Skip to content

Commit d41708f

Browse files
rachit89rachit89
authored
Update main.tf
1 parent 3f51851 commit d41708f

File tree

1 file changed

+68
-39
lines changed
  • examples/complete-vpc-with-vpn

1 file changed

+68
-39
lines changed

‎examples/complete-vpc-with-vpn/main.tf

Lines changed: 68 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,64 @@
11
locals {
2-
name = "vpc"
3-
region = "ap-south-1"
4-
environment = "prod"
2+
vpc_name = "vpc-test"
3+
aws_region = "ap-northeast-1"
4+
aws_account_id = "767398031518"
5+
environment = "prod"
6+
kms_user = null
7+
vpc_cidr = "10.10.0.0/16"
8+
vpc_availability_zones = ["ap-northeast-1a", "ap-northeast-1b"]
9+
kms_deletion_window_in_days = 7
10+
enable_key_rotation = false
11+
is_enabled = true
12+
vpc_flow_log_enabled = true
13+
vpn_server_enabled = false
14+
vpc_intra_subnet_enabled = true
15+
vpc_public_subnet_enabled = true
16+
auto_assign_public_ip = true
17+
vpc_private_subnet_enabled = true
18+
vpc_one_nat_gateway_per_az = true
19+
vpc_database_subnet_enabled = true
20+
vpc_s3_endpoint_enabled = true
21+
vpc_ecr_endpoint_enabled = true
22+
vpn_server_instance_type = "t3a.small"
23+
vpc_flow_log_cloudwatch_log_group_skip_destroy = false
24+
current_identity = data.aws_caller_identity.current.arn
25+
multi_region = false
26+
vpc_public_subnets_counts = 2
27+
vpc_private_subnets_counts = 2
28+
vpc_database_subnets_counts = 2
29+
vpc_intra_subnets_counts = 2
530
additional_aws_tags = {
631
Owner = "Organization_Name"
732
Expires = "Never"
833
Department = "Engineering"
934
}
10-
kms_user = null
11-
vpc_cidr = "10.10.0.0/16"
12-
current_identity = data.aws_caller_identity.current.arn
1335
}
1436

1537
data "aws_caller_identity" "current" {}
1638

1739
module "key_pair_vpn" {
1840
source = "squareops/keypair/aws"
19-
key_name = format("%s-%s-vpn", local.environment, local.name)
41+
key_name = format("%s-%s-vpn", local.environment, local.vpc_name)
2042
environment = local.environment
21-
ssm_parameter_path = format("%s-%s-vpn", local.environment, local.name)
43+
ssm_parameter_path = format("%s-%s-vpn", local.environment, local.vpc_name)
2244
}
2345

2446
module "kms" {
2547
source = "terraform-aws-modules/kms/aws"
2648

27-
deletion_window_in_days = 7
49+
deletion_window_in_days = local.kms_deletion_window_in_days
2850
description = "Symetric Key to Enable Encryption at rest using KMS services."
29-
enable_key_rotation = false
30-
is_enabled = true
51+
enable_key_rotation = local.enable_key_rotation
52+
is_enabled = local.is_enabled
3153
key_usage = "ENCRYPT_DECRYPT"
32-
multi_region = false
54+
multi_region = local.multi_region
3355

3456
# Policy
3557
enable_default_policy = true
3658
key_owners = [local.current_identity]
37-
key_administrators = local.kms_user == null ? ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
38-
key_users = local.kms_user == null ? ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
39-
key_service_users = local.kms_user == null ? ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
59+
key_administrators = local.kms_user == null ? ["arn:aws:iam::${local.aws_account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${local.aws_account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
60+
key_users = local.kms_user == null ? ["arn:aws:iam::${local.aws_account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${local.aws_account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
61+
key_service_users = local.kms_user == null ? ["arn:aws:iam::${local.aws_account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling", "arn:aws:iam::${local.aws_account_id}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS", local.current_identity] : local.kms_user
4062
key_symmetric_encryption_users = [local.current_identity]
4163
key_hmac_users = [local.current_identity]
4264
key_asymmetric_public_encryption_users = [local.current_identity]
@@ -57,38 +79,45 @@ module "kms" {
5779
principals = [
5880
{
5981
type = "Service"
60-
identifiers = ["logs.${local.region}.amazonaws.com"]
82+
identifiers = ["logs.${local.aws_region}.amazonaws.com"]
6183
}
6284
]
6385
}
6486
]
6587
# Aliases
66-
aliases = ["${local.name}-KMS"]
88+
aliases = ["${local.vpc_name}-KMS"]
6789
aliases_use_name_prefix = true
6890
}
6991

