tpotce/cloud/terraform/README.md

# T-Pot Terraform

This [Terraform](https://www.terraform.io/) configuration can be used to provision a T-Pot instance in AWS in addition to all of the necessary pre-requisites. Specifically, the following resources will be created:

* EC2 instance:
  * t3.large (2 vCPU, 8 GiB RAM)
  * 128GB disk
  * [Debian Stretch](https://wiki.debian.org/Cloud/AmazonEC2Image/Stretch) (The T-Pot installation script will then upgrade this to Debian Sid)
* AWS Security Group:
  * TCP/UDP ports <= 64000 open to the Internet
  * TCP ports 64294, 64295 and 64297 open to a chosen administrative IP

[Cloud-init](https://cloudinit.readthedocs.io/en/latest/) is used to bootstrap the instance and install T-Pot on startup. Additional provisioning using Ansible etc. is not required.

The following resources are NOT automatically created and need to be specified in the configuration below:

* VPC
* Subnet

## Pre-Requisites

* [Terraform](https://www.terraform.io/) 0.12
* AWS Account
  * Existing VPC. VPC ID should be specified in configuration below
  * Existing subnet. Subnet ID should be specified in configuration below
* AWS Authentication credentials should be [set using environment variables](https://www.terraform.io/docs/providers/aws/index.html#environment-variables)

## Required Configuration Changes

### Terraform Variables

In `aws/variables.tf`, change the following variables to correspond to your existing EC2 infrastructure:

* `admin_ip` - source IP address(es) that you will use to administer the system. Connections to TCP ports 64294, 64295 and 64297 will be allowed from this IP only. Multiple IPs or CIDR blocks can be specified in the format: `["127.0.0.1/32", "192.168.0.0/24"]`
* `ec2_vpc_id`
* `ec2_subnet_id`
* `ec2_region`

### Admin Credentials
```
myCONF_WEB_USER='webuser'
myCONF_WEB_PW='w3b$ecret'
```
This will be used to configure credentials for the T-Pot Kibana interface.

## Initialising

The [`terraform init`](https://www.terraform.io/docs/commands/init.html) command is used to initialize a working directory containing Terraform configuration files.

```
$ cd aws
$ terraform init
```

## Applying the Configuration

The [`terraform apply`](https://www.terraform.io/docs/commands/apply.html) command is used to apply the changes required to reach the desired state of the configuration, or the pre-determined set of actions generated by a [`terraform plan`](https://www.terraform.io/docs/commands/plan.html) execution plan.

```
$ terraform apply
```

This will perform the following actions:

1. Create EC2 security group
2. Start a Debian EC2 instance
3. Update all packages and reboot if necessary
4. Install T-Pot and required dependencies
5. Reboot

## Connecting to the Instance

When the installation is completed, you can proceed with connecting/logging in to the T-Pot according to the [documentation](https://github.com/dtag-dev-sec/tpotce#ssh-and-web-access).