Terraform AWS EC2 Instance Config Builder

Terraform AWS EC2 Instance Config Builder

This builder generates Terraform HCL to launch an AWS EC2 instance along with a security group that governs inbound access. It produces a self-contained configuration you can terraform apply immediately, with sensible defaults for SSH access, an optional first-boot script, and tags for cost tracking.

How it works

The output defines an aws_security_group with one ingress block per port you allow (protocol tcp, source 0.0.0.0/0) and a permissive egress block. It then defines an aws_instance referencing that security group via vpc_security_group_ids. Key fields:

• ami — the base image id for your region.
• instance_type — CPU and memory class, for example t3.micro.
• key_name — the SSH key pair, included only when provided.
• user_data — a first-boot shell script, base64 encoded with base64encode().
• tags — a Name tag and any environment label.

What the generated HCL looks like

A minimal generated configuration for a web server on t3.small with ports 22 and 443 open might look like:

resource "aws_security_group" "web_sg" {
  name        = "web-server-sg"
  description = "Allow SSH and HTTPS"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "web" {
  ami                    = "ami-0abcdef1234567890"
  instance_type          = "t3.small"
  vpc_security_group_ids = [aws_security_group.web_sg.id]

  tags = {
    Name = "web-server"
  }
}

The builder generates the full file ready to drop into your working directory — AMI placeholder, your chosen ports, and tags filled in.

Common instance types by use case

Tips and example

After copying, initialize and launch:

terraform init
terraform plan
terraform apply

Always look up the correct AMI id for your target region, since AMIs are region scoped. For example, the same Amazon Linux 2023 image has a different id in us-east-1 versus eu-west-1 — find the current id in the AWS console or with aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64.

Restrict the SSH ingress source to your own IP rather than 0.0.0.0/0 in production. Keep user_data idempotent so re-runs do not break a booted instance, and tag every resource with at minimum a Name and an Environment so costs are easy to track and instances easy to find.