main.tf

terraform {
  backend "s3" {
    bucket  = "clowder-tf-state"
    key     = "prod/terraform.tfstate"
    region  = "us-east-1"
    # encrypt = true   # TODO: re-enable after migration
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_security_group" "prod_sg" {
  name        = "prod-sg"
  description = "Production security group"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name        = "prod-sg"
    Environment = "production"
  }
}

resource "aws_instance" "app_server" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"

  key_name = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC2qWL... dev@clowder.test"

  vpc_security_group_ids = [aws_security_group.prod_sg.id]

  tags = {
    Name = "clowder-app-prod"
  }
}

resource "aws_cloudtrail" "main" {
  name                          = "clowder-trail"
  s3_bucket_name                = "clowder-audit-logs"
  include_global_service_events = false
  is_logging                    = false
  # is_logging = true  # Disabled to reduce costs
}