From 2586532143606ccb9b77f899f116feababb59aba Mon Sep 17 00:00:00 2001
From: Malcolm Roberts <malcolm@careevolution.com>
Date: Wed, 7 Jun 2023 09:08:34 -0500
Subject: [PATCH] Initial implementation

---
 .../exercises/alb-exercise1/lb/terragrunt.hcl |  60 +++
 .../alb-exercise1/web/terragrunt.hcl          |  52 +++
 src/basic-web-infra/exercises/env.hcl         |  21 ++
 .../exercises/vpc/terragrunt.hcl              |  34 ++
 src/basic-web-infra/global/config/main.tf     |  28 ++
 src/basic-web-infra/global/config/rules.tf    | 205 +++++++++++
 src/basic-web-infra/global/config/s3.tf       |  84 +++++
 .../global/config/terragrunt.hcl              |  10 +
 .../global/iam/account_alias.tf               |   3 +
 src/basic-web-infra/global/iam/groups.tf      |  12 +
 src/basic-web-infra/global/iam/main.tf        | 111 ++++++
 src/basic-web-infra/global/iam/outputs.tf     |   0
 src/basic-web-infra/global/iam/roles.tf       |   0
 src/basic-web-infra/global/iam/terragrunt.hcl |  10 +
 src/basic-web-infra/global/iam/variables.tf   |   0
 src/basic-web-infra/global/ssm/iam.tf         |  53 +++
 src/basic-web-infra/global/ssm/main.tf        |  42 +++
 src/basic-web-infra/global/ssm/patching.tf    | 341 ++++++++++++++++++
 .../global/ssm/ssm-artifacts.tf               |  41 +++
 .../global/ssm/ssm-packages.tf                |  58 +++
 .../global/ssm/ssm-patch-log.tf               |  60 +++
 src/basic-web-infra/global/ssm/terragrunt.hcl |  10 +
 .../global/ssm/windows-defender-updates.tf    | 111 ++++++
 src/basic-web-infra/modules/lb/certificate.tf |  36 ++
 src/basic-web-infra/modules/lb/dns.tf         |  13 +
 src/basic-web-infra/modules/lb/main.tf        | 135 +++++++
 src/basic-web-infra/modules/lb/outputs.tf     |  19 +
 src/basic-web-infra/modules/lb/s3.tf          |  51 +++
 src/basic-web-infra/modules/lb/variables.tf   |  61 ++++
 src/basic-web-infra/modules/lb/waf.tf         | 172 +++++++++
 src/basic-web-infra/modules/vpc/flowlogs.tf   |  82 +++++
 src/basic-web-infra/modules/vpc/main.tf       |  77 ++++
 src/basic-web-infra/modules/vpc/outputs.tf    |  31 ++
 src/basic-web-infra/modules/vpc/variables.tf  |  44 +++
 src/basic-web-infra/modules/web/ami.tf        |  12 +
 src/basic-web-infra/modules/web/keypair.tf    |  17 +
 src/basic-web-infra/modules/web/main.tf       | 122 +++++++
 src/basic-web-infra/modules/web/outputs.tf    |  11 +
 .../modules/web/remote_access.tf              |  65 ++++
 src/basic-web-infra/modules/web/variables.tf  |  79 ++++
 40 files changed, 2373 insertions(+)
 create mode 100644 src/basic-web-infra/exercises/alb-exercise1/lb/terragrunt.hcl
 create mode 100644 src/basic-web-infra/exercises/alb-exercise1/web/terragrunt.hcl
 create mode 100644 src/basic-web-infra/exercises/env.hcl
 create mode 100644 src/basic-web-infra/exercises/vpc/terragrunt.hcl
 create mode 100644 src/basic-web-infra/global/config/main.tf
 create mode 100644 src/basic-web-infra/global/config/rules.tf
 create mode 100644 src/basic-web-infra/global/config/s3.tf
 create mode 100644 src/basic-web-infra/global/config/terragrunt.hcl
 create mode 100644 src/basic-web-infra/global/iam/account_alias.tf
 create mode 100644 src/basic-web-infra/global/iam/groups.tf
 create mode 100644 src/basic-web-infra/global/iam/main.tf
 create mode 100644 src/basic-web-infra/global/iam/outputs.tf
 create mode 100644 src/basic-web-infra/global/iam/roles.tf
 create mode 100644 src/basic-web-infra/global/iam/terragrunt.hcl
 create mode 100644 src/basic-web-infra/global/iam/variables.tf
 create mode 100644 src/basic-web-infra/global/ssm/iam.tf
 create mode 100644 src/basic-web-infra/global/ssm/main.tf
 create mode 100644 src/basic-web-infra/global/ssm/patching.tf
 create mode 100644 src/basic-web-infra/global/ssm/ssm-artifacts.tf
 create mode 100644 src/basic-web-infra/global/ssm/ssm-packages.tf
 create mode 100644 src/basic-web-infra/global/ssm/ssm-patch-log.tf
 create mode 100644 src/basic-web-infra/global/ssm/terragrunt.hcl
 create mode 100644 src/basic-web-infra/global/ssm/windows-defender-updates.tf
 create mode 100644 src/basic-web-infra/modules/lb/certificate.tf
 create mode 100644 src/basic-web-infra/modules/lb/dns.tf
 create mode 100644 src/basic-web-infra/modules/lb/main.tf
 create mode 100644 src/basic-web-infra/modules/lb/outputs.tf
 create mode 100644 src/basic-web-infra/modules/lb/s3.tf
 create mode 100644 src/basic-web-infra/modules/lb/variables.tf
 create mode 100644 src/basic-web-infra/modules/lb/waf.tf
 create mode 100644 src/basic-web-infra/modules/vpc/flowlogs.tf
 create mode 100644 src/basic-web-infra/modules/vpc/main.tf
 create mode 100644 src/basic-web-infra/modules/vpc/outputs.tf
 create mode 100644 src/basic-web-infra/modules/vpc/variables.tf
 create mode 100644 src/basic-web-infra/modules/web/ami.tf
 create mode 100644 src/basic-web-infra/modules/web/keypair.tf
 create mode 100644 src/basic-web-infra/modules/web/main.tf
 create mode 100644 src/basic-web-infra/modules/web/outputs.tf
 create mode 100644 src/basic-web-infra/modules/web/remote_access.tf
 create mode 100644 src/basic-web-infra/modules/web/variables.tf

diff --git a/src/basic-web-infra/exercises/alb-exercise1/lb/terragrunt.hcl b/src/basic-web-infra/exercises/alb-exercise1/lb/terragrunt.hcl
new file mode 100644
index 0000000..25ab2b3
--- /dev/null
+++ b/src/basic-web-infra/exercises/alb-exercise1/lb/terragrunt.hcl
@@ -0,0 +1,60 @@
+include {
+  path = find_in_parent_folders()
+}
+
+include "account" {
+  path  = "${get_terragrunt_dir()}/../../../account.hcl"
+  expose = true
+ }
+
+include "env" {
+  path  = "${get_terragrunt_dir()}/../../env.hcl"
+  expose = true
+ }
+
+dependencies {
+  paths = [
+    "${get_terragrunt_dir()}/../../vpc",
+    "${get_terragrunt_dir()}/../web"
+  ]
+}
+
+dependency "vpc" {
+  config_path = "${get_terragrunt_dir()}/../../vpc"
+
+  mock_outputs = {
+    vpc_id                        = "vpc-test"
+    private_subnets_ids           = [ "subnet-private-a", "subnet-private-b" ]
+    public_subnets_ids            = [ "subnet-public-a", "subnet-public-b" ]
+    private_subnets_cidr_blocks   = [ "10.1.2.0/24", "10.1.4.0/24" ]
+    public_subnets_cidr_blocks    = [ "10.1.1.0/24", "10.1.3.0/24" ]
+  }
+}
+
+dependency "web" {
+  config_path = "${get_terragrunt_dir()}/../web"
+
+  mock_outputs = {
+    webserver_ids = ["i-12343459359", "i-94949494242424" ]
+  }
+}
+
+terraform  {
+  source = "${get_terragrunt_dir()}/../../../modules/lb//"
+}
+
+inputs = {
+  deployment_long_name        = include.account.locals.deployment_long_name
+  deployment_short_name       = include.account.locals.deployment_short_name
+  deployment_role             = include.env.locals.deployment_role
+  vpc_id                      = dependency.vpc.outputs.vpc_id
+  loadbalancer_subnets        = dependency.vpc.outputs.public_subnets_ids
+
+  default_domain_name         = "careevolution.dev"
+  default_subdomain           = "alb-exercise1"
+  target_instances            = dependency.web.outputs.webserver_ids
+  target_security_group_id    = dependency.web.outputs.security_group_id
+  target_port                 = "80"
+
+  tags                        = include.env.locals.tags
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/exercises/alb-exercise1/web/terragrunt.hcl b/src/basic-web-infra/exercises/alb-exercise1/web/terragrunt.hcl
new file mode 100644
index 0000000..6a89543
--- /dev/null
+++ b/src/basic-web-infra/exercises/alb-exercise1/web/terragrunt.hcl
@@ -0,0 +1,52 @@
+include {
+  path = find_in_parent_folders()
+}
+
+include "account" {
+  path  = "${get_terragrunt_dir()}/../../../account.hcl"
+  expose = true
+ }
+
+include "env" {
+  path  = "${get_terragrunt_dir()}/../../env.hcl"
+  expose = true
+ }
+
+dependencies {
+  paths = [
+    "${get_terragrunt_dir()}/../../vpc"
+  ]
+}
+
+dependency "vpc" {
+  config_path = "${get_terragrunt_dir()}/../../vpc"
+
+  mock_outputs = {
+    vpc_id                        = "vpc-test"
+    private_subnets_ids           = [ "subnet-private-a", "subnet-private-b" ]
+    public_subnets_ids            = [ "subnet-public-a", "subnet-public-b" ]
+    private_subnets_cidr_blocks   = [ "10.1.2.0/24", "10.1.4.0/24" ]
