From 8a5e3272c6fc498e8193f1d019747557c3a9c116 Mon Sep 17 00:00:00 2001 From: jmromeroes Date: Wed, 15 Apr 2026 16:25:43 -0500 Subject: [PATCH 1/3] CLM-39516: Update AWS reference architecture to match L-sized architecture - Update ECS configuration to L profile: 8 vCPU ARM (Graviton), 64 GB RAM - Update Java heap to 48GB (75% of 64GB RAM) with AlwaysPreTouch and monitoring threads - Change Aurora/RDS instance class from db.r6g.4xlarge to db.r6g.2xlarge - Add ALB idle timeout configuration (180 seconds) - Add ecs_runtime_platform variable for ARM64 architecture - Update documentation with L Customer Profile notes Co-Authored-By: Claude Opus 4.6 --- infra-aws-ha/README.md | 19 +++-- infra-aws-ha/terraform.tfvars.example | 103 ++++++++++++------------ infra-aws-ha/variables.tf | 65 ++++++++++----- infra-aws/README.md | 22 ++++-- infra-aws/terraform.tfvars.example | 110 +++++++++++++++++++------- infra-aws/variables.tf | 83 +++++++++++++++---- 6 files changed, 274 insertions(+), 128 deletions(-) diff --git a/infra-aws-ha/README.md b/infra-aws-ha/README.md index ffc68ba..a37a7e8 100644 --- a/infra-aws-ha/README.md +++ b/infra-aws-ha/README.md @@ -162,26 +162,32 @@ private_subnet_cidrs = ["10.0.10.0/24", "10.0.20.0/24", "10.0.30.0/24"] db_subnet_cidrs = ["10.0.40.0/24", "10.0.50.0/24", "10.0.60.0/24"] enable_nat_gateway = true -# ECS Configuration +# ECS Configuration - L Customer Profile +# L Profile: 8 vCPU ARM (Graviton), 64 GB RAM ecs_cpu = 8192 # 8 vCPU -ecs_memory = 32768 # 32 GB -ecs_memory_reservation = 24576 # 24 GB soft limit +ecs_memory = 65536 # 64 GB +ecs_memory_reservation = 49152 # 48 GB soft limit # IQ Server Configuration -iq_desired_count = 3 +iq_desired_count = 2 # Minimum 2 for HA iq_min_count = 2 iq_max_count = 5 iq_cpu_target_value = 70 # CPU target for auto scaling (%) iq_memory_target_value = 80 # Memory target for auto scaling (%) iq_docker_image = "sonatype/nexus-iq-server:latest" -java_opts = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs" + +# Java options for L profile: 48GB heap (75% of 64GB RAM) +# AlwaysPreTouch: Pre-faults heap pages for consistent GC performance +# CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting +# insight.threads.monitor=10: Enables monitoring thread pool +java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" # Database Configuration (Aurora PostgreSQL) db_name = "nexusiq" db_username = "nexusiq" db_password = "YourSecurePassword123!" # Change this! aurora_engine_version = "15.10" -aurora_instance_class = "db.r6g.4xlarge" +aurora_instance_class = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton aurora_instances = 2 db_backup_retention_period = 7 db_backup_window = "03:00-04:00" @@ -192,6 +198,7 @@ db_deletion_protection = false # Load Balancer Configuration # ssl_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" alb_deletion_protection = false +alb_idle_timeout = 180 # 3 minutes # EFS Configuration efs_throughput_mode = "provisioned" diff --git a/infra-aws-ha/terraform.tfvars.example b/infra-aws-ha/terraform.tfvars.example index 16a39c2..036b49e 100644 --- a/infra-aws-ha/terraform.tfvars.example +++ b/infra-aws-ha/terraform.tfvars.example @@ -1,12 +1,12 @@ -# Copy this file to terraform.tfvars and update the values +# Copy this file to terraform.tfvars and update the values # cp terraform.tfvars.example terraform.tfvars - + # ================================ # GENERAL CONFIGURATION # ================================ aws_region = "us-east-1" cluster_name = "ref-arch-iq-ha-cluster" - + # ================================ # NETWORK CONFIGURATION # ================================ @@ -15,25 +15,29 @@ public_subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] private_subnet_cidrs = ["10.0.10.0/24", "10.0.20.0/24", "10.0.30.0/24"] db_subnet_cidrs = ["10.0.40.0/24", "10.0.50.0/24", "10.0.60.0/24"] enable_nat_gateway = true - + # ================================ -# ECS CONFIGURATION +# ECS CONFIGURATION - L Customer Profile # ================================ +# L Profile: 8 vCPU ARM (Graviton), 64 GB RAM ecs_cpu = 8192 # 8 vCPU -ecs_memory = 32768 # 32 GB -ecs_memory_reservation = 24576 # 24 GB soft limit - -# ================================ -# IQ SERVER CONFIGURATION -# ================================ -iq_desired_count = 3 # 3 instances for better HA -iq_min_count = 2 # Minimum for auto scaling -iq_max_count = 5 # Maximum for auto scaling -iq_cpu_target_value = 70 # CPU target for auto scaling (%) -iq_memory_target_value = 80 # Memory target for auto scaling (%) -iq_docker_image = "sonatype/nexus-iq-server:latest" -java_opts = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs" - +ecs_memory = 65536 # 64 GB +ecs_memory_reservation = 49152 # 48 GB soft limit + +# IQ Server Configuration +iq_desired_count = 2 # Minimum 2 for HA +iq_min_count = 2 # Minimum for auto scaling +iq_max_count = 5 # Maximum for auto scaling +iq_cpu_target_value = 70 # CPU target for auto scaling (%) +iq_memory_target_value = 80 # Memory target for auto scaling (%) +iq_docker_image = "sonatype/nexus-iq-server:latest" + +# Java options for L profile: 48GB heap (75% of 64GB RAM) +# AlwaysPreTouch: Pre-faults heap pages for consistent GC performance +# CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting +# insight.threads.monitor=10: Enables monitoring thread pool +java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" + # ================================ # DATABASE CONFIGURATION (Aurora PostgreSQL) # ================================ @@ -41,46 +45,46 @@ db_name = "nexusiq" db_username = "nexusiq" db_password = "YourSecurePassword123!" # CHANGE THIS! aurora_engine_version = "15.10" -aurora_instance_class = "db.r6g.4xlarge" +aurora_instance_class = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton aurora_instances = 2 # Minimum 2 for HA -db_backup_retention_period = 7 -db_backup_window = "03:00-04:00" -db_maintenance_window = "sun:04:00-sun:05:00" -db_skip_final_snapshot = false # Set to true for development -db_deletion_protection = false # Set to false for development - +db_backup_retention_period = 7 +db_backup_window = "03:00-04:00" +db_maintenance_window = "sun:04:00-sun:05:00" +db_skip_final_snapshot = true +db_deletion_protection = false + # ================================ # LOAD BALANCER CONFIGURATION # ================================ # Uncomment and provide SSL certificate ARN for HTTPS # ssl_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" -alb_deletion_protection = false # Set to true for production - +alb_deletion_protection = false +alb_idle_timeout = 180 + # ================================ # EFS CONFIGURATION # ================================ efs_throughput_mode = "provisioned" efs_provisioned_throughput_in_mibps = 100 - # ================================ # MONITORING CONFIGURATION # ================================ enable_container_insights = true -enable_prometheus = true -log_retention_days = 30 - +enable_prometheus = true +log_retention_days = 30 + # ================================ # COMMON TAGS # ================================ common_tags = { Project = "nexus-iq-server-ha" - Environment = "production" # or "development", "staging" + Environment = "production" Terraform = "true" Owner = "platform-team" CostCenter = "engineering" } - + # ================================ # SECURITY NOTES # ================================ @@ -89,23 +93,14 @@ common_tags = { # 3. Provide an SSL certificate ARN for HTTPS termination # 4. Restrict public access CIDRs in production # 5. Enable deletion protection for production resources -# 6. Use specific Helm chart versions rather than "latest" in production - -# ================================ -# COST OPTIMIZATION NOTES -# ================================ -# 1. ECS Fargate pricing based on vCPU and memory usage -# 2. Use smaller task sizes (ecs_cpu/ecs_memory) for development -# 3. Adjust backup retention periods based on requirements -# 4. Use burstable EFS throughput mode if consistent high throughput isn't needed -# 5. Consider using Fargate Spot for non-production workloads - -# ================================ -# HIGH AVAILABILITY NOTES -# ================================ -# 1. Minimum 2 IQ Server tasks (iq_desired_count = 2) -# 2. Minimum 2 Aurora instances (aurora_instances = 2) -# 3. ECS tasks run across multiple Availability Zones -# 4. Auto scaling based on CPU and memory utilization -# 5. Service discovery for inter-task communication -# 6. Shared EFS storage for stateful data + +# ================================ +# L CUSTOMER PROFILE NOTES +# ================================ +# This configuration is optimized for large-scale deployments: +# - 8 vCPU ARM Graviton (cost-optimized) +# - 64 GB RAM with 48 GB Java heap for policy evaluation workloads +# - Suitable for ~15,000 applications with continuous monitoring +# - Database: 64 GB RAM, 500 GB storage, up to 2000 GB auto-scale +# - Aurora Multi-AZ with 2 instances for HA +# - EFS provisioned throughput for shared storage diff --git a/infra-aws-ha/variables.tf b/infra-aws-ha/variables.tf index 10a871a..b10957a 100644 --- a/infra-aws-ha/variables.tf +++ b/infra-aws-ha/variables.tf @@ -1,3 +1,5 @@ +# Sonatype IQ Server - AWS Cloud-Native HA Configuration +# L Customer Profile: 8 vCPU ARM, 64 GB RAM, 48 GB Java heap variable "aws_region" { description = "AWS region for resources" @@ -11,7 +13,7 @@ variable "cluster_name" { default = "ref-arch-iq-ha-cluster" } - +# Network Configuration variable "vpc_cidr" { description = "CIDR block for VPC" type = string @@ -25,7 +27,7 @@ variable "public_subnet_cidrs" { } variable "private_subnet_cidrs" { - description = "CIDR blocks for private subnets (EKS nodes)" + description = "CIDR blocks for private subnets (ECS tasks)" type = list(string) default = ["10.0.10.0/24", "10.0.20.0/24", "10.0.30.0/24"] } @@ -42,23 +44,37 @@ variable "enable_nat_gateway" { default = true } - +# ECS Configuration - L Customer Profile +# Note: Using ARM-based Graviton processors for better price/performance +# Fargate ARM requires platform_version = "LATEST" in ECS service variable "ecs_cpu" { - description = "CPU units for ECS task (1024 = 1 vCPU)" + description = "CPU units for ECS task (1024 = 1 vCPU). L profile: 8 vCPU (8192)" type = number default = 8192 } variable "ecs_memory" { - description = "Memory for ECS task in MiB" + description = "Memory for ECS task in MiB. L profile: 64 GB (65536 MiB)" type = number - default = 32768 + default = 65536 } variable "ecs_memory_reservation" { description = "Soft memory limit for ECS task in MiB" type = number - default = 24576 + default = 49152 # 48 GB soft limit +} + +variable "ecs_runtime_platform" { + description = "ECS runtime platform configuration for ARM (Graviton)" + type = object({ + cpu_architecture = string + operating_system_family = string + }) + default = { + cpu_architecture = "ARM64" + operating_system_family = "LINUX" + } } variable "enable_container_insights" { @@ -67,11 +83,11 @@ variable "enable_container_insights" { default = true } - +# IQ Server Configuration variable "iq_desired_count" { description = "Desired number of IQ Server tasks (HA requires minimum 2)" type = number - default = 3 + default = 2 validation { condition = var.iq_desired_count >= 2 @@ -115,12 +131,17 @@ variable "iq_docker_image" { } variable "java_opts" { - description = "Java options for IQ Server" + description = "Java options for IQ Server (L profile: 48GB heap, 75% of 64GB RAM)" type = string - default = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs" + default = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" + # Note: Using 48GB heap (75% of 64GB RAM) for large-scale workloads + # Can increase to 55GB (86%) if needed for peak continuous monitoring loads + # AlwaysPreTouch: Pre-faults all heap pages during startup for consistent GC performance + # CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting + # insight.threads.monitor=10: Enables monitoring thread pool for continuous monitoring } - +# Database Configuration (Aurora PostgreSQL) variable "db_name" { description = "Database name" type = string @@ -146,9 +167,9 @@ variable "aurora_engine_version" { } variable "aurora_instance_class" { - description = "Aurora instance class" + description = "Aurora instance class (ARM Graviton for better price/performance)" type = string - default = "db.r6g.4xlarge" + default = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton } variable "aurora_instances" { @@ -192,7 +213,7 @@ variable "db_deletion_protection" { default = false } - +# Load Balancer Configuration variable "ssl_certificate_arn" { description = "ARN of SSL certificate for ALB HTTPS listener" type = string @@ -205,7 +226,13 @@ variable "alb_deletion_protection" { default = false } +variable "alb_idle_timeout" { + description = "ALB idle timeout in seconds" + type = number + default = 180 +} +# EFS Configuration variable "efs_throughput_mode" { description = "EFS throughput mode" type = string @@ -223,7 +250,7 @@ variable "efs_provisioned_throughput_in_mibps" { default = 100 } - +# Logging Configuration variable "log_retention_days" { description = "CloudWatch log retention in days" type = number @@ -248,14 +275,14 @@ variable "log_archive_retention_days" { default = 2555 } - +# Monitoring Configuration variable "enable_prometheus" { description = "Enable Prometheus monitoring" type = bool default = true } - +# Common Tags variable "common_tags" { description = "Common tags to apply to all resources" type = map(string) @@ -264,4 +291,4 @@ variable "common_tags" { Environment = "production" Terraform = "true" } -} \ No newline at end of file +} diff --git a/infra-aws/README.md b/infra-aws/README.md index 11b4821..c633f5d 100644 --- a/infra-aws/README.md +++ b/infra-aws/README.md @@ -155,18 +155,25 @@ public_subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24"] private_subnet_cidrs = ["10.0.10.0/24", "10.0.20.0/24"] db_subnet_cidrs = ["10.0.30.0/24", "10.0.40.0/24"] -# ECS Configuration -ecs_cpu = 8192 # 8 vCPU -ecs_memory = 32768 # 32 GB -iq_desired_count = 1 # Single instance -iq_docker_image = "sonatype/nexus-iq-server:latest" -java_opts = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs" +# ECS Configuration - L Customer Profile +# L Profile: 8 vCPU ARM (Graviton), 64 GB RAM +ecs_cpu = 8192 # 8 vCPU +ecs_memory = 65536 # 64 GB +ecs_memory_reservation = 49152 # 48 GB soft limit +iq_desired_count = 1 # Single instance +iq_docker_image = "sonatype/nexus-iq-server:latest" + +# Java options for L profile: 48GB heap (75% of 64GB RAM) +# AlwaysPreTouch: Pre-faults heap pages for consistent GC performance +# CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting +# insight.threads.monitor=10: Enables monitoring thread pool +java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" # Database Configuration db_name = "nexusiq" db_username = "nexusiq" db_password = "YourSecurePassword123!" # Change this! -db_instance_class = "db.r6g.4xlarge" +db_instance_class = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton db_allocated_storage = 500 db_max_allocated_storage = 1000 postgres_version = "15.10" @@ -179,6 +186,7 @@ db_deletion_protection = false # Load Balancer Configuration # ssl_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" alb_deletion_protection = false +alb_idle_timeout = 180 # 3 minutes # Logging Configuration log_retention_days = 30 diff --git a/infra-aws/terraform.tfvars.example b/infra-aws/terraform.tfvars.example index d73d878..95fe2e6 100644 --- a/infra-aws/terraform.tfvars.example +++ b/infra-aws/terraform.tfvars.example @@ -1,39 +1,93 @@ -# Copy this file to terraform.tfvars and update the values +# Copy this file to terraform.tfvars and update the values # cp terraform.tfvars.example terraform.tfvars - -# General Configuration -aws_region = "us-east-1" - -# Network Configuration + +# ================================ +# GENERAL CONFIGURATION +# ================================ +aws_region = "us-east-1" +cluster_name = "ref-arch-iq-cluster" + +# ================================ +# NETWORK CONFIGURATION +# ================================ vpc_cidr = "10.0.0.0/16" public_subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24"] private_subnet_cidrs = ["10.0.10.0/24", "10.0.20.0/24"] db_subnet_cidrs = ["10.0.30.0/24", "10.0.40.0/24"] - -# ECS Configuration -ecs_cpu = 8192 # 8 vCPU -ecs_memory = 32768 # 32 GB -iq_desired_count = 1 # Single instance (recommended) -iq_docker_image = "sonatype/nexus-iq-server:latest" -java_opts = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs" - -# Database Configuration + +# ================================ +# ECS CONFIGURATION - L Customer Profile +# ================================ +# L Profile: 8 vCPU ARM (Graviton), 64 GB RAM +ecs_cpu = 8192 # 8 vCPU +ecs_memory = 65536 # 64 GB +ecs_memory_reservation = 49152 # 48 GB soft limit + +# IQ Server Configuration +iq_desired_count = 1 # Single instance (for pilot/dev; use HA config for production) +iq_docker_image = "sonatype/nexus-iq-server:latest" + +# Java options for L profile: 48GB heap (75% of 64GB RAM) +# AlwaysPreTouch: Pre-faults heap pages for consistent GC performance +# CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting +# insight.threads.monitor=10: Enables monitoring thread pool +java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" + +# ================================ +# DATABASE CONFIGURATION +# ================================ db_name = "nexusiq" db_username = "nexusiq" -db_password = "YourSecurePassword123!" # Change this! -db_instance_class = "db.r6g.4xlarge" +db_password = "YourSecurePassword123!" # CHANGE THIS! +db_instance_class = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton db_allocated_storage = 500 -db_max_allocated_storage = 1000 +db_max_allocated_storage = 2000 postgres_version = "15.10" -db_backup_retention_period = 7 -db_backup_window = "03:00-04:00" -db_maintenance_window = "sun:04:00-sun:05:00" -db_skip_final_snapshot = true -db_deletion_protection = false - -# Load Balancer Configuration +db_backup_retention_period = 7 +db_backup_window = "03:00-04:00" +db_maintenance_window = "sun:04:00-sun:05:00" +db_skip_final_snapshot = true +db_deletion_protection = false + +# ================================ +# LOAD BALANCER CONFIGURATION +# ================================ +# Uncomment and provide SSL certificate ARN for HTTPS # ssl_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" alb_deletion_protection = false - -# Logging Configuration -log_retention_days = 30 +alb_idle_timeout = 180 + +# ================================ +# MONITORING