Skip to content

Commit c0f4620

Browse files
RohitSquareopsRohitSquareops
authored
support for mapping the "public in" on launch (#7)
enable auto_assign_public_ip to true for public subnet
1 parent b1bcd33 commit c0f4620

File tree

8 files changed

+86
-48
lines changed

8 files changed

+86
-48
lines changed

‎IAM.md

Lines changed: 73 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -13,51 +13,53 @@ The Policy required to deploy this module is:
1313
"Action": [
1414
"ec2:AllocateAddress",
1515
"ec2:AssociateAddress",
16+
"ec2:AssociateDhcpOptions",
1617
"ec2:AssociateRouteTable",
18+
"ec2:AssociateVpcCidrBlock",
1719
"ec2:AttachInternetGateway",
18-
"ec2:AttachVolume",
1920
"ec2:AttachVpnGateway",
2021
"ec2:AuthorizeSecurityGroupEgress",
2122
"ec2:AuthorizeSecurityGroupIngress",
23+
"ec2:CancelSpotInstanceRequests",
24+
"ec2:CreateCustomerGateway",
25+
"ec2:CreateDefaultVpc",
26+
"ec2:CreateDhcpOptions",
27+
"ec2:CreateEgressOnlyInternetGateway",
2228
"ec2:CreateFlowLogs",
2329
"ec2:CreateInternetGateway",
2430
"ec2:CreateKeyPair",
2531
"ec2:CreateNatGateway",
2632
"ec2:CreateNetworkAcl",
2733
"ec2:CreateNetworkAclEntry",
28-
"ec2:CreateNetworkInterface",
29-
"ec2:CreatePlacementGroup",
3034
"ec2:CreateRoute",
3135
"ec2:CreateRouteTable",
3236
"ec2:CreateSecurityGroup",
3337
"ec2:CreateSubnet",
3438
"ec2:CreateTags",
3539
"ec2:CreateVPC",
36-
"ec2:CreateVolume",
37-
"ec2:CreateVpcEndpoint",
3840
"ec2:CreateVpnGateway",
41+
"ec2:DeleteCustomerGateway",
42+
"ec2:DeleteDhcpOptions",
43+
"ec2:DeleteEgressOnlyInternetGateway",
3944
"ec2:DeleteFlowLogs",
4045
"ec2:DeleteInternetGateway",
4146
"ec2:DeleteKeyPair",
4247
"ec2:DeleteNatGateway",
4348
"ec2:DeleteNetworkAcl",
4449
"ec2:DeleteNetworkAclEntry",
45-
"ec2:DeleteNetworkInterface",
46-
"ec2:DeletePlacementGroup",
4750
"ec2:DeleteRoute",
4851
"ec2:DeleteRouteTable",
4952
"ec2:DeleteSecurityGroup",
5053
"ec2:DeleteSubnet",
5154
"ec2:DeleteTags",
5255
"ec2:DeleteVPC",
53-
"ec2:DeleteVolume",
54-
"ec2:DeleteVpcEndpoints",
5556
"ec2:DeleteVpnGateway",
5657
"ec2:DescribeAccountAttributes",
5758
"ec2:DescribeAddresses",
58-
"ec2:DescribeAvailabilityZones",
59+
"ec2:DescribeCustomerGateways",
60+
"ec2:DescribeDhcpOptions",
61+
"ec2:DescribeEgressOnlyInternetGateways",
5962
"ec2:DescribeFlowLogs",
60-
"ec2:DescribeImages",
6163
"ec2:DescribeInstanceAttribute",
6264
"ec2:DescribeInstanceCreditSpecifications",
6365
"ec2:DescribeInstanceTypes",
@@ -67,28 +69,27 @@ The Policy required to deploy this module is:
6769
"ec2:DescribeNatGateways",
6870
"ec2:DescribeNetworkAcls",
6971
"ec2:DescribeNetworkInterfaces",
70-
"ec2:DescribePlacementGroups",
71-
"ec2:DescribePrefixLists",
7272
"ec2:DescribeRouteTables",
7373
"ec2:DescribeSecurityGroups",
74+
"ec2:DescribeSpotInstanceRequests",
7475
"ec2:DescribeSubnets",
7576
"ec2:DescribeTags",
7677
"ec2:DescribeVolumes",
7778
"ec2:DescribeVpcAttribute",
78-
"ec2:DescribeVpcEndpoints",
7979
"ec2:DescribeVpcs",
8080
"ec2:DescribeVpnGateways",
8181
"ec2:DetachInternetGateway",
82-
"ec2:DetachVolume",
8382
"ec2:DetachVpnGateway",
83+
"ec2:DisableVgwRoutePropagation",
8484
"ec2:DisassociateAddress",
8585
"ec2:DisassociateRouteTable",
86+
"ec2:DisassociateVpcCidrBlock",
87+
"ec2:EnableVgwRoutePropagation",
8688
"ec2:ImportKeyPair",
8789
"ec2:ModifyInstanceAttribute",
88-
"ec2:ModifyVolume",
89-
"ec2:ModifyVpcEndpoint",
9090
"ec2:MonitorInstances",
9191
"ec2:ReleaseAddress",
92+
"ec2:RequestSpotInstances",
9293
"ec2:RevokeSecurityGroupEgress",
9394
"ec2:RevokeSecurityGroupIngress",
9495
"ec2:RunInstances",
