192 lines
6.0 KiB
HCL
192 lines
6.0 KiB
HCL
data "aws_availability_zones" "available-az" {
|
|
state = "available"
|
|
}
|
|
|
|
locals {
|
|
// subnet_start = cidrsubnets(var.vpc-cidr, 1, 1) # divide vpc into 2
|
|
# no-az = length(data.aws_availability_zones.available-az.id)
|
|
no-az = 2 # hard-coding to 2AZ
|
|
vpc-cidr = var.vpc-cidr
|
|
total-no-subnets = local.no-az * (var.number-of-private-subnets-per-az + var.number-of-public-subnets-per-az)
|
|
|
|
# simple-divide = local.total-no-subnets >=8 ? cidrsubnets(local.vpc-cidr, 4,4,4,4,4,4,4,4) : local.total-no-subnets >=6 ? cidrsubnets(local.vpc-cidr, 3,3,3,3,3,3) : local.total-no-subnets >=4 ? cidrsubnets(local.vpc-cidr, 2,2,2,2) : local.total-no-subnets >=2 ? cidrsubnets(local.vpc-cidr, 1,1) : null
|
|
simple-divide = local.total-no-subnets >= 12 ? cidrsubnets(local.vpc-cidr, 4,4,4,4, 4,4,4,4, 4,4,4,4) : local.total-no-subnets >= 8 ? cidrsubnets(local.vpc-cidr, 3,3,3,3, 3,3,3,3) : local.total-no-subnets >= 6 ? cidrsubnets(local.vpc-cidr, 3,3,3, 3,3,3) : local.total-no-subnets >= 4 ? cidrsubnets(local.vpc-cidr, 2,2,2,2) : local.total-no-subnets >= 2 ? cidrsubnets(local.vpc-cidr, 1, 1) : null
|
|
public-subnets = slice(local.simple-divide, 0, var.number-of-public-subnets-per-az * local.no-az)
|
|
private-subnets = slice(local.simple-divide, var.number-of-public-subnets-per-az * local.no-az , local.total-no-subnets)
|
|
}
|
|
|
|
resource aws_subnet private-subnets {
|
|
count = length(local.private-subnets)
|
|
# count = length(var.private-subnet-cidrs)
|
|
# count = var.number-of-private-subnets-per-az * length(data.aws_availability_zones.available-az.names)
|
|
vpc_id = aws_vpc.vpc.id
|
|
availability_zone = element(data.aws_availability_zones.available-az.names, count.index)
|
|
# cidr_block = cidrsubnet(local.subnet_start[0], 2, count.index)
|
|
# cidr_block = var.private-subnet-cidrs[count.index]
|
|
cidr_block = local.private-subnets[count.index]
|
|
tags = merge(
|
|
var.default-tags,
|
|
{
|
|
Name = "${local.resource-prefix}-private-${split("-",element(data.aws_availability_zones.available-az.names, count.index))[2]}-${count.index+1}"
|
|
},
|
|
)
|
|
}
|
|
|
|
resource aws_subnet public-subnets {
|
|
count = length(local.public-subnets)
|
|
# count = length(var.public-subnet-cidrs)
|
|
# count = var.number-of-public-subnets-per-az * length(data.aws_availability_zones.available-az.names)
|
|
vpc_id = aws_vpc.vpc.id
|
|
availability_zone = element(data.aws_availability_zones.available-az.names, count.index)
|
|
# cidr_block = cidrsubnet(local.subnet_start[1], 2, count.index)
|
|
# cidr_block = var.public-subnet-cidrs[count.index]
|
|
cidr_block = local.public-subnets[count.index]
|
|
tags = merge(
|
|
var.default-tags,
|
|
{
|
|
Name = "${local.resource-prefix}-public-${split("-",element(data.aws_availability_zones.available-az.names, count.index))[2]}-${count.index+1}"
|
|
},
|
|
)
|
|
}
|
|
|
|
resource "aws_vpc" "vpc" {
|
|
cidr_block = var.vpc-cidr
|
|
enable_dns_hostnames = true
|
|
enable_dns_support = true
|
|
|
|
tags = merge(
|
|
var.default-tags,
|
|
{
|
|
Name = "${local.resource-prefix}-vpc"
|
|
},
|
|
)
|
|
|
|
lifecycle {
|
|
create_before_destroy = true
|
|
}
|
|
}
|
|
|
|
resource "aws_internet_gateway" "igw" {
|
|
