# ec2-node
Creates EC2 instances with IMDSv2, encrypted root volumes, and optional key pairs.
Provisions one or more EC2 instances with IMDSv2 enforced, encrypted root and data EBS volumes, and optional detailed monitoring. Key pairs are created and associated when provided. `ami_id` is passed in explicitly per instance to keep builds deterministic — there is no AMI lookup or filtering in this module. Instance names are derived from `name_prefix`, the resolved AWS availability-zone ID, and each instance's `name_suffix`.
Primary and secondary private IPs can be set explicitly. Secondary IPs are attached to the instance's primary ENI and can be added or changed on existing instances without replacing them, subject to the max IP count for the chosen instance type.
## Usage
### Basic instance
```hcl
module "ec2" {
source = "hcassc.jfrog.io/iac-tf-modules-virtual__compute/ec2-node/aws"
version = "0.6.0"
name_prefix = "prod"
instances = {
bastion = {
name_suffix = "bastion"
ami_id = "ami-0123456789abcdef0"
instance_type = "t3.micro"
subnet_id = module.vpc.public_subnet_ids["a"]
security_group_ids = [module.security_groups.ids["bastion"]]
iam_instance_profile = module.iam_role.instance_profile_name
associate_public_ip = true
root_volume = {
size = 20
}
}
}
}
```
### Fixed primary and secondary private IPs
Useful when downstream systems (DNS, firewall rules, peer configs) need to reference stable addresses. Note the instance type's max private-IP-per-ENI limit caps how many secondary IPs you can request — a `t3.micro`, for example, allows only one secondary IP in addition to the primary.
```hcl
module "ec2" {
source = "hcassc.jfrog.io/iac-tf-modules-virtual__compute/ec2-node/aws"
version = "0.6.0"
name_prefix = "prod"
instances = {
app-node = {
name_suffix = "app-node"
ami_id = "ami-0123456789abcdef0"
instance_type = "t3.medium"
subnet_id = module.vpc.private_subnet_ids["a"]
security_group_ids = [module.security_groups.ids["app"]]
primary_private_ip = "10.0.1.10"
secondary_private_ips = ["10.0.1.11", "10.0.1.12"]
root_volume = {
size = 20
}
}
}
}
```
### Multiple instances with data volumes and key pair
```hcl
module "ec2" {
source = "hcassc.jfrog.io/iac-tf-modules-virtual__compute/ec2-node/aws"
version = "0.6.0"
name_prefix = "prod"
key_pairs = {
ops = {
name = "ops-team"
public_key = file("${path.module}/keys/ops.pub")
}
}
instances = {
db-primary = {
name_suffix = "db-primary"
ami_id = "ami-0123456789abcdef0"
instance_type = "r6g.large"
subnet_id = module.vpc.private_subnet_ids["a"]
security_group_ids = [module.security_groups.ids["db"]]
key_name = "ops"
primary_private_ip = "10.0.2.10"
root_volume = {
size = 20
}
data_volumes = [
{
device_name = "/dev/xvdf"
volume_size = 200
volume_type = "gp3"
iops = 6000
throughput = 250
}
]
instance_tags = {
role = "database"
}
}
db-replica = {
name_suffix = "db-replica"
ami_id = "ami-0123456789abcdef0"
instance_type = "r6g.large"
subnet_id = module.vpc.private_subnet_ids["b"]
security_group_ids = [module.security_groups.ids["db"]]
key_name = "ops"
primary_private_ip = "10.0.3.10"
root_volume = {
size = 20
}
data_volumes = [
{
device_name = "/dev/xvdf"
volume_size = 200
}
]
instance_tags = {
role = "database-replica"
}
}
}
tags = {
environment = "prod"
team = "platform"
}
}
```
## Requirements
| Name | Version |
| ------------------------------------------------------------------------ | ------------------ |
| [terraform](#requirement_terraform) | >= 1.15.0, < 2.0.0 |
| [aws](#requirement_aws) | >= 6.0, < 7.0 |
## Providers
| Name | Version |
| ------------------------------------------------ | ------------- |
| [aws](#provider_aws) | >= 6.0, < 7.0 |
## Resources
| Name | Type |
| --------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_ebs_volume.data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume) | resource |
| [aws_instance.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
| [aws_key_pair.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource |
| [aws_volume_attachment.data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/volume_attachment) | resource |
## Inputs
| Name | Description | Type | Default | Required |
| ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | :------: |
| [name_prefix](#input_name_prefix) | Prefix prepended to resource names created by this module | `string` | n/a | yes |
| [instances](#input_instances) | Map of EC2 instance definitions.
- ami_id is passed in explicitly to ensure deterministic builds.
- name_suffix is appended to resources to ensure standardized names. | map(object({
name_suffix = string
ami_id = string
instance_type = string
subnet_id = string
security_group_ids = list(string)
iam_instance_profile = optional(string)
key_name = optional(string)
associate_public_ip = optional(bool, false)
ebs_optimized = optional(bool, true)
monitoring = optional(bool, false)
placement_group = optional(string)
tenancy = optional(string, "default")
primary_private_ip = optional(string)
secondary_private_ips = optional(list(string), [])
# User data — mutually exclusive
user_data = optional(string)
user_data_base64 = optional(string)
# IMDSv2 — tokens required by default, hop limit 1 unless overridden (e.g. ECS needs 2)
metadata_http_tokens = optional(string, "required")
metadata_hop_limit = optional(number, 1)
# Root volume
root_volume = object({
size = number
type = optional(string, "gp3")
kms_key_id = optional(string)
delete_on_termination = optional(bool, true)
tags = optional(map(string), {})
})
# Additional EBS data volumes
data_volumes = optional(list(object({
device_name = string
volume_size = number
volume_type = optional(string, "gp3")
kms_key_id = optional(string)
delete_on_termination = optional(bool, true)
iops = optional(number)
throughput = optional(number)
tags = optional(map(string), {})
})), [])
# Per-instance tags — overrides module level tags
instance_tags = optional(map(string), {})
})) | `{}` | no |
| [key_pairs](#input_key_pairs) | Map of key pairs to register in AWS EC2.
Each entry requires a name and an OpenSSH-format public key string
which may be sourced from a secret store or a TLS provider. | map(object({
name = string
public_key = string
})) | `{}` | no |
| [tags](#input_tags) | Tags applied to all resources in this module. | `map(string)` | `{}` | no |
## Outputs
| Name | Description |
| -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| [ami_ids](#output_ami_ids) | Map of instance keys to the AMI ID in use. |
| [data_volume_attachments](#output_data_volume_attachments) | Map of data volume keys to attached volume IDs. |
| [data_volume_ids](#output_data_volume_ids) | Map of data volume keys to EBS volume IDs. |
| [instance_arns](#output_instance_arns) | Map of instance keys to instance ARNs. |
| [instance_ids](#output_instance_ids) | Map of instance keys to instance IDs. |
| [key_pair_fingerprints](#output_key_pair_fingerprints) | Map of key pair keys to fingerprints. |
| [key_pair_ids](#output_key_pair_ids) | Map of key pair keys to AWS key pair IDs. |
| [network_interface_ids](#output_network_interface_ids) | Map of instance keys to primary network interface IDs (for manual ENI IP tests). |
| [primary_private_ips](#output_primary_private_ips) | Map of instance keys to primary private IP addresses. |
| [private_dns](#output_private_dns) | Map of instance keys to private DNS names. |
| [public_ips](#output_public_ips) | Map of instance keys to public IP addresses. Null if no public IP assigned. |
| [secondary_private_ips](#output_secondary_private_ips) | Map of instance keys to their secondary private IP addresses. |