Compute

1# heroku-to-aws EB SingleInstance shape (generate-terraform.md): no ALB, instance in a PUBLIC
2# subnet with AssociatePublicIpAddress=true so it is reachable. MUST be POLICY_OK — the policy
3# gate flags only admin/datastore ports open to the world (22/3389/5432/6379/…), never web
4# 80/443, so serving web traffic directly from a public instance is not a violation.
5
6resource "aws_elastic_beanstalk_application" "web" {
7  name = "${var.project_name}-web"
8}
9
10resource "aws_elastic_beanstalk_environment" "web" {
11  name                = "${var.project_name}-web"
12  application         = aws_elastic_beanstalk_application.web.name
13  solution_stack_name = data.aws_elastic_beanstalk_solution_stack.web.name
14  tier                = "WebServer"
15
16  setting {
17    namespace = "aws:elasticbeanstalk:environment"
18    name      = "EnvironmentType"
19    value     = "SingleInstance"
20  }
21  setting {
22    namespace = "aws:autoscaling:launchconfiguration"
23    name      = "InstanceType"
24    value     = var.instance_type_web
25  }
26  setting {
27    namespace = "aws:autoscaling:launchconfiguration"
28    name      = "SecurityGroups"
29    value     = aws_security_group.eb_instances.id
30  }
31  setting {
32    namespace = "aws:ec2:vpc"
33    name      = "AssociatePublicIpAddress"
34    value     = "true"
35  }
36}
37
38data "aws_elastic_beanstalk_solution_stack" "web" {
39  most_recent = true
40  name_regex  = "64bit Amazon Linux 2023 (.*) running Python 3.12"
41}
42
43resource "aws_security_group" "eb_instances" {
44  name   = "${var.project_name}-eb"
45  vpc_id = aws_vpc.main.id
46
47  ingress {
48    from_port   = 80
49    to_port     = 80
50    protocol    = "tcp"
51    cidr_blocks = ["0.0.0.0/0"]
52  }
53  ingress {
54    from_port   = 443
55    to_port     = 443
56    protocol    = "tcp"
57    cidr_blocks = ["0.0.0.0/0"]
58  }
59  egress {
60    from_port   = 0
61    to_port     = 0
62    protocol    = "-1"
63    cidr_blocks = ["0.0.0.0/0"]
64  }
65}