+    public_subnets_cidr_blocks    = [ "10.1.1.0/24", "10.1.3.0/24" ]
+  }
+}
+terraform  {
+  source = "${get_terragrunt_dir()}/../../../modules/web//"
+}
+
+inputs = {
+  deployment_long_name  = include.account.locals.deployment_long_name
+  deployment_short_name = include.account.locals.deployment_short_name
+  deployment_role       = include.env.locals.deployment_role
+
+  vpc_id                = dependency.vpc.outputs.vpc_id
+  vpc_cidr_block        = include.env.locals.vpc_cidr
+  instance_subnet_id    = dependency.vpc.outputs.public_subnets_ids[0]
+  suffixes              = [ "01A", "02A" ]
+  instance_type         = "t3.medium"
+  keypair_name          = "${include.account.locals.deployment_long_name}-${include.env.locals.deployment_role}"
+  tags                  = include.env.locals.tags
+  patch_group           = "Windows Automatic Reboot"
+
+  allow_remote_access   = include.env.locals.allow_remote_access
+  remote_access_cidrs   = include.env.locals.remote_access_cidrs
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/exercises/env.hcl b/src/basic-web-infra/exercises/env.hcl
new file mode 100644
index 0000000..62e160d
--- /dev/null
+++ b/src/basic-web-infra/exercises/env.hcl
@@ -0,0 +1,21 @@
+
+locals {
+  deployment_role       = "exercises"
+  vpc_cidr              = "10.45.0.0/16"
+
+  allow_remote_access   = false
+  remote_access_cidrs = [
+  ]
+
+  terragrunt_tags = {
+    created_by        = "terraform"
+    terraform_path    = "/${lower(path_relative_to_include())}"
+  }
+
+  tags = {
+    ce_resource_path = "/HIRING/EXERCISES"
+    created_by       = "terraform",
+    project          = "exercises"
+    cost_center      = "hiring"
+  }
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/exercises/vpc/terragrunt.hcl b/src/basic-web-infra/exercises/vpc/terragrunt.hcl
new file mode 100644
index 0000000..1b3e805
--- /dev/null
+++ b/src/basic-web-infra/exercises/vpc/terragrunt.hcl
@@ -0,0 +1,34 @@
+include {
+  path = find_in_parent_folders()
+}
+
+include "account" {
+  path  = "${get_terragrunt_dir()}/../../account.hcl"
+  expose = true
+ }
+
+include "env" {
+  path  = "${get_terragrunt_dir()}/../env.hcl"
+  expose = true
+ }
+
+dependency "infrastructure" {
+  config_path = "${get_terragrunt_dir()}/../../../infrastructure/prod"
+}
+
+terraform {
+  source = "${get_terragrunt_dir()}/../../modules/vpc//"
+}
+
+inputs = {
+  deployment_long_name                  = include.account.locals.deployment_long_name
+  deployment_short_name                 = include.account.locals.deployment_short_name
+  deployment_role                       = include.env.locals.deployment_role
+
+  vpc_cidr                              = include.env.locals.vpc_cidr
+  infrastructure_dns_domain_name        = dependency.infrastructure.outputs.dns_domain_name
+  infrastructure_dns_server_ips         = dependency.infrastructure.outputs.dns_server_ips
+  infrastructure_ntp_server_ips         = dependency.infrastructure.outputs.ntp_server_ips
+  infrastructure_netbios_nameserver_ips = dependency.infrastructure.outputs.netbios_name_server_ips
+  infrastructure_netbios_node_type      = dependency.infrastructure.outputs.netbios_node_type
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/config/main.tf b/src/basic-web-infra/global/config/main.tf
new file mode 100644
index 0000000..2ccd740
--- /dev/null
+++ b/src/basic-web-infra/global/config/main.tf
@@ -0,0 +1,28 @@
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+resource "aws_iam_role" "config" {
+  name = "AWSConfigRole"
+
+  assume_role_policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "config.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+POLICY
+}
+
+resource "aws_iam_role_policy_attachment" "config" {
+  role       = aws_iam_role.config.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
+}
+
diff --git a/src/basic-web-infra/global/config/rules.tf b/src/basic-web-infra/global/config/rules.tf
new file mode 100644
index 0000000..19dd898
--- /dev/null
+++ b/src/basic-web-infra/global/config/rules.tf
@@ -0,0 +1,205 @@
+#https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html
+
+
+resource "aws_config_config_rule" "ec2_volume_inuse_check" {
+  name = "ec2_volume_inuse_check"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "EC2_VOLUME_INUSE_CHECK"
+  }
+}
+
+resource "aws_config_config_rule" "eip_attached" {
+  name = "eip_attached"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "EIP_ATTACHED"
+  }
+}
+
+resource "aws_config_config_rule" "encrypted_volumes" {
+  name = "encrypted_volumes"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "ENCRYPTED_VOLUMES"
+  }
+}
+
+resource "aws_config_config_rule" "incoming_ssh_disabled" {
+  name = "incoming_ssh_disabled"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "INCOMING_SSH_DISABLED"
+  }
+}
+
+resource "aws_config_config_rule" "cloud_trail_enabled" {
+  name = "cloud_trail_enabled"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "CLOUD_TRAIL_ENABLED"
+  }
+
+  input_parameters = <<EOF
+{
+  "s3BucketName": "ce-hiring-cloudtrail"
+}
+EOF
+}
+
+resource "aws_config_config_rule" "cloudwatch_alarm_action_check" {
+  name = "cloudwatch_alarm_action_check"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "CLOUDWATCH_ALARM_ACTION_CHECK"
+  }
+
+  input_parameters = <<EOF
+{
+  "alarmActionRequired" : "true",
+  "insufficientDataActionRequired" : "false",
+  "okActionRequired" : "false"
+}
+EOF
+}
+
+resource "aws_config_config_rule" "iam_group_has_users_check" {
+  name = "iam_group_has_users_check"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "IAM_GROUP_HAS_USERS_CHECK"
+  }
+}
+
+//see https://docs.aws.amazon.com/config/latest/developerguide/iam-password-policy.html
+resource "aws_config_config_rule" "iam_password_policy" {
+  name = "iam_password_policy"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "IAM_PASSWORD_POLICY"
+  }
+
+  input_parameters = <<EOF
+{
+  "RequireUppercaseCharacters" : "true",
+  "RequireLowercaseCharacters" : "true",
+  "RequireSymbols" : "true",
+  "RequireNumbers" : "true",
+  "MinimumPasswordLength" : "20",
+  "PasswordReusePrevention" : "24",
+  "MaxPasswordAge" : "90"
+}
+EOF
+}
+
+resource "aws_config_config_rule" "iam_user_group_membership_check" {
+  name = "iam_user_group_membership_check"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "IAM_USER_GROUP_MEMBERSHIP_CHECK"
+  }
+
+  input_parameters = <<EOF
+{
+  "groupNames" : "readonly_users"
+}
+EOF
+}
+
+resource "aws_config_config_rule" "iam_user_no_policies_check" {
+  name = "iam_user_no_policies_check"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "IAM_USER_NO_POLICIES_CHECK"
+  }
+}
+
+resource "aws_config_config_rule" "root_account_mfa_enabled" {
+  name = "root_account_mfa_enabled"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "ROOT_ACCOUNT_MFA_ENABLED"
+  }
+}
+
+resource "aws_config_config_rule" "s3_bucket_public_read_prohibited" {
+  name = "s3_bucket_public_read_prohibited"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "S3_BUCKET_PUBLIC_READ_PROHIBITED"
+  }
+}
+
+resource "aws_config_config_rule" "s3_bucket_public_write_prohibited" {
+  name = "s3_bucket_public_write_prohibited"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "S3_BUCKET_PUBLIC_WRITE_PROHIBITED"
+  }
+}
+
+resource "aws_config_config_rule" "s3_bucket_ssl_requests_only" {
+  name = "s3_bucket_ssl_requests_only"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "S3_BUCKET_SSL_REQUESTS_ONLY"
+  }
+}
+
+resource "aws_config_config_rule" "s3_bucket_server_side_encryption_enabled" {
+  name = "s3_bucket_server_side_encryption_enabled"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
+  }
+}
+
+resource "aws_config_config_rule" "s3_bucket_versioning_enabled" {
+  name = "s3_bucket_versioning_enabled"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "S3_BUCKET_VERSIONING_ENABLED"
+  }
+}
+
+resource "aws_config_config_rule" "ebs_optimized_instance" {
+  name = "ebs_optimized_instance"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "EBS_OPTIMIZED_INSTANCE"
+  }
+}
+
+resource "aws_config_config_rule" "required_tags" {
