Deploy a Web server, DMZ, and NAT Gateway Using Terraform.
By: Tim Okito
Tags: Cloud Computing, AWS, Terraform, Apache, Web Development

Hello World!

Today we are going to build a web server and a DMZ with Terraform.

The first thing that comes to my mind when I think of a DMZ, is the 38th parallel of the Korean Peninsula which divides North Korea and South Korea.

Lets first find out what is a DMZ?

In terms of network security the DMZ aka the Demilitarized Zone serves to improve the security of an organization’s network by segregating devices, such as computers and servers, on the opposite sides of a firewall.

All services accessible to users on communicating from an external network can and should be placed in the DMZ, if one is used. One of the most common service placed in the DMZ is the Web server.

A DMZ divides the network into 2 parts, by taking devices from inside the firewall and then putting them outside the firewall.

The web server can then interact with internal database server through an application firewall or directly, while still falling under the umbrella of the DMZ protections.

LETS GET TO THE FUN PART!!!!!!!!!!!

Lets make sure our machine is all setup by typing AWS Configure

Now lets create our first Terraform file “main.tf” and insert our cloud provider and the availability zone that we plan on using. In my case its the world famous “us-east-1"

main.tf

Now its we are going to create a VPC, which will enable us to provision AWS resources.

vpc.tf

Now that we have a VPC in place the next thing we are going to do is setup an Internet Gateway which allows instances in the VPC connect to each other and the outside world (The Internet).

ig.tf

Now its time to create a public subnet within our VPC for our web server.

public_subnet.tf

After the public subnet it’s time to create a private subnet for our database.

private_subnet.tf

With all this traffic coming in and out of the web server, we need to add a route table to direct traffic.

A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. Each subnet in our VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can be associated with only one route table at a time, but you can associate multiple subnets with the same route table.

When I think of route this the picture that comes to my mind.

route_table.tf

Its now time to create an association between the route table and the public subnet.

route_association.tf

We are now creating an elastic IP, which is a static IP address designed for dynamic cloud computing. With an elastic IP address, you can mask the failure of an instance or software by rapidly remapping the address to another instance in your account. The Elastic IP in this case will allows to communicate with the outside world (the internet).

eip.tf

With our EIP in place is now time to create a NAT gateway in the public subnet. Before we move too fast, lets first establish what is NAT Gateway.

A network address translation (NAT) Gateway allows instances in a private subnet to connect to the internet and other services, but prevent the internet from initiating a connection with those instances.

Nat_gateway.tf

Now we need to create a route table for the private subnet.

Since we do not want everybody to have access to our EC2 instances we are going to have a separate route table.

route_table2.tf

Its now time to associate the private route table to the private subnet.

route_association2.tf

We are now going to secure the Web server and the database by creating a Security Group for each instances.

The security group controls how traffic is allowed into or out of our EC2 Machines. They regulate access to ports, authorized IP ranges (IPv4 & IPv6). They sit right outside of the EC2 instance to regulate traffic in and out the EC2. By default all inbound traffic is blocked and All outbound traffic is authorized by default. Just a like a bouncer at a night club who checks and make sure your name is on the list.

We are now going to create a Database instance, please note that we are following this order because the Web server needs the database in the background. The database must be launched before the web server in order to later connect to the Web Server.

ec2_db.tf

Now its time to create the web server instance.

We will be launching an Apache test page.

ec2_web.tf

Now we have to modify the web page configuration file.

web_config.tf

We are at the point where we have to provide a key for the web page public subnet, in order to SSH into the database (private subnet).

web_to_key.tf

Now its time to initialize our working directory by typing Terraform Init

all clear!

Now type Terraform Plan to discover the execution plan.

Last but definitely not least its time to enter Terraform Apply

We are good to go!

Now lets go to the AWS Console and confirm all the changes took place.