpcId, nil | ||
| } | ||
|
|
||
| func getOrCreateSecurityGroup(ctx context.Context, svc *ec2.Client, vpcID string) (string, error) { | ||
| // Check if security group exists | ||
| result, err := svc.DescribeSecurityGroups(ctx, &ec2.DescribeSecurityGroupsInput{ | ||
| Filters: []ec2types.Filter{ | ||
| { | ||
| Name: aws.String("group-name"), | ||
| Values: []string{securityGroupName}, | ||
| }, | ||
| { | ||
| Name: aws.String("vpc-id"), | ||
| Values: []string{vpcID}, | ||
| }, | ||
| }, | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| if len(result.SecurityGroups) > 0 { | ||
| return *result.SecurityGroups[0].GroupId, nil | ||
| } | ||
|
|
||
| // Create security group if it doesn't exist | ||
| createResult, err := svc.CreateSecurityGroup(ctx, &ec2.CreateSecurityGroupInput{ | ||
| GroupName: aws.String(securityGroupName), | ||
| Description: aws.String("Security group for EC2 instance"), | ||
| VpcId: aws.String(vpcID), | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| // Authorize inbound traffic on port 50051/tcp | ||
| _, err = svc.AuthorizeSecurityGroupIngress(ctx, &ec2.AuthorizeSecurityGroupIngressInput{ | ||
| GroupId: aws.String(*createResult.GroupId), | ||
| IpPermissions: []ec2types.IpPermission{ | ||
| { | ||
| IpProtocol: aws.String("tcp"), | ||
| FromPort: aws.Int32(50051), | ||
| ToPort: aws.Int32(50051), | ||
| IpRanges: []ec2types.IpRange{ | ||
| { | ||
| CidrIp: aws.String("0.0.0.0/0"), | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return *createResult.GroupId, nil | ||
| } | ||
|
|
||
| func createSecret(ctx context.Context, svc *secretsmanager.Client) error { | ||
| _, err := svc.CreateSecret(ctx, &secretsmanager.CreateSecretInput{ | ||
| Name: aws.String(secretName), | ||
| SecretString: aws.String(secretValue), | ||
| }) | ||
| return err | ||
| } | ||
|
|
||
| func launchEC2Instance(ctx context.Context, svc *ec2.Client, roleArn, securityGroupID string) (string, error) { | ||
| runResult, err := svc.RunInstances(ctx, &ec2.RunInstancesInput{ | ||
| ImageId: aws.String(amiID), | ||
| InstanceType: ec2types.InstanceTypeT2Micro, | ||
| KeyName: aws.String(keyName), | ||
| MinCount: aws.Int32(1), | ||
| MaxCount: aws.Int32(1), | ||
| IamInstanceProfile: &ec2types.IamInstanceProfileSpecification{ | ||
| Arn: aws.String(roleArn), | ||
| }, | ||
| SecurityGroupIds: []string{securityGroupID}, | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| instanceID := *runResult.Instances[0].InstanceId | ||
|
|
||
| // Wait for the instance to be in running state | ||
| err = svc.WaitUntilInstanceRunning(ctx, &ec2.DescribeInstancesInput{ | ||
| InstanceIds: []string{instanceID}, | ||
| }) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return instanceID, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters