Skip to content

Commit 306f029

Browse files
yuvraj-revnueyuvraj-revnue
committed
added changes for secondary CIDR support
1 parent 950dec5 commit 306f029

File tree

12 files changed

+326
-6
lines changed

12 files changed

+326
-6
lines changed

‎README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,7 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
218218
| <a name="input_database_subnet_cidrs"></a> [database\_subnet\_cidrs](#input\_database\_subnet\_cidrs) | Database Tier subnet CIDRs to be created | `list(any)` | `[]` | no |
219219
| <a name="input_database_subnet_enabled"></a> [database\_subnet\_enabled](#input\_database\_subnet\_enabled) | Set true to enable database subnets | `bool` | `false` | no |
220220
| <a name="input_default_network_acl_ingress"></a> [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` | <pre>[<br> {<br> "action": "deny",<br> "cidr_block": "0.0.0.0/0",<br> "from_port": 22,<br> "protocol": "tcp",<br> "rule_no": 98,<br> "to_port": 22<br> },<br> {<br> "action": "deny",<br> "cidr_block": "0.0.0.0/0",<br> "from_port": 3389,<br> "protocol": "tcp",<br> "rule_no": 99,<br> "to_port": 3389<br> },<br> {<br> "action": "allow",<br> "cidr_block": "0.0.0.0/0",<br> "from_port": 0,<br> "protocol": "-1",<br> "rule_no": 100,<br> "to_port": 0<br> },<br> {<br> "action": "allow",<br> "from_port": 0,<br> "ipv6_cidr_block": "::/0",<br> "protocol": "-1",<br> "rule_no": 101,<br> "to_port": 0<br> }<br>]</pre> | no |
221+
| <a name="input_enable_database_subnet_group"></a> [enable\_database\_subnet\_group](#input\_enable\_database\_subnet\_group) | Whether create database subnet groups | `bool` | `false` | no |
221222
| <a name="input_environment"></a> [environment](#input\_environment) | Specify the environment indentifier for the VPC | `string` | `""` | no |
222223
| <a name="input_flow_log_cloudwatch_log_group_kms_key_arn"></a> [flow\_log\_cloudwatch\_log\_group\_kms\_key\_arn](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_arn) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs | `string` | `null` | no |
223224
| <a name="input_flow_log_cloudwatch_log_group_retention_in_days"></a> [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | `null` | no |
@@ -227,6 +228,7 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
227228
| <a name="input_intra_subnet_cidrs"></a> [intra\_subnet\_cidrs](#input\_intra\_subnet\_cidrs) | A list of intra subnets CIDR to be created | `list(any)` | `[]` | no |
228229
| <a name="input_intra_subnet_enabled"></a> [intra\_subnet\_enabled](#input\_intra\_subnet\_enabled) | Set true to enable intra subnets | `bool` | `false` | no |
229230
| <a name="input_ipv6_enabled"></a> [ipv6\_enabled](#input\_ipv6\_enabled) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. | `bool` | `false` | no |
231+
| <a name="input_ipv6_only"></a> [ipv6\_only](#input\_ipv6\_only) | Enable it for deploying native IPv6 network | `bool` | `false` | no |
230232
| <a name="input_name"></a> [name](#input\_name) | Specify the name of the VPC | `string` | `""` | no |
231233
| <a name="input_one_nat_gateway_per_az"></a> [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Set to true if a NAT Gateway is required per availability zone for Private Subnet Tier | `bool` | `false` | no |
232234
| <a name="input_private_subnet_assign_ipv6_address_on_creation"></a> [private\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_private\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on private subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
@@ -235,6 +237,8 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
235237
| <a name="input_public_subnet_assign_ipv6_address_on_creation"></a> [public\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_public\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on public subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
236238
| <a name="input_public_subnet_cidrs"></a> [public\_subnet\_cidrs](#input\_public\_subnet\_cidrs) | A list of public subnets CIDR to be created inside the VPC | `list(any)` | `[]` | no |
237239
