feat(aws): add a common instance profile for SSM

terraform/ops-aws-instance-profile/backend.tf

@@ -0,0 +1,10 @@
+terraform {
+  backend "remote" {
+    hostname     = "app.terraform.io"
+    organization = "freecodecamp"
+
+    workspaces {
+      name = "tfws-ops-aws-instance-profile"
+    }
+  }
+}

terraform/ops-aws-instance-profile/main.tf

@@ -0,0 +1,42 @@
+variable "stack_tags" {
+  type        = map(string)
+  description = "Tags to apply to all resources in this stack"
+  default = {
+    Environment = "ops"
+    Stack       = "common"
+  }
+}
+
+resource "aws_iam_role" "stg_mw_instance_profile_role" {
+  name               = "fCCSSMInstanceProfileRole"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+
+  description          = "Allows EC2 instances to call AWS services like CloudWatch and Systems Manager on your behalf."
+  max_session_duration = 3600
+
+  tags = var.stack_tags
+}
+
+resource "aws_iam_role_policy_attachment" "stg_mw_instance_profile_role_attachment" {
+  role       = aws_iam_role.stg_mw_instance_profile_role.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+}
+
+resource "aws_iam_instance_profile" "stg_mw_instance_profile" {
+  name = aws_iam_role.stg_mw_instance_profile_role.name
+  role = aws_iam_role.stg_mw_instance_profile_role.name
+}

terraform/ops-aws-instance-profile/providers.tf

@@ -0,0 +1,5 @@
+provider "aws" {
+  region     = var.region
+  access_key = var.aws_access_key_id
+  secret_key = var.aws_secret_access_key
+}

terraform/ops-aws-instance-profile/variables.tf

@@ -0,0 +1,17 @@
+variable "aws_access_key_id" {
+  description = "The value of the AWS Access Key ID."
+  type        = string
+  sensitive   = true
+}
+
+variable "aws_secret_access_key" {
+  description = "The value of the AWS Secret Access Key."
+  type        = string
+  sensitive   = true
+}
+
+variable "region" {
+  description = "The name of the region in which to deploy instances."
+  default     = "us-east-1"
+  type        = string
+}

terraform/ops-aws-instance-profile/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "5.43.0"
+    }
+  }
+  required_version = ">= 1"
+}