├── .gitignore ├── .header.md ├── .pre-commit-config.yaml ├── .terraform-docs.yaml ├── .tflint.hcl ├── .tfsec ├── launch_configuration_imdsv2_tfchecks.json ├── launch_template_imdsv2_tfchecks.json ├── no_launch_config_tfchecks.json ├── sg_no_embedded_egress_rules_tfchecks.json └── sg_no_embedded_ingress_rules_tfchecks.json ├── CODEOWNERS ├── LICENSE ├── NOTICE.txt ├── README.md ├── UPGRADE-GUIDE-1.0.md ├── UPGRADE-GUIDE-2.0.md ├── UPGRADE-GUIDE-3.0.md ├── data.tf ├── examples ├── basic │ ├── .header.md │ ├── .terraform-docs.yaml │ ├── README.md │ ├── main.tf │ ├── outputs.tf │ ├── providers.tf │ └── variables.tf ├── central_vpcs │ ├── .header.md │ ├── .terraform-docs.yaml │ ├── README.md │ ├── main.tf │ ├── outputs.tf │ ├── providers.tf │ └── variables.tf ├── central_vpcs_inspection │ ├── .header.md │ ├── .terraform-docs.yaml │ ├── README.md │ ├── firewall_policy.tf │ ├── main.tf │ ├── outputs.tf │ ├── providers.tf │ └── variables.tf ├── core_network_share │ ├── .header.md │ ├── .terraform-docs.yaml │ ├── README.md │ ├── main.tf │ ├── outputs.tf │ ├── providers.tf │ └── variables.tf └── reference_global_network │ ├── .header.md │ ├── .terraform-docs.yaml │ ├── README.md │ ├── main.tf │ ├── outputs.tf │ ├── policy.tf │ ├── providers.tf │ └── variables.tf ├── main.tf ├── modules └── subnet_cidrs │ ├── main.tf │ ├── outputs.tf │ ├── providers.tf │ └── variables.tf ├── outputs.tf ├── providers.tf ├── tests ├── examples_basic.tftest.hcl ├── examples_central_vpcs.tftest.hcl ├── examples_central_vpcs_inspection.hcl ├── examples_core_network_share.tftest.hcl └── examples_reference_global_network.tftest.hcl └── variables.tf /.gitignore: -------------------------------------------------------------------------------- 1 | build/ 2 | plan.out 3 | plan.out.json 4 | 5 | # Local .terraform directories 6 | .terraform/ 7 | 8 | # .tfstate files 9 | *.tfstate 10 | *.tfstate.* 11 | 12 | # Crash log files 13 | crash.log 14 | 15 | # Exclude all .tfvars files, which are likely to contain sentitive data, such as 16 | # password, private keys, and other secrets. These should not be part of version 17 | # control as they are data points which are potentially sensitive and subject 18 | # to change depending on the environment. 19 | # 20 | *.tfvars 21 | 22 | # Ignore override files as they are usually used to override resources locally and so 23 | # are not checked in 24 | override.tf 25 | override.tf.json 26 | *_override.tf 27 | *_override.tf.json 28 | 29 | # Include override files you do wish to add to version control using negated pattern 30 | # 31 | # !example_override.tf 32 | 33 | # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan 34 | # example: *tfplan* 35 | 36 | # Ignore CLI configuration files 37 | .terraformrc 38 | terraform.rc 39 | .terraform.lock.hcl 40 | 41 | go.mod 42 | go.sum 43 | -------------------------------------------------------------------------------- /.header.md: -------------------------------------------------------------------------------- 1 | # AWS Cloud WAN Module 2 | 3 | This module can be used to deploy an [AWS Cloud WAN](https://docs.aws.amazon.com/vpc/latest/cloudwan/what-is-cloudwan.html) network - with the Core Network as main resource. A Global Network (the high-level container for the Core Network), can also be created if required. 4 | 5 | In addition, the module abstracts Central VPCs' creation and Core Network attachment - with the Global Network and Core Network created either within or outside the same module definition. Central VPC types supported are Inspection, Egress (with or without inspection), Ingress (with or without inspection), and Shared Services. Below you can find more information about the format and definition of each VPC type. 6 | 7 | ## Global Network and Core Network 8 | 9 | Two variables - `var.global_network` and `var.core_network` - are used to define the Global Network and Core Network. Starting with the **Global Network**, the following attributes can be configured: 10 | 11 | - `description` = (string) Global Network's description. 12 | - `tags` = (Optional|map(string)) Tags to apply to the Global Network resource. 13 | 14 | If a Global Network is already created and it is desired to pass only the resource ID to create a Core Network, use the `var.global_network_id` variable. 15 | 16 | Following with the **Core Network**, the following attributes can be configured: 17 | 18 | - `description` = (string) Core Network's description. 19 | - `policy_document` = (any) Core Network's policy in JSON format. It is recommended the use of the [Core Network Document data source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document). 20 | - `resource_share_name` = (Optional|string) AWS Resource Access Manager (RAM) Resource Share name. Providing this value, RAM resources will be created to share the Core Network with the principals indicated in `var.core_network.ram_share_principals`. 21 | - `resource_share_allow_external_principals` = (Optional|bool) Indicates whether principals outside your AWS Organization can be associated with a Resource Share. 