| <a name="input_public_subnet_enabled"></a> [public\_subnet\_enabled](#input\_public\_subnet\_enabled) | Set true to enable public subnets | `bool` | `false` | no |
240+
| <a name="input_secondary_cidr_blocks"></a> [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of the secondary CIDR blocks which can be at most 5 | `list(string)` | `[]` | no |
241+
| <a name="input_secondry_cidr_enabled"></a> [secondry\_cidr\_enabled](#input\_secondry\_cidr\_enabled) | Whether enable secondary CIDR with VPC | `bool` | `false` | no |
238242
| <a name="input_vpc_cidr"></a> [vpc\_cidr](#input\_vpc\_cidr) | The CIDR block of the VPC | `string` | `"10.0.0.0/16"` | no |
239243
| <a name="input_vpn_key_pair_name"></a> [vpn\_key\_pair\_name](#input\_vpn\_key\_pair\_name) | Specify the name of AWS Keypair to be used for VPN Server | `string` | `""` | no |
240244
| <a name="input_vpn_server_enabled"></a> [vpn\_server\_enabled](#input\_vpn\_server\_enabled) | Set to true if you want to deploy VPN Gateway resource and attach it to the VPC | `bool` | `false` | no |
@@ -252,6 +256,7 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
252256
| <a name="output_vpc_cidr_block"></a> [vpc\_cidr\_block](#output\_vpc\_cidr\_block) | IPV4 CIDR Block for this VPC |
253257
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | The ID of the VPC |
254258
| <a name="output_vpc_ipv6_association_id"></a> [vpc\_ipv6\_association\_id](#output\_vpc\_ipv6\_association\_id) | The association ID for the IPv6 CIDR block |
259+
| <a name="output_vpc_secondary_cidr_blocks"></a> [vpc\_secondary\_cidr\_blocks](#output\_vpc\_secondary\_cidr\_blocks) | List of secondary CIDR blocks of the VPC |
255260
| <a name="output_vpn_host_public_ip"></a> [vpn\_host\_public\_ip](#output\_vpn\_host\_public\_ip) | IP Address of VPN Server |
256261
| <a name="output_vpn_security_group"></a> [vpn\_security\_group](#output\_vpn\_security\_group) | Security Group ID of VPN Server |
257262
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/vpc-native-ipv6/README.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# VPC with IPv6 support
2+
3+
4+
VPC with dual stack IP mode enabled IPv6 and IPv4 includes public and private subnet will be created per availability zone in addition to single NAT Gateway shared between all availability zones.
5+
6+
## Usage
7+
8+
To run this example you need to execute:
9+
10+
```bash
11+
$ terraform init
12+
$ terraform plan
13+
$ terraform apply
14+
```
15+
16+
Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources.
17+
18+
19+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
20+
## Requirements
21+
22+
No requirements.
23+
24+
## Providers
25+
26+
No providers.
27+
28+
## Modules
29+
30+
| Name | Source | Version |
31+
|------|--------|---------|
32+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../.. | n/a |
33+
34+
## Resources
35+
36+
No resources.
37+
38+
## Inputs
39+
40+
No inputs.
41+
42+
## Outputs
43+
44+
| Name | Description |
45+
|------|-------------|
46+
| <a name="output_database_subnets"></a> [database\_subnets](#output\_database\_subnets) | List of IDs of database subnets |
47+
| <a name="output_intra_subnets"></a> [intra\_subnets](#output\_intra\_subnets) | List of IDs of Intra subnets |
48+
| <a name="output_ipv6_vpc_cidr_block"></a> [ipv6\_vpc\_cidr\_block](#output\_ipv6\_vpc\_cidr\_block) | The IPv6 CIDR block |
49+
| <a name="output_private_subnets"></a> [private\_subnets](#output\_private\_subnets) | List of IDs of private subnets |
50+
| <a name="output_public_subnets"></a> [public\_subnets](#output\_public\_subnets) | List of IDs of public subnets |
51+
| <a name="output_region"></a> [region](#output\_region) | AWS Region |
52+
| <a name="output_vpc_cidr_block"></a> [vpc\_cidr\_block](#output\_vpc\_cidr\_block) | The CIDR of the VPC |
53+
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | The ID of the VPC |
54+
| <a name="output_vpc_ipv6_association_id"></a> [vpc\_ipv6\_association\_id](#output\_vpc\_ipv6\_association\_id) | The association ID for the IPv6 CIDR block |
55+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/vpc-native-ipv6/main.tf

