Terraform EC2 + Security Group + Docker

Now the whole environment becomes code. Terraform creates the EC2 instance, a least-privilege security group, an IAM role, a key pair, and basic networking — all reproducible with `terraform apply` and destroyable with `terraform destroy`. This is the jump from 'a server I built' to 'infrastructure I can recreate anywhere'.

The files this template produces. Copy any of them straight into your project.

terraform {
  required_version = ">= 1.6"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

provider "aws" {
  region = var.region
}

# Scoped security group: SSH from your IP, HTTP/HTTPS from anywhere.
resource "aws_security_group" "web" {
  name        = "${var.name}-sg"
  description = "Web + restricted SSH"

  ingress {
    description = "SSH from operator"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.operator_cidr]
  }
  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  tags = { Project = var.name }
}

resource "aws_instance" "web" {
  ami                    = var.ami_id
  instance_type          = "t3.micro"
  key_name               = var.key_name
  vpc_security_group_ids = [aws_security_group.web.id]
  iam_instance_profile   = aws_iam_instance_profile.web.name

  user_data = <<-EOF
    #!/usr/bin/env bash
    dnf install -y docker && systemctl enable --now docker
    docker run -d --name web -p 80:80 --restart unless-stopped nginx:1.27-alpine
  EOF

  tags = { Name = var.name, Project = var.name }
}

1. 1

   Initialize Terraform

   Download the AWS provider and set up the working directory.

   terraform init

   Pulls the AWS provider plugin.

2. 2

   Preview the plan

   Always look before you leap. `plan` shows every resource Terraform will create — nothing is applied yet.

   terraform plan -var operator_cidr="$(curl -s ifconfig.me)/32"

   Scopes SSH to your current public IP automatically.

3. 3

   Apply

   Create the security group, IAM role, and instance. Terraform records everything in its state file.

   terraform apply

   Type 'yes' to confirm the plan.

   The state file describes your real infrastructure — keep it safe (Level 9 moves it to a remote backend).

4. 4

   Reach the app

   Open the public_ip output in a browser. The same box as before — but now it's fully described by code.

5. 5

   Destroy it

   Prove the value of IaC: tear the whole thing down in one command, then recreate it any time.

   terraform destroy

   Removes every resource it created.

Ask the assistant to explain, review, or recommend — authored for this template.

• SSH is now scoped to your IP

  Info

  The security group only allows SSH from operator_cidr, not the whole internet.

• IAM role enables keyless access

  Info

  Attaching AmazonSSMManagedInstanceCore lets you use Session Manager instead of SSH keys.

• HTTP still open to the world

  Low

  Port 80 is public (expected for a web app), but there's no TLS in this minimal config.

  Reuse the Nginx + Certbot pattern from Level 1, or terminate TLS at a load balancer later.

Tear it down when you're done — the fastest way to avoid a surprise bill.

1. 1

   Run terraform destroy — this is the whole point of IaC.

   Billing

   terraform destroy

2. 2

   Confirm no leftover key pairs or Elastic IPs remain in the console.