22 | - `ram_share_principals` = (Optional|list(string)) List of principals (AWS Account or AWS Organization) to share the Core Network with. 23 | - `tags` = (Optional|map(string)) Tags to apply to the Core Network and RAM Resource Share (if created) resources. 24 | 25 | If a Core Network is already created and it is desired to pass only the resource ARN to attach Central VPCs, use the `var.core_network_arn` variable. 26 | 27 | ### Examples 28 | 29 | The example below builds an AWS Network Manager Global Network and Core Network from scratch. The Core Network needs the ID of the Global Network created, and also a policy document (to define the global infrastructure). You can find more information about the policy document in the [documentation](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-change-sets.html) 30 | 31 | ```hcl 32 | module "cloudwan" { 33 | source = "aws-ia/cloudwan/aws" 34 | version = "3.x.x" 35 | 36 | global_network = { 37 | description = "Global Network - AWS Cloud WAN Module" 38 | 39 | tags = { 40 | Name "global-network" 41 | } 42 | } 43 | 44 | core_network = { 45 | description = "Core Network - AWS Cloud WAN Module" 46 | policy_document = data.aws_networkmanager_core_network_policy_document.main.json 47 | 48 | tags = { 49 | Name = "core-network" 50 | } 51 | } 52 | 53 | tags = { 54 | Module = "aws-ia/cloudwan/aws" 55 | } 56 | } 57 | ``` 58 | 59 | If you already have a Network Manager Global Network created, you can pass the ID as variable and only create the Core Network. 60 | 61 | ```hcl 62 | module "cloudwan" { 63 | source = "aws-ia/cloudwan/aws" 64 | version = "3.x.x" 65 | 66 | global_network_id "global-network-021aedd98c7487b93" 67 | 68 | core_network = { 69 | description = "Global Network - AWS CloudWAN Module" 70 | policy_document = data.aws_networkmanager_core_network_policy_document.main.json 71 | 72 | tags = { 73 | Name = "core-network" 74 | } 75 | } 76 | 77 | tags = { 78 | Module = "aws-ia/cloudwan/aws" 79 | } 80 | } 81 | ``` 82 | 83 | In addition, when creating a new Core Network, you can also share it using [AWS Resource Access Manager](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html) (RAM). You can [share a core network](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-share-network.html) across accounts or across your organization. Important to note that **you must share your global resource from the N. Virginia (us-east-1) Region so that all other Regions can see the global resource.** 84 | 85 | ```hcl 86 | module "cloud_wan" { 87 | source = "aws-ia/cloudwan/aws" 88 | version = "3.x.x" 89 | 90 | global_network = { 91 | description = "Global Network - ${var.identifier}" 92 | 93 | tags = { 94 | Name = "global-network" 95 | } 96 | } 97 | 98 | core_network = { 99 | description = "Core Network - ${var.identifier}" 100 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 101 | 102 | resource_share_name = "core-network-share" 103 | resource_share_allow_external_principals = false 104 | ram_share_principals = [org-XXX] 105 | 106 | tags = { 107 | Name = "core-network" 108 | } 109 | } 110 | 111 | tags = { 112 | Project = var.identifier 113 | } 114 | } 115 | ``` 116 | 117 | ### Policy Creation 118 | 119 | Policy documents can be passed as a string of JSON or using the [policy_document data source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document) (recommended option). 120 | 121 | ```hcl 122 | data "aws_networkmanager_core_network_policy_document" "policy" { 123 | core_network_configuration { 124 | vpn_ecmp_support = false 125 | asn_ranges = ["64512-64520"] 126 | edge_locations { 127 | location = "us-east-1" 128 | asn = 64512 129 | } 130 | } 131 | 132 | segments { 133 | name = "shared" 134 | description = "SegmentForSharedServices" 135 | require_attachment_acceptance = true 136 | } 137 | 138 | segment_actions { 139 | action = "share" 140 | mode = "attachment-route" 141 | segment = "shared" 142 | share_with = ["*"] 143 | } 144 | 145 | attachment_policies { 146 | rule_number = 1 147 | condition_logic = "or" 148 | 149 | conditions { 150 | type = "tag-value" 151 | operator = "equals" 152 | key = "segment" 153 | value = "shared" 154 | } 155 | action { 156 | association_method = "constant" 157 | segment = "shared" 158 | } 159 | } 160 | } 161 | ``` 162 | 163 | ## Network definition 164 | 165 | The variable `var.ipv4_network_definition` is an attribute to configure a supernet (IPv4 CIDR block) or [managed prefix list](https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.html) of your network/VPCs in AWS. This variable is used when configuring VPC routing in some central VPCs. When checking the different VPC types below, you can check whether this variable is required or not. 166 | 167 | ## Central VPCs 168 | 169 | Aside the creation of the Global Network and Core Network, this module also abstracts the creation of Central VPCs - and the attachment to the Core Network. The variable `var.central_vpcs` can be configured with a map of VPC definitions, with the following attributes: 170 | 171 | - `type` = (string) VPC type (`inspection`, `egress`, `egress_with_inspection`, `ingress`, `ingress_with_inspection`, `shared_services`) - each one of them with a specific VPC routing. For more information about the configuration of each VPC type, check each Central VPC type section below. 