Improve config

[ravikiranvm]

No description provided.

[Copilot]

Pull request overview

This PR updates the Terraform configuration to improve portability and security around S3 buckets/state management and to make the WireGuard EC2 bootstrap/config outputs more usable.

Changes:

• Make the client-config S3 bucket name account-unique and add default encryption + public access blocking.
• Pass the S3 bucket name into EC2 user-data via templatefile, add new root/module outputs (bucket name/ARN, VPN public IP), and select the latest Ubuntu 22.04 AMI dynamically.
• Adjust networking/security posture by removing SSH ingress from the security group.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
terraform/outputs.tf	Adds outputs for bucket name/ARN and VPN public IP.
terraform/main.tf	Wires storage bucket name into compute module and updates backend bucket configuration.
terraform/modules/storage/main.tf	Makes bucket name account-specific and adds SSE + public access block; exports bucket name.
terraform/modules/security_group/main.tf	Removes SSH ingress rule (leaves WireGuard UDP ingress).
terraform/modules/compute/main.tf	Switches to dynamic Ubuntu AMI lookup; templates user-data with bucket name; tags instance.
terraform/modules/compute/variables.tf	Adds bucket_name input variable for user-data templating.
terraform/modules/compute/user_data.sh	Improves bootstrap logic (deps install, IMDSv2 public IP, dynamic iface); uploads client config to the bucket.
terraform_state/main.tf	Makes tfstate bucket name account-specific; adds provider + caller identity.
terraform_state/.terraform.lock.hcl	Adds provider lock file for the terraform_state root module.

Files not reviewed (1)

• terraform_state/.terraform.lock.hcl: Generated file

Comments suppressed due to low confidence (1)

terraform/main.tf:57

• The backend S3 bucket is hard-coded to a specific AWS account ID, while terraform_state/main.tf provisions cloudvpn-tfstate-${account_id}. This makes the repo non-portable and easy to misconfigure for other accounts/environments. Consider using a partial backend configuration here and pass the bucket name via terraform init -backend-config=..., or document a placeholder value instead of committing a real account-specific bucket name.

terraform {
    backend "s3" {
        bucket = "cloudvpn-tfstate-548846591939"
        key = "CloudVPN/terraform.tfstate"
        region = "ap-southeast-1"
        encrypt = true
        use_lockfile = true
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.