Skip to content

Commit 0c9bc0d

Browse files
committed
Modified Variables & upgraded version of vpn modules and vpn security groups
1 parent 1c9109d commit 0c9bc0d

File tree

16 files changed

+126
-122
lines changed

16 files changed

+126
-122
lines changed

README.md

Lines changed: 48 additions & 32 deletions
Large diffs are not rendered by default.

examples/complete-vpc-with-vpn/README.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,12 +52,11 @@ No inputs.
5252
| Name | Description |
5353
|------|-------------|
5454
| <a name="output_database_subnets"></a> [database\_subnets](#output\_database\_subnets) | List of IDs of database subnets |
55-
| <a name="output_intra_subnets"></a> [intra\_subnets](#output\_intra\_subnets) | List of IDs of Intra subnets |
56-
| <a name="output_private_subnets"></a> [private\_subnets](#output\_private\_subnets) | List of IDs of private subnets |
57-
| <a name="output_public_subnets"></a> [public\_subnets](#output\_public\_subnets) | List of IDs of public subnets |
58-
| <a name="output_region"></a> [region](#output\_region) | AWS Region |
5955
| <a name="output_vpc_cidr_block"></a> [vpc\_cidr\_block](#output\_vpc\_cidr\_block) | AWS Region |
6056
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | The ID of the VPC |
57+
| <a name="output_vpc_intra_subnets"></a> [vpc\_intra\_subnets](#output\_vpc\_intra\_subnets) | List of IDs of Intra subnets |
58+
| <a name="output_vpc_private_subnets"></a> [vpc\_private\_subnets](#output\_vpc\_private\_subnets) | List of IDs of private subnets |
59+
| <a name="output_vpc_public_subnets"></a> [vpc\_public\_subnets](#output\_vpc\_public\_subnets) | List of IDs of public subnets |
6160
| <a name="output_vpn_host_public_ip"></a> [vpn\_host\_public\_ip](#output\_vpn\_host\_public\_ip) | IP Adress of VPN Server |
6261
| <a name="output_vpn_security_group"></a> [vpn\_security\_group](#output\_vpn\_security\_group) | Security Group ID of VPN Server |
6362
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

examples/complete-vpc-with-vpn/main.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ locals {
55
environment = "prod"
66
kms_user = null
77
vpc_cidr = "10.10.0.0/16"
8-
vpc_availability_zones = ["ap-northeast-1a", "ap-northeast-1b"]
8+
vpc_availability_zones = ["ap-northeast-1a", "ap-northeast-1c"]
99
kms_deletion_window_in_days = 7
1010
enable_key_rotation = false
1111
is_enabled = true
12-
vpc_flow_log_enabled = true
13-
vpn_server_enabled = false
12+
vpc_flow_log_enabled = false
13+
vpn_server_enabled = true
1414
vpc_intra_subnet_enabled = true
1515
vpc_public_subnet_enabled = true
1616
auto_assign_public_ip = true
Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,3 @@
1-
output "region" {
2-
description = "AWS Region"
3-
value = local.region
4-
}
5-
61
output "vpc_id" {
72
description = "The ID of the VPC"
83
value = module.vpc.vpc_id
@@ -13,24 +8,24 @@ output "vpc_cidr_block" {
138
value = module.vpc.vpc_cidr_block
149
}
1510

16-
output "public_subnets" {
11+
output "vpc_public_subnets" {
1712
description = "List of IDs of public subnets"
18-
value = module.vpc.public_subnets
13+
value = module.vpc.vpc_public_subnets
1914
}
2015

21-
output "private_subnets" {
16+
output "vpc_private_subnets" {
2217
description = "List of IDs of private subnets"
23-
value = module.vpc.private_subnets
18+
value = module.vpc.vpc_private_subnets
2419
}
2520

2621
output "database_subnets" {
2722
description = "List of IDs of database subnets"
2823
value = module.vpc.database_subnets
2924
}
3025

31-
output "intra_subnets" {
26+
output "vpc_intra_subnets" {
3227
description = "List of IDs of Intra subnets"
33-
value = module.vpc.intra_subnets
28+
value = module.vpc.vpc_intra_subnets
3429
}
3530