+  name = "required_tags"
+
+  source {
+    owner             = "AWS"
+    source_identifier = "REQUIRED_TAGS"
+  }
+  input_parameters = <<EOF
+{
+  "tag1Key" : "created_by",
+  "tag1Value" : "terraform",
+  "tag2Key" : "cost_center",
+  "tag3Key" : "project"
+}
+EOF
+}
diff --git a/src/basic-web-infra/global/config/s3.tf b/src/basic-web-infra/global/config/s3.tf
new file mode 100644
index 0000000..bffa4e0
--- /dev/null
+++ b/src/basic-web-infra/global/config/s3.tf
@@ -0,0 +1,84 @@
+resource "aws_s3_bucket" "config" {
+  bucket = "ce-hiring-aws-configuration"
+}
+
+resource "aws_s3_bucket_versioning" "config" {
+  bucket = aws_s3_bucket.config.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "config" {
+  bucket = aws_s3_bucket.config.bucket
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_acl" "config" {
+  bucket = aws_s3_bucket.config.id
+  acl    = "private"
+}
+
+resource "aws_s3_bucket_public_access_block" "config" {
+  bucket = aws_s3_bucket.config.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_policy" "config" {
+  bucket = aws_s3_bucket.config.id
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AWSConfigBucketPermissionsCheck",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+         "config.amazonaws.com"
+        ]
+      },
+      "Action": "s3:GetBucketAcl",
+      "Resource": "${aws_s3_bucket.config.arn}"
+    },
+    {
+      "Sid": "AWSConfigBucketExistenceCheck",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "config.amazonaws.com"
+        ]
+      },
+      "Action": "s3:ListBucket",
+      "Resource": "${aws_s3_bucket.config.arn}"
+    },
+    {
+      "Sid": "AWSConfigBucketDelivery",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+         "config.amazonaws.com"
+        ]
+      },
+      "Action": "s3:PutObject",
+      "Resource": "${aws_s3_bucket.config.arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/Config/*",
+      "Condition": {
+        "StringEquals": {
+          "s3:x-amz-acl": "bucket-owner-full-control"
+        }
+      }
+    }
+  ]
+}
+POLICY
+}
diff --git a/src/basic-web-infra/global/config/terragrunt.hcl b/src/basic-web-infra/global/config/terragrunt.hcl
new file mode 100644
index 0000000..3abe32a
--- /dev/null
+++ b/src/basic-web-infra/global/config/terragrunt.hcl
@@ -0,0 +1,10 @@
+include {
+  path = find_in_parent_folders()
+}
+
+locals {
+  terragrunt_tags = {
+    created_by        = "terraform"
+    terraform_path    = "/${lower(path_relative_to_include())}"
+  }
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/iam/account_alias.tf b/src/basic-web-infra/global/iam/account_alias.tf
new file mode 100644
index 0000000..a63bd3f
--- /dev/null
+++ b/src/basic-web-infra/global/iam/account_alias.tf
@@ -0,0 +1,3 @@
+resource "aws_iam_account_alias" "alias" {
+  account_alias = "ce-hiring"
+}
diff --git a/src/basic-web-infra/global/iam/groups.tf b/src/basic-web-infra/global/iam/groups.tf
new file mode 100644
index 0000000..9c3af5d
--- /dev/null
+++ b/src/basic-web-infra/global/iam/groups.tf
@@ -0,0 +1,12 @@
+resource "aws_iam_group" "hiring_candidates" {
+  name = "HiringCandidates"
+}
+
+data "aws_iam_policy" "ec2fullaccess" {
+  name = "AmazonEC2FullAccess"
+}
+
+resource "aws_iam_group_policy_attachment" "test-attach" {
+  group      = aws_iam_group.hiring_candidates.name
+  policy_arn = data.aws_iam_policy.ec2fullaccess.arn
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/iam/main.tf b/src/basic-web-infra/global/iam/main.tf
new file mode 100644
index 0000000..00db8ea
--- /dev/null
+++ b/src/basic-web-infra/global/iam/main.tf
@@ -0,0 +1,111 @@
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+
+data "aws_caller_identity" "ops" {
+  provider = aws.admin
+}
+
+resource "aws_iam_account_password_policy" "password_policy" {
+  minimum_password_length        = 20
+  max_password_age               = 90
+  password_reuse_prevention      = 24
+  hard_expiry                    = false
+  require_lowercase_characters   = true
+  require_numbers                = true
+  require_uppercase_characters   = true
+  require_symbols                = true
+  allow_users_to_change_password = true
+}
+
+resource "aws_iam_policy" "require_mfa" {
+  name = "RequireMFA"
+  policy = jsonencode(
+    {
+      "Version" : "2012-10-17",
+      "Statement" : [
+        {
+          "Sid" : "AllowViewAccountInfo",
+          "Effect" : "Allow",
+          "Action" : [
+            "iam:GetAccountPasswordPolicy",
+            "iam:GetAccountSummary",
+            "iam:ListVirtualMFADevices"
+          ],
+          "Resource" : "*"
+        },
+        {
+          "Sid" : "AllowManageOwnPasswords",
+          "Effect" : "Allow",
+          "Action" : [
+            "iam:ChangePassword",
+            "iam:GetUser"
+          ],
+          "Resource" : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}"
+        },
+        {
+          "Sid" : "AllowManageOwnAccessKeys",
+          "Effect" : "Allow",
+          "Action" : [
+            "iam:CreateAccessKey",
+            "iam:DeleteAccessKey",
+            "iam:ListAccessKeys",
+            "iam:UpdateAccessKey"
+          ],
+          "Resource" : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}"
+        },
+        {
+          "Sid" : "AllowManageOwnVirtualMFADevice",
+          "Effect" : "Allow",
+          "Action" : [
+            "iam:CreateVirtualMFADevice",
+            "iam:DeleteVirtualMFADevice"
+          ],
+          "Resource" : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:mfa/$${aws:username}"
+        },
+        {
+          "Sid" : "AllowManageOwnUserMFA",
+          "Effect" : "Allow",
+          "Action" : [
+            "iam:DeactivateMFADevice",
+            "iam:EnableMFADevice",
+            "iam:ListMFADevices",
+            "iam:ResyncMFADevice"
+          ],
+          "Resource" : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}"
+        },
+        {
+          "Sid" : "DenyAllExceptListedIfNoMFA",
+          "Effect" : "Deny",
+          "NotAction" : [
+            "iam:CreateVirtualMFADevice",
+            "iam:DeleteVirtualMFADevice",
+            "iam:EnableMFADevice",
+            "iam:GetUser",
+            "iam:ListMFADevices",
+            "iam:ListVirtualMFADevices",
+            "iam:ResyncMFADevice",
+            "sts:GetSessionToken",
+            "sts:AssumeRole"
+          ],
+          "Resource" : "*",
+          "Condition" : {
+            "BoolIfExists" : {
+              "aws:MultiFactorAuthPresent" : "false"
+            }
+          }
+        }
+      ]
+    }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "require_mfa" {
+  role       = "OrganizationAccountAccessRole"
+  policy_arn = aws_iam_policy.require_mfa.arn
+}
+
+resource "aws_iam_role_policy_attachment" "aws_support_access" {
+  role       = "OrganizationAccountAccessRole"
+  policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/iam/outputs.tf b/src/basic-web-infra/global/iam/outputs.tf
new file mode 100644
index 0000000..e69de29
diff --git a/src/basic-web-infra/global/iam/roles.tf b/src/basic-web-infra/global/iam/roles.tf
new file mode 100644
index 0000000..e69de29
diff --git a/src/basic-web-infra/global/iam/terragrunt.hcl b/src/basic-web-infra/global/iam/terragrunt.hcl
new file mode 100644
index 0000000..3abe32a
--- /dev/null
+++ b/src/basic-web-infra/global/iam/terragrunt.hcl
@@ -0,0 +1,10 @@
+include {
+  path = find_in_parent_folders()
+}
+
+locals {
+  terragrunt_tags = {
+    created_by        = "terraform"
+    terraform_path    = "/${lower(path_relative_to_include())}"
+  }
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/iam/variables.tf b/src/basic-web-infra/global/iam/variables.tf
new file mode 100644
index 0000000..e69de29
diff --git a/src/basic-web-infra/global/ssm/iam.tf b/src/basic-web-infra/global/ssm/iam.tf
new file mode 100644
index 0000000..080a4ca
--- /dev/null
+++ b/src/basic-web-infra/global/ssm/iam.tf
@@ -0,0 +1,53 @@
+resource "aws_iam_policy" "allow_automation_access" {
+  name        = "AllowAutomationAccess"
+  description = "Allows limited access to specific resources needed for automation."
