mirror of https://github.com/hashicorp/boundary
chore(e2e): Add module for rdp member server (#5976)
* chore(e2e): Add module for rdp member server * CR: Update Domain mode to be compatible with newer versions of Windows * CR: Add comments to ports * CR: Simplify adding computer to the domainpull/5981/head
Michael Li
6 months ago
committed by
GitHub
parent
91050dcd46
commit
71fc7a5ec4
@ -0,0 +1,48 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
output "public_dns_address" {
|
||||
value = aws_instance.domain_controller.public_dns
|
||||
}
|
||||
|
||||
output "public_ip" {
|
||||
value = aws_instance.domain_controller.public_ip
|
||||
}
|
||||
|
||||
output "private_ip" {
|
||||
value = aws_instance.domain_controller.private_ip
|
||||
}
|
||||
|
||||
output "ipv6" {
|
||||
value = flatten(aws_instance.domain_controller.ipv6_addresses)
|
||||
}
|
||||
|
||||
output "admin_username" {
|
||||
description = "The username of the administrator account"
|
||||
value = "Administrator"
|
||||
}
|
||||
|
||||
output "password" {
|
||||
description = "This is the decrypted administrator password for the EC2 instance"
|
||||
value = nonsensitive(local.password)
|
||||
}
|
||||
|
||||
output "ssh_private_key" {
|
||||
description = "Private key to ssh into the windows client"
|
||||
value = abspath(local_sensitive_file.private_key.filename)
|
||||
}
|
||||
|
||||
output "security_group_id_list" {
|
||||
description = "List of security group IDs attached to the RDP server"
|
||||
value = aws_instance.domain_controller.vpc_security_group_ids
|
||||
}
|
||||
|
||||
output "keypair_name" {
|
||||
description = "The name of the keypair used for the instance"
|
||||
value = aws_key_pair.rdp-key.key_name
|
||||
}
|
||||
|
||||
output "domain_name" {
|
||||
description = "The domain name the instance is joined to"
|
||||
value = var.active_directory_domain
|
||||
}
|
||||
@ -1,46 +1,51 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
variable "prefix" {
|
||||
type = string
|
||||
description = "Prefix used to name various infrastructure components. Alphanumeric characters only."
|
||||
default = "enos"
|
||||
}
|
||||
|
||||
variable "vpc_id" {
|
||||
type = string
|
||||
description = "Id of VPC to add additional infra resources to."
|
||||
}
|
||||
|
||||
variable "aws_key_pair_name" {
|
||||
type = string
|
||||
description = "key_name for the aws_key_pair resource"
|
||||
default = "RDPKey"
|
||||
}
|
||||
|
||||
# =================================================================
|
||||
# ec2 instance configuration
|
||||
# =================================================================
|
||||
variable "server_version" {
|
||||
type = string
|
||||
description = "Server version for the windows instance"
|
||||
# Note that only 2025 and 2022 are supported in aws
|
||||
default = "2025"
|
||||
}
|
||||
|
||||
variable "rdp_target_instance_type" {
|
||||
variable "instance_type" {
|
||||
type = string
|
||||
description = "The AWS instance type to use for servers."
|
||||
default = "m7i-flex.xlarge"
|
||||
}
|
||||
|
||||
variable "prefix" {
|
||||
type = string
|
||||
description = "Prefix used to name various infrastructure components. Alphanumeric characters only."
|
||||
default = "enos"
|
||||
}
|
||||
|
||||
variable "root_block_device_size" {
|
||||
type = string
|
||||
description = "The volume size of the root block device."
|
||||
default = 128
|
||||
}
|
||||
|
||||
variable "aws_key_pair_name" {
|
||||
type = string
|
||||
description = "key_name for the aws_key_pair resource"
|
||||
default = "RDPKey"
|
||||
}
|
||||
|
||||
# =================================================================
|
||||
# domain information
|
||||
# =================================================================
|
||||
variable "active_directory_domain" {
|
||||
type = string
|
||||
description = "The name of the Active Directory domain to be created on the Windows Domain Controller."
