kubernetes-security-baseline-lab/terraform/cloud-cluster/README.md

Optional production-style path

This directory provisions one encrypted Ubuntu EC2 host with a deliberately small network surface. It is a scaffold for the documented cloud path; the local k3d path remains the primary, cost-free portfolio demo.

The AWS account, region, AMI, SSH key pair, and administrator CIDR are inputs, not repository values. Do not commit a real terraform.tfvars file or private keys. The security group intentionally exposes SSH and the Kubernetes API only to admin_cidr; add any public application ports explicitly when needed.

Example workflow:

cp terraform.tfvars.example terraform.tfvars
# Edit every replace-* value and set admin_cidr to your current IP /32.
terraform init
terraform validate
terraform plan
terraform apply
terraform output -raw public_ip

Then run ansible/bootstrap-k3s.yml against the output IP. terraform destroy removes the lab resources when finished. This path is not required for the portfolio demo and is not invoked by CI.