Ben Duncan
adb3d9876d
The AWS provider reads a bucket's tags with `ListTagsForResource` on S3 Control when it knows the account ID. S3 Control puts the account in the hostname — `https://{account}.{endpoint}` — so against an IP-addressed endpoint the request fails a DNS lookup before a packet leaves, and no endpoint configuration can help. A tagged bucket therefore fails its first read after being created. `skip_requesting_account_id` alone does not fix it: `aws-sdk-go-base` takes the account ID from the STS `GetCallerIdentity` credentials check before it consults that flag, so `skip_credentials_validation` is needed alongside it. With no account ID the provider falls back to `GetBucketTagging`, which predastore serves. `s3-webapp` is the only workbook that creates a bucket, and it uses no `aws_caller_identity` and references no other security group, so a blank account ID costs it nothing. The bucket also gets `force_destroy`, since the webapp uploads into it and a destroy of a used bucket fails `BucketNotEmpty` without it. The e2e harness now asserts the bucket carries the tags Terraform set, which is what catches this regressing, and no longer aborts the remaining workbooks on a failure — `s3-webapp` failing says nothing about whether RDS works, and four nights of `rds-quickstart` coverage were lost that way. `STOP_ON_FAIL=1` restores the early abort. Every workbook's provider versions are pinned, so a run reproduces rather than picking up whatever the registry published that morning.
title, seoTitle, description, category, tags, resources
| title | seoTitle | description | category | tags | resources | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Nginx Web Server | Terraform Nginx Web Server on Spinifex — Spinifex Docs | Provision a VPC, public subnet, internet gateway, route table, security group, and an EC2 instance that installs and starts Nginx from cloud-init user-data. | Terraform Workbooks |
|
|
Terraform: Nginx Web Server
Deploy a VPC with a public subnet and an EC2 instance running Nginx using Terraform on Spinifex.
Table of Contents
Overview
Deploy a complete Nginx web server on Spinifex using Terraform/OpenTofu. This workbook provisions a VPC, public subnet, internet gateway, route table, security group, SSH key pair, and an EC2 instance with cloud-init user-data that installs and starts Nginx.
What you'll learn:
- Configuring the AWS Terraform provider to target Spinifex
- Creating a VPC with public internet access
- Provisioning an EC2 instance with cloud-init user-data
- Generating SSH key pairs with the TLS provider
Prerequisites:
- Spinifex installed and running (see Installing Spinifex)
- An Ubuntu 26.04 AMI imported (see Setting Up Your Cluster)
- OpenTofu or Terraform installed
Instructions
Step 1. Get the Template
Clone the Terraform examples from the Spinifex repository:
git clone --depth 1 --filter=blob:none --sparse https://github.com/mulgadc/spinifex.git spinifex-tf
cd spinifex-tf
git sparse-checkout set docs/terraform
cd docs/terraform/nginx-webserver
Or create a main.tf file and paste the full configuration below.
Step 2. Deploy
The workbook defaults to t3.small (2 vCPU, 2 GiB). On clusters without that type registered, override with TF_VAR_instance_type — query what's available with aws ec2 describe-instance-types.
export AWS_PROFILE=spinifex
tofu init
tofu apply
Step 3. Verify
Note: EC2 instances can take 30+ seconds to boot after apply. If SSH or HTTP is unreachable, wait and retry.
After apply completes, use the outputs to test:
curl http://<public_ip>
ssh -i nginx-demo.pem ubuntu@<public_ip>
Open the web_url output in your browser to see the Nginx welcome page.
Clean Up
tofu destroy
Troubleshooting
AMI Not Found
Ensure you have imported an Ubuntu 26.04 image. Check available AMIs:
aws ec2 describe-images --owners 000000000000 --profile spinifex
Provider Connection Refused
Verify Spinifex services are running:
sudo systemctl status spinifex.target
curl -k https://localhost:9999/
SSH Connection Timeout
Check that the security group allows inbound SSH (port 22) and that the instance has a public IP assigned. Verify the instance is running:
aws ec2 describe-instances --profile spinifex
Nginx Not Responding
SSH into the instance and check cloud-init logs:
ssh -i nginx-demo.pem ubuntu@<public_ip>
sudo journalctl -u cloud-init --no-pager
sudo systemctl status nginx