[AWS] Move ci.jenkins.io from Azure (sponsorship) to AWS (sponsorship)

[dduportal]

This issue is a top-level EPIC about ci.jenkins.io in the context of the cloud billing and Jenkins Infrastructure sponsorship.

• Since Migrate ci.jenkins.io to the sponsored subscription #3913, ci.jenkins.io runs in the Azure sponsored subscription which has around $49k credits valid until May 2025.
  • ci.jenkins.io consumes around $8k monthly in this system, out of the $10k monthly consumed
  • Challenge: we want these credits to last at least until end of April 2025
• AWS granted a $60k credits ("AWS Sponsorship account") which we weren't able to use until know (missing people to spend time on it), valid until end of January 2025
  • We want to consume as much as possible in these credits for both our benefits and AWS'

As such, we agreed on moving ci.jenkins.io from Azure (sponsored) to AWS (sponsored):

• It's an autonomous system (no relations or hard links with other systems in the Jenkins infra)
• It used to run on AWS (CloudBees) account so there should not be a lot of "new" things
• We can always move it back somewhere else (Azure?) in January if we run out of time or credits

This task is divided in the following distinct topics:

Tasks

Beta Give feedback

1. Set up the AWS (sponsored) account as a Terraform project #4314
   +0
   
2. [ci.jenkins.io] Move ephemeral VM agents to AWS #4316
   EC2 aws ci.jenkins.io +3
   
3. [ci.jenkins.io] Define virtual networking for AWS #4320
   aws ci.jenkins.io +2
   
4. [ci.jenkins.io] Move controller (VM) to AWS #4315
   aws ci.jenkins.io +2
   
5. [ci.jenkins.io] Create private EKS cluster with "side" services (datadog, ACP, etc.) #4319
   artifact-caching-proxy aws ci.jenkins.io +3
   
6. [ci.jenkins.io] Move ephemeral Linux containers to AWS #4317
   triage +1
7. [ci.jenkins.io] Move ACI agents to ephemeral Windows containers to AWS #4318
   triage +1
8. [ci.jenkins.io] Set up an ECR pull through cache #4321
   aws ci.jenkins.io triage +3

[dduportal]

Update: we have to use us-east2 region (we target the Availability Zone b for spreading out of the first AZ).

Rationale: us-east-1 is the default and legacy region and is subject to a lot more outage than other regions, not mentioning the spot instance availabilities, in our past experience.

Note

In the former Cloudbees AWS account, us-east-1 used to host the "permanent" workload (such as Jenkins controller)
while us-east-2 used to be for ephemeral workloads (such as Jenkins agents).
We do not have such a requirement in the Jenkins AWS account here