@@ -97,56 +98,66 @@ The Policy required to deploy this module is:
9798
"ec2:TerminateInstances",
9899
"ec2:UnmonitorInstances"
99100
],
100-
"Resource": "*"
101+
"Resource": [
102+
"*"
103+
]
101104
},
102105
{
103106
"Sid": "VisualEditor1",
104107
"Effect": "Allow",
105108
"Action": [
106-
"iam:AddRoleToInstanceProfile",
109+
"elasticache:AddTagsToResource",
110+
"elasticache:CreateCacheSubnetGroup",
111+
"elasticache:DeleteCacheSubnetGroup",
112+
"elasticache:DescribeCacheSubnetGroups",
113+
"elasticache:ListTagsForResource",
114+
"elasticache:ModifyCacheSubnetGroup",
115+
"elasticache:RemoveTagsFromResource"
116+
],
117+
"Resource": [
118+
"*"
119+
]
120+
},
121+
{
122+
"Sid": "VisualEditor2",
123+
"Effect": "Allow",
124+
"Action": [
107125
"iam:AttachRolePolicy",
108-
"iam:CreateInstanceProfile",
109126
"iam:CreatePolicy",
110127
"iam:CreateRole",
111-
"iam:DeleteInstanceProfile",
112128
"iam:DeletePolicy",
113129
"iam:DeleteRole",
114130
"iam:DeleteRolePermissionsBoundary",
115131
"iam:DetachRolePolicy",
116-
"iam:GetInstanceProfile",
117132
"iam:GetPolicy",
118133
"iam:GetPolicyVersion",
119134
"iam:GetRole",
120135
"iam:ListAttachedRolePolicies",
121136
"iam:ListInstanceProfilesForRole",
122-
"iam:ListPolicies",
123137
"iam:ListPolicyVersions",
124138
"iam:ListRolePolicies",
125139
"iam:PassRole",
126140
"iam:PutRolePermissionsBoundary",
127-
"iam:RemoveRoleFromInstanceProfile",
128141
"iam:TagPolicy",
129142
"iam:TagRole",
130143
"iam:UntagPolicy"
131144
],
132-
"Resource": "*"
145+
"Resource": [
146+
"*"
147+
]
133148
},
134149
{
135-
"Sid": "VisualEditor2",
150+
"Sid": "VisualEditor3",
136151
"Effect": "Allow",
137152
"Action": [
138-
"kms:CreateKey",
139-
"kms:Decrypt",
140-
"kms:DescribeKey",
141-
"kms:GetKeyPolicy",
142-
"kms:GetKeyRotationStatus",
143-
"kms:ListResourceTags",
144-
"kms:ScheduleKeyDeletion"
153+
"kms:Decrypt"
145154
],
146-
"Resource": "*"
155+
"Resource": [
156+
"*"
157+
]
147158
},
148159
{
149-
"Sid": "VisualEditor3",
160+
"Sid": "VisualEditor4",
150161
"Effect": "Allow",
151162
"Action": [
152163
"logs:AssociateKmsKey",
@@ -160,10 +171,12 @@ The Policy required to deploy this module is:
160171
"logs:TagLogGroup",
161172
"logs:UntagLogGroup"
162173
],
163-
"Resource": "*"
174+
"Resource": [
175+
"*"
176+
]
164177
},
165178
{
166-
"Sid": "VisualEditor4",
179+
"Sid": "VisualEditor5",
167180
"Effect": "Allow",
168181
"Action": [
169182
"rds:AddTagsToResource",
@@ -173,27 +186,40 @@ The Policy required to deploy this module is:
173186
"rds:ListTagsForResource",
174187
"rds:RemoveTagsFromResource"
175188
],
176-
"Resource": "*"
189+
"Resource": [
190+
"*"
191+
]
177192
},
178193
{
179-
"Sid": "VisualEditor5",
194+
"Sid": "VisualEditor6",
195+
"Effect": "Allow",
196+
"Action": [
197+
"redshift:CreateClusterSubnetGroup",
198+
"redshift:CreateTags",
199+
"redshift:DeleteClusterSubnetGroup",
200+
"redshift:DeleteTags",
201+
"redshift:DescribeClusterSubnetGroups",
202+
"redshift:ModifyClusterSubnetGroup"
203+
],
204+
"Resource": [
205+
"*"
206+
]
207+
},
208+
{
209+
"Sid": "VisualEditor7",
180210
"Effect": "Allow",
181211
"Action": [
182212
"ssm:AddTagsToResource",
183-
"ssm:CreateDocument",
184-
"ssm:DeleteDocument",
185213
"ssm:DeleteParameter",
186-
"ssm:DescribeDocument",
187-
"ssm:DescribeDocumentPermission",
188214
"ssm:DescribeParameters",
189-
"ssm:GetDocument",
190215
"ssm:GetParameter",
191216
"ssm:GetParameters",
192217
"ssm:ListTagsForResource",
193-
"ssm:PutParameter",
194-
"ssm:UpdateDocument"
218+
"ssm:PutParameter"
195219
],
196-
"Resource": "*"
220+
"Resource": [
221+
"*"
222+
]
197223
}
198224
]
199225
}

