Infrastructure Production-Ready
sur AWS

1 Installer AWS CLI sur votre PC

Télécharger et installer depuis le site officiel :

# Windows (PowerShell admin)
msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi

# macOS
curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
sudo installer -pkg AWSCLIV2.pkg -target /

# Linux
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip && sudo ./aws/install

# Vérifier
aws --version

2 Créer les Access Keys (console AWS)

1. Console AWS → IAM → Users → votre utilisateur
2. Onglet Security credentials
3. Create access key → Use case: CLI
4. Copier Access Key ID et Secret Access Key

3 Configurer AWS CLI sur votre PC

# Configurer les credentials
aws configure

# Il demande 4 choses :
# AWS Access Key ID : AKIA...........
# AWS Secret Access Key : wJalr..........
# Default region : us-east-1 (ou votre région)
# Default output format : json

# Vérifier que ça marche
aws sts get-caller-identity

4 Créer une Key Pair SSH

Pour se connecter aux instances en SSH :

# Option A : via la console
# EC2 → Key Pairs → Create key pair
# Name : ma-cle-production
# Type : RSA, Format : .pem
# Le fichier .pem se télécharge automatiquement

# Option B : via CLI
aws ec2 create-key-pair --key-name ma-cle-production \
  --query 'KeyMaterial' --output text > ma-cle-production.pem

# Sécuriser la clé (Linux/Mac)
chmod 400 ma-cle-production.pem

# Connexion SSH à une instance
ssh -i ma-cle-production.pem ec2-user@IP_PUBLIQUE

5 Installer OpenTofu (pour l'IaC)

# Windows (avec Chocolatey)
choco install opentofu

# macOS (avec Homebrew)
brew install opentofu

# Linux
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh

# Vérifier
tofu --version

OpenTofu utilise automatiquement vos credentials AWS CLI. Si aws sts get-caller-identity marche, tofu marchera aussi.

6 Structure de projet OpenTofu

# Créer le dossier du projet
mkdir grand-tp && cd grand-tp

# Créer les fichiers de base
touch provider.tf main.tf variables.tf outputs.tf

# Créer le .gitignore (OBLIGATOIRE)
cat > .gitignore <<'EOF'
*.tfstate
*.tfstate.backup
.terraform/
terraform.tfvars
crash.log
EOF

provider.tf — Toujours commencer par ça :

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"  # Adapter à votre région

  default_tags {
    tags = {
      Project     = "GrandTP"
      Environment = "production"
      ManagedBy   = "OpenTofu"
    }
  }
}

7 Workflow OpenTofu

# 1. Initialiser (télécharge le provider AWS)
tofu init

# 2. Formater le code
tofu fmt

# 3. Valider la syntaxe
tofu validate

# 4. Prévisualiser les changements
tofu plan

# 5. Appliquer (déployer)
tofu apply

# 6. À LA FIN — OBLIGATOIRE — Détruire
tofu destroy

Console VPC › Create VPC

Console VPC › Subnets › Create (4 d'un coup)

Console Internet Gateway + Route Tables

1. VPC › Internet Gateways › Create › Name : production-igw
2. Actions › Attach to VPC › production-vpc
3. VPC › Route Tables › Create : public-rt
4. Routes › Edit › Add : 0.0.0.0/0 → production-igw
5. Subnet Associations › Edit › cocher les 2 subnets publics

Console Security Groups (3 à créer)

Console KMS › Create key

Console RDS › Subnet Groups › Create

Name: production-dbnet, VPC: production-vpc, Subnets: private-a + private-b (les 2 privés)

Console RDS › Create database

Console IAM › Roles › Create role

Trusted entity: AWS service › EC2

Policies à attacher :

• AmazonSSMManagedInstanceCore
• CloudWatchAgentServerPolicy
• SecretsManagerReadWrite
• AWSKeyManagementServicePowerUser

Role name: ec2-production-role

1 Target Group

EC2 › Target Groups › Create : production-tg, HTTP/80, VPC production, Health check: /health

2 Application Load Balancer

EC2 › Load Balancers › Create ALB : production-alb, Internet-facing, 2 subnets publics, SG: alb-sg, Listener HTTP:80 → production-tg