+  policy = jsonencode(
+    {
+      "Version" : "2012-10-17",
+      "Statement" : [
+        {
+          "Sid" : "AllowSSMParameterStoreAccess",
+          "Effect" : "Allow",
+          "Action" : [
+            "ssm:GetParameter"
+          ],
+          "Resource" : [
+            "arn:aws:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/*"
+          ]
+        },
+        {
+          "Sid" : "AllowSSMParamterDecryption",
+          "Effect" : "Allow",
+          "Action" : [
+            "kms:Decrypt"
+          ],
+          "Resource" : [
+            "arn:aws:kms:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:alias/ssm"
+          ]
+        },
+        {
+          "Sid" : "AllowEC2ReadOnlyLimitedAccess",
+          "Effect" : "Allow",
+          "Action" : [
+            "ec2:DescribeTags",
+            "ec2:DescribeInstances"
+          ],
+          "Resource" : [
+            "*"
+          ]
+        },
+        {
+          "Sid" : "AllowSSMArtifiactAccess",
+          "Effect" : "Allow",
+          "Action" : [
+            "s3:GetObject",
+            "s3:GetEncryptionConfiguration"
+          ],
+          "Resource" : [
+            "${aws_s3_bucket.ssm_artifacts.arn}/*",
+            "${aws_s3_bucket.ssm_artifacts.arn}"
+          ]
+        }
+      ]
+  })
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/ssm/main.tf b/src/basic-web-infra/global/ssm/main.tf
new file mode 100644
index 0000000..fc69d5a
--- /dev/null
+++ b/src/basic-web-infra/global/ssm/main.tf
@@ -0,0 +1,42 @@
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+variable "default_tags" {
+  type = map(any)
+  default = {
+    created_by  = "terraform",
+    project     = "ssm"
+    cost_center = "global"
+  }
+}
+
+resource "aws_iam_role" "ssm_maintenance_window" {
+  name = "ssm-maintenance-window"
+  assume_role_policy = jsonencode(
+    {
+      "Version" : "2012-10-17",
+      "Statement" : [
+        {
+          "Sid" : "AllowAssumeRole",
+          "Action" : "sts:AssumeRole",
+          "Principal" : {
+            "Service" : [
+              "ec2.amazonaws.com",
+              "ssm.amazonaws.com"
+            ]
+          },
+          "Effect" : "Allow"
+        }
+      ]
+    }
+  )
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "ssm_maintenance_window" {
+  role       = aws_iam_role.ssm_maintenance_window.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonSSMMaintenanceWindowRole"
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/ssm/patching.tf b/src/basic-web-infra/global/ssm/patching.tf
new file mode 100644
index 0000000..ad68794
--- /dev/null
+++ b/src/basic-web-infra/global/ssm/patching.tf
@@ -0,0 +1,341 @@
+#https://docs.microsoft.com/en-us/troubleshoot/windows-client/deployment/standard-terminology-software-updates
+
+resource "aws_ssm_patch_baseline" "windows_patching_baseline" {
+  name             = "ce-windows-baseline"
+  description      = "Patching baseline for windows servers"
+  operating_system = "WINDOWS"
+
+  # Critical Stability and security related OS patches
+  approval_rule {
+    approve_after_days = 3
+    compliance_level   = "CRITICAL"
+
+    patch_filter {
+      key = "PATCH_SET"
+      values = [
+        "OS"
+      ]
+    }
+
+    patch_filter {
+      key = "PRODUCT"
+      values = [
+        "*"
+      ]
+    }
+    patch_filter {
+      key = "CLASSIFICATION"
+      values = [
+        "CriticalUpdates",
+        "SecurityUpdates"
+      ]
+    }
+
+    patch_filter {
+      key = "MSRC_SEVERITY"
+      values = [
+        "Critical",
+        "Important"
+      ]
+    }
+  }
+
+  # All other OS updates
+  approval_rule {
+    approve_after_days = 14
+    compliance_level   = "LOW"
+
+    patch_filter {
+      key = "PATCH_SET"
+      values = [
+        "OS"
+      ]
+    }
+
+    patch_filter {
+      key = "PRODUCT"
+      values = [
+        "*"
+      ]
+    }
+    patch_filter {
+      key = "CLASSIFICATION"
+      values = [
+        "*"
+      ]
+    }
+
+    patch_filter {
+      key = "MSRC_SEVERITY"
+      values = [
+        "Low",
+        "Moderate",
+        "Unspecified"
+      ]
+    }
+  }
+
+  # All application updates
+  approval_rule {
+    approve_after_days = 3
+    compliance_level   = "LOW"
+
+    patch_filter {
+      key = "PATCH_SET"
+      values = [
+        "APPLICATION"
+      ]
+    }
+
+    patch_filter {
+      key = "PRODUCT"
+      values = [
+        "*"
+      ]
+    }
+    patch_filter {
+      key = "CLASSIFICATION"
+      values = [
+        "*"
+      ]
+    }
+
+    patch_filter {
+      key = "MSRC_SEVERITY"
+      values = [
+        "*"
+      ]
+    }
+  }
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+    OS               = "Windows"
+    Environment      = "Production"
+  })
+}
+
+resource "aws_ssm_patch_baseline" "amazon_linux_patching_baseline" {
+  name             = "ce-amazon-linux-baseline"
+  description      = "SSM Patch Baseline for amazon linux servers"
+  operating_system = "AMAZON_LINUX"
+
+  approval_rule {
+    approve_after_days = 3
+    compliance_level   = "CRITICAL"
+    patch_filter {
+      key = "CLASSIFICATION"
+      values = [
+        "Security", "Recommended"
+      ]
+    }
+    patch_filter {
+      key = "SEVERITY"
+      values = [
+        "Critical",
+        "Important"
+      ]
+    }
+  }
+
+  approval_rule {
+    approve_after_days = 3
+    compliance_level   = "LOW"
+    patch_filter {
+      key = "CLASSIFICATION"
+      values = [
+        "Security",
+        "Recommended",
+        "Newpackage",
+        "Enhancement",
+        "Bugfix"
+      ]
+    }
+  }
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+    OS               = "Amazon Linux"
+    Environment      = "Production"
+  })
+}
+
+resource "aws_ssm_patch_baseline" "amazon_linux2_patching_baseline" {
+  name             = "ce-amazon-linux2-baseline"
+  description      = "SSM Patch Baseline for amazon linux servers"
+  operating_system = "AMAZON_LINUX_2"
+
+  approval_rule {
+    approve_after_days = 3
+    compliance_level   = "CRITICAL"
+    patch_filter {
+      key = "CLASSIFICATION"
+      values = [
+        "Security", "Recommended"
+      ]
+    }
+    patch_filter {
+      key = "SEVERITY"
+      values = [
+        "Critical",
+        "Important"
+      ]
+    }
+  }
+
+  approval_rule {
+    approve_after_days = 3
+    compliance_level   = "LOW"
+    patch_filter {
+      key = "CLASSIFICATION"
+      values = [
+        "Security",
+        "Recommended",
+        "Newpackage",
+        "Enhancement",
+        "Bugfix"
+      ]
+    }
+  }
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+    OS               = "Amazon Linux"
+    Environment      = "Production"
+  })
+}
+
+resource "aws_ssm_patch_group" "windows_automatic_reboot" {
+  baseline_id = aws_ssm_patch_baseline.windows_patching_baseline.id
+  patch_group = "Windows Automatic Reboot"
+}
+
+resource "aws_ssm_patch_group" "primary_domain_controller" {
+  baseline_id = aws_ssm_patch_baseline.windows_patching_baseline.id
+  patch_group = "Primary Domain Controller"
+}
+
+resource "aws_ssm_patch_group" "patch_server" {
+  baseline_id = aws_ssm_patch_baseline.windows_patching_baseline.id
+  patch_group = "Patch Server"
+}
+
+resource "aws_ssm_patch_group" "aws_linux_automatic_reboot" {
+  baseline_id = aws_ssm_patch_baseline.amazon_linux_patching_baseline.id
+  patch_group = "AWS Linux Automatic Reboot"
+}
+
+resource "aws_ssm_patch_group" "aws_linux2_automatic_reboot" {
+  baseline_id = aws_ssm_patch_baseline.amazon_linux2_patching_baseline.id
+  patch_group = "AWS Linux 2 Automatic Reboot"
+}
+
+resource "aws_ssm_maintenance_window" "servers" {
+  name              = "PatchAllEC2Instances"
+  schedule          = "cron(0 4 * * ? *)"
+  schedule_timezone = "America/Detroit"
+  duration          = 3
+  cutoff            = 1
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+  })
+}
+
+resource "aws_ssm_maintenance_window_target" "domain_controller" {
+  name          = "WindowsPrimaryDomainController"
+  window_id     = aws_ssm_maintenance_window.servers.id
+  description   = "Patch the primary domain controller independently so we don't accidentally take the domain offline."
+  resource_type = "INSTANCE"
+
+  targets {
+    key = "tag:Patch Group"
+    values = [
+      aws_ssm_patch_group.primary_domain_controller.patch_group
+    ]
+  }
+}
+
+resource "aws_ssm_maintenance_window_target" "patch_server" {
+  name          = "WindowsPatchServer"
+  window_id     = aws_ssm_maintenance_window.servers.id
+  description   = "Patch the patch server so we don't accidentally break patching for other instances."
+  resource_type = "INSTANCE"
+
+  targets {
+    key = "tag:Patch Group"
+    values = [
+      aws_ssm_patch_group.patch_server.patch_group
+    ]
+  }
+}
+
+resource "aws_ssm_maintenance_window_target" "windows_automatic_reboot" {
+  name          = "WindowsAutomaticReboot"
+  window_id     = aws_ssm_maintenance_window.servers.id
+  description   = "Targets to install updates with a reboot reboot if necessary."
+  resource_type = "INSTANCE"
+
+  targets {
+    key = "tag:Patch Group"
+    values = [
+      aws_ssm_patch_group.windows_automatic_reboot.patch_group
+    ]
+  }
+}
+
+resource "aws_ssm_maintenance_window_target" "linux_automatic_reboot" {
+  name          = "LinuxAutomaticReboot"
+  window_id     = aws_ssm_maintenance_window.servers.id
+  description   = "Targets to install updates with a reboot if necessary."
+  resource_type = "INSTANCE"
+
+  targets {
+    key = "tag:Patch Group"
+    values = [
+      aws_ssm_patch_group.aws_linux_automatic_reboot.patch_group,
+      aws_ssm_patch_group.aws_linux2_automatic_reboot.patch_group
+    ]
+  }
+}
+
+resource "aws_ssm_maintenance_window_task" "automatic_reboot" {
+  name             = "AutomaticReboot"
+  max_concurrency  = 5
+  max_errors       = 0
+  task_type        = "RUN_COMMAND"
+  task_arn         = "AWS-RunPatchBaseline"
+  priority         = 1
+  window_id        = aws_ssm_maintenance_window.servers.id
+  service_role_arn = aws_iam_role.ssm_maintenance_window.arn
+
+  targets {
+    key = "WindowTargetIds"
+    values = [
+      #If a single maintenance window task is registered with multiple targets,
+      # its task invocations occur sequentially and not in parallel.
+      # We use the sequential behavior ensure domain controller and patch server get patched after everything else.
