05 - Infrastructure as Code Patterns: Terraform, Pulumi, and Policy as Code

# Terraform: reusable module for microservice infrastructure
# modules/microservice-infra/main.tf

variable "service_name" {
  type        = string
  description = "Microservice name"
}

variable "environment" {
  type        = string
  description = "Environment (dev, staging, production)"
}

variable "cpu_limit" {
  type    = string
  default = "500m"
}

variable "memory_limit" {
  type    = string
  default = "512Mi"
}

# Kubernetes namespace with standard labels
resource "kubernetes_namespace" "service" {
  metadata {
    name = "${var.service_name}-${var.environment}"
    labels = {
      "app.kubernetes.io/name"       = var.service_name
      "app.kubernetes.io/env"        = var.environment
      "platform.company.io/managed"  = "true"
    }
  }
}

# PostgreSQL database (RDS)
resource "aws_db_instance" "database" {
  identifier     = "${var.service_name}-${var.environment}"
  engine         = "postgres"
  engine_version = "15.4"
  instance_class = var.environment == "production" ? "db.r6g.large" : "db.t3.micro"

  allocated_storage     = 20
  max_allocated_storage = var.environment == "production" ? 100 : 50
  storage_encrypted     = true

  db_name  = replace(var.service_name, "-", "_")
  username = "app_user"
  password = random_password.db_password.result

  backup_retention_period = var.environment == "production" ? 30 : 7
  deletion_protection     = var.environment == "production"

  tags = {
    Service     = var.service_name
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

# Redis cache (ElastiCache)
resource "aws_elasticache_cluster" "cache" {
  cluster_id           = "${var.service_name}-${var.environment}"
  engine               = "redis"
  node_type            = var.environment == "production" ? "cache.r6g.large" : "cache.t3.micro"
  num_cache_nodes      = 1
  parameter_group_name = "default.redis7"
  port                 = 6379
}

output "namespace" {
  value = kubernetes_namespace.service.metadata[0].name
}

output "database_endpoint" {
  value = aws_db_instance.database.endpoint
}

output "cache_endpoint" {
  value = aws_elasticache_cluster.cache.cache_nodes[0].address
}
      

// Pulumi: reusable component in TypeScript
// microservice-infra.ts

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as k8s from "@pulumi/kubernetes";

interface MicroserviceInfraArgs {
  serviceName: string;
  environment: string;
  cpuLimit?: string;
  memoryLimit?: string;
  enableDatabase?: boolean;
  enableCache?: boolean;
}

export class MicroserviceInfra extends pulumi.ComponentResource {
  public readonly namespace: k8s.core.v1.Namespace;
  public readonly databaseEndpoint?: pulumi.Output<string>;
  public readonly cacheEndpoint?: pulumi.Output<string>;

  constructor(
    name: string,
    args: MicroserviceInfraArgs,
    opts?: pulumi.ComponentResourceOptions
  ) {
    super("company:platform:MicroserviceInfra", name, {}, opts);

    const isProd = args.environment === "production";

    // Kubernetes namespace
    this.namespace = new k8s.core.v1.Namespace(
      `${args.serviceName}-ns`,
      {
        metadata: {
          name: `${args.serviceName}-${args.environment}`,
          labels: {
            "app.kubernetes.io/name": args.serviceName,
            "app.kubernetes.io/env": args.environment,
            "platform.company.io/managed": "true",
          },
        },
      },
      { parent: this }
    );

    // Conditional database
    if (args.enableDatabase !== false) {
      const db = new aws.rds.Instance(
        `${args.serviceName}-db`,
        {
          identifier: `${args.serviceName}-${args.environment}`,
          engine: "postgres",
          engineVersion: "15.4",
          instanceClass: isProd ? "db.r6g.large" : "db.t3.micro",
          allocatedStorage: 20,
          storageEncrypted: true,
          deletionProtection: isProd,
        },
        { parent: this }
      );
      this.databaseEndpoint = db.endpoint;
    }

    this.registerOutputs({
      namespaceName: this.namespace.metadata.name,
    });
  }
}
      

# OPA/Rego: policy for validating Terraform plans
# policy/terraform/mandatory_tags.rego

package terraform.mandatory_tags

import rego.v1

# All resources must have mandatory tags
mandatory_tags := ["Environment", "Service", "ManagedBy", "Team"]

# Find resources missing mandatory tags
deny contains msg if {
  resource := input.planned_values.root_module.resources[_]
  tags := object.get(resource.values, "tags", {})
  required_tag := mandatory_tags[_]
  not tags[required_tag]
  msg := sprintf(
    "Resource '%s' is missing mandatory tag '%s'",
    [resource.address, required_tag]
  )
}

# Production databases must have encryption enabled
deny contains msg if {
  resource := input.planned_values.root_module.resources[_]
  resource.type == "aws_db_instance"
  resource.values.storage_encrypted != true
  msg := sprintf(
    "Database '%s' must have storage_encrypted = true",
    [resource.address]
  )
}

# No public resources without approval
deny contains msg if {
  resource := input.planned_values.root_module.resources[_]
  resource.type == "aws_s3_bucket"
  acl := object.get(resource.values, "acl", "private")
  acl == "public-read"
  msg := sprintf(
    "S3 bucket '%s' cannot be public without approval",
    [resource.address]
  )
}