Installing a connector on AWS ECS using Terraform

Connectors are secure on-premises components that link Apono and your resources:

No secrets are read, cached, or stored.
No account admin privileges need to be granted to Apono.
The connector contacts your secret store or key vault to sync data or provision access.

Once set up, this connector will enable you to sync data from cloud applications and grant and revoke access permissions through Amazon Elastic Container Service (ECS).

Prerequisites

Item	Description
AdminstratorAccess Role	AWS role that provides full access to AWS services and resources
Apono Token	Account-specific Apono authentication value Use the following steps to obtain your token: On the Connectors page, click Install Connector. The Install Connector page appears. Click AWS > Install and Connect AWS Account. > Terraform (ECS). Copy the token in step listed on the page in step 1.
Virtual Private Cloud (VPC) ID	Unique identifier for a virtual network dedicated to an AWS account
Subnet IDs	Unique identifier for a specific subnet within a VPC
Terraform CLI	HashiCorp's tool for provisioning and managing infrastructure

Install a connector

Follow these steps to install an Apono connector for AWS on ECS:

At the shell prompt, set the environment variables.

export TF_VAR_APONO_TOKEN="<APONO_TOKEN>"
export TF_VAR_REGION="<AWS_REGION>"
export TF_VAR_CONNECTOR_ID="<APONO_CONNECTOR_NAME>"
export TF_VAR_VPC_ID="<AWS_VPC_ID>"
export TF_VAR_SUBNET_IDS="<["SUBNET_ID1","SUBNET_ID2"]>"
export TF_VAR_TAGS="<{tag1="value1"}>"

In a new or existing Terraform (.tf) file, add the following provider and module information to create a connector with permissions or without permissions.

⚠️
When using the following snippets, be sure to use the correct value for assignPublicIp:

true: Set when a subnet has an Internet Gateway.

false: Set shen a subnet has a NAT Gateway.

With permissions: Enables installing the connector in the cloud environment and managing access to resources, such as Amazon RDS, S3 buckets, EC2 machines, and self-hosted databases

provider "aws" {
    region = "{var.REGION}"
}

module "apono-connector" {
    source = "github.com/apono-io/terraform-modules//aws/connector-with-permissions/stacks/apono-connector"
    connectorId = "{var.CONNECTOR_ID}"
    aponoToken = "{var.APONO_TOKEN}"
    vpcId = "{var.VPC_ID}"
    subnetIds = "{var.SUBNET_IDS}"
    assignPublicIp = true
    tags = "{var.TAGS}"
}

Without permissions: Enables installing the connector in the cloud environment but managing access to non-AWS resources, such as self-hosted databases

provider "aws" {
    region = "{var.REGION}"
}

module "apono-connector" {
    source = "github.com/apono-io/terraform-modules//aws/connector-without-permissions/stacks/apono-connector"
    connectorId = "{var.CONNECTOR_ID}"
    aponoToken = "{var.APONO_TOKEN}"
    vpcId = "{var.VPC_ID}"
    subnetIds = "{var.SUBNET_IDS}"
    assignPublicIp = true
    tags = "{var.TAGS}"
}

At the Terraform CLI, download and install the provider plugin and module.
```
terraform init
```
Apply the Terraform changes. The proposed changes and a confirmation prompt will be listed.
```
terraform apply
```
Enter yes to confirm deploying the changes to your AWS account.
On the Connectors page, verify that the connector has been deployed.

FAQ

Can the Apono Terraform module be pinned to a version?

Yes. You can append the version number to the source location with the ?ref=vX.X.X query string.

The following example pins the version to 1.0.0 for a connector without permissions.

provider "aws" {
    region = "{var.REGION}"
}

module "apono-connector" {
    source = "github.com/apono-io/terraform-modules//aws/connector-without-permissions/stacks/apono-connector?ref=v1.0.0"
    connectorId = "{var.CONNECTOR_ID}"
    aponoToken = "{var.APONO_TOKEN}"
    vpcId = "{var.VPC_ID}"
    subnetIds = "{var.SUBNET_IDS}"
    assignPublicIp = true
    tags = "{var.TAGS}"
}