CONFIGURATION +# ================================ +enable_container_insights = true +log_retention_days = 30 + +# ================================ +# COMMON TAGS +# ================================ +common_tags = { + Project = "nexus-iq-server" + Environment = "production" + Terraform = "true" + Owner = "platform-team" + CostCenter = "engineering" +} + +# ================================ +# SECURITY NOTES +# ================================ +# 1. Change the db_password to a strong, unique password +# 2. Consider using AWS Secrets Manager rotation for the database password +# 3. Provide an SSL certificate ARN for HTTPS termination +# 4. Enable deletion protection for production resources + +# ================================ +# L CUSTOMER PROFILE NOTES +# ================================ +# This configuration is optimized for large-scale deployments: +# - 8 vCPU ARM Graviton (cost-optimized) +# - 64 GB RAM with 48 GB Java heap for policy evaluation workloads +# - Suitable for ~15,000 applications with continuous monitoring +# - Database: 64 GB RAM, 500 GB storage, up to 2000 GB auto-scale +# - LB idle timeout 180 seconds diff --git a/infra-aws/variables.tf b/infra-aws/variables.tf index 51aeb34..26a8ec1 100644 --- a/infra-aws/variables.tf +++ b/infra-aws/variables.tf @@ -1,3 +1,5 @@ +# Sonatype IQ Server - AWS Cloud-Native Configuration +# L Customer Profile: 8 vCPU ARM, 64 GB RAM, 48 GB Java heap variable "aws_region" { description = "AWS region for resources" @@ -5,8 +7,13 @@ variable "aws_region" { default = "us-east-1" } +variable "cluster_name" { + description = "Name of the ECS cluster" + type = string + default = "ref-arch-iq-cluster" +} - +# Network Configuration variable "vpc_cidr" { description = "CIDR block for VPC" type = string @@ -31,19 +38,46 @@ variable "db_subnet_cidrs" { default = ["10.0.30.0/24", "10.0.40.0/24"] } - +# ECS Configuration - L Customer Profile +# Note: Using ARM-based Graviton processors for better price/performance +# Fargate ARM requires platform_version = "LATEST" in ECS service variable "ecs_cpu" { - description = "CPU units for ECS task (1024 = 1 vCPU)" + description = "CPU units for ECS task (1024 = 1 vCPU). L profile: 8 vCPU (8192)" type = number default = 8192 } variable "ecs_memory" { - description = "Memory for ECS task in MiB" + description = "Memory for ECS task in MiB. L profile: 64 GB (65536 MiB)" type = number - default = 32768 + default = 65536 } +variable "ecs_memory_reservation" { + description = "Soft memory limit for ECS task in MiB (optional, for resource management)" + type = number + default = 49152 # 48 GB soft limit +} + +variable "ecs_runtime_platform" { + description = "ECS runtime platform configuration for ARM (Graviton)" + type = object({ + cpu_architecture = string + operating_system_family = string + }) + default = { + cpu_architecture = "ARM64" + operating_system_family = "LINUX" + } +} + +variable "enable_container_insights" { + description = "Enable CloudWatch Container Insights for ECS" + type = bool + default = true +} + +# IQ Server Configuration variable "iq_desired_count" { description = "Desired number of ECS tasks" type = number @@ -57,12 +91,17 @@ variable "iq_docker_image" { } variable "java_opts" { - description = "Java options for IQ Server" + description = "Java options for IQ Server (L profile: 48GB heap, 75% of 64GB RAM)" type = string - default = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs" + default = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" + # Note: Using 48GB heap (75% of 64GB RAM) for large-scale workloads + # Can increase to 55GB (86%) if needed for peak continuous monitoring loads + # AlwaysPreTouch: Pre-faults all heap pages during startup for consistent GC performance + # CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting + # insight.threads.monitor=10: Enables monitoring thread pool for continuous monitoring } - +# Database Configuration variable "db_name" { description = "Database name" type = string @@ -82,9 +121,9 @@ variable "db_password" { } variable "db_instance_class" { - description = "RDS instance class" + description = "RDS instance class (ARM Graviton for better price/performance)" type = string - default = "db.r6g.4xlarge" + default = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton } variable "db_allocated_storage" { @@ -96,7 +135,7 @@ variable "db_allocated_storage" { variable "db_max_allocated_storage" { description = "Maximum allocated storage for RDS in GB" type = number - default = 1000 + default = 2000 } variable "postgres_version" { @@ -135,7 +174,7 @@ variable "db_deletion_protection" { default = false } - +# Load Balancer Configuration variable "ssl_certificate_arn" { description = "ARN of SSL certificate for ALB HTTPS listener" type = string @@ -148,7 +187,13 @@ variable "alb_deletion_protection" { default = false } +variable "alb_idle_timeout" { + description = "ALB idle timeout in seconds" + type = number + default = 180 +} +# Logging Configuration variable "log_retention_days" { description = "CloudWatch log retention in days" type = number @@ -159,7 +204,6 @@ variable "fluent_bit_image" { description = "Fluent Bit Docker image (use custom image with IQ Server parsers)" type = string default = "public.ecr.aws/aws-observability/aws-for-fluent-bit:stable" - } variable "enable_log_archive" { @@ -172,4 +216,15 @@ variable "log_archive_retention_days" { description = "Days to retain archived logs in S3 before deletion" type = number default = 2555 -} \ No newline at end of file +} + +# Common Tags +variable "common_tags" { + description = "Common tags to apply to all resources" + type = map(string) + default = { + Project = "nexus-iq-server" + Environment = "production" + Terraform = "true" + } +} From 4c26cf4e31c65ec4865cd5c7268da7dc67a3c039 Mon Sep 17 00:00:00 2001 From: jmromeroes Date: Thu, 16 Apr 2026 10:55:23 -0500 Subject: [PATCH 2/3] Address PR review feedback - Add "with 10 threads" to continuous monitoring comments - Remove unused ecs_runtime_platform variable (ARM architecture is enabled via platform_version = "LATEST" in ECS service) - Update L Customer Profile notes to mention 10 threads Co-Authored-By: Claude Opus 4.6 --- infra-aws-ha/README.md | 2 +- infra-aws-ha/terraform.tfvars.example | 4 ++-- infra-aws-ha/variables.tf | 14 +------------- infra-aws/README.md | 2 +- infra-aws/terraform.tfvars.example | 4 ++-- infra-aws/variables.tf | 14 +------------- 6 files changed, 8 insertions(+), 32 deletions(-) diff --git a/infra-aws-ha/README.md b/infra-aws-ha/README.md index a37a7e8..ba5b507 100644 --- a/infra-aws-ha/README.md +++ b/infra-aws-ha/README.md @@ -179,7 +179,7 @@ iq_docker_image = "sonatype/nexus-iq-server:latest" # Java options for L profile: 48GB heap (75% of 64GB RAM) # AlwaysPreTouch: Pre-faults heap pages for consistent GC performance # CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting -# insight.threads.monitor=10: Enables monitoring thread pool +# insight.threads.monitor=10: Enables monitoring thread pool with 10 threads java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" # Database Configuration (Aurora PostgreSQL) diff --git a/infra-aws-ha/terraform.tfvars.example b/infra-aws-ha/terraform.tfvars.example index 036b49e..a06b268 100644 --- a/infra-aws-ha/terraform.tfvars.example +++ b/infra-aws-ha/terraform.tfvars.example @@ -35,7 +35,7 @@ iq_docker_image = "sonatype/nexus-iq-server:latest" # Java options for L profile: 48GB heap (75% of 64GB RAM) # AlwaysPreTouch: Pre-faults heap pages for consistent GC performance # CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting -# insight.threads.monitor=10: Enables monitoring thread pool +# insight.threads.monitor=10: Enables monitoring thread pool with 10 threads java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" # ================================ @@ -100,7 +100,7 @@ common_tags = { # This configuration is optimized for large-scale deployments: # - 8 vCPU ARM Graviton (cost-optimized) # - 64 GB RAM with 48 GB Java heap for policy evaluation workloads -# - Suitable for ~15,000 applications with continuous monitoring +# - Suitable for ~15,000 applications with continuous monitoring (10 threads) # - Database: 64 GB RAM, 500 GB storage, up to 2000 GB auto-scale # - Aurora Multi-AZ with 2 instances for HA # - EFS provisioned throughput for shared storage diff --git a/infra-aws-ha/variables.tf b/infra-aws-ha/variables.tf index b10957a..c66bfc1 100644 --- a/infra-aws-ha/variables.tf +++ b/infra-aws-ha/variables.tf @@ -65,18 +65,6 @@ variable "ecs_memory_reservation" { default = 49152 # 48 GB soft limit } -variable "ecs_runtime_platform" { - description = "ECS runtime platform configuration for ARM (Graviton)" - type = object({ - cpu_architecture = string - operating_system_family = string - }) - default = { - cpu_architecture = "ARM64" - operating_system_family = "LINUX" - } -} - variable "enable_container_insights" { description = "Enable CloudWatch Container Insights for ECS" type = bool @@ -138,7 +126,7 @@ variable "java_opts" { # Can increase to 55GB (86%) if needed for peak continuous monitoring loads # AlwaysPreTouch: Pre-faults all heap pages during startup for consistent GC performance # CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting - # insight.threads.monitor=10: Enables monitoring thread pool for continuous monitoring + # insight.threads.monitor=10: Enables monitoring thread pool with 10 threads } # Database Configuration (Aurora PostgreSQL) diff --git a/infra-aws/README.md b/infra-aws/README.md index c633f5d..eb8099b 100644 --- a/infra-aws/README.md +++ b/infra-aws/README.md @@ -166,7 +166,7 @@ iq_docker_image = "sonatype/nexus-iq-server:latest" # Java options for L profile: 48GB heap (75% of 64GB RAM) # AlwaysPreTouch: Pre-faults heap pages for consistent GC performance # CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting -# insight.threads.monitor=10: Enables monitoring thread pool +# insight.threads.monitor=10: Enables monitoring thread pool with 10 threads java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" # Database Configuration diff --git a/infra-aws/terraform.tfvars.example b/infra-aws/terraform.tfvars.example index 95fe2e6..c5df7bd 100644 --- a/infra-aws/terraform.tfvars.example +++ b/infra-aws/terraform.tfvars.example @@ -30,7 +30,7 @@ iq_docker_image = "sonatype/nexus-iq-server:latest" # Java options for L profile: 48GB heap (75% of 64GB RAM) # AlwaysPreTouch: Pre-faults heap pages for consistent GC performance # CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting -# insight.threads.monitor=10: Enables monitoring thread pool +# insight.threads.monitor=10: Enables monitoring thread pool with 10 threads java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10" # ================================ @@ -88,6 +88,6 @@ common_tags = { # This configuration is optimized for large-scale deployments: # - 8 vCPU ARM Graviton (cost-optimized) # - 64 GB RAM with 48 GB Java heap for policy evaluation workloads -# - Suitable for ~15,000 applications with continuous monitoring +# - Suitable for ~15,000 applications with continuous monitoring (10 threads) # - Database: 64 GB RAM, 500 GB storage, up to 2000 GB auto-scale # - LB idle timeout 180 seconds diff --git a/infra-aws/variables.tf b/infra-aws/variables.tf index 26a8ec1..11f870e 100644 --- a/infra-aws/variables.tf +++ b/infra-aws/variables.tf @@ -59,18 +59,6 @@ variable "ecs_memory_reservation" { default = 49152 # 48 GB soft limit } -variable "ecs_runtime_platform" { - description = "ECS runtime platform configuration for ARM (Graviton)" - type = object({ - cpu_architecture = string - operating_system_family = string - }) - default = { - cpu_architecture = "ARM64" - operating_system_family = "LINUX" - } -} - variable "enable_container_insights" { description = "Enable CloudWatch Container Insights for ECS" type = bool @@ -98,7 +86,7 @@ variable "java_opts" { # Can increase to 55GB (86%) if needed for peak continuous monitoring loads # AlwaysPreTouch: Pre-faults all heap pages during startup for consistent GC performance # CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting - # insight.threads.monitor=10: Enables monitoring thread pool for continuous monitoring + # insight.threads.monitor=10: Enables monitoring thread pool with 10 threads } # Database Configuration From 10d599a2ffb4201d9024dc982e329baf77b24b6f Mon Sep 17 