terraform-aws-vpc-network/main.tf at main · cruxstack/terraform-aws-vpc-network · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
locals {
  enabled                               = module.this.enabled
  nat_aws_shield_protection_enabled     = local.enabled && var.nat_aws_shield_protection_enabled
  privatelink_enabled                   = local.enabled && (local.privatelink_vpc_endpoints_enabled || local.privatelink_gateway_endpoints_enabled)
  privatelink_vpc_endpoints_enabled     = local.enabled && length(var.privatelink_vpc_endpoints) > 0
  privatelink_gateway_endpoints_enabled = local.enabled && length(var.privatelink_gateway_endpoints) > 0
  vpc_flow_logs_enabled                 = local.enabled && var.vpc_flow_logs_enabled

  aws_account_id  = try(coalesce(var.aws_account_id, data.aws_caller_identity.current[0].account_id), "")
  aws_region_name = try(coalesce(var.aws_region_name, data.aws_region.current[0].name), "")

  subnet_max_count = (
    var.subnet_max_count > 0 ? var.subnet_max_count : (
      length(var.availability_zone_ids) > 0 ? length(var.availability_zone_ids) : length(var.availability_zones)
    )
  )
  privatelink_gateway_endpoint_map = {
    for v in var.privatelink_gateway_endpoints : lower(v) => {
      name            = lower(v)
      policy          = null
      route_table_ids = module.subnets.private_route_table_ids
    }
  }

  privatelink_vpc_endpoint_sg_key = "vpc-endpoint-interfaces"
  privatelink_vpc_endpoint_map = {
    for v in var.privatelink_vpc_endpoints : lower(v) => {
      name                = lower(v)
      policy              = null
      private_dns_enabled = true
      security_group_ids = local.privatelink_vpc_endpoints_enabled ? [
        module.privatelink_vpc_endpoint_sg[local.privatelink_vpc_endpoint_sg_key].id
      ] : []
      subnet_ids = module.subnets.private_subnet_ids
    }
  }
}

data "aws_caller_identity" "current" {
  count = module.this.enabled && var.aws_account_id == "" ? 1 : 0
}

data "aws_region" "current" {
  count = module.this.enabled && var.aws_region_name == "" ? 1 : 0
}

# ====================================================================== vpc ===

module "vpc" {
  source  = "cloudposse/vpc/aws"
  version = "3.0.0"

  ipv4_primary_cidr_block          = var.vpc_ipv4_cidr
  assign_generated_ipv6_cidr_block = var.vpc_ipv6_cidr_auto_assigned
  internet_gateway_enabled         = var.public_subnets_enabled
  dns_hostnames_enabled            = true
  dns_support_enabled              = true

  context = module.this.context
}

module "subnets" {
  source  = "cloudposse/dynamic-subnets/aws"
  version = "3.1.1"

  availability_zones              = var.availability_zones
  availability_zone_ids           = var.availability_zone_ids
  ipv4_cidr_block                 = [module.vpc.vpc_cidr_block]
  ipv4_cidrs                      = var.subnet_ipv4_cidrs
  ipv6_enabled                    = false
  igw_id                          = var.public_subnets_enabled ? [module.vpc.igw_id] : []
  map_public_ip_on_launch         = var.public_subnets_auto_assign_ip
  max_subnet_count                = local.subnet_max_count
  nat_gateway_enabled             = lower(var.nat_type) == "gateway"
  nat_instance_enabled            = lower(var.nat_type) == "instance"
  nat_instance_type               = var.nat_instance_size
  public_subnets_enabled          = var.public_subnets_enabled
  public_subnets_additional_tags  = var.public_subnets_extra_tags
  private_subnets_additional_tags = var.private_subnets_extra_tags
  vpc_id                          = module.vpc.vpc_id

  context = module.this.context
}

# -------------------------------------------------------------- privatelink ---

module "privatelink_vpc_endpoint_sg" {
  for_each = local.privatelink_vpc_endpoints_enabled ? toset([local.privatelink_vpc_endpoint_sg_key]) : []

  source  = "cloudposse/security-group/aws"
  version = "2.2.0"

  create_before_destroy      = true
  preserve_security_group_id = false
  attributes                 = [each.value]
  vpc_id                     = module.vpc.vpc_id
  allow_all_egress           = true

  rules_map = {
    ingress = [{
      key              = "vpc_ingress"
      type             = "ingress"
      from_port        = 0
      to_port          = 65535
      protocol         = "-1" # allow ping
      cidr_blocks      = compact(concat([module.vpc.vpc_cidr_block], module.vpc.additional_cidr_blocks))
      ipv6_cidr_blocks = compact(concat([module.vpc.vpc_ipv6_cidr_block], module.vpc.additional_ipv6_cidr_blocks))
      description      = "ingress from vpc to ${each.value}"
    }]
  }

  context = module.this.context
}

module "privatelink_vpc_endpoints" {
  source  = "cloudposse/vpc/aws//modules/vpc-endpoints"
  version = "3.0.0"

  enabled                 = local.privatelink_enabled
  vpc_id                  = module.vpc.vpc_id
  gateway_vpc_endpoints   = local.privatelink_gateway_endpoint_map
  interface_vpc_endpoints = local.privatelink_vpc_endpoint_map

  context = module.this.context
}

# ------------------------------------------------------------------- shield ---

data "aws_eip" "nat" {
  for_each  = local.nat_aws_shield_protection_enabled ? toset(module.subnets.nat_ips) : []
  public_ip = each.key
}

resource "aws_shield_protection" "nat" {
  for_each = local.nat_aws_shield_protection_enabled ? data.aws_eip.nat : {}

  name         = data.aws_eip.nat[each.key].id
  resource_arn = "arn:aws:ec2:${local.aws_region_name}:${local.aws_account_id}:eip-allocation/${data.aws_eip.nat[each.key].id}"
}

# ---------------------------------------------------------------- flow-logs ---

resource "aws_flow_log" "this" {
  count = local.vpc_flow_logs_enabled ? 1 : 0

  log_destination      = var.vpc_flow_logs_destination
  log_destination_type = lower(var.vpc_flow_logs_destination_type)
  traffic_type         = upper(var.vpc_flow_logs_traffic_type)
  vpc_id               = module.vpc.vpc_id

  tags = module.this.tags
}