172 | - `name` = (Optional|string) Name of the VPC. If not defined, the key of the map will be used. 173 | - `cidr_block` = (Optional|string) IPv4 CIDR range. **Cannot set if vpc_ipv4_ipam_pool_id is set.** 174 | - `vpc_ipv4_ipam_pool_id` = (Optional|string) Set to use IPAM to get an IPv4 CIDR block. **Cannot set if cidr_block is set.** 175 | - `vpc_ipv4_netmask_length` = (Optional|number) Set to use IPAM to get an IPv4 CIDR block using a specified netmask. Must be set with `var.vpc_ipv4_ipam_pool_id`. 176 | - `az_count` = (number) Searches the number of AZs in the region and takes a slice based on this number - the slice is sorted a-z. 177 | - `vpc_enable_dns_hostnames` = (Optional|bool) Indicates whether the instances launched in the VPC get DNS hostnames. Enabled by default. 178 | - `vpc_enable_dns_support` = (Optional|bool) Indicates whether the DNS resolution is supported for the VPC. If enabled, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC network range "plus two" succeed. If disabled, the Amazon provided DNS service in the VPC that resolves public DNS hostnames to IP addresses is not enabled. Enabled by default. 179 | - `vpc_instance_tenancy` = (Optional|string) The allowed tenancy of instances launched into the VPC. 180 | - `vpc_flow_logs` = (Optional|object(any)) Configuration of the VPC Flow Logs of the VPC configured. Options: "cloudwatch", "s3", "none". 181 | - `subnets` = (any) Configuration of the subnets to create in the VPC - a map of subnets' definition is expected. Depending the VPC type, the format (subnets to configure and resources created by the module) will be different. Check each Central VPC type section below. for more information. 182 | - `tags` = (Optional|map(string)) Tags to apply to all the Central VPC resources. 183 | 184 | To simplify the definition of this module, the following [VPC module](https://registry.terraform.io/modules/aws-ia/vpc/aws/latest) is used to create the VPC resources. We recommend to review its README to have more information about its inputs and outputs. 185 | 186 | ### Inspection VPC 187 | 188 | Defining the type **inspection** will create specific VPC subnets and routing to create a central Inspection VPC - specific for East/West traffic inspection. When defining the VPC subnets (attribute `subnets`) two keys are mandatory: **endpoints** - to place the [AWS Network Firewall](https://aws.amazon.com/network-firewall/) or [Gateway Load Balancer](https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/) endpoints - and **core_network** - to place the Core Network attachment ENIs -. You are free to create additional subnets, but default configuration and VPC routing won't be created on them. 189 | 190 | When defining the subnets, the following attributes can be configured: 191 | 192 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 193 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 194 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 195 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core_network* subnet type, these tags will be applied to the Core Network attachment. 196 | 197 | In addition, additional attributes can be configured for the **core_network** subnet type: 198 | 199 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `true`. 200 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 201 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 202 | 203 | Regarding the VPC routing, a default route (0.0.0.0/0) is created in the **endpoints** route tables pointing to the Core Network attachment. 204 | 205 | ```hcl 206 | module "inspection_vpc" { 207 | source = "aws-ia/cloudwan/aws" 208 | version = "3.x.x" 209 | 210 | core_network_arn = module.cloud_wan.core_network.arn 211 | 212 | central_vpcs = { 213 | inspection-east-west = { 214 | type = "inspection" 215 | cidr_block = "10.10.0.0/24" 216 | az_count = 2 217 | 218 | subnets = { 219 | endpoints = { cidrs = ["10.10.0.0/28", "10.10.0.16/28"] } 220 | core_network = { 221 | cidrs = ["10.10.0.32/28", "10.10.0.48/28"] 222 | 223 | tags = { domain = "inspection" } 224 | } 225 | } 226 | } 227 | } 228 | } 229 | ``` 230 | 231 | ### Egress VPC 232 | 233 | Defining the type **egress** will create specific VPC subnets and routing to create a central Egress VPC. When defining the VPC subnets (attribute `subnets`) two keys are mandatory: **public** - to place the [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) or [NAT instances](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html) - and **core_network** - to place the Core Network attachment ENIs -. You are free to create additional subnets, but default configuration and VPC routing won't be created on them. 234 | 235 | When defining the subnets, the following attributes can be configured: 236 | 237 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 238 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 239 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 240 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core_network* subnet type, these tags will be applied to the Core Network attachment. 