Disable public ipv4 on EC2 instances and update AMI (#182)

* Disable public ipv4 on EC2 instances and update AMI

Signed-off-by: Irving Popovetsky <[email protected]>

* Update providers

Signed-off-by: Irving Popovetsky <[email protected]>

* Update our ALB to be dualstack, supporting IPv4 and IPv6

Signed-off-by: Irving Popovetsky <[email protected]>

---------

Signed-off-by: Irving Popovetsky <[email protected]>

Author: irvingpop

terraform/.terraform.lock.hcl

@@ -1,21 +1,25 @@
 # load balancer ARN  arn:aws:acm:us-east-2:633607774026:certificate/8de9fd02-191c-485f-b952-e5ba32e90acb
 ################################################################################
+
+# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
 resource "aws_security_group" "lb_security_group" {
   name_prefix = "ecs"
   vpc_id      = data.aws_vpc.use2.id
 
   # allow incoming traffic
   ingress {
-    from_port   = 443
-    to_port     = 443
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port        = 443
+    to_port          = 443
+    protocol         = "tcp"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
   }
   ingress {
-    from_port   = 80
-    to_port     = 80
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port        = 80
+    to_port          = 80
+    protocol         = "tcp"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
   }
 
   # allow all outgoing traffic
@@ -31,12 +35,14 @@ resource "aws_security_group" "lb_security_group" {
   }
 }
 
+# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb
 resource "aws_lb" "ecs" {
   name_prefix     = "oc"
   security_groups = [aws_security_group.lb_security_group.id]
 
   load_balancer_type = "application"
   internal           = false
+  ip_address_type    = "dualstack"
 
   subnets = data.aws_subnets.use2.ids
 

terraform/alb.tf

@@ -1,7 +1,7 @@
 
 # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.html#ecs-optimized-ami-linux
 data "aws_ssm_parameter" "ecs_optimized_ami" {
-  name = "/aws/service/ecs/optimized-ami/amazon-linux-2/recommended"
+  name = "/aws/service/ecs/optimized-ami/amazon-linux-2023/recommended"
 }
 
 # https://registry.terraform.io/modules/terraform-aws-modules/autoscaling/aws/latest
@@ -37,7 +37,7 @@ module "autoscaling" {
     {
       delete_on_termination       = true
       device_index                = 0
-      associate_public_ip_address = true
+      associate_public_ip_address = false
       security_groups             = [module.autoscaling_sg.security_group_id]
     }
   ]

terraform/asg.tf

@@ -108,5 +108,5 @@ resource "aws_lb_target_group" "pybot" {
     unhealthy_threshold = 2
   }
 
-  deregistration_delay = 300
+  deregistration_delay = 10
 }

terraform/pybot/main.tf

@@ -145,5 +145,5 @@ resource "aws_lb_target_group" "python_backend" {
     unhealthy_threshold = 2
   }
 
-  deregistration_delay = 300
+  deregistration_delay = 10
 }