3631
output "vpn_host_public_ip" {
@@ -41,4 +36,4 @@ output "vpn_host_public_ip" {
4136
output "vpn_security_group" {
4237
description = "Security Group ID of VPN Server"
4338
value = module.vpc.vpn_security_group
44-
}
39+
}

examples/complete-vpc-with-vpn/providers.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
provider "aws" {
2-
region = local.region
2+
region = local.aws_region
33
default_tags {
44
tags = local.additional_aws_tags
55
}

examples/multi-account-vpc-peering/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,4 @@ module "vpc_peering" {
2222
vpc_peering_multi_account_enabled = true
2323
vpc_peering_requester_aws_profile = "peer"
2424
vpc_peering_accepter_aws_profile = "accepter"
25-
}
25+
}

examples/multi-account-vpc-peering/provider.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,4 @@ provider "aws" {
1414
default_tags {
1515
tags = local.additional_tags
1616
}
17-
}
17+
}

main.tf

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
locals {
2-
azs = length(var.vpc_availability_zones)
2+
azs = length(var.vpc_availability_zones)
33
# public subnets cidr
44
public_subnets_native = var.vpc_public_subnet_enabled ? length(var.vpc_public_subnet_cidrs) > 0 ? var.vpc_public_subnet_cidrs : [for netnum in range(0, var.vpc_public_subnets_counts) : cidrsubnet(var.vpc_cidr, 8, netnum)] : []
55
secondary_public_subnets = var.vpc_public_subnet_enabled && var.secondry_cidr_enabled ? [
66
for cidr_block in var.secondary_cidr_blocks : [
77
for netnum in range(0, var.vpc_public_subnets_counts) : cidrsubnet(cidr_block, 8, netnum)
88
]
99
] : []
10-
vpc_public_subnets = concat(local.public_subnets_native, flatten(local.secondary_public_subnets))
10+
vpc_public_subnets = concat(local.public_subnets_native, flatten(local.secondary_public_subnets))
1111

1212
# intra subnets cidr
1313
intra_subnets_native = var.vpc_intra_subnet_enabled ? length(var.vpc_intra_subnet_cidrs) > 0 ? var.vpc_intra_subnet_cidrs : [for netnum in range(var.vpc_intra_subnets_counts * 3, var.vpc_intra_subnets_counts * 4) : cidrsubnet(var.vpc_cidr, 4, netnum)] : []
@@ -16,26 +16,26 @@ locals {
1616
for netnum in range(var.vpc_intra_subnets_counts * 3, var.vpc_intra_subnets_counts * 4) : cidrsubnet(cidr_block, 8, netnum)
1717
]
1818
] : []
19-
vpc_intra_subnets = concat(local.intra_subnets_native, flatten(local.secondary_intra_subnets))
20-
19+
vpc_intra_subnets = concat(local.intra_subnets_native, flatten(local.secondary_intra_subnets))
20+
2121
# private subnets cidr
2222
private_subnets_native = var.vpc_private_subnet_enabled ? length(var.vpc_private_subnet_cidrs) > 0 ? var.vpc_private_subnet_cidrs : [for netnum in range(var.vpc_private_subnets_counts * 4, var.vpc_private_subnets_counts * 5) : cidrsubnet(var.vpc_cidr, 8, netnum)] : []
2323
secondary_private_subnets = var.vpc_private_subnet_enabled && var.secondry_cidr_enabled ? [
2424
for cidr_block in var.secondary_cidr_blocks : [
2525
for netnum in range(var.vpc_private_subnets_counts, var.vpc_private_subnets_counts * 2) : cidrsubnet(cidr_block, 4, netnum)
2626
]
2727
] : []
28-
vpc_private_subnets = concat(local.private_subnets_native, flatten(local.secondary_private_subnets))
29-
28+
vpc_private_subnets = concat(local.private_subnets_native, flatten(local.secondary_private_subnets))
29+
3030
# database subnets cidr
3131
database_subnets_native = var.vpc_database_subnet_enabled ? length(var.vpc_database_subnet_cidrs) > 0 ? var.vpc_database_subnet_cidrs : [for netnum in range(var.vpc_database_subnets_counts * 2, var.vpc_database_subnets_counts * 3) : cidrsubnet(var.vpc_cidr, 8, netnum)] : []
3232
secondary_database_subnets = var.vpc_database_subnet_enabled && var.secondry_cidr_enabled ? [
3333
for cidr_block in var.secondary_cidr_blocks : [
3434
for netnum in range(var.vpc_database_subnets_counts * 2, var.vpc_database_subnets_counts * 3) : cidrsubnet(cidr_block, 8, netnum)
3535
]
3636
] : []
37-
vpc_database_subnets = concat(local.database_subnets_native, flatten(local.secondary_database_subnets))
38-
vpc_single_nat_gateway = var.vpc_one_nat_gateway_per_az == true ? false : true
37+
vpc_database_subnets = concat(local.database_subnets_native, flatten(local.secondary_database_subnets))
38+
vpc_single_nat_gateway = var.vpc_one_nat_gateway_per_az == true ? false : true
3939
create_database_subnet_route_table = var.vpc_database_subnet_enabled
4040
create_flow_log_cloudwatch_log_group = var.vpc_flow_log_enabled == true || var.vpc_flow_log_cloudwatch_log_group_skip_destroy == true ? true : false
4141
is_supported_arch = data.aws_ec2_instance_type.arch.supported_architectures[0] == "arm64" ? false : true # for VPN Instance
@@ -65,7 +65,6 @@ data "aws_availability_zones" "available" {}
6565
data "aws_ec2_instance_type" "arch" {
6666
instance_type = var.vpn_server_instance_type
6767
}
68-
6968
module "vpc" {
7069
source = "terraform-aws-modules/vpc/aws"
7170
version = "5.2.0"
@@ -269,12 +268,12 @@ resource "aws_security_group" "vpc_endpoints" {
269268
}
270269
# private links for ECR.dkr
271270