|
||||
default = "mydomain.local"
|
||||
default = "mydomain.com"
|
||||
}
|
||||
|
||||
variable "active_directory_netbios_name" {
|
||||
@ -0,0 +1,169 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
terraform {
|
||||
required_version = ">= 1.1.2"
|
||||
|
||||
required_providers {
|
||||
enos = {
|
||||
source = "registry.terraform.io/hashicorp-forge/enos"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "enos_environment" "current" {}
|
||||
|
||||
data "aws_caller_identity" "current" {}
|
||||
|
||||
data "aws_ami" "infra" {
|
||||
most_recent = true
|
||||
owners = ["amazon"]
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["Windows_Server-${var.server_version}-English-Full-Base*"]
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_vpc" "infra" {
|
||||
id = var.vpc_id
|
||||
}
|
||||
|
||||
data "aws_subnets" "infra" {
|
||||
filter {
|
||||
name = "vpc-id"
|
||||
values = [var.vpc_id]
|
||||
}
|
||||
}
|
||||
|
||||
locals {
|
||||
username = split(":", data.aws_caller_identity.current.user_id)[1]
|
||||
domain_parts = split(".", var.active_directory_domain)
|
||||
domain_sld = local.domain_parts[0] # second-level domain (example.com --> example)
|
||||
domain_tld = local.domain_parts[1] # top-level domain (example.com --> com)
|
||||
}
|
||||
|
||||
resource "aws_instance" "member_server" {
|
||||
ami = data.aws_ami.infra.id
|
||||
instance_type = var.instance_type
|
||||
vpc_security_group_ids = var.domain_controller_sec_group_id_list
|
||||
key_name = var.domain_controller_aws_keypair_name
|
||||
subnet_id = data.aws_subnets.infra.ids[0]
|
||||
ipv6_address_count = 1
|
||||
|
||||
root_block_device {
|
||||
volume_type = "gp2"
|
||||
volume_size = var.root_block_device_size
|
||||
delete_on_termination = "true"
|
||||
encrypted = true
|
||||
}
|
||||
|
||||
user_data_replace_on_change = true
|
||||
|
||||
user_data = <<EOF
|
||||
<powershell>
|
||||
# Set up SSH so we can remotely manage the instance
|
||||
## Install OpenSSH Server and Client
|
||||
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
|
||||
Set-Service -Name sshd -StartupType 'Automatic'
|
||||
Start-Service sshd
|
||||
|
||||
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
|
||||
Set-Service -Name ssh-agent -StartupType Automatic
|
||||
Start-Service ssh-agent
|
||||
|
||||
## Set PowerShell as the default SSH shell
|
||||
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value (Get-Command powershell.exe).Path -PropertyType String -Force
|
||||
|
||||
## Configure SSH server to use private key authentication so that scripts don't have to use passwords
|
||||
## Save the private key from instance metadata
|
||||
$ImdsToken = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/api/token' -Method 'PUT' -Headers @{'X-aws-ec2-metadata-token-ttl-seconds' = 2160} -UseBasicParsing).Content
|
||||
$ImdsHeaders = @{'X-aws-ec2-metadata-token' = $ImdsToken}
|
||||
$AuthorizedKey = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key' -Headers $ImdsHeaders -UseBasicParsing).Content
|
||||
$AuthorizedKeysPath = 'C:\ProgramData\ssh\administrators_authorized_keys'
