xpk/terraform.aws-baseline-infra
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

FIX: corrected vpcep SG, removing default gateway endpoints, updated readme

Browse Source
This commit is contained in:
xpk 2023-07-12 23:30:57 +08:00
parent fdd28c892a
commit cf2667baf8
Signed by: xpk
GPG Key ID: CD4FF6793F09AB86
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
modules/networking/vpc-endpoints/README.md
View File

@ -16,8 +16,7 @@ Automatically, this module performs the following additional tasks
# Types of endpoints # Types of endpoints
## Gateway endpoints ## Gateway endpoints
At time of writing, AWS provides 2 gateway endpoints at no charge. These endpoints are deployed by default, At time of writing, AWS provides 2 gateway endpoints at no charge.
unless an empty list `[]` is provided as input.
* s3 * s3
* dynamodb * dynamodb

5
modules/networking/vpc-endpoints/main.tf
View File

@ -55,14 +55,15 @@ resource "aws_security_group" "vpc-ep-sg" {
from_port = 443 from_port = 443
to_port = 443 to_port = 443
protocol = "tcp" protocol = "tcp"
cidr_blocks = [data.aws_vpc.this-vpc.cidr_block] # cidr_blocks = [data.aws_vpc.this-vpc.cidr_block]
cidr_blocks = data.aws_vpc.this-vpc.cidr_block_associations.*.cidr_block
} }
egress { egress {
from_port = 0 from_port = 0
to_port = 0 to_port = 0
protocol = "-1" protocol = "-1"
cidr_blocks = compact(concat(["0.0.0.0/0"], var.secondary_cidrs)) cidr_blocks = ["0.0.0.0/0"]
} }
tags = { "Name" : "VpcEpAccess" } tags = { "Name" : "VpcEpAccess" }

4
modules/networking/vpc-endpoints/variables.tf
View File

@ -5,8 +5,8 @@ variable interface-ep-services {
} }
variable gateway-ep-services { variable gateway-ep-services {
type = list(string) type = list(string)
default = ["s3","dynamodb"] default = []
description = "Gateway endpoints are free, so deploy for all supported services by default." description = "s3 and dynamodb gateway endpoints are free."
} }
variable resource-prefix {} variable resource-prefix {}
variable secondary_cidrs { variable secondary_cidrs {