count = var.number-of-public-subnets-per-az > 0 ? 1 : 0
|
|
vpc_id = aws_vpc.vpc.id
|
|
|
|
tags = merge(
|
|
var.default-tags,
|
|
{
|
|
Name = "${local.resource-prefix}-igw"
|
|
},
|
|
)
|
|
}
|
|
|
|
resource "aws_eip" "ngw-eip" {
|
|
count = var.create-nat-gateway ? 1 : 0
|
|
vpc = true
|
|
tags = var.default-tags
|
|
depends_on = [aws_internet_gateway.igw]
|
|
}
|
|
|
|
resource "aws_nat_gateway" "ngw" {
|
|
count = var.create-nat-gateway ? 1 : 0
|
|
allocation_id = aws_eip.ngw-eip[0].id
|
|
subnet_id = aws_subnet.public-subnets[0].id
|
|
|
|
tags = merge(
|
|
var.default-tags,
|
|
{
|
|
Name = "${local.resource-prefix}-ngw"
|
|
},
|
|
)
|
|
|
|
depends_on = [aws_internet_gateway.igw]
|
|
}
|
|
|
|
resource aws_route_table public-route-table {
|
|
count = var.number-of-public-subnets-per-az > 0 ? 1 : 0
|
|
vpc_id = aws_vpc.vpc.id
|
|
tags = merge(
|
|
var.default-tags,
|
|
{
|
|
Name = "${local.resource-prefix}-publicroutetable"
|
|
},
|
|
)
|
|
}
|
|
|
|
resource aws_route_table private-route-table {
|
|
count = var.number-of-private-subnets-per-az > 0 ? 1 : 0
|
|
vpc_id = aws_vpc.vpc.id
|
|
tags = merge(
|
|
var.default-tags,
|
|
{
|
|
Name = "${local.resource-prefix}-privateroutetable"
|
|
},
|
|
)
|
|
}
|
|
|
|
resource "aws_route" "public-routes" {
|
|
count = var.number-of-public-subnets-per-az > 0 ? 1 : 0
|
|
|
|
destination_cidr_block = "0.0.0.0/0"
|
|
gateway_id = aws_internet_gateway.igw[0].id
|
|
route_table_id = aws_route_table.public-route-table[0].id
|
|
}
|
|
|
|
resource "aws_route" "private-routes" {
|
|
count = var.number-of-private-subnets-per-az > 0 && var.create-nat-gateway ? 1 : 0
|
|
|
|
destination_cidr_block = "0.0.0.0/0"
|
|
nat_gateway_id = aws_nat_gateway.ngw[0].id
|
|
route_table_id = aws_route_table.private-route-table[0].id
|
|
}
|
|
|
|
resource "aws_route_table_association" "public_route_association" {
|
|
count = length(aws_subnet.public-subnets)
|
|
route_table_id = aws_route_table.public-route-table[0].id
|
|
subnet_id = aws_subnet.public-subnets[count.index].id
|
|
}
|
|
|
|
resource "aws_route_table_association" "private_route_association" {
|
|
count = length(aws_subnet.private-subnets)
|
|
route_table_id = aws_route_table.private-route-table[0].id
|
|
subnet_id = aws_subnet.private-subnets[count.index].id
|
|
}
|
|
|
|
/*
|
|
harden default security group. the default sg created by aws allows all egress.
|
|
this resource limits ingress and egress from and to itself
|
|
*/
|
|
|
|
resource "aws_default_security_group" default-sg {
|
|
vpc_id = aws_vpc.vpc.id
|
|
ingress {
|
|
protocol = -1
|
|
self = true
|
|
from_port = 0
|
|
to_port = 0
|
|
description = "Allow traffic coming from this SG"
|
|
}
|
|
egress {
|
|
from_port = 0
|
|
protocol = -1
|
|
to_port = 0
|
|
self = true
|
|
description = "Allow traffic going to this SG"
|
|
}
|
|
tags = merge(
|
|
var.default-tags,
|
|
{
|
|
Name = "${local.resource-prefix}-defaultsg"
|
|
},
|
|
)
|
|
}
|
|
|
|
# Enable gateway endpoints which are free
|
|
module vpc-ep {
|
|
count = var.create-free-vpc-endpoints ? 1 : 0
|
|
source = "../vpc-endpoints"
|
|
|
|
default-tags = var.default-tags
|
|
gateway-ep-services = ["s3","dynamodb"]
|
|
interface-ep-services = []
|
|
resource-prefix = local.resource-prefix
|
|
vpc-id = aws_vpc.vpc.id
|
|
} |