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ module "vpc" {
3131
availability_zones = 2
3232
vpn_server_enabled = false
3333
intra_subnet_enabled = true
34+
auto_assign_public_ip = true
3435
public_subnet_enabled = true
3536
private_subnet_enabled = true
3637
one_nat_gateway_per_az = true
@@ -149,6 +150,7 @@ In this module, we have implemented the following CIS Compliance checks for VPC:
149150

150151
| Name | Description | Type | Default | Required |
151152
|------|-------------|------|---------|:--------:|
153+
| <a name="input_auto_assign_public_ip"></a> [auto\_assign\_public\_ip](#input\_auto\_assign\_public\_ip) | Specify true to indicate that instances launched into the subnet should be assigned a public IP address. | `bool` | `false` | no |
152154
| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | Number of Availability Zone to be used by VPC Subnets | `number` | `2` | no |
153155
| <a name="input_database_subnet_cidrs"></a> [database\_subnet\_cidrs](#input\_database\_subnet\_cidrs) | Database Tier subnet CIDRs to be created | `list(any)` | `[]` | no |
154156
| <a name="input_database_subnet_enabled"></a> [database\_subnet\_enabled](#input\_database\_subnet\_enabled) | Set true to enable database subnets | `bool` | `false` | no |

‎examples/complete-vpc-with-vpn/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ No providers.
3232
| Name | Source | Version |
3333
|------|--------|---------|
3434
| <a name="module_key_pair_vpn"></a> [key\_pair\_vpn](#module\_key\_pair\_vpn) | squareops/keypair/aws | n/a |
35-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | squareops/vpc/aws | n/a |
35+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ../../ | n/a |
3636

3737
## Resources
3838

‎examples/complete-vpc-with-vpn/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ module "vpc" {
2828
vpn_server_enabled = false
2929
intra_subnet_enabled = true
3030
public_subnet_enabled = true
31+
auto_assign_public_ip = true
3132
private_subnet_enabled = true
3233
one_nat_gateway_per_az = true
3334
database_subnet_enabled = true

‎examples/simple-vpc/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,5 @@ module "vpc" {
1717
environment = local.environment
1818
availability_zones = 2
1919
public_subnet_enabled = true
20+
auto_assign_public_ip = true
2021
}

‎examples/vpc-with-private-subnet/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,6 @@ module "vpc" {
1818
availability_zones = 2
1919
public_subnet_enabled = true
2020
private_subnet_enabled = true
21+
auto_assign_public_ip = true
2122

2223
}

‎main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ module "vpc" {
4040
enable_dns_hostnames = true
4141
flow_log_traffic_type = "ALL"
4242
one_nat_gateway_per_az = var.one_nat_gateway_per_az
43+
map_public_ip_on_launch = var.auto_assign_public_ip
4344
flow_log_destination_type = "cloud-watch-logs"
4445
manage_default_network_acl = true
4546
default_network_acl_ingress = concat(local.nacl_allow_vpc_access_rule, var.default_network_acl_ingress)

‎variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,3 +152,9 @@ variable "flow_log_max_aggregation_interval" {
152152
type = number
153153
default = 60
154154
}
155+
156+
variable "auto_assign_public_ip" {
157+
description = "Specify true to indicate that instances launched into the subnet should be assigned a public IP address."
158+
type = bool
159+
default = false
160+
}

0 commit comments

Comments
 (0)