241 | 242 | In addition, additional attributes can be configured for both the **public** and **core_network** subnet types: 243 | 244 | - Public subnets (*public*) 245 | - `nat_gateway_configuration` = (Optional|string) Determines if NAT Gateways should be created and in how many AZs. Valid values = `"none"`, `"single_az"`, `"all_azs"` (default). 246 | - `map_public_ip_on_launch` = (Optional|bool) Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default to `false`. 247 | - Core Network subnets (*core_network*) 248 | - `connect_to_public_natgw` = (Optional|bool) Determines if a default route to NAT Gateways should be created. Defaults to `true`. 249 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`. 250 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 251 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 252 | 253 | Regarding the VPC routing, the default configuration of the `connect_to_public_natgw` attribute in the **core_network** subnet type creates a default route (0.0.0.0/0) in the route tables to the NAT gateways. The CIDR block or Prefix List defined in `var.ipv4_network_definition` (required in this VPC type) will be used to create a VPC route to the Core Network in the **public** route tables. 254 | 255 | ```hcl 256 | module "egress_vpc" { 257 | source = "aws-ia/cloudwan/aws" 258 | version = "3.x.x" 259 | 260 | core_network_arn = module.cloud_wan.core_network.arn 261 | 262 | ipv4_network_definition = "10.0.0.0/8" 263 | 264 | central_vpcs = { 265 | central-egress = { 266 | type = "egress" 267 | cidr_block = "10.10.0.0/24" 268 | az_count = 2 269 | 270 | subnets = { 271 | public = { cidrs = ["10.10.0.0/28", "10.10.0.16/28"] } 272 | core_network = { 273 | cidrs = ["10.10.0.32/28", "10.10.0.48/28"] 274 | 275 | tags = { domain = "egress" } 276 | } 277 | } 278 | } 279 | } 280 | } 281 | ``` 282 | 283 | ### Egress VPC (with inspection) 284 | 285 | Defining the type **egress_with_inspection** will create specific VPC subnets and routing to create a central Egress VPC with subnets to add an inspection layer between the Core Network attachment and the public subnets - to inspect egress traffic. When defining the VPC subnets (attribute `subnets`) three keys are mandatory: 286 | 287 | - **public** to place the [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) or [NAT instances](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html) 288 | - **endpoints** to place the [AWS Network Firewall](https://aws.amazon.com/network-firewall/) or [Gateway Load Balancer](https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/) endpoints. 289 | - **core_network** to place the Core Network attachment ENIs. 290 | 291 | You are free to create additional subnets, but default configuration and VPC routing won't be created on them. When defining the subnets, the following attributes can be configured: 292 | 293 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 294 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 295 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 296 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core_network* subnet type, these tags will be applied to the Core Network attachment. 297 | 298 | In addition, additional attributes can be configured for the **public**, **endpoints**, and **core_network** subnet types: 299 | 300 | - Public subnets (*public*) 301 | - `nat_gateway_configuration` = (Optional|string) Determines if NAT Gateways should be created and in how many AZs. Valid values = `"none"`, `"single_az"`, `"all_azs"` (default). 302 | - `map_public_ip_on_launch` = (Optional|bool) Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default to `false`. 303 | - Endpoint subnets (*endpoints*) 304 | - `connect_to_public_natgw` = (Optional|bool) Determines if routes to NAT Gateways should be created. Defaults to `true`. 305 | - Core Network subnets (*core_network*) 306 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `true`. 307 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 308 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 309 | 310 | Regarding the VPC routing, the default configuration of the `connect_to_public_natgw` attribute in the **endpoints** subnet type creates a default route (0.0.0.0/0) in the route tables to the NAT gateways. The CIDR block or Prefix List defined in `var.ipv4_network_definition` (required in this VPC type) will be used to create a VPC route to the Core Network from the **endpoints** route tables. 