7092

7193
module "vpc" {
72-
source = "squareops/vpc/aws"
73-
name = local.name
74-
region = local.region
75-
vpc_cidr = local.vpc_cidr
76-
environment = local.environment
77-
flow_log_enabled = true
78-
vpn_key_pair_name = module.key_pair_vpn.key_pair_name
79-
availability_zones = ["ap-south-1a", "ap-south-1b"]
80-
vpn_server_enabled = true
81-
intra_subnet_enabled = true
82-
public_subnet_enabled = true
83-
auto_assign_public_ip = true
84-
private_subnet_enabled = true
85-
one_nat_gateway_per_az = true
86-
database_subnet_enabled = true
87-
vpn_server_instance_type = "t3a.small"
88-
vpc_s3_endpoint_enabled = true
89-
vpc_ecr_endpoint_enabled = true
90-
flow_log_max_aggregation_interval = 60 # In seconds
91-
flow_log_cloudwatch_log_group_skip_destroy = true
92-
flow_log_cloudwatch_log_group_retention_in_days = 90
93-
flow_log_cloudwatch_log_group_kms_key_arn = module.kms.key_arn #Enter your kms key arn
94+
source = "../../"
95+
name = local.vpc_name
96+
aws_region = local.aws_region
97+
vpc_cidr = local.vpc_cidr
98+
environment = local.environment
99+
vpc_flow_log_enabled = local.vpc_flow_log_enabled
100+
vpn_server_key_pair_name = module.key_pair_vpn.key_pair_name
101+
vpc_availability_zones = local.vpc_availability_zones
102+
vpn_server_enabled = local.vpn_server_enabled
103+
vpc_intra_subnet_enabled = local.vpc_intra_subnet_enabled
104+
vpc_public_subnet_enabled = local.vpc_public_subnet_enabled
105+
auto_assign_public_ip = local.auto_assign_public_ip
106+
vpc_private_subnet_enabled = local.vpc_private_subnet_enabled
107+
vpc_one_nat_gateway_per_az = local.vpc_one_nat_gateway_per_az
108+
vpc_database_subnet_enabled = local.vpc_database_subnet_enabled
109+
vpn_server_instance_type = local.vpn_server_instance_type
110+
vpc_s3_endpoint_enabled = local.vpc_s3_endpoint_enabled
111+
vpc_ecr_endpoint_enabled = local.vpc_ecr_endpoint_enabled
112+
vpc_flow_log_max_aggregation_interval = 60 # In seconds
113+
vpc_flow_log_cloudwatch_log_group_skip_destroy = local.vpc_flow_log_cloudwatch_log_group_skip_destroy
114+
vpc_flow_log_cloudwatch_log_group_retention_in_days = 90
115+
vpc_flow_log_cloudwatch_log_group_kms_key_arn = module.kms.key_arn #Enter your kms key arn
116+
vpc_public_subnets_counts = local.vpc_public_subnets_counts
117+
vpc_private_subnets_counts = local.vpc_private_subnets_counts
118+
vpc_database_subnets_counts = local.vpc_database_subnets_counts
119+
vpc_intra_subnets_counts = local.vpc_intra_subnets_counts
120+
vpc_endpoint_type_private_s3 = "Gateway"
121+
vpc_endpoint_type_ecr_dkr = "Interface"
122+
vpc_endpoint_type_ecr_api = "Interface"
94123
}

0 commit comments

Comments
 (0)