Upd terraform (#110)

* Update terraform

* update

* update

Author: yongwww

terraform/artifacts.tf

@@ -18,4 +18,11 @@ resource "aws_s3_bucket" "artifacts-bucket" {
     target_bucket = var.access_logs_target_bucket
     target_prefix = "log/"
   }
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        sse_algorithm = "AES256"
+      }
+    }
+  }
 }

terraform/firewall.tf

@@ -1,10 +1,14 @@
+data "aws_vpc" "main" {
+  id = var.vpc_id
+}
+
 resource "aws_security_group" "ssh_inbound" {
   vpc_id = var.vpc_id
   ingress {
     from_port   = 22
     to_port     = 22
     protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    cidr_blocks = [data.aws_vpc.main.cidr_block]
   }
   tags = {
     Name = "ssh_inbound"

terraform/modules/head-node/firewall.tf

@@ -1,10 +1,14 @@
+data "aws_vpc" "main" {
+  id = var.vpc_id
+}
+
 resource "aws_security_group" "ssh_inbound" {
   vpc_id = var.vpc_id
   ingress {
     from_port   = 22
     to_port     = 22
     protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    cidr_blocks = [data.aws_vpc.main.cidr_block]
   }
   tags = {
     Name = "ssh_inbound"

terraform/modules/head-node/main.tf

@@ -42,7 +42,11 @@ resource "aws_iam_role_policy" "jenkins_fleet" {
             "ec2:DescribeInstances",
             "ec2:TerminateInstances",
             "ec2:DescribeInstanceStatus",
-            "ec2:DescribeSpotFleetRequests"
+            "ec2:DescribeSpotFleetRequests",
+            "ec2:DescribeFleets",
+            "ec2:DescribeFleetInstances",
+            "ec2:ModifyFleet",
+            "ec2:DescribeInstanceTypes"
          ],
          "Resource":"*"
       },

terraform/sccache.tf

@@ -9,4 +9,11 @@ resource "aws_s3_bucket" "bucket" {
     target_bucket = var.access_logs_target_bucket
     target_prefix = "log/"
   }
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        sse_algorithm = "AES256"
+      }
+    }
+  }
 }

terraform/vars/tvm-ci-prod.auto.tfvars

@@ -53,7 +53,7 @@ autoscaler_types = {
     labels                                   = "CPU-LARGE-SPOT"
     min_size                                 = 0
     max_size                                 = 90
-    on_demand_percentage_above_base_capacity = 100
+    on_demand_percentage_above_base_capacity = 0
     on_demand_base_capacity                  = 0
   }
   "Prod-Autoscaler-Jenkins-CPU-SPOT" = {
@@ -179,7 +179,7 @@ autoscaler_types = {
     labels                                   = "GPU-G5-SPOT"
     min_size                                 = 0
     max_size                                 = 64
-    on_demand_percentage_above_base_capacity = 100
+    on_demand_percentage_above_base_capacity = 0
     on_demand_base_capacity                  = 0
   }
   "Flashinfer-Autoscaler-Jenkins-GPU-G6" = {
@@ -197,7 +197,7 @@ autoscaler_types = {
     labels                                   = "GPU-G6-SPOT"
     min_size                                 = 0
     max_size                                 = 64
-    on_demand_percentage_above_base_capacity = 100
+    on_demand_percentage_above_base_capacity = 0
     on_demand_base_capacity                  = 0
   }
 }