terraform.aws-baseline-infra/modules/networking/vpc_subnets/vpc.tf

data "aws_availability_zones" "available-az" {
  state = "available"
}

locals {
  subnet_start = cidrsubnets(var.vpc-cidr, 4, 4)
}

resource aws_subnet private-subnets {
  count = var.number-of-private-subnets-per-az * length(data.aws_availability_zones.available-az.names)
  vpc_id = aws_vpc.vpc.id
  availability_zone = element(data.aws_availability_zones.available-az.names, count.index)
  cidr_block = cidrsubnet(local.subnet_start[0], 4, count.index)
  tags = merge(
  var.default-tags,
  {
    Name = "${local.resource-prefix}-private-${split("-",element(data.aws_availability_zones.available-az.names, count.index))[2]}-${count.index+1}"
  },
  )
}

resource aws_subnet public-subnets {
  count = var.number-of-public-subnets-per-az * length(data.aws_availability_zones.available-az.names)
  vpc_id = aws_vpc.vpc.id
  availability_zone = element(data.aws_availability_zones.available-az.names, count.index)
  cidr_block = cidrsubnet(local.subnet_start[1], 4, count.index)
  tags = merge(
  var.default-tags,
  {
    Name = "${local.resource-prefix}-public-${split("-",element(data.aws_availability_zones.available-az.names, count.index))[2]}-${count.index+1}"
  },
  )
}

resource "aws_vpc" "vpc" {
  cidr_block           = var.vpc-cidr
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = merge(
  var.default-tags,
  {
    Name = "${local.resource-prefix}-vpc"
  },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_internet_gateway" "igw" {
  count = var.number-of-public-subnets-per-az > 0 ? 1 : 0
  vpc_id = aws_vpc.vpc.id

  tags = merge(
  var.default-tags,
  {
    Name = "${local.resource-prefix}-igw"
  },
  )
}

resource "aws_eip" "ngw-eip" {
  count = var.create-nat-gateway ? 1 : 0
  vpc = true
  tags = var.default-tags
  depends_on = [aws_internet_gateway.igw]
}

resource "aws_nat_gateway" "ngw" {
  count = var.create-nat-gateway ? 1 : 0
  allocation_id = aws_eip.ngw-eip[0].id
  subnet_id     = aws_subnet.public-subnets[0].id

  tags = merge(
  var.default-tags,
  {
    Name = "${local.resource-prefix}-ngw"
  },
  )

  depends_on = [aws_internet_gateway.igw]
}

resource aws_route_table public-route-table {
  count = var.number-of-public-subnets-per-az > 0 ? 1 : 0
  vpc_id = aws_vpc.vpc.id
  tags = merge(
  var.default-tags,
  {
    Name = "${local.resource-prefix}-publicroutetable"
  },
  )
}

resource aws_route_table private-route-table {
  count = var.number-of-private-subnets-per-az > 0 ? 1 : 0
  vpc_id = aws_vpc.vpc.id
  tags = merge(
  var.default-tags,
  {
    Name = "${local.resource-prefix}-privateroutetable"
  },
  )
}

resource "aws_route" "public-routes" {
  count = var.number-of-public-subnets-per-az > 0 ? 1 : 0

  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.igw[0].id
  route_table_id         = aws_route_table.public-route-table[0].id
}

resource "aws_route" "private-routes" {
  count = var.number-of-private-subnets-per-az > 0 ? 1 : 0

  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.ngw[0].id
  route_table_id         = aws_route_table.private-route-table[0].id
}

resource "aws_route_table_association" "public_route_association" {
  count = length(aws_subnet.public-subnets)
  route_table_id = aws_route_table.public-route-table[0].id
  subnet_id = aws_subnet.public-subnets[count.index].id
}

resource "aws_route_table_association" "private_route_association" {
  count = length(aws_subnet.private-subnets)
  route_table_id = aws_route_table.private-route-table[0].id
  subnet_id      = aws_subnet.private-subnets[count.index].id
}

/*
harden default security group. the default sg created by aws allows all egress.
this resource limits ingress and egress from and to itself
*/

resource "aws_default_security_group" default-sg {
  vpc_id = aws_vpc.vpc.id
  ingress {
    protocol = -1
    self = true
    from_port = 0
    to_port = 0
  }
  egress {
    from_port = 0
    protocol = -1
    to_port = 0
    self = true
  }
  tags = merge(
  var.default-tags,
  {
    Name = "${local.resource-prefix}-defaultsg"
  },
  )
}

# Enable gateway endpoints which are free
module vpc-ep {
  source = "../vpc-endpoints"

  default-tags          = var.default-tags
  gateway-ep-services   = ["s3","dynamodb"]
  interface-ep-services = []
  resource-prefix       = local.resource-prefix
  vpc-id                = aws_vpc.vpc.id
}