|
||||
New-Item -Path $AuthorizedKeysPath -ItemType File -Value $AuthorizedKey -Force
|
||||
|
||||
## Ensure the SSH agent pulls in the new key.
|
||||
Set-Service -Name ssh-agent -StartupType "Automatic"
|
||||
Restart-Service -Name ssh-agent
|
||||
|
||||
## Open the firewall for SSH connections
|
||||
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
|
||||
|
||||
# Adds member server to the domain
|
||||
[int]$intix = Get-NetAdapter | % { Process { If ( $_.Status -eq "up" ) { $_.ifIndex } }}
|
||||
Set-DNSClientServerAddress -interfaceIndex $intix -ServerAddresses ("${var.domain_controller_ip}","127.0.0.1")
|
||||
$here_string_password = @'
|
||||
${var.domain_admin_password}
|
||||
'@
|
||||
$password = ConvertTo-SecureString $here_string_password -AsPlainText -Force
|
||||
$username = "${local.domain_sld}\Administrator"
|
||||
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
|
||||
|
||||
# check that domain can be reached
|
||||
$timeout = 300
|
||||
$interval = 10
|
||||
$elapsed = 0
|
||||
|
||||
do {
|
||||
try {
|
||||
$result = Resolve-DnsName -Name "${var.active_directory_domain}" -Server "${var.domain_controller_ip}" -ErrorAction Stop
|
||||
if ($result) {
|
||||
Write-Host "DNS resolved successfully."
|
||||
break
|
||||
}
|
||||
} catch {
|
||||
Write-Host "DNS not resolved yet. Retrying in $interval seconds..."
|
||||
Start-Sleep -Seconds $interval
|
||||
$elapsed += $interval
|
||||
}
|
||||
if ($elapsed -ge $timeout) {
|
||||
Write-Host "DNS resolution failed after 5 minutes. Exiting."
|
||||
exit 1
|
||||
}
|
||||
} while ($true)
|
||||
|
||||
# add computer to domain
|
||||
Add-Computer -DomainName "${var.active_directory_domain}" -Credential $credential
|
||||
|
||||
Restart-Computer -Force
|
||||
</powershell>
|
||||
EOF
|
||||
|
||||
metadata_options {
|
||||
http_endpoint = "enabled"
|
||||
instance_metadata_tags = "enabled"
|
||||
}
|
||||
get_password_data = true
|
||||
|
||||
tags = {
|
||||
Name = "${var.prefix}-rdp-member-server-${local.username}"
|
||||
}
|
||||
}
|
||||
|
||||
locals {
|
||||
password = rsadecrypt(aws_instance.member_server.password_data, file(var.domain_controller_private_key))
|
||||
private_key = abspath(var.domain_controller_private_key)
|
||||
}
|
||||
|
||||
resource "time_sleep" "wait_2_minutes" {
|
||||
depends_on = [aws_instance.member_server]
|
||||
create_duration = "2m"
|
||||
}
|
||||
|
||||
# wait for the SSH service to be available on the instance. We specifically use
|
||||
# BatchMode=Yes to prevent SSH from prompting for a password to ensure that we
|
||||
# can just SSH using the private key
|
||||
resource "enos_local_exec" "wait_for_ssh" {
|
||||
depends_on = [time_sleep.wait_2_minutes]
|
||||
inline = ["timeout 600s bash -c 'until ssh -i ${local.private_key} -o BatchMode=Yes -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no Administrator@${aws_instance.member_server.public_ip} \"echo ready\"; do sleep 10; done'"]
|
||||
}
|
||||
|
||||
# Retrieve the domain hostname of the member server, which will be used in
|
||||
# Kerberos
|
||||
resource "enos_local_exec" "get_hostname" {
|
||||
depends_on = [
|
||||
enos_local_exec.wait_for_ssh,
|
||||
]
|
||||
|
||||
inline = ["ssh -i ${local.private_key} -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no Administrator@${aws_instance.member_server.public_ip} '$env:COMPUTERNAME'"]
|
||||
}
|
||||
@ -0,0 +1,34 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
output "public_dns_address" {
|
||||
description = "This is the public DNS address of our instance"
|
||||
value = aws_instance.member_server.public_dns
|
||||
}
|
||||
|
||||
output "public_ip" {
|
||||
value = aws_instance.member_server.public_ip
|
||||
}
|
||||
|
||||
output "private_ip" {
|
||||
value = aws_instance.member_server.private_ip
|
||||
}
|
||||
|
||||
output "ipv6" {
|
||||
value = flatten(aws_instance.member_server.ipv6_addresses)
|
||||
}
|
||||
|
||||
output "admin_username" {
|
||||
description = "The username of the administrator account"
|
||||
value = "Administrator"
|
||||
}
|
||||
|
||||
output "password" {
|
||||
description = "This is the decrypted administrator password for the EC2 instance"
|
||||
value = local.password
|
||||
}
|
||||
|
||||
output "domain_hostname" {
|
||||
description = "The hostname of the domain controller"
|
||||
value = trimspace(enos_local_exec.get_hostname.stdout)
|
||||
}
|
||||
@ -0,0 +1,73 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
variable "vpc_id" {
|
||||
type = string
|
||||
description = "Id of VPC to add additional infra resources to."
