Развертывание Keycloak на AWS ECS с Fargate с использованием Terraform

1# Конфигурация VPC
2module "vpc" {
3  source  = "terraform-aws-modules/vpc/aws"
4  version = "~> 3.0"
5
6  name = "keycloak-vpc"
7  cidr = "10.0.0.0/16"
8
9  azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
10  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
11  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
12
13  enable_nat_gateway = true
14  single_nat_gateway = false  # Для продакшена используйте несколько NAT gateway
15  one_nat_gateway_per_az = true
16
17  enable_vpn_gateway = false
18
19  # Включите поддержку DNS для VPC
20  enable_dns_hostnames = true
21  enable_dns_support   = true
22
23  # Добавьте теги для лучшего управления ресурсами
24  tags = {
25    Environment = "production"
26    Project     = "keycloak"
27    Terraform   = "true"
28  }
29}
30
31# Группы безопасности
32resource "aws_security_group" "alb" {
33  name        = "keycloak-alb-sg"
34  description = "Группа безопасности для Keycloak ALB"
35  vpc_id      = module.vpc.vpc_id
36
37  ingress {
38    description = "HTTPS из интернета"
39    from_port   = 443
40    to_port     = 443
41    protocol    = "tcp"
42    cidr_blocks = ["0.0.0.0/0"]
43  }
44
45  ingress {
46    description = "HTTP из интернета (для редиректов)"
47    from_port   = 80
48    to_port     = 80
49    protocol    = "tcp"
50    cidr_blocks = ["0.0.0.0/0"]
51  }
52
53  egress {
54    from_port   = 0
55    to_port     = 0
56    protocol    = "-1"
57    cidr_blocks = ["0.0.0.0/0"]
58  }
59}

1# Группа подсетей базы данных
2resource "aws_db_subnet_group" "keycloak" {
3  name       = "keycloak-db-subnet-group"
4  subnet_ids = module.vpc.private_subnets
5
6  tags = {
7    Name = "Keycloak DB Subnet Group"
8  }
9}
10
11# Группа безопасности базы данных
12resource "aws_security_group" "database" {
13  name        = "keycloak-database-sg"
14  description = "Группа безопасности для базы данных Keycloak"
15  vpc_id      = module.vpc.vpc_id
16
17  ingress {
18    description     = "PostgreSQL от сервиса Keycloak"
19    from_port       = 5432
20    to_port         = 5432
21    protocol        = "tcp"
22    security_groups = [aws_security_group.keycloak.id]
23  }
24
25  egress {
26    from_port   = 0
27    to_port     = 0
28    protocol    = "-1"
29    cidr_blocks = ["0.0.0.0/0"]
30  }
31}
32
33# Кластер Aurora PostgreSQL
34resource "aws_rds_cluster" "keycloak" {
35  cluster_identifier      = "keycloak-cluster"
36  engine                  = "aurora-postgresql"
37  engine_version          = "13.7"
38  database_name           = "keycloak"
39  master_username         = "keycloak"
40  master_password         = var.database_password  # Используйте AWS Secrets Manager в продакшене
41  backup_retention_period = 7
42  preferred_backup_window = "03:00-04:00"
43  db_subnet_group_name    = aws_db_subnet_group.keycloak.name
44  vpc_security_group_ids  = [aws_security_group.database.id]
45  skip_final_snapshot     = true  # Измените для продакшена
46
47  tags = {
48    Name = "Keycloak Aurora Cluster"
49  }
50}

1# Кластер ECS
2resource "aws_ecs_cluster" "keycloak" {
3  name = "keycloak-cluster"
4
5  setting {
6    name  = "containerInsights"
7    value = "enabled"
8  }
9
10  tags = {
11    Name = "Keycloak ECS Cluster"
12  }
13}
14
15# Определение задач ECS
16resource "aws_ecs_task_definition" "keycloak" {
17  family                   = "keycloak"
18  network_mode             = "awsvpc"
19  requires_compatibilities = ["FARGATE"]
20  cpu                      = "1024"
21  memory                   = "2048"
22  execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn
23
24  container_definitions = jsonencode([
25    {
26      name  = "keycloak"
27      image = "quay.io/keycloak/keycloak:20.0.3"
28      essential = true
29      portMappings = [
30        {
31          containerPort = 8080
32          hostPort      = 8080
33          protocol      = "tcp"
34        }
35      ]
36      environment = [
37        { name = "KC_DB", value = "postgres" },
38        { name = "KC_DB_URL", value = "jdbc:postgresql://keycloak-cluster.cluster-abc123xyz.us-east-1.rds.amazonaws.com:5432/keycloak" },
39        { name = "KC_DB_USERNAME", value = "keycloak" },
40        { name = "KC_DB_PASSWORD", value = "var.database_password" },
41        { name = "KEYCLOAK_ADMIN", value = "admin" },
42        { name = "KEYCLOAK_ADMIN_PASSWORD", value = "var.keycloak_admin_password" }
43      ]
44      command = ["start", "--optimized"]
45    }
46  ])
47}

1# Application Load Balancer
2resource "aws_lb" "keycloak" {
3  name               = "keycloak-alb"
4  internal           = false
5  load_balancer_type = "application"
6  security_groups    = [aws_security_group.alb.id]
7  subnets            = module.vpc.public_subnets
8
9  enable_deletion_protection = true  # Установите true для продакшена
10
11  tags = {
12    Name = "Keycloak ALB"
13  }
14}

1# Запись Route 53 для Keycloak
2resource "aws_route53_record" "keycloak" {
3  zone_id = var.route53_zone_id
4  name    = var.keycloak_hostname
5  type    = "A"
6
7  alias {
8    name                   = aws_lb.keycloak.dns_name
9    zone_id                = aws_lb.keycloak.zone_id
10    evaluate_target_health = true
11  }
12}

1# Инициализируйте Terraform
2terraform init
3
4# Запланируйте развертывание
5terraform plan -var-file=prod.tfvars -out=tfplan
6
7# Примените развертывание
8terraform apply tfplan
9
10# Проверьте развертывание
11terraform output