272-
resource "aws_vpc_endpoint" "private-ecr_dkr" {
271+
resource "aws_vpc_endpoint" "private_ecr_dkr" {
273272
count = var.vpc_ecr_endpoint_enabled ? 1 : 0
274273
depends_on = [data.aws_route_tables.aws_private_routes]
275274
vpc_id = module.vpc.vpc_id
276275
service_name = "com.amazonaws.${var.aws_region}.ecr.dkr"
277-
subnet_ids = module.vpc.private_subnets
276+
subnet_ids = [module.vpc.private_subnets[count.index]]
278277
security_group_ids = [aws_security_group.vpc_endpoints[0].id]
279278
vpc_endpoint_type = var.vpc_endpoint_type_ecr_dkr
280279
private_dns_enabled = true
@@ -297,11 +296,11 @@ POLICY
297296

298297
# private links for ECR.api
299298

300-
resource "aws_vpc_endpoint" "private-ecr_api" {
299+
resource "aws_vpc_endpoint" "private_ecr_api" {
301300
count = var.vpc_ecr_endpoint_enabled ? 1 : 0
302301
depends_on = [data.aws_route_tables.aws_private_routes]
303302
vpc_id = module.vpc.vpc_id
304-
subnet_ids = module.vpc.private_subnets
303+
subnet_ids = [module.vpc.private_subnets[count.index]]
305304
service_name = "com.amazonaws.${var.aws_region}.ecr.api"
306305
vpc_endpoint_type = var.vpc_endpoint_type_ecr_api
307306
private_dns_enabled = true

modules/vpc_peering/README.md

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ No modules.
4747
| [aws_vpc_peering_connection.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_peering_connection) | resource |
4848
| [aws_vpc_peering_connection_accepter.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_peering_connection_accepter) | resource |
4949
| [aws_vpc_peering_connection_options.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_peering_connection_options) | resource |
50+
| [aws_caller_identity.accepter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
5051
| [aws_route_tables.accepter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route_tables) | data source |
5152
| [aws_route_tables.requester](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route_tables) | data source |
5253
| [aws_vpc.accepter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
@@ -56,13 +57,16 @@ No modules.
5657