311 | 312 | ```hcl 313 | module "egress_with_inspection_vpc" { 314 | source = "aws-ia/cloudwan/aws" 315 | version = "3.x.x" 316 | 317 | core_network_arn = module.cloud_wan.core_network.arn 318 | 319 | ipv4_network_definition = "10.0.0.0/8" 320 | 321 | central_vpcs = { 322 | central-egress-inspection = { 323 | type = "egress_with_inspection" 324 | cidr_block = "10.10.0.0/24" 325 | az_count = 2 326 | 327 | subnets = { 328 | public = { netmask = 28 } 329 | endpoints = { netmask = 28 } 330 | core_network = { 331 | netmask = 28 332 | 333 | tags = { domain = "egress" } 334 | } 335 | } 336 | } 337 | } 338 | } 339 | ``` 340 | 341 | ### Ingress VPC 342 | 343 | Defining the type **ingress** will create specific VPC subnets and routing to create a central Ingress VPC. When defining the VPC subnets (attribute `subnets`) two keys are mandatory: **public** - to place the [Elastic Load Balancers](https://aws.amazon.com/elasticloadbalancing/) or your own ingress solution - and **core_network** - to place the Core Network attachment ENIs -. You are free to create additional subnets, but default configuration and VPC routing won't be created on them. 344 | 345 | When defining the subnets, the following attributes can be configured: 346 | 347 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 348 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 349 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 350 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core_network* subnet type, these tags will be applied to the Core Network attachment. 351 | 352 | In addition, additional attributes can be configured for both the **public** and **core_network** subnet types: 353 | 354 | - Public subnets (*public*) 355 | - `connect_to_igw` = (Optional|bool) Determines if the default route (0.0.0.0/0) is created in the public subnets with destination the Internet gateway. Defaults to `true`. 356 | - `map_public_ip_on_launch` = (Optional|bool) Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default to `false`. 357 | - Core Network subnets (*core_network*) 358 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`. 359 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 360 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 361 | 362 | Regarding the VPC routing, the CIDR block or Prefix List defined in `var.ipv4_network_definition` (required in this VPC type) will be used to create a VPC route to the Core Network in the **public** route tables. 363 | 364 | ```hcl 365 | module "egress_with_inspection_vpc" { 366 | source = "aws-ia/cloudwan/aws" 367 | version = "3.x.x" 368 | 369 | core_network_arn = module.cloud_wan.core_network.arn 370 | 371 | ipv4_network_definition = "10.0.0.0/8" 372 | 373 | central_vpcs = { 374 | ingress = { 375 | type = "ingress" 376 | cidr_block = "10.10.0.0/24" 377 | az_count = 2 378 | 379 | subnets = { 380 | public = { netmask = 28 } 381 | core_network = { 382 | netmask = 28 383 | 384 | tags = { domain = "ingress" } 385 | } 386 | } 387 | } 388 | } 389 | } 390 | ``` 391 | 392 | ### Ingress VPC (with inspection) 393 | 394 | Defining the type **ingress_with_inspection** will create specific VPC subnets and routing to create a central Ingress VPC with subnets to add an inspection layer between the Internet gateway and the public subnets - to inspect ingress traffic. When defining the VPC subnets (attribute `subnets`) three keys are mandatory: 395 | 396 | - **endpoints** to place the [AWS Network Firewall](https://aws.amazon.com/network-firewall/) or [Gateway Load Balancer](https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/) endpoints. 397 | - **public** to place the [Elastic Load Balancers](https://aws.amazon.com/elasticloadbalancing/) or your own ingress solution. 398 | - **core_network** to place the Core Network attachment ENIs. 399 | 400 | You are free to create additional subnets, but default configuration and VPC routing won't be created on them. When defining the subnets, the following attributes can be configured: 401 | 402 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 403 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 404 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 405 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core_network* subnet type, these tags will be applied to the Core Network attachment. 406 | 407 | In addition, additional attributes can be configured for both the **public** and **core_network** subnet types: 408 | 409 | - Public subnets (*public*) 410 | - `connect_to_igw` = (Optional|bool) Determines if the default route (0.0.0.0/0) is created in the public subnets with destination the Internet gateway. Defaults to `false`. 411 | - `map_public_ip_on_launch` = (Optional|bool) Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default to `false`. 412 | - Core Network subnets (*core_network*) 413 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`. 414 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 415 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 416 | 417 | Regarding the VPC routing, the CIDR block or Prefix List defined in `var.ipv4_network_definition` (required in this VPC type) will be used to create a VPC route to the Core Network in the **public** route tables. 