Add modern IaC examples: Terraform, Packer, cloud-config, and CI/CD

[chefgs]

Summary

This PR adds a comprehensive modernization guide and working examples showing how the original 2012 cloud-init/Chef/Ansible patterns map to current Infrastructure as Code best practices. Includes production-ready Terraform configurations, Packer AMI building, cloud-config YAML templates, and GitHub Actions CI/CD pipelines.

Key Changes

Documentation

• MODERNIZATION.md: Detailed guide mapping original 2012 concepts to modern equivalents:
  • Infrastructure orchestration: shell scripts → Terraform/OpenTofu
  • AMI selection: hardcoded IDs → dynamic data sources
  • cloud-init: bash scripts → cloud-config YAML modules
  • Security: SSH key pairs → IAM roles + SSM Session Manager
  • Package installation: runtime downloads → Packer pre-baked AMIs
  • Configuration management: Chef 14/Ansible → modern versions with collections
  • Secrets: hardcoded values → Parameter Store/Secrets Manager
  • CI/CD: manual execution → GitHub Actions with OIDC

Terraform Infrastructure as Code

• main.tf: Declarative infrastructure replacing create_instance.sh:

  • Dynamic AMI resolution (Amazon Linux 2023, no hardcoded IDs)
  • IAM instance role with SSM access (replaces SSH key pairs)
  • Security group with zero inbound ports (SSM-only access)
  • Launch template with IMDSv2 enforcement
  • Auto Scaling Group for true "cattle" pattern at scale
  • SSM parameters for configuration values

• variables.tf: Parameterized inputs replacing positional bash arguments

• outputs.tf: Useful post-apply information (ASM name, AMI ID, SSM connection commands)

Cloud-Config YAML

• cloud-config.yaml: Terraform templatefile version with variable substitution:

  • Declarative user/group management (replaces useradd scripts)
  • Package installation via cloud-init modules
  • Configuration file generation (replaces echo/cat >> patterns)
  • Monitoring agent setup and Ansible playbook execution
  • Idempotent by design, works across distros

• cloud-config-standalone.yaml: Standalone version for direct AWS CLI use

Packer AMI Building

• packer.pkr.hcl: Pre-bake AMI with all software pre-installed:
  • Dynamic base AMI resolution (same pattern as Terraform)
  • System updates, package installation, RPM building at AMI time
  • Ansible provisioner for configuration management
  • Cleanup of build artifacts
  • Manifest output for downstream automation

GitHub Actions CI/CD

• deploy.yml: Complete infrastructure pipeline:

  • Validate: cloud-config schema check, Terraform format/validate
  • Plan: runs on every PR, posts plan as comment, uploads artifact
  • Apply: manual approval gate, runs on merge to main
  • Destroy: manual trigger only, never automatic
  • OIDC federated identity (no stored AWS credentials)

• packer-build.yml: AMI building pipeline:

  • Triggers on Packer/Ansible config changes
  • Stores new AMI ID in SSM Parameter Store
  • Automatically picked up by next Terraform apply

Supporting Files

• modern/README.md: Quick start guide with examples for Terraform, cloud-config, and Packer workflows

Notable Implementation Details

• Security-first: No SSH, no port 22, no key pair management. All access via SSM Session Manager with full CloudTrail audit trail.
• Immutable infrastructure: Packer pre-bakes everything; instances launch in seconds with zero runtime dependencies.
• State management: Terraform tracks all resources; terraform destroy replaces manual terminate_instances.sh.
• Declarative cloud-config: Uses YAML modules instead of bash scripts for idempotency and cross-distro compatibility.
• Modern tooling: Terraform 1.9+, Packer 1.10+, Ansible 9+, Chef 18+, Amazon Linux 2023 (not EOL RHEL 7).
• GitOps-ready:

https://claude.ai/code/session_011yTw5W74dhGvxs4GxEcKFq