5758
| Name | Description | Type | Default | Required |
5859
|------|-------------|------|---------|:--------:|
59-
| <a name="input_accepter_name"></a> [accepter\_name](#input\_accepter\_name) | Assign a meaningful name or label to the VPC Accepter. This aids in distinguishing the Accepter VPC within the VPC peering connection. | `string` | `""` | no |
60-
| <a name="input_accepter_vpc_id"></a> [accepter\_vpc\_id](#input\_accepter\_vpc\_id) | Specify the unique identifier of the VPC that will act as the Acceptor in the VPC peering connection. | `string` | `""` | no |
61-
| <a name="input_accepter_vpc_region"></a> [accepter\_vpc\_region](#input\_accepter\_vpc\_region) | Provide the AWS region where the Acceptor VPC is located. This helps in identifying the correct region for establishing the VPC peering connection. | `string` | `""` | no |
62-
| <a name="input_peering_enabled"></a> [peering\_enabled](#input\_peering\_enabled) | Set this variable to true if you want to create the VPC peering connection. Set it to false if you want to skip the creation process. | `bool` | `true` | no |
63-
| <a name="input_requester_name"></a> [requester\_name](#input\_requester\_name) | Provide a descriptive name or label for the VPC Requester. This helps identify and differentiate the Requester VPC in the peering connection. | `string` | `""` | no |
64-
| <a name="input_requester_vpc_id"></a> [requester\_vpc\_id](#input\_requester\_vpc\_id) | Specify the unique identifier of the VPC that will act as the Reqester in the VPC peering connection. | `string` | `""` | no |
65-
| <a name="input_requester_vpc_region"></a> [requester\_vpc\_region](#input\_requester\_vpc\_region) | Specify the AWS region where the Requester VPC resides. It ensures the correct region is used for setting up the VPC peering. | `string` | `""` | no |
60+
| <a name="input_vpc_peering_accepter_aws_profile"></a> [vpc\_peering\_accepter\_aws\_profile](#input\_vpc\_peering\_accepter\_aws\_profile) | Provide the AWS profile where the accepter VPC is located. | `string` | `""` | no |
61+
| <a name="input_vpc_peering_accepter_name"></a> [vpc\_peering\_accepter\_name](#input\_vpc\_peering\_accepter\_name) | Assign a meaningful name or label to the VPC Accepter. This aids in distinguishing the Accepter VPC within the VPC peering connection. | `string` | `""` | no |
62+
| <a name="input_vpc_peering_accepter_vpc_id"></a> [vpc\_peering\_accepter\_vpc\_id](#input\_vpc\_peering\_accepter\_vpc\_id) | Specify the unique identifier of the VPC that will act as the Acceptor in the VPC peering connection. | `string` | `""` | no |
63+
| <a name="input_vpc_peering_accepter_vpc_region"></a> [vpc\_peering\_accepter\_vpc\_region](#input\_vpc\_peering\_accepter\_vpc\_region) | Provide the AWS region where the Acceptor VPC is located. This helps in identifying the correct region for establishing the VPC peering connection. | `string` | `""` | no |
64+
| <a name="input_vpc_peering_enabled"></a> [vpc\_peering\_enabled](#input\_vpc\_peering\_enabled) | Set this variable to true if you want to create the VPC peering connection. Set it to false if you want to skip the creation process. | `bool` | `true` | no |
65+
| <a name="input_vpc_peering_multi_account_enabled"></a> [vpc\_peering\_multi\_account\_enabled](#input\_vpc\_peering\_multi\_account\_enabled) | Set this variable to true if you want to create the VPC peering connection between reagions. Set it to false if you want to skip the creation process. | `bool` | `true` | no |
66+
| <a name="input_vpc_peering_requester_aws_profile"></a> [vpc\_peering\_requester\_aws\_profile](#input\_vpc\_peering\_requester\_aws\_profile) | Provide the AWS profile where the requester VPC is located. | `string` | `""` | no |
67+
| <a name="input_vpc_peering_requester_name"></a> [vpc\_peering\_requester\_name](#input\_vpc\_peering\_requester\_name) | Provide a descriptive name or label for the VPC Requester. This helps identify and differentiate the Requester VPC in the peering connection. | `string` | `""` | no |
68+
| <a name="input_vpc_peering_requester_vpc_id"></a> [vpc\_peering\_requester\_vpc\_id](#input\_vpc\_peering\_requester\_vpc\_id) | Specify the unique identifier of the VPC that will act as the Reqester in the VPC peering connection. | `string` | `""` | no |
69+
| <a name="input_vpc_peering_requester_vpc_region"></a> [vpc\_peering\_requester\_vpc\_region](#input\_vpc\_peering\_requester\_vpc\_region) | Specify the AWS region where the Requester VPC resides. It ensures the correct region is used for setting up the VPC peering. | `string` | `""` | no |
6670

6771
## Outputs
6872

modules/vpc_peering/main.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ resource "aws_vpc_peering_connection" "this" {
4848
peer_owner_id = var.vpc_peering_multi_account_enabled ? data.aws_caller_identity.accepter.id : null
4949
provider = aws.peer
5050
tags = {
51-
Name = format("%s-%s-%s", var.requester_name, "to", var.accepter_name)
51+
Name = format("%s-%s-%s", var.vpc_peering_requester_name, "to", var.vpc_peering_accepter_name)
5252
}
5353
}
5454

@@ -59,7 +59,7 @@ resource "aws_vpc_peering_connection_accepter" "this" {
5959
vpc_peering_connection_id = aws_vpc_peering_connection.this[0].id
6060
auto_accept = true
6161
tags = {
62-
Name = format("%s-%s-%s", var.requester_name, "to", var.accepter_name)
62+
Name = format("%s-%s-%s", var.vpc_peering_requester_name, "to", var.vpc_peering_accepter_name)
6363
}
6464
}
6565

@@ -90,4 +90,4 @@ resource "aws_route" "accepter" {
9090
destination_cidr_block = data.aws_vpc.requester.cidr_block
9191
vpc_peering_connection_id = var.vpc_peering_enabled ? aws_vpc_peering_connection.this[0].id : null
9292
provider = aws.accepter
93-
}
93+
}

0 commit comments

Comments
 (0)