418 | 419 | ```hcl 420 | module "egress_with_inspection_vpc" { 421 | source = "aws-ia/cloudwan/aws" 422 | version = "3.x.x" 423 | 424 | core_network_arn = module.cloud_wan.core_network.arn 425 | 426 | ipv4_network_definition = "10.0.0.0/8" 427 | 428 | central_vpcs = { 429 | ingress-with-inspection = { 430 | type = "ingress_with_inspection" 431 | cidr_block = "10.10.0.0/24" 432 | az_count = 2 433 | 434 | subnets = { 435 | endpoints = { netmask = 28 } 436 | public = { netmask = 28 } 437 | core_network = { 438 | netmask = 28 439 | 440 | tags = { domain = "ingress" } 441 | } 442 | } 443 | } 444 | } 445 | } 446 | ``` 447 | 448 | ### Shared Services VPC 449 | 450 | Defining the type **shared_services** will create specific VPC subnets and routing to create a central Shared Services VPC. When defining the VPC subnets (attribute `subnets`) the only mandatory key is **core_network** - to place the Core Network attachment ENIs. When defining the subnets, the following attributes can be configured: 451 | 452 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 453 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 454 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 455 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core_network* subnet type, these tags will be applied to the Core Network attachment. 456 | 457 | In addition, additional attributes can be configured for both the **core_network** subnet type: 458 | 459 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`. 460 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 461 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 462 | 463 | Regarding the VPC routing, a default route (0.0.0.0/0) poiting to the Core Network attachment will be created in any private route table you create. 464 | 465 | ```hcl 466 | module "egress_with_inspection_vpc" { 467 | source = "aws-ia/cloudwan/aws" 468 | version = "3.x.x" 469 | 470 | core_network_arn = module.cloud_wan.core_network.arn 471 | 472 | central_vpcs = { 473 | shared-services = { 474 | type = "shared_services" 475 | cidr_block = "10.10.0.0/24" 476 | az_count = 2 477 | 478 | subnets = { 479 | vpc_endpoints = { netmask = 28 } 480 | hybrid_dns = { netmask = 28 } 481 | core_network = { 482 | netmask = 28 483 | 484 | tags = { domain = "shared" } 485 | } 486 | } 487 | } 488 | } 489 | } 490 | ``` 491 | 492 | ## AWS Network Firewall 493 | 494 | The variable `var.aws_network_firewall` allows the configuration of [AWS Network Firewall](https://aws.amazon.com/network-firewall/) resources in those central VPCs where inspection can be added - VPC types `inspection`, `egress_with_inspection` and `ingress_with_inspection`. As we use the following [AWS Network Firewall module](https://registry.terraform.io/modules/aws-ia/networkfirewall/aws/latest), the VPC routing pointing to the firewall endpoints is also abstracted. 495 | 496 | The variable expects a map containing the Network Firewall configuration to apply in each VPC. How do you make sure the Network Firewall resource (and VPC routing) is created in the corresponding central VPC? By using the same **key value** you used in `var.central_vpcs`. Each map definition expects the following attributes: 497 | 498 | - `name` = (string) Name of the AWS Network Firewall resource. 499 | - `description` = (string) Description of the AWS Network Firewall resource. 500 | - `policy_arn` = (string) ARN of the Network Firewall Policy. 501 | - `delete_protection` = (Optional|bool) Indicates whether it is possible to delete the firewall. Defaults to `false`. 502 | - `policy_change_protection` = (Optional|bool) Indicates whether it is possible to change the firewall policy. Defaults to `false`. 503 | - `subnet_change_protection` = (Optional|bool) Indicates whether it is possible to change the associated subnet(s) after creation. Defaults to `false`. 504 | - `tags` = (Optional|map(string)) Tags to apply to the AWS Network Firewall resource. 505 | 506 | ### Inspection VPC 507 | 508 | If you configure the creation of an AWS Network Firewall resource in an Inspection VPC (type `inspection`), the VPC routes created are the default ones (0.0.0.0/0) pointing to the firewall endpoints in the **core_network** route tables. 509 | 510 | ```hcl 511 | module "cloudwan_central_vpcs" { 512 | source = "aws-ia/cloudwan/aws" 513 | version = "3.x.x" 514 | 515 | global_network = { 516 | description = "Global Network" 517 | 518 | tags = { 519 | Name = "global-network" 520 | } 521 | } 522 | 523 | core_network = { 524 | description = "Core Network" 525 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 526 | 527 | tags = { 528 | Name = "core-network" 529 | } 530 | } 531 | 532 | ipv4_network_definition = "10.0.0.0/8" 533 | central_vpcs = { 534 | inspection = { 535 | type = "inspection" 536 | cidr_block = "10.10.0.0/24" 537 | az_count = 2 538 | 539 | subnets = { 540 | endpoints = { netmask = 28 } 541 | core_network = { 542 | netmask = 28 543 | 544 | tags = { domain = "inspection" } 545 | } 546 | } 547 | } 548 | } 549 | 550 | aws_network_firewall = { 551 | inspection = { 552 | name = "anfw-inspection" 553 | description = "AWS Network Firewall - East/West" 554 | policy_arn = aws_networkfirewall_firewall_policy.policy.arn 555 | } 556 | } 557 | } 558 | ``` 559 | 560 | ### Egress VPC 561 | 562 | If you configure the creation of an AWS Network Firewall resource in an Egress VPC (type `egress_with_inspection`), the VPC routes created are: 563 | 564 | * Default route (0.0.0.0/0) pointing to the firewall endpoints in the **core_network** route tables. 