+      aws_ssm_maintenance_window_target.windows_automatic_reboot.id,
+      aws_ssm_maintenance_window_target.linux_automatic_reboot.id,
+      aws_ssm_maintenance_window_target.patch_server.id,
+      aws_ssm_maintenance_window_target.domain_controller.id,
+    ]
+  }
+
+  task_invocation_parameters {
+    run_command_parameters {
+      output_s3_bucket     = aws_s3_bucket.ssm_patch_log.bucket
+      output_s3_key_prefix = "Servers/AutomaticReboot"
+      timeout_seconds      = 600
+
+      parameter {
+        name   = "Operation"
+        values = ["Install"]
+      }
+      parameter {
+        name   = "RebootOption"
+        values = ["RebootIfNeeded"]
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/ssm/ssm-artifacts.tf b/src/basic-web-infra/global/ssm/ssm-artifacts.tf
new file mode 100644
index 0000000..b857670
--- /dev/null
+++ b/src/basic-web-infra/global/ssm/ssm-artifacts.tf
@@ -0,0 +1,41 @@
+resource "aws_s3_bucket" "ssm_artifacts" {
+  bucket = "hiring-ssm-artifacts-store"
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM/S3"
+  })
+}
+
+resource "aws_s3_bucket_cors_configuration" "ssm_artifacts" {
+  bucket = aws_s3_bucket.ssm_artifacts.bucket
+
+  cors_rule {
+    allowed_origins = ["*"]
+    allowed_methods = ["GET"]
+    max_age_seconds = 3000
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "ssm_artifacts" {
+  bucket = aws_s3_bucket.ssm_artifacts.bucket
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_acl" "ssm_artifacts" {
+  bucket = aws_s3_bucket.ssm_artifacts.id
+  acl    = "private"
+}
+
+resource "aws_s3_bucket_public_access_block" "ssm_artifacts" {
+  bucket = aws_s3_bucket.ssm_artifacts.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/ssm/ssm-packages.tf b/src/basic-web-infra/global/ssm/ssm-packages.tf
new file mode 100644
index 0000000..811c1f7
--- /dev/null
+++ b/src/basic-web-infra/global/ssm/ssm-packages.tf
@@ -0,0 +1,58 @@
+
+resource "aws_s3_bucket" "ssm_packages" {
+  bucket = "ce-hiring-ssm-packages-store"
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+    Name             = "SSM Packages"
+    Environment      = "Production"
+  })
+}
+
+resource "aws_s3_bucket_versioning" "ssm_packages" {
+  bucket = aws_s3_bucket.ssm_packages.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "ssm_packages" {
+  bucket = aws_s3_bucket.ssm_packages.bucket
+
+  rule {
+    id     = "DeleteIncompleteMultipartUploads"
+    status = "Enabled"
+
+    abort_incomplete_multipart_upload {
+      days_after_initiation = 5
+    }
+  }
+
+  depends_on = [
+    aws_s3_bucket_versioning.ssm_packages
+  ]
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "ssm_packages" {
+  bucket = aws_s3_bucket.ssm_packages.bucket
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_acl" "ssm_packages" {
+  bucket = aws_s3_bucket.ssm_packages.id
+  acl    = "private"
+}
+
+resource "aws_s3_bucket_public_access_block" "ssm_packages" {
+  bucket = aws_s3_bucket.ssm_packages.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
diff --git a/src/basic-web-infra/global/ssm/ssm-patch-log.tf b/src/basic-web-infra/global/ssm/ssm-patch-log.tf
new file mode 100644
index 0000000..9cdb0a9
--- /dev/null
+++ b/src/basic-web-infra/global/ssm/ssm-patch-log.tf
@@ -0,0 +1,60 @@
+resource "aws_s3_bucket" "ssm_patch_log" {
+  bucket = "ce-hiring-ssm-patch-log-store"
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+    Name             = "SSM Patch Logs"
+    Environment      = "Production"
+  })
+}
+
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "ssm_patch_log" {
+  bucket = aws_s3_bucket.ssm_patch_log.bucket
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_acl" "ssm_patch_log" {
+  bucket = aws_s3_bucket.ssm_patch_log.id
+  acl    = "private"
+}
+
+resource "aws_s3_bucket_public_access_block" "ssm_patch_log" {
+  bucket = aws_s3_bucket.ssm_patch_log.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_iam_policy" "ssm_patch_log_policy" {
+  name        = "AllowWriteToS3LogBucket"
+  description = "Allows SSM to write to the ssm log bucket"
+  policy = jsonencode(
+    {
+      "Version" : "2012-10-17",
+      "Statement" : [
+        {
+          "Effect" : "Allow",
+          "Action" : [
+            "s3:*Object"
+          ],
+          "Resource" : [
+            aws_s3_bucket.ssm_patch_log.arn
+          ]
+        }
+      ]
+    }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ssm_patch_log_policy_attachment" {
+  role       = aws_iam_role.ssm_maintenance_window.name
+  policy_arn = aws_iam_policy.ssm_patch_log_policy.arn
+}
diff --git a/src/basic-web-infra/global/ssm/terragrunt.hcl b/src/basic-web-infra/global/ssm/terragrunt.hcl
new file mode 100644
index 0000000..3abe32a
--- /dev/null
+++ b/src/basic-web-infra/global/ssm/terragrunt.hcl
@@ -0,0 +1,10 @@
+include {
+  path = find_in_parent_folders()
+}
+
+locals {
+  terragrunt_tags = {
+    created_by        = "terraform"
+    terraform_path    = "/${lower(path_relative_to_include())}"
+  }
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/global/ssm/windows-defender-updates.tf b/src/basic-web-infra/global/ssm/windows-defender-updates.tf
new file mode 100644
index 0000000..24587aa
--- /dev/null
+++ b/src/basic-web-infra/global/ssm/windows-defender-updates.tf
@@ -0,0 +1,111 @@
+resource "aws_ssm_patch_baseline" "windows_defender" {
+  name             = "ce-windows-defender-definition-updates"
+  description      = "Baseline for updating windows defender definitions"
+  operating_system = "WINDOWS"
+
+  #Windows defender updates
+  approval_rule {
+    approve_after_days = 0
+    compliance_level   = "INFORMATIONAL"
+
+    patch_filter {
+      key = "PATCH_SET"
+      values = [
+        "OS"
+      ]
+    }
+
+    patch_filter {
+      key = "PRODUCT"
+      values = [
+        "MicrosoftDefenderAntivirus"
+      ]
+    }
+    patch_filter {
+      key = "CLASSIFICATION"
+      values = [
+        "*"
+      ]
+    }
+
+    patch_filter {
+      key = "MSRC_SEVERITY"
+      values = [
+        "*"
+      ]
+    }
+  }
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+    OS               = "Windows"
+    Environment      = "Production"
+  })
+}
+
+
+resource "aws_ssm_patch_group" "windows_defender" {
+  baseline_id = aws_ssm_patch_baseline.windows_defender.id
+  patch_group = "Windows Defender"
+}
+
+resource "aws_ssm_maintenance_window" "windows_defender" {
+  name              = "WindowsDefenderDefinitionUpdates"
+  schedule          = "rate(2 hours)"
+  schedule_timezone = "America/Detroit"
+  duration          = 3
+  cutoff            = 1
+
+  tags = merge(var.default_tags, {
+    ce_resource_path = "/HIRING/GLOBAL/SSM"
+  })
+}
+
+resource "aws_ssm_maintenance_window_target" "windows_defender" {
+  name          = "AllWindowsInstances"
+  window_id     = aws_ssm_maintenance_window.windows_defender.id
+  description   = "Update all windows servers with windows defender."
+  resource_type = "INSTANCE"
+
+  targets {
+    key = "tag-key"
+    values = [
+      "Name"
+    ]
+  }
+}
+
+resource "aws_ssm_maintenance_window_task" "windows_defender" {
+  name             = "AutomaticReboot"
+  max_concurrency  = 5
+  max_errors       = 0
+  task_type        = "RUN_COMMAND"
+  task_arn         = "AWS-RunPatchBaseline"
+  priority         = 1
+  window_id        = aws_ssm_maintenance_window.windows_defender.id
+  service_role_arn = aws_iam_role.ssm_maintenance_window.arn
+
+  targets {
+    key = "WindowTargetIds"
+    values = [
+      aws_ssm_maintenance_window_target.windows_defender.id,
+    ]
+  }
+
+  task_invocation_parameters {
+    run_command_parameters {
+      output_s3_bucket     = aws_s3_bucket.ssm_patch_log.bucket
+      output_s3_key_prefix = "Servers/WindowsDefender"
+      timeout_seconds      = 600
+
+      parameter {
+        name   = "Operation"
+        values = ["Install"]
+      }
+      parameter {
+        name   = "RebootOption"
+        values = ["NoReboot"]
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/lb/certificate.tf b/src/basic-web-infra/modules/lb/certificate.tf
new file mode 100644
index 0000000..b50c7d7
--- /dev/null
+++ b/src/basic-web-infra/modules/lb/certificate.tf
@@ -0,0 +1,36 @@
+data "aws_route53_zone" "certificate" {
+  provider = aws.public_infrastructure
+  name     = "${var.default_domain_name}."
+}
+
+resource "aws_acm_certificate" "certificate" {
+  domain_name       = "${var.default_subdomain}.${var.default_domain_name}"
+  validation_method = "DNS"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_route53_record" "certificate" {
+  provider = aws.public_infrastructure
+  for_each = {
+    for dvo in aws_acm_certificate.certificate.domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  }
+
+  allow_overwrite = true
+  name            = each.value.name
+  records         = [each.value.record]
+  ttl             = 60
+  type            = each.value.type
+  zone_id         = data.aws_route53_zone.certificate.zone_id
+}
+
+resource "aws_acm_certificate_validation" "certificate" {
+  certificate_arn         = aws_acm_certificate.certificate.arn
+  validation_record_fqdns = [for record in aws_route53_record.certificate : record.fqdn]
+}
diff --git a/src/basic-web-infra/modules/lb/dns.tf b/src/basic-web-infra/modules/lb/dns.tf
new file mode 100644
index 0000000..c597dd7
--- /dev/null
+++ b/src/basic-web-infra/modules/lb/dns.tf
@@ -0,0 +1,13 @@
+
+resource "aws_route53_record" "loadbalancer_A" {
+  provider = aws.public_infrastructure
+  zone_id  = data.aws_route53_zone.certificate.zone_id
+  name     = var.default_subdomain
+  type     = "A"
+
+  alias {
+    name                   = aws_lb.loadbalancer.dns_name
+    zone_id                = aws_lb.loadbalancer.zone_id
+    evaluate_target_health = true
+  }
+}
diff --git a/src/basic-web-infra/modules/lb/main.tf b/src/basic-web-infra/modules/lb/main.tf
new file mode 100644
index 0000000..a67ba69
--- /dev/null
+++ b/src/basic-web-infra/modules/lb/main.tf
@@ -0,0 +1,135 @@
+data "aws_caller_identity" "current" {}
+data "aws_elb_service_account" "main" {}
+
+resource "aws_security_group" "loadbalancer" {
+  vpc_id = var.vpc_id
+
+  tags = merge(var.tags, {
+    Name        = "LoadBalancer (${var.deployment_role})"
+    Description = "LoadBalancer security group (${var.deployment_role})"
+  })
+}
+
+resource "aws_security_group_rule" "https" {
+  security_group_id = aws_security_group.loadbalancer.id
+  type              = "ingress"
+  protocol          = "TCP"
+  cidr_blocks       = ["0.0.0.0/0"]
+  from_port         = 443
+  to_port           = 443
+  description       = "Allows open access to https"
+}
+
+resource "aws_security_group_rule" "http" {
+  security_group_id = aws_security_group.loadbalancer.id
+  type              = "ingress"
+  protocol          = "TCP"
+  cidr_blocks       = ["0.0.0.0/0"]
+  from_port         = 80
+  to_port           = 80
+  description       = "Allows open access to https"
+}
+
+resource "aws_security_group_rule" "outbound" {
+  security_group_id = aws_security_group.loadbalancer.id
+  type                      = "egress"
+  protocol                  = "-1"
+  from_port                 = 80
+  to_port                   = 80
+  source_security_group_id  = var.target_security_group_id
+  description               = "Allows egress to the instances sg."