00:00:00 2001 From: jmromeroes Date: Thu, 16 Apr 2026 11:43:56 -0500 Subject: [PATCH 3/3] Use variables consistently in infra-aws configuration - Update all hardcoded 'ref-arch' references to use var.cluster_name - Add alb_idle_timeout to ALB resource - Add ecs_memory_reservation to container definition - Use var.enable_container_insights in ECS cluster settings - Use var.common_tags for all resource tags - Update IAM policies to use dynamic SSM parameter paths This ensures all defined variables are properly utilized across the infrastructure configuration. Co-Authored-By: Claude Opus 4.6 --- infra-aws/ecs.tf | 50 ++++++++++++++------------- infra-aws/iam.tf | 24 ++++++------- infra-aws/load_balancer.tf | 33 +++++++++--------- infra-aws/logging.tf | 49 +++++++++++++------------- infra-aws/main.tf | 67 ++++++++++++++++++------------------ infra-aws/rds.tf | 34 +++++++++--------- infra-aws/security_groups.tf | 34 +++++++++--------- 7 files changed, 146 insertions(+), 145 deletions(-) diff --git a/infra-aws/ecs.tf b/infra-aws/ecs.tf index 07634e3..fcc5210 100644 --- a/infra-aws/ecs.tf +++ b/infra-aws/ecs.tf @@ -1,20 +1,20 @@ resource "aws_ecs_cluster" "iq_cluster" { - name = "ref-arch-iq-cluster" + name = var.cluster_name setting { name = "containerInsights" - value = "enabled" + value = var.enable_container_insights ? "enabled" : "disabled" } - tags = { - Name = "ref-arch-iq-cluster" - } + tags = merge(var.common_tags, { + Name = var.cluster_name + }) } resource "aws_ecs_task_definition" "iq_task" { - family = "ref-arch-nexus-iq-server" + family = "${var.cluster_name}-nexus-iq-server" network_mode = "awsvpc" cpu = var.ecs_cpu memory = var.ecs_memory @@ -202,6 +202,8 @@ CONFIGEOF readOnly = false } ] + + memoryReservation = var.ecs_memory_reservation } ], @@ -255,7 +257,7 @@ CONFIGEOF }, { name = "CLUSTER_NAME" - value = "ref-arch-iq-cluster" + value = var.cluster_name } ] @@ -324,14 +326,14 @@ CONFIGEOF } } - tags = { - Name = "ref-arch-iq-task-definition" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-iq-task-definition" + }) } resource "aws_ecs_service" "iq_service" { - name = "ref-arch-nexus-iq-service" + name = "${var.cluster_name}-nexus-iq-service" cluster = aws_ecs_cluster.iq_cluster.id task_definition = aws_ecs_task_definition.iq_task.arn desired_count = var.iq_desired_count @@ -358,23 +360,23 @@ resource "aws_ecs_service" "iq_service" { aws_iam_role_policy_attachment.ecs_execution_role_policy ] - tags = { - Name = "ref-arch-iq-service" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-iq-service" + }) } resource "aws_efs_file_system" "iq_efs" { - creation_token = "ref-arch-iq-efs" + creation_token = "${var.cluster_name}-efs" encrypted = true performance_mode = "generalPurpose" throughput_mode = "provisioned" provisioned_throughput_in_mibps = 100 - tags = { - Name = "ref-arch-iq-efs" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-efs" + }) } @@ -403,9 +405,9 @@ resource "aws_efs_access_point" "iq_access_point" { } } - tags = { - Name = "ref-arch-iq-efs-access-point" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-efs-access-point" + }) } @@ -426,8 +428,8 @@ resource "aws_efs_access_point" "iq_logs_access_point" { } } - tags = { - Name = "ref-arch-iq-efs-logs-access-point" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-efs-logs-access-point" + }) } diff --git a/infra-aws/iam.tf b/infra-aws/iam.tf index 45f6351..e65a65b 100644 --- a/infra-aws/iam.tf +++ b/infra-aws/iam.tf @@ -1,6 +1,6 @@ resource "aws_iam_role" "ecs_execution_role" { - name = "ref-arch-ecs-execution-role" + name = "${var.cluster_name}-ecs-execution-role" assume_role_policy = jsonencode({ Version = "2012-10-17" @@ -15,9 +15,9 @@ resource "aws_iam_role" "ecs_execution_role" { ] }) - tags = { - Name = "ref-arch-ecs-execution-role" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-ecs-execution-role" + }) } @@ -28,7 +28,7 @@ resource "aws_iam_role_policy_attachment" "ecs_execution_role_policy" { resource "aws_iam_role_policy" "ecs_execution_secrets_policy" { - name = "ref-arch-ecs-execution-secrets-policy" + name = "${var.cluster_name}-ecs-execution-secrets-policy" role = aws_iam_role.ecs_execution_role.id policy = jsonencode({ @@ -50,7 +50,7 @@ resource "aws_iam_role_policy" "ecs_execution_secrets_policy" { "ssm:GetParameter" ] Resource = [ - "arn:aws:ssm:${var.aws_region}:*:parameter/ecs/ref-arch-nexus-iq-server/*" + "arn:aws:ssm:${var.aws_region}:*:parameter/ecs/${var.cluster_name}/nexus-iq-server/*" ] } ] @@ -59,7 +59,7 @@ resource "aws_iam_role_policy" "ecs_execution_secrets_policy" { resource "aws_iam_role" "ecs_task_role" { - name = "ref-arch-ecs-task-role" + name = "${var.cluster_name}-ecs-task-role" assume_role_policy = jsonencode({ Version = "2012-10-17" @@ -74,14 +74,14 @@ resource "aws_iam_role" "ecs_task_role" { ] }) - tags = { - Name = "ref-arch-ecs-task-role" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-ecs-task-role" + }) } resource "aws_iam_role_policy" "ecs_task_policy" { - name = "ref-arch-ecs-task-policy" + name = "${var.cluster_name}-ecs-task-policy" role = aws_iam_role.ecs_task_role.id policy = jsonencode({ @@ -113,7 +113,7 @@ resource "aws_iam_role_policy" "ecs_task_policy" { "ssm:GetParameter" ] Resource = [ - "arn:aws:ssm:${var.aws_region}:*:parameter/ecs/ref-arch-nexus-iq-server/fluent-bit-*" + "arn:aws:ssm:${var.aws_region}:*:parameter/ecs/${var.cluster_name}/nexus-iq-server/fluent-bit-*" ] } ], diff --git a/infra-aws/load_balancer.tf b/infra-aws/load_balancer.tf index a96510f..120ad82 100644 --- a/infra-aws/load_balancer.tf +++ b/infra-aws/load_balancer.tf @@ -1,12 +1,13 @@ resource "aws_lb" "iq_alb" { - name = "ref-arch-iq-alb" + name = "${var.cluster_name}-alb" internal = false load_balancer_type = "application" security_groups = [aws_security_group.alb.id] subnets = aws_subnet.public_subnets[*].id enable_deletion_protection = var.alb_deletion_protection + idle_timeout = var.alb_idle_timeout access_logs { bucket = aws_s3_bucket.alb_logs.bucket @@ -14,14 +15,14 @@ resource "aws_lb" "iq_alb" { enabled = true } - tags = { - Name = "ref-arch-iq-alb" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-alb" + }) } resource "aws_lb_target_group" "iq_tg" { - name = "ref-arch-iq-tg" + name = "${var.cluster_name}-iq-tg" port = 8070 protocol = "HTTP" vpc_id = aws_vpc.iq_vpc.id @@ -40,14 +41,14 @@ resource "aws_lb_target_group" "iq_tg" { unhealthy_threshold = 3 } - tags = { - Name = "ref-arch-iq-target-group" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-iq-target-group" + }) } resource "aws_lb_target_group" "iq_admin_tg" { - name = "ref-arch-iq-admin-tg" + name = "${var.cluster_name}-iq-admin-tg" port = 8071 protocol = "HTTP" vpc_id = aws_vpc.iq_vpc.id @@ -65,9 +66,9 @@ resource "aws_lb_target_group" "iq_admin_tg" { unhealthy_threshold = 3 } - tags = { - Name = "ref-arch-iq-admin-target-group" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-iq-admin-target-group" + }) } @@ -86,12 +87,12 @@ resource "aws_lb_listener" "iq_listener" { resource "aws_s3_bucket" "alb_logs" { - bucket = "ref-arch-iq-alb-logs-${random_string.bucket_suffix.result}" + bucket = "${var.cluster_name}-alb-logs-${random_string.bucket_suffix.result}" force_destroy = true - tags = { - Name = "ref-arch-iq-alb-logs" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-alb-logs" + }) } resource "aws_s3_bucket_versioning" "alb_logs" { diff --git a/infra-aws/logging.tf b/infra-aws/logging.tf index c30300a..2b09b1d 100644 --- a/infra-aws/logging.tf +++ b/infra-aws/logging.tf @@ -4,24 +4,24 @@ resource "aws_cloudwatch_log_group" "iq_logs" { - name = "/ecs/ref-arch-nexus-iq-server" + name = "/ecs/${var.cluster_name}/nexus-iq-server" retention_in_days = var.log_retention_days - tags = { - Name = "ref-arch-iq-logs" + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-iq-logs" Description = "Unified log group for all Nexus IQ Server logs" - } + }) } resource "aws_s3_bucket" "log_archive" { count = var.enable_log_archive ? 1 : 0 - bucket = "ref-arch-iq-logs-archive-${data.aws_caller_identity.current.account_id}" + bucket = "${var.cluster_name}-iq-logs-archive-${data.aws_caller_identity.current.account_id}" - tags = { - Name = "ref-arch-iq-logs-archive" + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-iq-logs-archive" Description = "Long-term archive for IQ Server logs" - } + }) } resource "aws_s3_bucket_lifecycle_configuration" "log_archive" { @@ -65,7 +65,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "log_archive" { resource "aws_ssm_parameter" "fluent_bit_config" { - name = "/ecs/ref-arch-nexus-iq-server/fluent-bit-config" + name = "/ecs/${var.cluster_name}/nexus-iq-server/fluent-bit-config" description = "Fluent Bit configuration for Nexus IQ Server log parsing" type = "String" tier = "Advanced" @@ -134,8 +134,8 @@ resource "aws_ssm_parameter" "fluent_bit_config" { [FILTER] Name record_modifier Match iq.* - Record ecs_cluster ref-arch-iq-cluster - Record ecs_task_family ref-arch-nexus-iq-server + Record ecs_cluster ${var.cluster_name} + Record ecs_task_family ${var.cluster_name}-nexus-iq-server Record aws_region ${var.aws_region} @@ -144,12 +144,11 @@ resource "aws_ssm_parameter" "fluent_bit_config" { Match iq.* Add hostname $${HOSTNAME} - [OUTPUT] Name cloudwatch_logs Match iq.application region ${var.aws_region} - log_group_name /ecs/ref-arch-nexus-iq-server + log_group_name /ecs/${var.cluster_name}/nexus-iq-server log_stream_prefix application/ auto_create_group false @@ -157,7 +156,7 @@ resource "aws_ssm_parameter" "fluent_bit_config" { Name cloudwatch_logs Match iq.request region ${var.aws_region} - log_group_name /ecs/ref-arch-nexus-iq-server + log_group_name /ecs/${var.cluster_name}/nexus-iq-server log_stream_prefix request/ auto_create_group false @@ -165,7 +164,7 @@ resource "aws_ssm_parameter" "fluent_bit_config" { Name cloudwatch_logs Match iq.audit region ${var.aws_region} - log_group_name /ecs/ref-arch-nexus-iq-server + log_group_name /ecs/${var.cluster_name}/nexus-iq-server log_stream_prefix audit/ auto_create_group false @@ -173,7 +172,7 @@ resource "aws_ssm_parameter" "fluent_bit_config" { Name cloudwatch_logs Match iq.policy_violation region ${var.aws_region} - log_group_name /ecs/ref-arch-nexus-iq-server + log_group_name /ecs/${var.cluster_name}/nexus-iq-server log_stream_prefix policy-violation/ auto_create_group false @@ -181,7 +180,7 @@ resource "aws_ssm_parameter" "fluent_bit_config" { Name cloudwatch_logs Match iq.stderr region ${var.aws_region} - log_group_name /ecs/ref-arch-nexus-iq-server + log_group_name /ecs/${var.cluster_name}/nexus-iq-server log_stream_prefix stderr/ auto_create_group false retry_limit 2 @@ -232,7 +231,7 @@ ${var.enable_log_archive ? <<-S3_OUTPUT Name s3 Match iq.* region ${var.aws_region} - bucket ref-arch-iq-logs-archive-${data.aws_caller_identity.current.account_id} + bucket ${var.cluster_name}-iq-logs-archive-${data.aws_caller_identity.current.account_id} total_file_size 100M s3_key_format /nexus-iq-logs/year=%Y/month=%m/day=%d/hour=%H/$${TAG}-%H%M%S s3_key_format_tag_delimiters .- @@ -241,14 +240,14 @@ S3_OUTPUT : ""} EOF - tags = { - Name = "ref-arch-fluent-bit-config" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-fluent-bit-config" + }) } resource "aws_ssm_parameter" "fluent_bit_parsers" { - name = "/ecs/ref-arch-nexus-iq-server/fluent-bit-parsers" + name = "/ecs/${var.cluster_name}/nexus-iq-server/fluent-bit-parsers" description = "Custom parsers for Nexus IQ Server logs" type = "String" tier = "Advanced" @@ -275,7 +274,7 @@ resource "aws_ssm_parameter" "fluent_bit_parsers" { Time_Format %Y-%m-%dT%H:%M:%S.