565 | * CIDR blocks provided in `var.ipv4_network_definition` pointing to the firewall endpoints in the **public** route tables. 566 | 567 | ```hcl 568 | module "cloudwan_central_vpcs" { 569 | source = "aws-ia/cloudwan/aws" 570 | version = "3.x.x" 571 | 572 | global_network = { 573 | description = "Global Network" 574 | 575 | tags = { 576 | Name = "global-network" 577 | } 578 | } 579 | 580 | core_network = { 581 | description = "Core Network" 582 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 583 | 584 | tags = { 585 | Name = "core-network" 586 | } 587 | } 588 | 589 | ipv4_network_definition = "10.0.0.0/8" 590 | central_vpcs = { 591 | egress-inspection = { 592 | type = "egress_with_inspection" 593 | cidr_block = "10.10.0.0/24" 594 | az_count = 2 595 | 596 | subnets = { 597 | public = { netmask = 28 } 598 | endpoints = { netmask = 28 } 599 | core_network = { 600 | netmask = 28 601 | 602 | tags = { domain = "egress" } 603 | } 604 | } 605 | } 606 | } 607 | 608 | aws_network_firewall = { 609 | egress-inspection = { 610 | name = "anfw-egress-inspection" 611 | description = "AWS Network Firewall - Egress" 612 | policy_arn = aws_networkfirewall_firewall_policy.policy.arn 613 | } 614 | } 615 | } 616 | ``` 617 | 618 | ### Ingress VPC 619 | 620 | If you configure the creation of an AWS Network Firewall resource in an Ingress VPC (type `ingress_with_inspection`), the following resources are created: 621 | 622 | * VPC route table associated to the Internet gateway. 623 | * Public subnet CIDR blocks pointing to the firewall endpoints in the IGW route table. 624 | * Default route (0.0.0.0/0) pointing to the firewall endpoints in the **public** route tables. 625 | 626 | ```hcl 627 | module "cloudwan_central_vpcs" { 628 | source = "aws-ia/cloudwan/aws" 629 | version = "3.x.x" 630 | 631 | global_network = { 632 | description = "Global Network" 633 | 634 | tags = { 635 | Name = "global-network" 636 | } 637 | } 638 | 639 | core_network = { 640 | description = "Core Network" 641 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 642 | 643 | tags = { 644 | Name = "core-network" 645 | } 646 | } 647 | 648 | ipv4_network_definition = "10.0.0.0/8" 649 | central_vpcs = { 650 | ingress-inspection = { 651 | type = "ingress_with_inspection" 652 | cidr_block = "10.10.0.0/24" 653 | az_count = 2 654 | 655 | subnets = { 656 | endpoints = { netmask = 28 } 657 | public = { netmask = 28 } 658 | core_network = { 659 | netmask = 28 660 | 661 | tags = { domain = "ingress" } 662 | } 663 | } 664 | } 665 | } 666 | 667 | aws_network_firewall = { 668 | ingress-inspection = { 669 | name = "anfw-ingress-inspection" 670 | description = "AWS Network Firewall - Ingress" 671 | policy_arn = aws_networkfirewall_firewall_policy.policy.arn 672 | } 673 | } 674 | } 675 | ``` 676 | 677 | ## Common questions 678 | 679 | ### How can I configure tags in the Core Network attachment? 680 | 681 | AWS Cloud WAN automates the association of an attachment to a specific segment, reducing the operational overhead specially in multi-Account environments. If you check how to define a [core network policy](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policies-json.html), you will see that the parameter **attachment-policies** is where you can define how to automate the associations. What can you use to define the attachment's association policy? You can use the Resource ID, Account ID, AWS Region, Attachment Type, and **Tags** - which is the common item to use. 682 | 683 | Now that we have explained the importance of tags when creating Core Network attachments, how can I create these tags using the module? As we use the following [VPC module](https://registry.terraform.io/modules/aws-ia/vpc/aws/latest) to create the central VPCs, the tags defined under the **core_network** subnet type will be applied to the Core Network attachment. 684 | 685 | ```hcl 686 | core_network = { 687 | netmask = 28 688 | 689 | tags = { domain = "segment" } 690 | } 691 | ``` 692 | 693 | ### Should I create Central VPCs in the same module definition as the Core Network? 694 | 695 | This module has been created to be used once per AWS Region you are creating resources - only 1 provider can be configured. This means that, if you want to create Central VPCs in several AWS Regions, you should have 1 module definition per Region. What about the Global Network and Core Network? These resources are global, and they can be created using a provider definition from any Region - of course, where [Cloud WAN is available](https://docs.aws.amazon.com/network-manager/latest/cloudwan/what-is-cloudwan.html#cloudwan-available-regions). **Important to note that whatever Region you configure for the provider that creates the Cloud WAN resources, the [home region](https://docs.aws.amazon.com/network-manager/latest/cloudwan/what-is-cloudwan.html#cloudwan-home-region) will be US West (Oregon)**. 