Enterprise Infrastructure Lab
Interactive terraform planning, cost estimation, and security validation.
bash - terraform plan
Terraform will perform the following actions:
# aws_vpc.lakshay_portfolio_vpc will be created
+ resource "aws_vpc" "lakshay_portfolio_vpc" {
+ cidr_block = "10.0.0.0/16"
+ enable_dns_hostnames = true
+ tags = { Name = "lakshay-walia-cloud-vpc" }
}
# aws_security_group.k3s_cluster_sg will be created
+ resource "aws_security_group" "k3s_cluster_sg" {
+ name = "k3s-cluster-hardened-sg"
+ ingress: 443/tcp from 0.0.0.0/0
+ ingress: 80/tcp from 0.0.0.0/0
+ ingress: 22/tcp from 10.0.0.0/16 (VPC only)
}
# aws_s3_bucket.educenter_backups will be created
+ resource "aws_s3_bucket" "educenter_backups" { ... }
# aws_subnet.public will be created
# aws_subnet.private will be created
# aws_internet_gateway.igw will be created
# aws_nat_gateway.nat will be created
# aws_instance.k3s_master will be created
# aws_instance.k3s_worker will be created
Plan: 9 to add, 0 to change, 0 to destroy.
lakshay_portfolio_vpc
aws_vpc
igw
aws_internet_gateway
public_subnet
aws_subnet
private_subnet
aws_subnet
nat_gw
aws_nat_gateway
k3s_master
aws_instance
educenter_backups
aws_s3_bucket
Resource Config
Click a node to view HCL...
Compute Resources
Number of Instances
1
Storage & Data
EBS Storage (GB) ($0.10/GB/mo)
20
S3 Storage (GB) ($0.023/GB/mo)
10
Data Transfer Out (GB) ($0.09/GB)
5
Networking Add-ons
Elastic IP (Unattached)
$3.60/mo
NAT Gateway
$32/mo + $0.045/GB
Estimated AWS Cost
$0.00
Annual: $0.00
Compute (EC2)
$0.00
Storage (EBS+S3)
$0.00
Networking (NAT+EIP)
$0.00
Data Transfer
$0.00
Security Score: 78/100
Based on CIS AWS Foundations
Inbound Rules Analysis
| Port/Protocol | Source | Description | Status |
|---|---|---|---|
| TCP 22 (SSH) | 10.0.0.0/16 | Admin access from internal VPC | ✓ Good |
| TCP 443 (HTTPS) | 0.0.0.0/0 | Public web traffic | ✓ Good |
| TCP 80 (HTTP) | 0.0.0.0/0 | Public web traffic | ⚠️ Warning |
| ALL (Egress) | 0.0.0.0/0 | Unrestricted outbound traffic | ⚠️ Warning |
CIS Benchmark Compliance
✓ Ensure no security groups allow ingress from 0.0.0.0/0 to port 22
✓ Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389
✓ Ensure VPC flow logging is enabled in all VPCs
✖ Ensure the default security group of every VPC restricts all traffic
✓ Ensure routing tables do not route VPC peering traffic to IGW
✖ Ensure unrestricted egress is minimized
1 Select Operating System
2 Select Node Role
3 Security Hardening
4 Additional Tools
# Click 'Generate Bootstrap Script' to create your custom provisioning script.
# The script will appear here.