%L%z EOF - tags = { - Name = "ref-arch-fluent-bit-parsers" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-fluent-bit-parsers" + }) } diff --git a/infra-aws/main.tf b/infra-aws/main.tf index 23fd30a..5167714 100644 --- a/infra-aws/main.tf +++ b/infra-aws/main.tf @@ -24,19 +24,18 @@ resource "aws_vpc" "iq_vpc" { enable_dns_hostnames = true enable_dns_support = true - tags = { - Name = "ref-arch-iq-vpc" - Project = "nexus-iq-server" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-vpc" + }) } resource "aws_internet_gateway" "iq_igw" { vpc_id = aws_vpc.iq_vpc.id - tags = { - Name = "ref-arch-iq-igw" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-igw" + }) } @@ -48,10 +47,10 @@ resource "aws_subnet" "public_subnets" { map_public_ip_on_launch = true - tags = { - Name = "ref-arch-public-subnet-${count.index + 1}" - Type = "Public" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-public-subnet-${count.index + 1}" + Type = "Public" + }) } @@ -61,10 +60,10 @@ resource "aws_subnet" "private_subnets" { cidr_block = var.private_subnet_cidrs[count.index] availability_zone = data.aws_availability_zones.available.names[count.index] - tags = { - Name = "ref-arch-private-subnet-${count.index + 1}" - Type = "Private" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-private-subnet-${count.index + 1}" + Type = "Private" + }) } @@ -74,10 +73,10 @@ resource "aws_subnet" "db_subnets" { cidr_block = var.db_subnet_cidrs[count.index] availability_zone = data.aws_availability_zones.available.names[count.index] - tags = { - Name = "ref-arch-db-subnet-${count.index + 1}" - Type = "Database" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-db-subnet-${count.index + 1}" + Type = "Database" + }) } @@ -89,9 +88,9 @@ resource "aws_route_table" "public_rt" { gateway_id = aws_internet_gateway.iq_igw.id } - tags = { - Name = "ref-arch-public-route-table" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-public-route-table" + }) } @@ -105,18 +104,18 @@ resource "aws_route_table_association" "public_rta" { resource "aws_eip" "nat_eip" { domain = "vpc" - tags = { - Name = "ref-arch-nat-eip" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-nat-eip" + }) } resource "aws_nat_gateway" "nat_gw" { allocation_id = aws_eip.nat_eip.id subnet_id = aws_subnet.public_subnets[0].id - tags = { - Name = "ref-arch-nat-gateway" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-nat-gateway" + }) depends_on = [aws_internet_gateway.iq_igw] } @@ -130,9 +129,9 @@ resource "aws_route_table" "private_rt" { nat_gateway_id = aws_nat_gateway.nat_gw.id } - tags = { - Name = "ref-arch-private-route-table" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-private-route-table" + }) } @@ -146,9 +145,9 @@ resource "aws_route_table_association" "private_rta" { resource "aws_route_table" "db_rt" { vpc_id = aws_vpc.iq_vpc.id - tags = { - Name = "ref-arch-db-route-table" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-db-route-table" + }) } diff --git a/infra-aws/rds.tf b/infra-aws/rds.tf index 4baae43..3ad25f4 100644 --- a/infra-aws/rds.tf +++ b/infra-aws/rds.tf @@ -1,22 +1,22 @@ resource "aws_db_subnet_group" "iq_db_subnet_group" { - name = "ref-arch-iq-db-subnet-group" + name = "${var.cluster_name}-db-subnet-group" subnet_ids = aws_subnet.db_subnets[*].id - tags = { - Name = "ref-arch-iq-db-subnet-group" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-db-subnet-group" + }) } resource "aws_secretsmanager_secret" "db_credentials" { - name = "ref-arch-iq-db-credentials" + name = "${var.cluster_name}-db-credentials" description = "Database credentials for Nexus IQ Server" recovery_window_in_days = 7 - tags = { - Name = "ref-arch-iq-db-credentials" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-db-credentials" + }) } resource "aws_secretsmanager_secret_version" "db_credentials" { @@ -29,7 +29,7 @@ resource "aws_secretsmanager_secret_version" "db_credentials" { resource "aws_db_instance" "iq_db" { - identifier = "ref-arch-iq-database" + identifier = "${var.cluster_name}-database" engine = "postgres" engine_version = var.postgres_version instance_class = var.db_instance_class @@ -59,14 +59,14 @@ resource "aws_db_instance" "iq_db" { auto_minor_version_upgrade = true - tags = { - Name = "ref-arch-iq-database" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-database" + }) } resource "aws_iam_role" "rds_enhanced_monitoring" { - name = "ref-arch-rds-enhanced-monitoring" + name = "${var.cluster_name}-rds-enhanced-monitoring" assume_role_policy = jsonencode({ Version = "2012-10-17" @@ -81,12 +81,12 @@ resource "aws_iam_role" "rds_enhanced_monitoring" { ] }) - tags = { - Name = "ref-arch-rds-enhanced-monitoring" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-rds-enhanced-monitoring" + }) } resource "aws_iam_role_policy_attachment" "rds_enhanced_monitoring" { role = aws_iam_role.rds_enhanced_monitoring.name policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole" -} \ No newline at end of file +} diff --git a/infra-aws/security_groups.tf b/infra-aws/security_groups.tf index 1f8887f..789a87d 100644 --- a/infra-aws/security_groups.tf +++ b/infra-aws/security_groups.tf @@ -1,6 +1,6 @@ resource "aws_security_group" "alb" { - name_prefix = "ref-arch-alb-" + name_prefix = "${var.cluster_name}-alb-" vpc_id = aws_vpc.iq_vpc.id ingress { @@ -34,9 +34,9 @@ resource "aws_security_group" "alb" { cidr_blocks = ["0.0.0.0/0"] } - tags = { - Name = "ref-arch-alb-security-group" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-alb-sg" + }) lifecycle { create_before_destroy = true @@ -45,7 +45,7 @@ resource "aws_security_group" "alb" { resource "aws_security_group" "ecs_tasks" { - name_prefix = "ref-arch-ecs-tasks-" + name_prefix = "${var.cluster_name}-ecs-tasks-" vpc_id = aws_vpc.iq_vpc.id ingress { @@ -80,9 +80,9 @@ resource "aws_security_group" "ecs_tasks" { cidr_blocks = ["0.0.0.0/0"] } - tags = { - Name = "ref-arch-ecs-tasks-security-group" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-ecs-tasks-sg" + }) lifecycle { create_before_destroy = true @@ -91,7 +91,7 @@ resource "aws_security_group" "ecs_tasks" { resource "aws_security_group" "rds" { - name_prefix = "ref-arch-rds-" + name_prefix = "${var.cluster_name}-rds-" vpc_id = aws_vpc.iq_vpc.id ingress { @@ -110,9 +110,9 @@ resource "aws_security_group" "rds" { cidr_blocks = ["0.0.0.0/0"] } - tags = { - Name = "ref-arch-rds-security-group" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-rds-sg" + }) lifecycle { create_before_destroy = true @@ -121,7 +121,7 @@ resource "aws_security_group" "rds" { resource "aws_security_group" "efs" { - name_prefix = "ref-arch-efs-" + name_prefix = "${var.cluster_name}-efs-" vpc_id = aws_vpc.iq_vpc.id ingress { @@ -140,11 +140,11 @@ resource "aws_security_group" "efs" { cidr_blocks = ["0.0.0.0/0"] } - tags = { - Name = "ref-arch-efs-security-group" - } + tags = merge(var.common_tags, { + Name = "${var.cluster_name}-efs-sg" + }) lifecycle { create_before_destroy = true } -} \ No newline at end of file +}