Deploy a Private YugabyteDB Anywhere Universe on AWS with Terraform

				
					terraform {
  required_version = ">= 1.5.0"

  required_providers {
    yba = {
      source  = "yugabyte/yba"
      version = "~> 1.0"
    }

    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

###############################################################################
# Variables
###############################################################################

variable "aws_region" {
  description = "AWS region where the private YugabyteDB universe is deployed."
  type        = string
  default     = "us-east-1"
}

variable "database_vpc_id" {
  description = "Existing VPC where YugabyteDB nodes will be deployed."
  type        = string
}

variable "yb_node_security_group_id" {
  description = "Existing security group attached to the YugabyteDB nodes."
  type        = string
}

variable "application_security_group_id" {
  description = "Security group attached to the application."
  type        = string
}

variable "availability_zones" {
  description = "Ordered list of Availability Zones and private subnets."
  type = list(object({
    code      = string
    subnet_id = string
  }))
}

variable "provider_name" {
  description = "Name of the AWS provider configuration in YBA."
  type        = string
  default     = "private-aws-provider"
}

variable "universe_name" {
  description = "Name of the YugabyteDB universe."
  type        = string
  default     = "private-aws-universe"
}

variable "instance_type" {
  description = "AWS EC2 instance type for the YugabyteDB nodes."
  type        = string
  default     = "m6i.4xlarge"
}

variable "ysql_password" {
  description = "Password for the YugabyteDB YSQL user."
  type        = string
  sensitive   = true
}

###############################################################################
# Providers
###############################################################################

provider "aws" {
  region = var.aws_region
}

provider "yba" {
  # The following values are supplied through environment variables:
  #
  # YBA_HOST
  # YBA_API_TOKEN
  # YBA_ENABLE_HTTPS
}

###############################################################################
# Allow the Application to Reach YSQL
###############################################################################

resource "aws_vpc_security_group_ingress_rule" "ysql_from_application" {
  security_group_id            = var.yb_node_security_group_id
  referenced_security_group_id = var.application_security_group_id

  description = "Allow YSQL connections from the application"
  ip_protocol = "tcp"
  from_port   = 5433
  to_port     = 5433
}

###############################################################################
# Register the Existing AWS Infrastructure with YBA
###############################################################################

resource "yba_aws_provider" "private" {
  name = var.provider_name

  # Use the IAM role attached to the YugabyteDB Anywhere EC2 instance.
  use_iam_instance_profile = true

  regions {
    code              = var.aws_region
    vpc_id            = var.database_vpc_id
    security_group_id = var.yb_node_security_group_id

    dynamic "zones" {
      for_each = var.availability_zones

      content {
        code   = zones.value.code
        subnet = zones.value.subnet_id
      }
    }
  }

  # Allow YBA to manage the default x86_64 image bundle.
  yba_managed_image_bundles {
    arch           = "x86_64"
    use_as_default = true
  }

  # The private subnets have NAT or equivalent outbound access.
  air_gap_install = false

  # Use AWS Time Sync through chrony.
  set_up_chrony = true

  timeouts {
    create = "30m"
    update = "30m"
    delete = "30m"
  }
}

###############################################################################
# Retrieve the Access Key Created or Managed by YBA
###############################################################################

data "yba_provider_key" "aws" {
  provider_id = yba_aws_provider.private.id
}

###############################################################################
# Select the Latest Stable YBDB Release Available in YBA
###############################################################################

data "yba_release_version" "stable" {
  track = "stable"

  depends_on = [
    yba_aws_provider.private
  ]
}

###############################################################################
# Create the Private YugabyteDB Universe
###############################################################################

resource "yba_universe" "private" {
  clusters {
    cluster_type = "PRIMARY"

    user_intent {
      universe_name = var.universe_name

      provider    = yba_aws_provider.private.id
      region_list = yba_aws_provider.private.regions[*].uuid

      num_nodes          = 3
      replication_factor = 3
      instance_type      = var.instance_type

      device_info {
        num_volumes = 1
        volume_size = 500
        storage_type = "GP3"
        disk_iops   = 3000
        throughput  = 125
      }

      yb_software_version = data.yba_release_version.stable.id
      access_key_code     = data.yba_provider_key.aws.id

      # Keep the database nodes private.
      assign_public_ip = false

      # Database APIs
      enable_ysql      = true
      enable_ysql_auth = true
      ysql_password    = var.ysql_password

      enable_ycql      = false
      enable_ycql_auth = false

      # Encryption in transit
      enable_node_to_node_encrypt   = true
      enable_client_to_node_encrypt = true

      use_time_sync = true
      use_systemd   = true

      instance_tags = {
        Environment = "demo"
        ManagedBy   = "Terraform"
        Network     = "private"
      }
    }
  }

  communication_ports {}

  delete_options {
    delete_backups = false
    delete_certs   = false
    force_delete   = false
  }

  timeouts {
    create = "120m"
    update = "120m"
    delete = "45m"
  }

  depends_on = [
    aws_vpc_security_group_ingress_rule.ysql_from_application
  ]
}

###############################################################################
# Outputs
###############################################################################

output "yba_aws_provider_id" {
  description = "UUID of the AWS provider registered with YBA."
  value       = yba_aws_provider.private.id
}

output "yba_universe_id" {
  description = "UUID of the private YugabyteDB universe."
  value       = yba_universe.private.id
}

output "yba_universe_name" {
  description = "Name of the YugabyteDB universe."
  value       = var.universe_name
}

output "yb_software_version" {
  description = "YBDB release selected for the universe."
  value       = data.yba_release_version.stable.id
}

output "private_node_ips" {
  description = "Private IP addresses of the YugabyteDB nodes."

  value = [
    for node in yba_universe.private.node_details_set :
    node.cloud_info[0].private_ip
  ]
}

output "public_node_ips" {
  description = "Public IP addresses, which should be empty."

  value = [
    for node in yba_universe.private.node_details_set :
    node.cloud_info[0].public_ip
  ]
}