+}
+
+resource "aws_lb" "loadbalancer" {
+  name                       = "${var.deployment_short_name}-${var.deployment_role}"
+  internal                   = false
+  load_balancer_type         = "application"
+  security_groups            = [
+    aws_security_group.loadbalancer.id
+  ]
+
+  enable_deletion_protection = false
+  drop_invalid_header_fields = true
+
+  subnets = var.loadbalancer_subnets
+
+  access_logs {
+    bucket  = aws_s3_bucket.logging_bucket.bucket
+    enabled = true
+  }
+
+  tags = merge(var.tags, {
+    Owner       = var.deployment_long_name
+    Purpose     = "LB"
+    Deployment  = upper(var.deployment_short_name)
+    Environment = upper(var.deployment_role)
+  })
+}
+
+resource "aws_wafv2_web_acl_association" "web_acl" {
+  resource_arn = aws_lb.loadbalancer.arn
+  web_acl_arn  = aws_wafv2_web_acl.waf_acl.arn
+}
+
+resource "aws_lb_target_group" "targetgroup" {
+  name        = var.default_subdomain
+  port        = var.target_port
+  protocol    = "HTTP"
+  target_type = "instance"
+  vpc_id      = var.vpc_id
+  slow_start  = 300
+
+  health_check {
+    enabled             = true
+    healthy_threshold   = 2
+    interval            = 90
+    matcher             = "200"
+    path                = "/"
+    port                = "traffic-port"
+    protocol            = "HTTP"
+    timeout             = 60
+    unhealthy_threshold = 2
+  }
+
+  stickiness {
+    cookie_duration = 28800
+    enabled         = true
+    type            = "lb_cookie"
+  }
+}
+
+resource "aws_lb_target_group_attachment" "targetgroup" {
+  for_each         = var.target_instances
+  target_group_arn = aws_lb_target_group.targetgroup.arn
+  target_id        = each.value
+  port             = var.target_port
+}
+
+resource "aws_lb_listener" "https" {
+  load_balancer_arn = aws_lb.loadbalancer.arn
+  port              = "443"
+  protocol          = "HTTPS"
+  ssl_policy        = "ELBSecurityPolicy-FS-1-2-Res-2020-10"
+  certificate_arn   = aws_acm_certificate.certificate.arn
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.targetgroup.arn
+  }
+}
+
+resource "aws_lb_listener" "http" {
+  load_balancer_arn = aws_lb.loadbalancer.arn
+  port              = "80"
+  protocol          = "HTTP"
+
+  default_action {
+    type = "redirect"
+
+    redirect {
+      port        = "443"
+      protocol    = "HTTPS"
+      status_code = "HTTP_301"
+    }
+  }
+}
diff --git a/src/basic-web-infra/modules/lb/outputs.tf b/src/basic-web-infra/modules/lb/outputs.tf
new file mode 100644
index 0000000..b7ad5dc
--- /dev/null
+++ b/src/basic-web-infra/modules/lb/outputs.tf
@@ -0,0 +1,19 @@
+output "arn" {
+  value = aws_lb.loadbalancer.arn
+}
+
+output "dns_name" {
+  value = aws_lb.loadbalancer.dns_name
+}
+
+output "zone_id" {
+  value = aws_lb.loadbalancer.zone_id
+}
+
+output "https_listener_arn" {
+  value = aws_lb_listener.https.arn
+}
+
+output "targetgroup_arn" {
+  value = aws_lb_target_group.targetgroup.arn
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/lb/s3.tf b/src/basic-web-infra/modules/lb/s3.tf
new file mode 100644
index 0000000..307d183
--- /dev/null
+++ b/src/basic-web-infra/modules/lb/s3.tf
@@ -0,0 +1,51 @@
+resource "aws_s3_bucket" "logging_bucket" {
+  bucket        = "${var.deployment_short_name}-${var.deployment_role}-loadbalancer"
+  force_destroy = true
+
+  tags = var.tags
+}
+
+resource "aws_s3_bucket_acl" "logging_bucket" {
+  bucket = aws_s3_bucket.logging_bucket.id
+  acl    = "private"
+}
+
+resource "aws_s3_bucket_public_access_block" "logging_bucket" {
+  bucket = aws_s3_bucket.logging_bucket.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "logging_bucket" {
+  bucket = aws_s3_bucket.logging_bucket.bucket
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "logging_bucket" {
+  bucket = aws_s3_bucket.logging_bucket.bucket
+  policy = <<POLICY
+{
+    "Version" : "2012-10-17",
+    "Id" : "LoadBalancerLogsPolicy",
+    "Statement" : [
+      {
+        "Sid" : "AllowRootWriteAccess",
+        "Effect" : "Allow",
+        "Principal" : {
+          "AWS" : "${data.aws_elb_service_account.main.arn}"
+        },
+        "Action" : "s3:PutObject",
+        "Resource" : "arn:aws:s3:::${aws_s3_bucket.logging_bucket.bucket}/AWSLogs/${data.aws_caller_identity.current.account_id}/*"
+      }
+    ]
+}
+POLICY
+}
diff --git a/src/basic-web-infra/modules/lb/variables.tf b/src/basic-web-infra/modules/lb/variables.tf
new file mode 100644
index 0000000..afbed6b
--- /dev/null
+++ b/src/basic-web-infra/modules/lb/variables.tf
@@ -0,0 +1,61 @@
+variable "deployment_long_name" {
+  type        = string
+  description = "The long name for the deployment."
+}
+
+variable "deployment_short_name" {
+  type        = string
+  description = "The short name for the deployment."
+}
+
+variable "deployment_role" {
+  type        = string
+  description = "The role for the deployment (Prod, Qa, Test, etc...)."
+}
+
+variable "vpc_id" {
+  type        = string
+  description = "The id of the vpc."
+}
+
+variable "loadbalancer_subnets" {
+  type        = set(string)
+  default     = null
+  description = "The subnets for the loadbalancer"
+}
+
+variable "default_domain_name" {
+    description = "Domain for the certificate and DNS entry. Do not include subdomain (eg, www.)"
+    type        = string
+}
+
+variable "default_subdomain" {
+    description = "Subdomain for the certificate and DNS entry."
+    type        = string
+    default     = null
+}
+
+variable "target_instances" {
+    description = "The list of instances to forward to."
+    type        = set(string)
+    default     = null
+}
+
+variable "target_security_group_id" {
+    description = "The security group to forward to."
+    type        = string
+    default     = null
+}
+
+
+variable "target_port" {
+    description = "The target port to forward to (80, 443, etc...)"
+    type        = string
+    default     = "443"
+}
+
+variable "tags" {
+  type        = map(any)
+  description = "Custom tags to apply."
