terraform.aws-baseline-infra/modules/networking/vpc_subnets/vpc.tf

data "aws_availability_zones" "available-az" {
  state = "available"
}

locals {
  // subnet_start = cidrsubnets(var.vpc-cidr, 1, 1) # divide vpc into 2
  # no-az = length(data.aws_availability_zones.available-az.id)
  no-az            = 2 # hard-coding to 2AZ
  vpc-cidr         = var.vpc-cidr
  total-no-subnets = local.no-az * (var.number-of-private-subnets-per-az + var.number-of-public-subnets-per-az)

  # simple-divide = local.total-no-subnets >=8 ? cidrsubnets(local.vpc-cidr, 4,4,4,4,4,4,4,4) : local.total-no-subnets >=6 ? cidrsubnets(local.vpc-cidr, 3,3,3,3,3,3) : local.total-no-subnets >=4 ? cidrsubnets(local.vpc-cidr, 2,2,2,2) : local.total-no-subnets >=2 ? cidrsubnets(local.vpc-cidr, 1,1) : null
  simple-divide   = local.total-no-subnets >= 12 ? cidrsubnets(local.vpc-cidr, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4) : local.total-no-subnets >= 8 ? cidrsubnets(local.vpc-cidr, 3, 3, 3, 3, 3, 3, 3, 3) : local.total-no-subnets >= 6 ? cidrsubnets(local.vpc-cidr, 3, 3, 3, 3, 3, 3) : local.total-no-subnets >= 4 ? cidrsubnets(local.vpc-cidr, 2, 2, 2, 2) : local.total-no-subnets >= 2 ? cidrsubnets(local.vpc-cidr, 1, 1) : null
  public-subnets  = slice(local.simple-divide, 0, var.number-of-public-subnets-per-az * local.no-az)
  private-subnets = slice(local.simple-divide, var.number-of-public-subnets-per-az * local.no-az, local.total-no-subnets)
}

resource "aws_subnet" "private-subnets" {
  count = length(local.private-subnets)
  # count = length(var.private-subnet-cidrs)
  # count = var.number-of-private-subnets-per-az * length(data.aws_availability_zones.available-az.names)
  vpc_id            = aws_vpc.vpc.id
  availability_zone = element(data.aws_availability_zones.available-az.names, count.index)
  # cidr_block = cidrsubnet(local.subnet_start[0], 2, count.index)
  # cidr_block = var.private-subnet-cidrs[count.index]
  cidr_block = local.private-subnets[count.index]
  tags = {
    Name = "${local.resource-prefix}-private-${split("-", element(data.aws_availability_zones.available-az.names, count.index))[2]}-${count.index + 1}"
  }
}

resource "aws_subnet" "public-subnets" {
  count = length(local.public-subnets)
  # count = length(var.public-subnet-cidrs)
  # count = var.number-of-public-subnets-per-az * length(data.aws_availability_zones.available-az.names)
  vpc_id            = aws_vpc.vpc.id
  availability_zone = element(data.aws_availability_zones.available-az.names, count.index)
  # cidr_block = cidrsubnet(local.subnet_start[1], 2, count.index)
  # cidr_block = var.public-subnet-cidrs[count.index]
  cidr_block = local.public-subnets[count.index]
  tags = {
    Name = "${local.resource-prefix}-public-${split("-", element(data.aws_availability_zones.available-az.names, count.index))[2]}-${count.index + 1}"
  }
}

resource "aws_vpc" "vpc" {
  cidr_block           = var.vpc-cidr
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "${local.resource-prefix}-vpc"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_internet_gateway" "igw" {
  count  = var.number-of-public-subnets-per-az > 0 ? 1 : 0
  vpc_id = aws_vpc.vpc.id

  tags = {
    Name = "${local.resource-prefix}-igw"
  }
}

resource "aws_eip" "ngw-eip" {
  count      = var.create-nat-gateway ? 1 : 0
  domain     = "vpc"
  depends_on = [aws_internet_gateway.igw]
}

resource "aws_nat_gateway" "ngw" {
  count         = var.create-nat-gateway ? 1 : 0
  allocation_id = aws_eip.ngw-eip[0].id
  subnet_id     = aws_subnet.public-subnets[0].id

  tags = {
    Name = "${local.resource-prefix}-ngw"
  }

  depends_on = [aws_internet_gateway.igw]
}

resource "aws_route_table" "public-route-table" {
  count  = var.number-of-public-subnets-per-az > 0 ? 1 : 0
  vpc_id = aws_vpc.vpc.id
  tags = {
    Name = "${local.resource-prefix}-public"
  }
}

resource "aws_route_table" "private-route-table" {
  count  = var.number-of-private-subnets-per-az > 0 ? 1 : 0
  vpc_id = aws_vpc.vpc.id
  tags = {
    Name = "${local.resource-prefix}-private"
  }
}

resource "aws_route" "public-routes" {
  count = var.number-of-public-subnets-per-az > 0 ? 1 : 0

  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.igw[0].id
  route_table_id         = aws_route_table.public-route-table[0].id
}

resource "aws_route" "private-routes" {
  count = var.number-of-private-subnets-per-az > 0 && var.create-nat-gateway ? 1 : 0

  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.ngw[0].id
  route_table_id         = aws_route_table.private-route-table[0].id
}

resource "aws_route_table_association" "public_route_association" {
  count          = length(aws_subnet.public-subnets)
  route_table_id = aws_route_table.public-route-table[0].id
  subnet_id      = aws_subnet.public-subnets[count.index].id
}

resource "aws_route_table_association" "private_route_association" {
  count          = length(aws_subnet.private-subnets)
  route_table_id = aws_route_table.private-route-table[0].id
  subnet_id      = aws_subnet.private-subnets[count.index].id
}

/*
harden default security group. the default sg created by aws allows all egress.
this resource limits ingress and egress from and to itself
*/

resource "aws_default_security_group" "default-sg" {
  vpc_id = aws_vpc.vpc.id
  ingress {
    protocol    = -1
    self        = true
    from_port   = 0
    to_port     = 0
    description = "Allow traffic coming from this SG"
  }
  egress {
    from_port   = 0
    protocol    = -1
    to_port     = 0
    self        = true
    description = "Allow traffic going to this SG"
  }
  tags = {
    Name = "${local.resource-prefix}-defaultsg"
  }
}

# Enable gateway endpoints which are free
module "vpc-ep" {
  count  = var.create-free-vpc-endpoints ? 1 : 0
  source = "../vpc-endpoints"

  gateway-ep-services   = ["s3", "dynamodb"]
  interface-ep-services = []
  resource-prefix       = local.resource-prefix
  vpc-id                = aws_vpc.vpc.id
}