VPC avec Terraform & AWS

  # create a VPC
  resource "aws_vpc" "main" {
    cidr_block = var.vpc_cidr
    tags       = { Name = var.vpc_tag } # utilise vpc_tag
  }

  # subnet public
  resource "aws_subnet" "pub" {
    count             = length(var.vpc_subnet_pub)
    vpc_id            = aws_vpc.main.id
    cidr_block        = var.vpc_subnet_pub[count.index]
    availability_zone = var.azs[count.index]
    tags = {
      Name = "subnet_${var.vpc_subnet_pub[count.index]}"
    }
  }

  # subnet private
  resource "aws_subnet" "priv" {
    count             = length(var.vpc_subnet_priv)
    vpc_id            = aws_vpc.main.id
    cidr_block        = var.vpc_subnet_priv[count.index]
    availability_zone = var.azs[count.index]
    tags = {
      Name = "subnet_${var.vpc_subnet_priv[count.index]}"
    }
  }

  # IGW / internet gateway
  resource "aws_internet_gateway" "igw" {
    vpc_id = aws_vpc.main.id
    tags   = { Name = "IGW" }
  }

  # EIP pour NAT
  resource "aws_eip" "nat_eip" {
    domain = "vpc"
  }

  #NAT GW dans SUB1 publique
  resource "aws_nat_gateway" "nat" {
    allocation_id = aws_eip.nat_eip.id
    subnet_id     = aws_subnet.pub[0].id
    tags          = { Name = "NAT-GW" }
  }

  # table routage publique (0.0.0/0 -> IGW)
  resource "aws_route_table" "public" {
    vpc_id = aws_vpc.main.id
    route {
      cidr_block = "0.0.0.0/0"
      gateway_id = aws_internet_gateway.igw.id
    }
    tags = { Name = "RT-public" }
  }

  # association RT publique aux sub public 1&2
  resource "aws_route_table_association" "pub" {
    count          = length(var.vpc_subnet_pub)
    subnet_id      = aws_subnet.pub[count.index].id
    route_table_id = aws_route_table.public.id
  }

  # table routage private (0.0.0/0 → IGW)
  resource "aws_route_table" "private" {
    vpc_id = aws_vpc.main.id
    route {
      cidr_block     = "0.0.0.0/0"
      nat_gateway_id = aws_nat_gateway.nat.id
    }
    tags = { Name = "RT-private" }
  }

  # association RT privée aux sub privés 3&4
  resource "aws_route_table_association" "priv" {
    count          = length(var.vpc_subnet_priv)
    subnet_id      = aws_subnet.priv[count.index].id # public → priv
    route_table_id = aws_route_table.private.id      # public → private
  }

  # EC2 dans subnets privés
  resource "aws_instance" "web" {
    count                  = 2
    ami                    = var.web_ami_id
    instance_type          = "t3.micro"
    subnet_id              = aws_subnet.priv[count.index].id
    vpc_security_group_ids = [aws_security_group.web_sg.id]
    user_data = base64encode(<<-EOF
                #!/bin/bash
                apt update -y 
                apt upgrade
                apt-getyum install -y apache2httpd
                systemctl start apache2httpd
                systemctl enable apache2httpd
                echo "Bienvenue sur le serveur web privé # ${count.index}" > /var/www/html/index.html
                EOF
    )

    tags = { Name = "lab-web-${count.index + 1}" }
  }

  #load balancer + target group
  resource "aws_lb" "alb" {
    name               = "lab-alb"
    load_balancer_type = "application"
    subnets            = aws_subnet.pub[*].id
    security_groups    = [aws_security_group.alb_sg.id]
  }

  resource "aws_lb_target_group" "tg" {
    name     = "lab-tg"
    port     = 80
    protocol = "HTTP"
    vpc_id   = aws_vpc.main.id
  }

  resource "aws_lb_target_group_attachment" "tg_attachment" {
    count            = length(aws_instance.web)
    target_group_arn = aws_lb_target_group.tg.arn
    target_id        = aws_instance.web[count.index].id
    port             = 80
  }

  resource "aws_lb_listener" "http" {
    load_balancer_arn = aws_lb.alb.arn
    port              = 80
    protocol          = "HTTP"

    default_action {
      type             = "forward"
      target_group_arn = aws_lb_target_group.tg.arn
    }
  }

  #security groups
  #pour l’ALB
  resource "aws_security_group" "alb_sg" {
    name   = "lab-alb-sg"
    vpc_id = aws_vpc.main.id

    ingress { #inbound : HTTP/HTTPS depuis 0.0.0.0/0
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }

    egress { #Outbound : vers SG des serveurs
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }

  #pour EC2 privés
  resource "aws_security_group" "web_sg" {
    name   = "lab-web-sg"
    vpc_id = aws_vpc.main.id

    ingress {
      from_port       = 80
      to_port         = 80
      protocol        = "tcp"
      security_groups = [aws_security_group.alb_sg.id]
      description     = "HTTP from ALB"
    }

    egress {
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }

variable "vpc_cidr" {
  description = "Plage CIDR du VPC"
  type        = string
  default     = "10.0.0.0/16"
}

variable "vpc_subnet_pub" {
  description = "CIDRs des subnets publics"
  type        = list(string)
  default     = ["10.0.1.0/24", "10.0.11.0/24"]
}

variable "vpc_subnet_priv" {
  description = "CIDRs des subnets privés"
  type        = list(string)
  default     = ["10.0.2.0/24", "10.0.21.0/24"]
}

variable "vpc_tag" {
  description = "Tag name du VPC"
  type        = string
  default     = "cesi"
}

variable "web_ami_id" {
  description = "AMI pour les EC2 web"
  type        = string
  default     = "ami-0c02fb55956c7d316" # Amazon Linux 2 us-east-1
}
variable "azs" {
  description = "Availability Zones"
  type        = list(string)
  default     = ["us-east-1a", "us-east-1b"] #region diff
}

# URL pour tester ALB
output "alb_dns_name" {
  description = "URL du Load Balancer"
  value       = aws_lb.alb.dns_name
}

# VPC
output "vpc_id" {
  description = "ID du VPC"
  value       = aws_vpc.main.id
}

# subnets
output "subnet_pub_ids" {
  description = "IDs des subnets publics"
  value       = aws_subnet.pub[*].id
}

output "subnet_priv_ids" {
  description = "IDs des subnets privés"
  value       = aws_subnet.priv[*].id
}

# NAT GW
output "nat_gateway_ip" {
  description = "IP publique du NAT Gateway"
  value       = aws_eip.nat_eip.public_ip
}

# EC2
output "web_instance_ids" {
  description = "IDs des instances web"
  value       = aws_instance.web[*].id
}

output "web_private_ips" {
  description = "IPs privées des serveurs web"
  value       = aws_instance.web[*].private_ip
}