+  default     = {}
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/lb/waf.tf b/src/basic-web-infra/modules/lb/waf.tf
new file mode 100644
index 0000000..c0836e3
--- /dev/null
+++ b/src/basic-web-infra/modules/lb/waf.tf
@@ -0,0 +1,172 @@
+resource "aws_wafv2_web_acl" "waf_acl" {
+  name        = "${var.deployment_short_name}-${var.deployment_role}-waf-acl"
+  scope       = "REGIONAL"
+  description = "Baseline wafv2 web acl"
+
+  default_action {
+    allow {}
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "${var.deployment_short_name}-${var.deployment_role}-waf-acl"
+    sampled_requests_enabled   = true
+  }
+
+  rule {
+    name     = "AWS-AWSManagedRulesAmazonIpReputationList"
+    priority = 1
+    statement {
+      managed_rule_group_statement {
+        vendor_name = "AWS"
+        name        = "AWSManagedRulesAmazonIpReputationList"
+        excluded_rule {
+          name = "AWSManagedIPReputationList"
+        }
+
+        excluded_rule {
+          name = "AWSManagedIPReputationList_0000"
+        }
+      }
+    }
+    override_action {
+      none {}
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWS-AWSManagedRulesAmazonIpReputationList"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "AWS-AWSManagedRulesCommonRuleSet"
+    priority = 2
+    statement {
+      managed_rule_group_statement {
+        vendor_name = "AWS"
+        name        = "AWSManagedRulesCommonRuleSet"
+        excluded_rule {
+          name = "GenericRFI_BODY"
+        }
+        excluded_rule {
+          name = "SizeConstraint_BODY"
+        }
+        excluded_rule {
+          name = "SizeRestrictions_BODY"
+        }
+
+        excluded_rule {
+          name = "SizeRestrictions_QUERYSTRING"
+        }
+
+        excluded_rule {
+          name = "CrossSiteScripting_BODY"
+        }
+        excluded_rule {
+          name = "SizeRestrictions_Cookie_HEADER"
+        }
+        excluded_rule {
+          name = "NoUserAgent_HEADER"
+        }
+        excluded_rule {
+          name = "GenericLFI_BODY"
+        }
+
+        excluded_rule {
+          name = "GenericRFI_QUERYARGUMENTS"
+        }
+
+        excluded_rule {
+          name = "EC2MetaDataSSRF_BODY"
+        }
+      }
+    }
+    override_action {
+      none {}
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWS-AWSManagedRulesCommonRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+  rule {
+    name     = "AWS-AWSManagedRulesKnownBadInputsRuleSet"
+    priority = 3
+    statement {
+      managed_rule_group_statement {
+        vendor_name = "AWS"
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+      }
+    }
+    override_action {
+      none {}
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWS-AWSManagedRulesKnownBadInputsRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+  rule {
+    name     = "AWS-AWSManagedRulesSQLiRuleSet"
+    priority = 4
+    statement {
+      managed_rule_group_statement {
+        vendor_name = "AWS"
+        name        = "AWSManagedRulesSQLiRuleSet"
+        excluded_rule {
+          name = "SQLi_BODY"
+        }
+      }
+    }
+    override_action {
+      none {}
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      sampled_requests_enabled   = true
+      metric_name                = "AWS-AWSManagedRulesSQLiRuleSet"
+    }
+  }
+
+  rule {
+    name     = "AWS-AWSManagedRulesWindowsRuleSet"
+    priority = 5
+    statement {
+      managed_rule_group_statement {
+        vendor_name = "AWS"
+        name        = "AWSManagedRulesWindowsRuleSet"
+        excluded_rule {
+          name = "PowerShellCommands_BODY"
+        }
+        excluded_rule {
+          name = "PowerShellCommands_COOKIE"
+        }
+        excluded_rule {
+          name = "PowerShellCommands_QUERYARGUMENTS"
+        }
+        excluded_rule {
+          name = "WindowsShellCommands_BODY"
+        }
+        excluded_rule {
+          name = "WindowsShellCommands_COOKIE"
+        }
+        excluded_rule {
+          name = "WindowsShellCommands_QUERYARGUMENTS"
+        }
+
+      }
+    }
+    override_action {
+      none {}
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWS-AWSManagedRulesWindowsRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+}
+
diff --git a/src/basic-web-infra/modules/vpc/flowlogs.tf b/src/basic-web-infra/modules/vpc/flowlogs.tf
new file mode 100644
index 0000000..4b38295
--- /dev/null
+++ b/src/basic-web-infra/modules/vpc/flowlogs.tf
@@ -0,0 +1,82 @@
+resource "aws_s3_bucket" "flowlogs_bucket" {
+  bucket        = "${var.deployment_short_name}-${var.deployment_role}-flowlogs"
+  force_destroy = true
+}
+
+resource "aws_s3_bucket_public_access_block" "flowlogs_bucket" {
+  bucket = aws_s3_bucket.flowlogs_bucket.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_acl" "flowlogs_bucket" {
+  bucket = aws_s3_bucket.flowlogs_bucket.id
+  acl    = "private"
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "flowlogs_bucket" {
+  bucket = aws_s3_bucket.flowlogs_bucket.id
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_iam_role" "flowlogs_cloudwatch" {
+  name = "FlowLogsCloudWatch${title(var.deployment_role)}"
+  assume_role_policy = jsonencode(
+    {
+      Statement = [
+        {
+          Action = "sts:AssumeRole"
+          Effect = "Allow"
+          Principal = {
+            Service = "vpc-flow-logs.amazonaws.com"
+          }
+        },
+      ]
+      Version = "2012-10-17"
+    }
+  )
+}
+
+resource "aws_iam_role_policy" "flowlogs_cloudwatch" {
+  name = "VPCFlowLogs"
+  role = aws_iam_role.flowlogs_cloudwatch.name
+  policy = jsonencode(
+    {
+      Statement = [
+        {
+          Action = [
+            "logs:PutLogEvents",
+            "logs:DescribeLogStreams",
+            "logs:DescribeLogGroups",
+            "logs:CreateLogStream",
+            "logs:CreateLogGroup",
+          ]
+          Effect   = "Allow"
+          Resource = "*"
+        },
+      ]
+      Version = "2012-10-17"
+    }
+  )
+}
+
+resource "aws_flow_log" "all" {
+  log_destination      = aws_s3_bucket.flowlogs_bucket.arn
+  log_destination_type = "s3"
+  traffic_type         = "ALL"
+  vpc_id               = module.vpc.vpc_id
+}
+
+resource "aws_flow_log" "all_cloudwatch" {
+  iam_role_arn    = aws_iam_role.flowlogs_cloudwatch.arn
+  log_destination = "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:FlowLogs"
+  traffic_type    = "ALL"
+  vpc_id          = module.vpc.vpc_id
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/vpc/main.tf b/src/basic-web-infra/modules/vpc/main.tf
new file mode 100644
index 0000000..a1d8fd6
--- /dev/null
+++ b/src/basic-web-infra/modules/vpc/main.tf
@@ -0,0 +1,77 @@
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "~> 2.0"
+
+  name = var.deployment_short_name
+  cidr = var.vpc_cidr
+
+  azs = [
+    data.aws_availability_zones.available.names[0],
+    data.aws_availability_zones.available.names[1]
+  ]
+
+  public_subnets = [
+    cidrsubnet(var.vpc_cidr, 8, 1),
+    cidrsubnet(var.vpc_cidr, 8, 3),
+  ]
+
+  private_subnets = [
+    cidrsubnet(var.vpc_cidr, 8, 2),
+    cidrsubnet(var.vpc_cidr, 8, 4)
+  ]
+
+  enable_nat_gateway  = true
+  enable_vpn_gateway  = true
+  enable_s3_endpoint  = true
+  enable_dhcp_options = true
+
+  dhcp_options_domain_name          = var.infrastructure_dns_domain_name
+  dhcp_options_domain_name_servers  = var.infrastructure_dns_server_ips
+  dhcp_options_netbios_name_servers = var.infrastructure_netbios_nameserver_ips
+  dhcp_options_netbios_node_type    = var.infrastructure_netbios_node_type
+  dhcp_options_ntp_servers          = var.infrastructure_ntp_server_ips
+
+  dhcp_options_tags = {
+    "Name"    = "${var.deployment_long_name} dhcp options"
+    "Purpose" = var.deployment_role
+  }
+
+  public_subnet_suffix = "public"
+  public_subnet_tags = {
+    "Name"    = "${var.deployment_long_name} public (${var.deployment_role})"
+    "Purpose" = var.deployment_role
+  }
+  public_route_table_tags = {
+    "Name"    = "${var.deployment_long_name} public (${var.deployment_role})"
+    "Purpose" = var.deployment_role
+  }
+
+  private_subnet_suffix = "private"
+  private_subnet_tags = {
+    "Name"    = "${var.deployment_long_name} private (${var.deployment_role})"
+    "Purpose" = var.deployment_role
+  }
+  private_route_table_tags = {
+    "Name"    = "${var.deployment_long_name} private (${var.deployment_role})"
+    "Purpose" = var.deployment_role
+  }
+
+  manage_default_security_group  = true
+  default_security_group_name    = "default"
+  default_security_group_ingress = []
+  default_security_group_egress  = []
+  default_security_group_tags    = { "Name" = "default (No Access)" }
+
+  tags = {
+    "Name"    = "${var.deployment_long_name} (${var.deployment_role})"
+    "Purpose" = var.deployment_role
+  }
+}
+
diff --git a/src/basic-web-infra/modules/vpc/outputs.tf b/src/basic-web-infra/modules/vpc/outputs.tf
new file mode 100644
index 0000000..e965c89
--- /dev/null
+++ b/src/basic-web-infra/modules/vpc/outputs.tf
@@ -0,0 +1,31 @@
+output "vpc_id" {
+  value = module.vpc.vpc_id
+}
+
+output "vpc_cidr" {
+  value = module.vpc.vpc_cidr_block
+}
+
+output "public_subnets_ids" {
+  value = module.vpc.public_subnets
+}
+
+output "private_subnets_ids" {
+  value = module.vpc.private_subnets
+}
+
+output "public_subnets_cidr_blocks" {
+  value = module.vpc.public_subnets_cidr_blocks
+}
+
+output "private_subnets_cidr_blocks" {
+  value = module.vpc.private_subnets_cidr_blocks
+}
+
+output "public_route_table_ids" {
+  value = module.vpc.public_route_table_ids
+}
+
+output "private_route_table_ids" {
+  value = module.vpc.private_route_table_ids
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/vpc/variables.tf b/src/basic-web-infra/modules/vpc/variables.tf
new file mode 100644
index 0000000..29e3bde
--- /dev/null
+++ b/src/basic-web-infra/modules/vpc/variables.tf
@@ -0,0 +1,44 @@
+variable "deployment_long_name" {
+  description = "The long name for the deployment (wheeling, tenantgroup, etc...)."
+  type        = string
+}
+
+variable "deployment_short_name" {
+  description = "The short name for the deployment (wh, tg, etc...)."
+  type        = string
+}
+
+variable "deployment_role" {
+  description = "The role for the deployment (qa, prod, staging, etc...)."
+  type        = string
+}
+
+variable "vpc_cidr" {
+  description = "The cidr for the VPC."
+  type        = string
+}
+
+variable "infrastructure_dns_domain_name" {
+  description = "The dns domain name for internal hosts."
+  type        = string
+}
+
+variable "infrastructure_dns_server_ips" {
+  description = "The list of ad DNS servers for the domain."
+  type        = list(string)
+}
+
+variable "infrastructure_ntp_server_ips" {
+  description = "The list of NTP servers for the vpc."
+  type        = list(string)
+}
+
+variable "infrastructure_netbios_nameserver_ips" {
+  description = "The list of netbios servers for the domain."
+  type        = list(string)
+}
+
+variable "infrastructure_netbios_node_type" {
+  description = "The node type of the netbios servers."
