Terraform for Fedora CoreOS: Immutable Atomic Updates

data "aws_ami" "fcos" {
  most_recent = true
  owners      = ["125523088429"] # Fedora
  filter {
    name   = "name"
    values = ["fedora-coreos-*-x86_64"]
  }
}
 
resource "aws_instance" "fcos" {
  ami           = data.aws_ami.fcos.id
  instance_type = "t3.medium"
  user_data     = data.ct_config.host.rendered
}

data "ct_config" "host" {
  content = <<-EOT
    variant: fcos
    version: 1.5.0
    passwd:
      users:
        - name: core
          ssh_authorized_keys:
            - ${chomp(file("~/.ssh/id_ed25519.pub"))}
    storage:
      files:
        - path: /etc/zincati/config.d/55-updates.toml
          mode: 0644
          contents:
            inline: |
              [updates]
              strategy = "periodic"
              [updates.periodic]
              time_zone = "UTC"
              [[updates.periodic.window]]
              days = ["Sat", "Sun"]
              start_time = "03:00"
              length_minutes = 60
    systemd:
      units:
        - name: podman.socket
          enabled: true
  EOT
}