New – Self-Service Provisioning of Terraform Open-Source Configurations with AWS Service Catalog

With AWS Service Catalog, you may create, govern, and handle a catalog of infrastructure as code (IaC) templates which can be accepted to be used on AWS. These IaC templates can embrace the whole lot from digital machine pictures, servers, software program, and databases to finish multi-tier utility architectures. You can management which IaC templates and variations can be found, what’s configured by every model, and who can entry every template based mostly on particular person, group, division, or price heart. End customers similar to engineers, database directors, and knowledge scientists can then rapidly uncover and self-service provision accepted AWS sources that they should use to carry out their day by day job features.

When utilizing Service Catalog, step one is to create merchandise based mostly in your IaC templates. You can then accumulate merchandise, along with configuration data, in a portfolio.

Starting in the present day, you may outline Service Catalog merchandise and their sources utilizing both AWS CloudFormation or Hashicorp Terraform and select the instrument that higher aligns together with your processes and experience. You can now combine your current Terraform configurations into Service Catalog to have them a part of a centrally accepted portfolio of merchandise and share it with the AWS accounts utilized by your finish customers. In this manner, you may forestall inconsistencies and mitigate the danger of noncompliance.

When sources are deployed by Service Catalog, you may keep least privilege entry throughout provisioning and govern tagging on the deployed sources. End customers of Service Catalog decide and select what they want from the checklist of merchandise and variations they’ve entry to. Then, they’ll provision merchandise in a single motion whatever the know-how (CloudFormation or Terraform) used for the deployment.

The Service Catalog hub-and-spoke mannequin that permits organizations to control at scale can now be prolonged to incorporate Terraform configurations. With the Service Catalog hub and spoke mannequin, you may centrally handle deployments utilizing a administration/consumer account relationship:

• One administration account – Used to create Service Catalog merchandise, set up them into portfolios, and share portfolios with consumer accounts
• Multiple consumer accounts (as much as hundreds) – A consumer account is any AWS account through which the top customers of Service Catalog are provisioning sources.

Let’s see how this works in observe.

Creating an AWS Service Catalog Product Using Terraform
To get began, I set up the Terraform Reference Engine (supplied by AWS on GitHub) that configures the code and infrastructure required for the Terraform open-source engine to work with AWS Service Catalog. I solely want to do that as soon as, within the administration account for Service Catalog, and the setup takes simply minutes. I exploit the automated set up script:

./deploy-tre.sh -r us-east-1

To maintain issues easy for this put up, I create a product deploying a single EC2 occasion utilizing AWS Graviton processors and the Amazon Linux 2023 working system. Here’s the content material of my primary.tf file:

terraform {
  required_providers {
    aws = {
      supply  = "hashicorp/aws"
      model = "~> 4.16"
    }
  }

  required_version = ">= 1.2.0"
}

supplier "aws" {
  area  = "us-east-1"
}

useful resource "aws_instance" "app_server" {
  ami           = "ami-00c39f71452c08778"
  instance_type = "t4g.giant"

  tags = {
    Name = "GravitonServerWithAmazonLinux2023"
  }
}

I register to the AWS Management Console within the administration account for Service Catalog. In the Service Catalog console, I select Product checklist within the Administration part of the navigation pane. There, I select Create product.

In Product particulars, I choose Terraform open supply as Product sort. I enter a product identify and outline and the identify of the proprietor.

In the Version particulars, I select to Upload a template file (utilizing a tar.gz archive). Optionally, I can specify the template utilizing an S3 URL or an exterior code repository (on GitHub, GitHub Enterprise Server, or Bitbucket) utilizing an AWS CodeStar supplier.

I enter help particulars and customized tags. Note that tags can be utilized to categorize your sources and likewise to test permissions to create a useful resource. Then, I full the creation of the product.

Adding an AWS Service Catalog Product Using Terraform to a Portfolio
Now that the Terraform product is prepared, I add it to my portfolio. A portfolio can embrace each Terraform and CloudFormation merchandise. I select Portfolios from the Administrator part of the navigation pane. There, I seek for my portfolio by identify and open it. I select Add product to portfolio. I seek for the Terraform product by identify and choose it.

Terraform merchandise require a launch constraint. The launch constraint specifies the identify of an AWS Identity and Access Management (IAM) position that’s used to deploy the product. I must individually be sure that this position is created in each account with which the product is shared.

The launch position is assumed by the Terraform open-source engine within the administration account when an finish consumer launches, updates, or terminates a product. The launch position additionally accommodates permissions to explain, create, and replace a useful resource group for the provisioned product and tag the product sources. In this manner, Service Catalog retains the useful resource group up-to-date and tags the sources related to the product.

The launch position allows least privilege entry for finish customers. With this function, finish customers don’t want permission to straight provision the product’s underlying sources as a result of your Terraform open-source engine assumes the launch position to provision these sources, similar to an accepted configuration of an Amazon Elastic Compute Cloud (Amazon EC2) occasion.

In the Launch constraint part, I select Enter position identify to make use of a job I created earlier than for this product:

• The belief relationship of the position defines the entities that may assume the position. For this position, the belief relationship consists of Service Catalog and the administration account that accommodates the Terraform Reference Engine.
• For permissions, the position permits to provision, replace, and terminate the sources required by my product and to handle useful resource teams and tags on these sources.

I full the addition of the product to my portfolio. Now the product is out there to the top customers who’ve entry to this portfolio.

Launching an AWS Service Catalog Product Using Terraform
End customers see the checklist of merchandise and variations they’ve entry to and might deploy them in a single motion. If you already use Service Catalog, the expertise is similar as with CloudFormation merchandise.

I register to the AWS Console within the consumer account for Service Catalog. The portfolio I used earlier than has been shared by the administration account with this consumer account. In the Service Catalog console, I select Products from the Provisioning group within the navigation pane. I seek for the product by identify and select Launch product.

I let Service Catalog generate a novel identify for the provisioned product and choose the product model to deploy. Then, I launch the product.

After a couple of minutes, the product has been deployed and is out there. The deployment has been managed by the Terraform Reference Engine.

In the Associated tags tab, I see that Service Catalog mechanically added data on the portfolio and the product.

In the Resources tab, I see the sources created by the provisioned product. As anticipated, it’s an EC2 occasion, and I can observe the hyperlink to open the Amazon EC2 console and get extra data.

End customers similar to engineers, database directors, and knowledge scientists can proceed to make use of Service Catalog and launch the merchandise they want with out having to think about if they’re provisioned utilizing Terraform or CloudFormation.

Availability and Pricing
AWS Service Catalog help for Terraform open-source configurations is out there in the present day in all AWS Regions the place it’s supplied. There is not any change in pricing when utilizing Terraform. With Service Catalog, you pay for the API calls you make to the service, and you can begin at no cost with the free tier. You additionally pay for the sources used and created by the Terraform Reference Engine. For extra data, see Service Catalog Pricing.

Enable self-service provisioning at scale in your Terraform open-source configurations.

— Danilo