3 Launch Template

#!/bin/bash
yum update -y
yum install -y python3-pip jq

TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
REGION=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/placement/region)

SECRET_ARN=$(aws rds describe-db-instances \
  --db-instance-identifier production-db \
  --query 'DBInstances[0].MasterUserSecret.SecretArn' \
  --output text --region $REGION)

SECRET_JSON=$(aws secretsmanager get-secret-value \
  --secret-id "$SECRET_ARN" \
  --query SecretString --output text --region $REGION)

DB_USER=$(echo "$SECRET_JSON" | jq -r '.username')
DB_PASS=$(echo "$SECRET_JSON" | jq -r '.password')
DB_HOST=$(aws rds describe-db-instances \
  --db-instance-identifier production-db \
  --query 'DBInstances[0].Endpoint.Address' \
  --output text --region $REGION)

mkdir -p /opt/guestbook
python3 -m venv /opt/guestbook/venv
source /opt/guestbook/venv/bin/activate
pip install flask pymysql

cat > /opt/guestbook/app.py <<'PYEOF'
from flask import Flask, request
import pymysql, os
app = Flask(__name__)

def get_db():
    return pymysql.connect(
        host=os.environ['DB_HOST'],
        user=os.environ['DB_USER'],
        password=os.environ['DB_PASS'],
        database='guestbook', autocommit=True)

@app.route('/health')
def health():
    return 'OK', 200

@app.route('/')
def index():
    db = get_db()
    cur = db.cursor()
    cur.execute("CREATE TABLE IF NOT EXISTS messages (id INT AUTO_INCREMENT PRIMARY KEY, msg TEXT, ts TIMESTAMP DEFAULT CURRENT_TIMESTAMP)")
    cur.execute("SELECT msg, ts FROM messages ORDER BY ts DESC LIMIT 20")
    msgs = cur.fetchall()
    html = "<h1>Guestbook</h1><form method=POST><input name=msg><button>Envoyer</button></form>"
    for m in msgs:
        html += f"<p><b>{m[1]}</b>: {m[0]}</p>"
    return html

@app.route('/', methods=['POST'])
def post():
    db = get_db()
    cur = db.cursor()
    cur.execute("CREATE TABLE IF NOT EXISTS messages (id INT AUTO_INCREMENT PRIMARY KEY, msg TEXT, ts TIMESTAMP DEFAULT CURRENT_TIMESTAMP)")
    cur.execute("INSERT INTO messages (msg) VALUES (%s)", (request.form['msg'],))
    return index()

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)
PYEOF

export DB_HOST="$DB_HOST" DB_USER="$DB_USER" DB_PASS="$DB_PASS"
cd /opt/guestbook && nohup /opt/guestbook/venv/bin/python app.py &

4 Auto Scaling Group

production-asg : Launch Template guestbook-template, 2 subnets publics, Attach to production-tg, Health check: ELB, Min=1, Desired=2, Max=4, CPU target 50%

1 Activer le monitoring détaillé

EC2 › Instance › Actions › Monitor › Enable detailed monitoring (sur chaque instance)

2 Créer le Dashboard

CloudWatch › Dashboards › Create : production-dashboard

1 S3 › Create bucket

Management › Lifecycle rule : Standard-IA (30j) → Glacier (90j) → Suppression (365j)

2 CloudFront › Create distribution

1 Taguer les instances

EC2 › Instances › Tags › Add : snapshot = yes

2 EC2 › Lifecycle Manager › Create policy

EBS snapshot policy, Target tags: snapshot = yes, Daily à 00:20, Retention: 7

Procédure debug standard

1. EC2 › Instances › vérifier IP publique + SG = web-sg
2. Connect › EC2 Instance Connect › username ec2-user
3. sudo cat /var/log/cloud-init-output.log | tail -50
4. curl http://localhost/health

1. ASG → ALB → Target Group → Launch Template
2. RDS (skip final snapshot) → DB Subnet Group
3. Secrets Manager → KMS (schedule deletion)
4. CloudFront → S3 (vider d'abord)
5. CloudWatch dashboard → DLM policy
6. VPC (supprime tout : subnets, SG, RT, IGW)
7. IAM Role