|
||||
}
|
||||
|
||||
# =================================================================
|
||||
# ec2 instance configuration
|
||||
# =================================================================
|
||||
variable "server_version" {
|
||||
type = string
|
||||
description = "Server version for the windows instance"
|
||||
default = "2025"
|
||||
}
|
||||
|
||||
variable "instance_type" {
|
||||
type = string
|
||||
description = "The AWS instance type to use for servers."
|
||||
default = "m7i-flex.xlarge"
|
||||
}
|
||||
|
||||
variable "root_block_device_size" {
|
||||
type = string
|
||||
description = "The volume size of the root block device."
|
||||
default = 128
|
||||
}
|
||||
|
||||
variable "prefix" {
|
||||
type = string
|
||||
description = "Prefix used to name various infrastructure components. Alphanumeric characters only."
|
||||
default = "enos"
|
||||
}
|
||||
|
||||
variable "domain_hostname" {
|
||||
type = string
|
||||
description = "Hostname to assign to the member server"
|
||||
default = "MyWindowsServer"
|
||||
}
|
||||
|
||||
variable "active_directory_domain" {
|
||||
type = string
|
||||
description = "The name of the Active Directory domain to be created on the Windows Domain Controller."
|
||||
}
|
||||
|
||||
# =================================================================
|
||||
# domain controller information
|
||||
# =================================================================
|
||||
variable "domain_controller_aws_keypair_name" {
|
||||
type = string
|
||||
description = "The AWS keypair created during creation of the domain controller."
|
||||
}
|
||||
|
||||
variable "domain_controller_ip" {
|
||||
type = string
|
||||
description = "IP Address of an already created Domain Controller and DNS server."
|
||||
}
|
||||
|
||||
variable "domain_admin_password" {
|
||||
type = string
|
||||
description = "The domain administrator password."
|
||||
}
|
||||
|
||||
variable "domain_controller_private_key" {
|
||||
type = string
|
||||
description = "The file path of the private key generated during creation of the domain controller."
|
||||
}
|
||||
|
||||
variable "domain_controller_sec_group_id_list" {
|
||||
type = list(any)
|
||||
description = "ID's of AWS Network Security Groups created during creation of the domain controller."
|
||||
}
|
||||
@ -1,28 +0,0 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
output "public_dns_address" {
|
||||
value = aws_instance.rdp_target.public_dns
|
||||
}
|
||||
|
||||
output "public_ip" {
|
||||
value = aws_instance.rdp_target.public_ip
|
||||
}
|
||||
|
||||
output "private_ip" {
|
||||
value = aws_instance.rdp_target.private_ip
|
||||
}
|
||||
|
||||
output "admin_username" {
|
||||
description = "The username of the administrator account"
|
||||
value = "Administrator"
|
||||
}
|
||||
|
||||
output "password" {
|
||||
description = "This is the decrypted administrator password for the EC2 instance"
|
||||
value = nonsensitive(local.password)
|
||||
}
|
||||
|
||||
output "ipv6" {
|
||||
value = flatten(aws_instance.rdp_target.*.ipv6_addresses)
|
||||
}
|
||||
Loading…
Reference in new issue