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
locals {
2+
name = "skaf"
3+
region = "ap-south-1"
4+
environment = "stage"
5+
additional_aws_tags = {
6+
Owner = "SquareOps"
7+
Expires = "Never"
8+
Department = "Engineering"
9+
}
10+
vpc_cidr = "10.10.0.0/16"
11+
ipv6_enabled = true
12+
ipv6_only = true
13+
}
14+
15+
module "vpc" {
16+
source = "../.."
17+
name = local.name
18+
vpc_cidr = local.vpc_cidr
19+
ipv6_only = local.ipv6_only
20+
environment = local.environment
21+
ipv6_enabled = local.ipv6_enabled
22+
availability_zones = ["ap-south-1a", "ap-south-1b"]
23+
public_subnet_enabled = true
24+
private_subnet_enabled = true
25+
intra_subnet_enabled = true
26+
database_subnet_enabled = true
27+
public_subnet_assign_ipv6_address_on_creation = true
28+
private_subnet_assign_ipv6_address_on_creation = true
29+
database_subnet_assign_ipv6_address_on_creation = true
30+
intra_subnet_assign_ipv6_address_on_creation = true
31+
}

‎examples/vpc-native-ipv6/outputs.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
output "region" {
2+
description = "AWS Region"
3+
value = local.region
4+
}
5+
6+
output "vpc_id" {
7+
description = "The ID of the VPC"
8+
value = module.vpc.vpc_id
9+
}
10+
11+
output "vpc_cidr_block" {
12+
description = "The CIDR of the VPC"
13+
value = module.vpc.vpc_cidr_block
14+
}
15+
16+
output "public_subnets" {
17+
description = "List of IDs of public subnets"
18+
value = module.vpc.public_subnets
19+
}
20+
21+
output "private_subnets" {
22+
description = "List of IDs of private subnets"
23+
value = module.vpc.private_subnets
24+
}
25+
26+
output "database_subnets" {
27+
description = "List of IDs of database subnets"
28+
value = module.vpc.database_subnets
29+
}
30+
31+
output "intra_subnets" {
32+
description = "List of IDs of Intra subnets"
33+
value = module.vpc.intra_subnets
34+
}
35+
36+
output "vpc_ipv6_association_id" {
37+
description = "The association ID for the IPv6 CIDR block"
38+
value = module.vpc.vpc_ipv6_association_id
39+
}
40+
41+
output "ipv6_vpc_cidr_block" {
42+
description = "The IPv6 CIDR block"
43+
value = module.vpc.ipv6_vpc_cidr_block
44+
}

‎examples/vpc-native-ipv6/providers.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
provider "aws" {
2+
region = local.region
3+
default_tags {
4+
tags = local.additional_aws_tags
5+
}
6+
}

‎examples/vpc-with-secondary-cidr/README.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# VPC with Private Subnets
2+
3+
4+
A public and private subnet will be created per availability zone in addition to single NAT Gateway shared between all availability zones.
5+
6+
## Usage
7+
8+
To run this example you need to execute:
9+
10+
```bash
11+
$ terraform init
12+
$ terraform plan
13+
$ terraform apply
14+
```
15+
16+
Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources.
17+
18+
19+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
20+
## Requirements
21+
22+
No requirements.
23+
24+
## Providers
25+
26+
No providers.
27+
28+
## Modules
29+
30+
| Name | Source | Version |
31+
|------|--------|---------|
32+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../.. | n/a |
33+
34+
## Resources
35+
36+
No resources.
37+
38+
## Inputs
39+
40+
No inputs.
41+
42+
## Outputs
43+
44+
| Name | Description |
45+
|------|-------------|
46+
| <a name="output_private_subnets"></a> [private\_subnets](#output\_private\_subnets) | List of IDs of private subnets |
47+
| <a name="output_public_subnets"></a> [public\_subnets](#output\_public\_subnets) | List of IDs of public subnets |
48+
| <a name="output_region"></a> [region](#output\_region) | AWS Region |
49+
| <a name="output_vpc_cidr_block"></a> [vpc\_cidr\_block](#output\_vpc\_cidr\_block) | AWS Region |
50+
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | The ID of the VPC |
51+
| <a name="output_vpc_secondary_cidr_blocks"></a> [vpc\_secondary\_cidr\_blocks](#output\_vpc\_secondary\_cidr\_blocks) | List of secondary CIDR blocks of the VPC |
52+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/vpc-with-secondary-cidr/main.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
locals {
2+
name = "skaf"
3+
region = "ap-south-1"
4+
environment = "stage"
5+
additional_aws_tags = {
6+
Owner = "SquareOps"
7+
Expires = "Never"
8+
Department = "Engineering"
9+
}
10+
vpc_cidr = "10.10.0.0/16"
11+
secondry_cidr_enabled = true
12+
secondary_cidr_blocks = ["10.20.0.0/16"]
13+
}
14+
15+
module "vpc" {
16+
source = "../.."
17+
name = local.name
18+
vpc_cidr = local.vpc_cidr
19+
environment = local.environment
20+
availability_zones = ["ap-south-1a", "ap-south-1b"]
21+
public_subnet_enabled = true
22+
private_subnet_enabled = true
23+
auto_assign_public_ip = true
24+
intra_subnet_enabled = true
25+
database_subnet_enabled = true
26+
secondry_cidr_enabled = local.secondry_cidr_enabled
27+
secondary_cidr_blocks = local.secondary_cidr_blocks
28+
}

‎examples/vpc-with-secondary-cidr/outputs.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
output "region" {
2+
description = "AWS Region"
3+
value = local.region
4+
}
5+
6+
output "vpc_id" {
7+
description = "The ID of the VPC"
8+
value = module.vpc.vpc_id
9+
}
10+
11+
output "vpc_cidr_block" {
12+
description = "AWS Region"
13+
value = module.vpc.vpc_cidr_block
14+
}
15+
16+
output "public_subnets" {
17+
description = "List of IDs of public subnets"
18+
value = module.vpc.public_subnets
19+
}
20+
21+
output "private_subnets" {
22+
description = "List of IDs of private subnets"
23+
value = module.vpc.private_subnets
24+
}
25+
26+
output "vpc_secondary_cidr_blocks" {
27+
description = "List of secondary CIDR blocks of the VPC"
28+
value = module.vpc.vpc_secondary_cidr_blocks
29+
}

‎examples/vpc-with-secondary-cidr/providers.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
provider "aws" {
2+
region = local.region
3+
default_tags {
4+
tags = local.additional_aws_tags
5+
}
6+
}

0 commit comments

Comments
 (0)