This script is an example of applying infrastructure as code principles to managing cloud servers. This script code be used as a step to pre-baking an AMI for production use, however it is currently used to rebuild the server as needed, rather than interactively patching one.

/*  180228 - soops@ucla.edu
    Deploy new web server
    into prodVPC 
    for testing 
    */

# sets the region
provider "aws" {
    region = "us-west-2"
}

#variables changed for publishing
resource "aws_instance" "webServerDev" {
    ami = "ami-standardAMI" 
    instance_type = "m4.large" # pubProd-b
    subnet_id = "subnet-mysubnet"
    vpc_security_group_ids = ["sg-mysecgroup"]
    associate_public_ip_address = true
    key_name = "mykey"
    iam_instance_profile = "myrole"

    ebs_block_device {
        device_name             = "/dev/xvda"
        delete_on_termination   = true
        volume_type             = "gp2"
        #volume_type            ="io1"
        volume_size             = "20"
#        iops                    = "1000"
    }

    volume_tags = {
        Name = "webServerDev"
    }
    # bootstraps the server
    user_data = <<-EOF
        #!/bin/bash
        # add apache 2.2
        sudo yum install httpd -y
        sudo mkdir -p /tmp/php7
        cd /tmp/php70
        # abb webstatic and load modules
        wget https://mirror.webtatic.com/yum/el6/latest.rpm
        sudo yum install latest.rpm -y
        sudo yum install --enablerepo=webtatic php70w -y
        sudo yum install php70w-opcache php70w-xml php70w-ldap php70w-pdo php70w-mysqlnd php70w-gd php70w-pecl-apcu php70w-mbstring php70w-imap geoip mod_geoip -y
        # sudo echo "<?php echo phpinfo(); ?>" > /var/www/html/index.php
        sudo yum install openldap-clients -y
        sudo yum update -y
        cd /tmp
        wget https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py
        sudo chmod +x /tmp/awslogs-agent-setup.py
        sudo /tmp/awslogs-agent-setup.py --region us-west-2 --non-interactive --configfile s3://mys3bucket/awslogs/awslogs.conf
        sudo mkdir /etc/awslogs
        sudo aws s3 cp s3://mys3bucket/webServer/etc/awslogs/awslogs.conf /etc/awslogs/.
        sudo service awslogs stop
        sudo service awslogs start
        cd ~
        # adds prebuilt v-hosts.conf
        sudo aws s3 cp s3://mys3bucket/webServer/etc/httpd/conf.d/v-hosts.conf /etc/httpd/conf.d/v-hosts.conf
        sudo aws s3 cp s3://mys3bucket/webServer/etc/httpd/conf.d/geoip.conf /etc/httpd/conf.d/geoip.conf
       
        sudo sed -i "s/DirectoryIndex\ index.html\ index.html.var/DirectoryIndex\ index.html\ index.php/g" /etc/httpd/conf/httpd.conf
        #set NameVirtualHost to work in httpd.conf
        sudo sed -i "s/\#NameVirtualHost\ \*\:80/NameVirtualHost\ \*\:80/g" /etc/httpd/conf/httpd.conf
        sudo sed -i "s/memory_limit\ =\ 128M/memory_limit\ =\ 256M/g" /etc/php.ini
        sudo sed -i "s/upload_max_filesize\ =\ 2M/upload_max_filesize\ =\ 10M/g" /etc/php.ini
        #load the /home/www directory
        sudo mkdir /home/www
        #sudo aws s3 cp --recursive s3://mys3bucket/webServer/wwwSync /home/www/
        sudo chown -R apache:apache /home/www
        sudo service httpd start
        # adding dump scripts, ldap & mysql dependencies
        # need to make sure security group access for ldap and db
        mkdir /home/ec2-user/scripts
        echo "aws s3 sync /etc s3://mys3bucket/webServer/etc/; aws s3 sync /home s3://mys3bucket/webServer/home/" > /home/ec2-user/scripts/awsSync.sh
        sudo chmod +x /home/ec2-user/awsSync.sh
        echo "aws s3 sync /var/log s3://mys3bucket/webServer/" > /home/ec2-user/scripts/logSync.sh
        sudo chmod +x /home/ec2-user/logSync.sh
        sudo chmod 777 /etc/crontab
        sudo echo "*/5 * * * * root /home/ec2-user/scripts/awsSync.sh" >> /etc/crontab
        sudo echo "*/5 * * * * root /home/ec2-user/scripts/logSync.sh" >> /etc/crontab
        sudo chmod 644 /etc/crontab
        # loading postfix, killing sendmail, starting servics
        sudo chkconfig sendmail off
        sudo service sendmail stop
        sudo yum install postfix -y
        sudo aws s3 cp s3://mys3bucket/webServer/etc/postfix/main.cf /etc/postfix/main.cf
        sudo chkconfig postfix on
        sudo service postfix start
        sudo chkconfig httpd on
        sudo service httpd start
        EOF
    



# names the instance
    tags {
        Name = "webServerTesting"
    }

}

# attach to elb
resource "aws_elb_attachment" "webServerAttachment" {
    elb = "webServer"
    instance = "{aws_instance.webServerDev.id}"
}

# sets dns A record
resource "aws_route53_record" "testServer" {
    zone_id = "myzoneid"
    name = "testwebserver.mydomain"
    type = "A"
    ttl = "300"
    records = ["${aws_instance.webServerDev.public_ip}"]
}


# sends public ip to terminal STDOUT
output "public ip" {
    value = "${aws_instance.webServerDev.public_ip}"
}