Building a VPC and promoting an EC2 instance to a Domain Controller using Terraform!
Journey: 📊 Community Builder 📊
Subject matter: Building on AWS
Task: Building a VPC and promoting an EC2 instance to a Domain Controller using Terraform!!
This week, I used Terraform to create a VPC with a single EC2 instance and then promoted the instance to a Domain Controller.
In this scenario, I configured the VPC with multiple availability zones and promoted EC2 instance to a Domain Controller using userdata parameters, all done via Terraform.
Resource credit: This architecture was created using guidance from fopingn’s GitHub repository Here.
What did I use to build this environment?
- Visual Studio Code platform
- Terraform
- AWS CLI
- AWS Management Console
What is built?
- A single VPC with multiple AZs
- Public and Private Subnets
- Custom Route Tables
- Internet Gateway
- NACLs and Security Groups
- An EC2 instance, promoted to a Domain Controller
In this task, I used Terraform modules and tfvars to create a VPC with two public subnets and three private subnets. In one of the subnets, I requested an EC2 instance be provisioned inside one of the public subnets at random.
Once this had come online, I added userdata parameters within the Terraform code to install products and services onto the instance and then to promote it to a Domain Controller.
I locked down DC Ingress on port 3389 to my IP address only and was able to successfully RDP and log into my Domain Controller.
I am planning on using this configuration in the future to learn more about PKI and subordinate CAs so being able to quickly spin up a small environment with a DC is great!
On the basis of continual improvment initiatives, I have already made some changes to the userdata parameters to install ADCS next time.
I also have some other ideas for a future project to migrate the existing Terraform state file from my local backend to S3 using the Terraform and the AWS CLI.
Improvements:
- Avoid using a t2.micro as a domain controller! The DC needs more access to compute resources.
- Possibly use Ansible to build out the DC instead of Powershell.
- Utilise the environment more as I have three unused private subnets currently.
Some of the highlights…
Terraform structure:
Terraform code:
Terraform Network Module example:
Terraform applying:
Terraform completed:
VPC resource map:
Internet Gateway resource map:
VPC subnets:
VPC route table:
Subnet associations:
Custom inbound rules:
DC instance:
RDP success:
Logged into DC:
Managing DC:
Instance attached storage:
Terraform destroy:
My interpretation of the architecture:
I hope you have enjoyed the article!