From 2d43919595ce2f998d1874dbee4a567cbf867da4 Mon Sep 17 00:00:00 2001 From: KF Date: Thu, 30 May 2024 18:27:52 +0800 Subject: [PATCH] UPD: Updated exercise3 --- .gitignore | 1 + NetworkContentDelivery/Exercise3/README.md | 11 +++-- NetworkContentDelivery/Exercise3/main.tf | 43 ++++++++++++++++++- NetworkContentDelivery/Exercise3/outputs.tf | 16 ++++++- .../Exercise3/terraform.tfvars | 3 +- NetworkContentDelivery/Exercise3/variables.tf | 5 --- 6 files changed, 65 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index 32e3639..1f9ab44 100644 --- a/.gitignore +++ b/.gitignore @@ -32,6 +32,7 @@ bin/ .terraform *.tfstate *.tfstate.backup +*.tfstate.*.* .idea .terraform.lock.hcl terraform-training.iml diff --git a/NetworkContentDelivery/Exercise3/README.md b/NetworkContentDelivery/Exercise3/README.md index b9043bc..6a29baa 100644 --- a/NetworkContentDelivery/Exercise3/README.md +++ b/NetworkContentDelivery/Exercise3/README.md @@ -11,11 +11,13 @@ | Name | Version | |------|---------| | aws | 5.51.1 | +| null | 3.2.2 | ## Modules | Name | Source | Version | |------|--------|---------| +| CloudflareSg | ../../Modules/Compute/security_group | n/a | | Vpc | terraform-aws-modules/vpc/aws | 5.8.1 | | VpcEndpoints | terraform-aws-modules/vpc/aws//modules/vpc-endpoints | 5.8.1 | @@ -23,6 +25,8 @@ | Name | Type | |------|------| +| [aws_ec2_managed_prefix_list.pl1](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_managed_prefix_list) | resource | +| [null_resource.CloudflareIps](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source | | [aws_iam_policy_document.dynamodb_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.s3_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | @@ -31,7 +35,6 @@ | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| PrivateSubnets | List of private subnets | `list(string)` | n/a | yes | | VpcCidr | VPC CIDR | `string` | n/a | yes | | VpcName | Name of VPC | `string` | n/a | yes | @@ -39,8 +42,10 @@ | Name | Description | |------|-------------| -| VpcCidr | n/a | -| VpcId | n/a | +| CloudflareSg | Cloudflare security group id | +| PrivateSubnetCidrs | Private subnet CIDRs | +| VpcCidr | Vpc CIDR | +| VpcId | Vpc ID | | last-updated | n/a | --- diff --git a/NetworkContentDelivery/Exercise3/main.tf b/NetworkContentDelivery/Exercise3/main.tf index 8c5a430..c6ecaa8 100644 --- a/NetworkContentDelivery/Exercise3/main.tf +++ b/NetworkContentDelivery/Exercise3/main.tf @@ -1,5 +1,9 @@ data "aws_availability_zones" "available" {} +locals { + PrivataSubnets = cidrsubnets(var.VpcCidr, 8, 8) +} + module "Vpc" { source = "terraform-aws-modules/vpc/aws" version = "5.8.1" @@ -8,8 +12,8 @@ module "Vpc" { cidr = var.VpcCidr azs = slice(data.aws_availability_zones.available.names, 0, 2) - private_subnets = var.PrivateSubnets - private_subnet_names = ["${var.VpcName}Private1", "${var.VpcName}Private2"] + private_subnets = local.PrivataSubnets + private_subnet_names = [for k, v in local.PrivataSubnets : "${var.VpcName}Private${k}"] enable_dns_hostnames = true enable_dns_support = true enable_nat_gateway = false @@ -83,4 +87,39 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" { values = [module.Vpc.vpc_id] } } +} + +resource "null_resource" "CloudflareIps" { + provisioner "local-exec" { + command = "wget -qO CfIps.json https://api.cloudflare.com/client/v4/ips" + } +} + +locals { + CfIpJson = jsondecode(file("${path.module}/CfIps.json")) +} + +resource "aws_ec2_managed_prefix_list" "pl1" { + name = "CloudflareIpRanges" + address_family = "IPv4" + max_entries = 20 + dynamic "entry" { + for_each = local.CfIpJson.result.ipv4_cidrs + content { + cidr = entry.value + description = "Cloudflare IP" + } + } +} + +module "CloudflareSg" { + source = "../../Modules/Compute/security_group" + description = "Cloudflare Ip Ranges" + egress = { + } + ingress = { + r1 = "tcp,443,443,${aws_ec2_managed_prefix_list.pl1.id},Cloudflare Prefix List" + } + name = "cloudflare-ips" + vpc-id = module.Vpc.vpc_id } \ No newline at end of file diff --git a/NetworkContentDelivery/Exercise3/outputs.tf b/NetworkContentDelivery/Exercise3/outputs.tf index e61effc..be0091e 100644 --- a/NetworkContentDelivery/Exercise3/outputs.tf +++ b/NetworkContentDelivery/Exercise3/outputs.tf @@ -1,7 +1,19 @@ output "VpcId" { - value = module.Vpc.vpc_id + value = module.Vpc.vpc_id + description = "Vpc ID" } output "VpcCidr" { - value = module.Vpc.vpc_cidr_block + value = module.Vpc.vpc_cidr_block + description = "Vpc CIDR" +} + +output "PrivateSubnetCidrs" { + value = module.Vpc.private_subnets_cidr_blocks + description = "Private subnet CIDRs" +} + +output "CloudflareSg" { + value = module.CloudflareSg.id + description = "Cloudflare security group id" } \ No newline at end of file diff --git a/NetworkContentDelivery/Exercise3/terraform.tfvars b/NetworkContentDelivery/Exercise3/terraform.tfvars index 52542bb..6cdffea 100644 --- a/NetworkContentDelivery/Exercise3/terraform.tfvars +++ b/NetworkContentDelivery/Exercise3/terraform.tfvars @@ -1,3 +1,2 @@ VpcName = "TrainingVpc" -VpcCidr = "192.168.0.0/16" -PrivateSubnets = ["192.168.100.0/24", "192.168.101.0/24"] \ No newline at end of file +VpcCidr = "192.168.0.0/16" \ No newline at end of file diff --git a/NetworkContentDelivery/Exercise3/variables.tf b/NetworkContentDelivery/Exercise3/variables.tf index 8745fed..a0afeb5 100644 --- a/NetworkContentDelivery/Exercise3/variables.tf +++ b/NetworkContentDelivery/Exercise3/variables.tf @@ -6,9 +6,4 @@ variable "VpcName" { variable "VpcCidr" { type = string description = "VPC CIDR" -} - -variable "PrivateSubnets" { - type = list(string) - description = "List of private subnets" } \ No newline at end of file