+  type        = string
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/web/ami.tf b/src/basic-web-infra/modules/web/ami.tf
new file mode 100644
index 0000000..d23cf04
--- /dev/null
+++ b/src/basic-web-infra/modules/web/ami.tf
@@ -0,0 +1,12 @@
+data "aws_caller_identity" "public_infrastructure" {
+  provider = aws.public_infrastructure
+}
+
+data "aws_ami" "server_ami" {
+  most_recent = true
+  owners      = [data.aws_caller_identity.public_infrastructure.account_id]
+  filter {
+    name   = "name"
+    values = ["CE_Windows_Server-2022-Full-Base*"]
+  }
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/web/keypair.tf b/src/basic-web-infra/modules/web/keypair.tf
new file mode 100644
index 0000000..05e7a7d
--- /dev/null
+++ b/src/basic-web-infra/modules/web/keypair.tf
@@ -0,0 +1,17 @@
+// couldn't figuire out how to use the ec2_keypair module because of terragrunt's `//` path requirement, so just copying it here
+locals {
+  public_key  = element(tls_private_key.this.*.public_key_openssh, 0)
+  private_key = element(tls_private_key.this.*.private_key_pem, 0)
+}
+
+resource "tls_private_key" "this" {  
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "aws_key_pair" "this" {
+  key_name   = var.keypair_name
+  public_key = local.public_key
+
+  tags = var.tags
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/web/main.tf b/src/basic-web-infra/modules/web/main.tf
new file mode 100644
index 0000000..6cd029f
--- /dev/null
+++ b/src/basic-web-infra/modules/web/main.tf
@@ -0,0 +1,122 @@
+data "aws_caller_identity" "current" {}
+
+locals {
+  ce_identifier = toset([for suffix in var.suffixes : "${upper(var.deployment_short_name)}-${upper(substr(var.deployment_role, 0, 4))}-WB-${upper(suffix)}"])
+}
+
+resource "aws_iam_role" "webserver" {
+  name = "${var.deployment_short_name}_${var.deployment_role}_WebRole"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_instance_profile" "webserver" {
+  name = "${var.deployment_short_name}${title(var.deployment_role)}WebProfile"
+  role = aws_iam_role.webserver.name
+}
+
+resource "aws_iam_role_policy_attachment" "webserver_ssm" {
+  role       = aws_iam_role.webserver.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+}
+
+resource "aws_iam_role_policy_attachment" "webserver_automation" {
+  role       = aws_iam_role.webserver.name
+  policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/AllowAutomationAccess"
+}
+
+resource "aws_security_group" "webserver" {
+  vpc_id = var.vpc_id
+
+  tags = merge(var.tags, {
+    Name        = "Webserver (${var.deployment_role})"
+    Description = "Webserver security group (${var.deployment_role})"
+  })
+}
+
+resource "aws_security_group_rule" "http" {
+  security_group_id = aws_security_group.webserver.id
+  type              = "ingress"
+  protocol          = "TCP"
+  cidr_blocks       = [var.vpc_cidr_block]
+  from_port         = 80
+  to_port           = 80
+  description       = "Allows internal access to http"
+}
+
+resource "aws_security_group_rule" "https" {
+  security_group_id = aws_security_group.webserver.id
+  type              = "ingress"
+  protocol          = "TCP"
+  cidr_blocks       = [var.vpc_cidr_block]
+  from_port         = 443
+  to_port           = 443
+  description       = "Allows internal access to https"
+}
+
+resource "aws_security_group_rule" "egress" {
+  security_group_id = aws_security_group.webserver.id
+  type              = "egress"
+  protocol          = "-1"
+  cidr_blocks       = ["0.0.0.0/0"]
+  from_port         = 0
+  to_port           = 0
+  description       = "Allows outbound traffic"
+}
+
+resource "aws_instance" "webserver" {
+  for_each      = local.ce_identifier
+  instance_type = var.instance_type
+  ami           = data.aws_ami.server_ami.id
+  key_name      = aws_key_pair.this.key_name
+  subnet_id     = var.instance_subnet_id
+  vpc_security_group_ids = concat(
+    var.additional_security_groups,
+    [aws_security_group.webserver.id]
+  )
+
+  disable_api_termination     = true
+  iam_instance_profile        = aws_iam_instance_profile.webserver.name
+  ebs_optimized               = true
+  monitoring                  = true
+  associate_public_ip_address = false
+
+  lifecycle {
+    ignore_changes = [ami]
+  }
+
+  tags = merge(var.tags, {
+    Name          = each.value
+    Owner         = var.deployment_long_name
+    Purpose       = "Web"
+    Deployment    = upper(var.deployment_short_name)
+    Environment   = upper(var.deployment_role)
+    "Patch Group" = var.patch_group
+    Hostname      = each.value
+    "Tenable"     = "FA"
+  })
+
+  root_block_device {
+    volume_size           = 1024
+    delete_on_termination = true
+    tags = merge(
+      { "Name" = "${each.value} C:" },
+      var.tags,
+      var.root_block_device_tags
+    )
+  }
+}
diff --git a/src/basic-web-infra/modules/web/outputs.tf b/src/basic-web-infra/modules/web/outputs.tf
new file mode 100644
index 0000000..c67f805
--- /dev/null
+++ b/src/basic-web-infra/modules/web/outputs.tf
@@ -0,0 +1,11 @@
+output "security_group_id" {
+  value = aws_security_group.webserver.id
+}
+
+output "instance_role_name" {
+  value = aws_iam_role.webserver.name
+}
+
+output "webserver_ids" {
+  value = values(aws_instance.webserver)[*].id
+}
\ No newline at end of file
diff --git a/src/basic-web-infra/modules/web/remote_access.tf b/src/basic-web-infra/modules/web/remote_access.tf
new file mode 100644
index 0000000..2c6c395
--- /dev/null
+++ b/src/basic-web-infra/modules/web/remote_access.tf
@@ -0,0 +1,65 @@
+resource "aws_security_group_rule" "webserver_wmi" {
+  count             = var.allow_remote_access == true ? 1 : 0
+  security_group_id = aws_security_group.webserver.id
+  type              = "ingress"
+  to_port           = 135
+  from_port         = 135
+  protocol          = "TCP"
+  cidr_blocks       = var.remote_access_cidrs
+  description       = "Allows negotiation of WMI connections to the instance"
+}
+
+resource "aws_security_group_rule" "webserver_wmi_dynamic" {
+  count             = var.allow_remote_access == true ? 1 : 0
+  security_group_id = aws_security_group.webserver.id
+  type              = "ingress"
+  to_port           = 65535
+  from_port         = 49152
+  protocol          = "TCP"
+  cidr_blocks       = var.remote_access_cidrs
+  description       = "Allows WMI to open a dynamic port for inbound querying"
+}
+
+resource "aws_security_group_rule" "webserver_smb" {
+  count             = var.allow_remote_access == true ? 1 : 0
+  security_group_id = aws_security_group.webserver.id
+  type              = "ingress"
+  to_port           = 445
+  from_port         = 445
+  protocol          = "TCP"
+  cidr_blocks       = var.remote_access_cidrs
+  description       = "Allows SMB connections"
+}
+
+resource "aws_security_group_rule" "webserver_rdp" {
+  count             = var.allow_remote_access == true ? 1 : 0
+  security_group_id = aws_security_group.webserver.id
+  type              = "ingress"
+  to_port           = 3389
+  from_port         = 3389
+  protocol          = "TCP"
+  cidr_blocks       = var.remote_access_cidrs
+  description       = "Allows RDP access"
+}
+
+resource "aws_security_group_rule" "webserver_winrm_http" {
+  count             = var.allow_remote_access == true ? 1 : 0
+  security_group_id = aws_security_group.webserver.id
+  type              = "ingress"
+  to_port           = 5985
+  from_port         = 5985
+  protocol          = "TCP"
+  cidr_blocks       = var.remote_access_cidrs
+  description       = "Allows winrm access"
+}
+
+resource "aws_security_group_rule" "webserver_winrm_https" {
+  count             = var.allow_remote_access == true ? 1 : 0
+  security_group_id = aws_security_group.webserver.id
+  type              = "ingress"
+  to_port           = 5986
+  from_port         = 5986
+  protocol          = "TCP"
+  cidr_blocks       = var.remote_access_cidrs
+  description       = "Allows https winrm access"
+}
diff --git a/src/basic-web-infra/modules/web/variables.tf b/src/basic-web-infra/modules/web/variables.tf
new file mode 100644
index 0000000..ad53b9a
--- /dev/null
+++ b/src/basic-web-infra/modules/web/variables.tf
@@ -0,0 +1,79 @@
+variable "deployment_long_name" {
+  type        = string
+  description = "The long name for the deployment."
+}
+
+variable "deployment_short_name" {
+  type        = string
+  description = "The short name for the deployment."
+}
+
+variable "deployment_role" {
+  type        = string
+  description = "The role for the deployment (Prod, Qa, Test, etc...)."
+}
+
+variable "vpc_id" {
+  type        = string
+  description = "The id of the vpc."
+}
+
+variable "vpc_cidr_block" {
+  type        = string
+  description = "The CIDR block of the vpc."
+}
+
+variable "instance_subnet_id" {
+  type        = string
+  description = "The subnet ids for the web EC2 instances."
+}
+
+variable "instance_type" {
+  type        = string
+  default     = "m5.2xlarge"
+  description = "The size of the instance."
+}
+
+variable "suffixes" {
+  type        = set(string)
+  default     = ["01A"]
+  description = "List of suffixes to append to each unique instance. 01A, 01B, 02A, etc...."
+}
+
+variable "keypair_name" {
+  type        = string
+  description = "The name of the EC2 key pair used to decrypt the administrator password."
+}
+
+variable "additional_security_groups" {
+  type        = list(string)
+  default     = []
+  description = "Other security groups to attach to the instances."
+}
+
+variable "allow_remote_access" {
+  type        = bool
+  description = "Enables or disables external remote access."
+}
+
+variable "remote_access_cidrs" {
+  type        = list(string)
+  description = "List of CIDRS for external remote access (WMI, etc...)."
+}
+
+variable "patch_group" {
+  type        = string
+  description = "Patch group for the instance"
+}
+
+variable "tags" {
+  type        = map(any)
+  description = "Custom tags to apply."
+  default     = {}
+}
+
+variable "root_block_device_tags" {
+  type        = map(any)
+  description = "Custom tags to apply strictly to the root block device."
+  default     = {}
+}
\ No newline at end of file