696 | 697 | Coming back to the question, our recommendation is to create the Global Network and Core Network in a different module definition than the Central VPCs - even if the provider you use to create the global resource is also used to create Central VPCs in that same Region. The main reason of the recommendation is to decouple the definition of global and regional resources. That said, if you want to use the same module definition to create global resources and central VPCs in the Region the provider has configured, the module will allow you to do it (and it's not an anti-pattern). 698 | 699 | ## Troubleshooting 700 | 701 | ### Creating Central VPCs with IPAM configuration - The "for_each" map includes keys derived from resource attributes that cannot be determined until apply 702 | 703 | When creating Central VPCs referencing an IPAM pool ID, you get the following error: 704 | 705 | ``` 706 | The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource. 707 | When working with unknown values in for_each, it's better to define the map keys statically in your configuration and place apply-time results only in the map values. 708 | Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a second time to fully converge. 709 | ``` 710 | 711 | As described in the error itself, you first need to create the IPAM pool to then later create the VPCs. You can use the [target](https://developer.hashicorp.com/terraform/tutorials/state/resource-targeting) option if the IPAM resources are created in the same document (and state file) as the VPCs. 712 | -------------------------------------------------------------------------------- /.pre-commit-config.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | fail_fast: false 3 | minimum_pre_commit_version: "2.6.0" 4 | repos: 5 | - 6 | repo: https://github.com/aws-ia/pre-commit-configs 7 | # To update run: 8 | # pre-commit autoupdate --freeze 9 | rev: c7091ec774495a41986bd9c5ea59152655ec4f3a # frozen: v1.6.2 10 | hooks: 11 | - id: aws-ia-meta-hook 12 | -------------------------------------------------------------------------------- /.terraform-docs.yaml: -------------------------------------------------------------------------------- 1 | formatter: markdown 2 | header-from: .header.md 3 | settings: 4 | anchor: true 5 | color: true 6 | default: true 7 | escape: true 8 | html: true 9 | indent: 2 10 | required: true 11 | sensitive: true 12 | type: true 13 | lockfile: false 14 | 15 | sort: 16 | enabled: true 17 | by: required 18 | 19 | output: 20 | file: README.md 21 | mode: replace -------------------------------------------------------------------------------- /.tflint.hcl: -------------------------------------------------------------------------------- 1 | # https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/module-inspection.md 2 | # borrowed & modified indefinitely from https://github.com/ksatirli/building-infrastructure-you-can-mostly-trust/blob/main/.tflint.hcl 3 | 4 | plugin "aws" { 5 | enabled = true 6 | version = "0.21.1" 7 | source = "github.com/terraform-linters/tflint-ruleset-aws" 8 | } 9 | 10 | config { 11 | module = true 12 | force = false 13 | } 14 | 15 | rule "terraform_required_providers" { 16 | enabled = true 17 | } 18 | 19 | rule "terraform_required_version" { 20 | enabled = true 21 | } 22 | 23 | rule "terraform_naming_convention" { 24 | enabled = true 25 | format = "snake_case" 26 | } 27 | 28 | rule "terraform_typed_variables" { 29 | enabled = true 30 | } 31 | 32 | rule "terraform_unused_declarations" { 33 | enabled = true 34 | } 35 | 36 | rule "terraform_comment_syntax" { 37 | enabled = true 38 | } 39 | 40 | rule "terraform_deprecated_index" { 41 | enabled = true 42 | } 43 | 44 | rule "terraform_deprecated_interpolation" { 45 | enabled = true 46 | } 47 | 48 | rule "terraform_documented_outputs" { 49 | enabled = true 50 | } 51 | 52 | rule "terraform_documented_variables" { 53 | enabled = true 54 | } 55 | 56 | rule "terraform_module_pinned_source" { 57 | enabled = true 58 | } 59 | 60 | rule "terraform_standard_module_structure" { 61 | enabled = true 62 | } 63 | 64 | rule "terraform_workspace_remote" { 65 | enabled = true 66 | } 67 | -------------------------------------------------------------------------------- /.tfsec/launch_configuration_imdsv2_tfchecks.json: -------------------------------------------------------------------------------- 1 | { 2 | "checks": [ 3 | { 4 | "code": "CUS002", 5 | "description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template", 6 | "impact": "Instance metadata service can be interacted with freely", 7 | "resolution": "Enable HTTP token requirement for IMDS", 8 | "requiredTypes": [ 9 | "resource" 10 | ], 11 | "requiredLabels": [ 12 | "aws_launch_configuration" 13 | ], 14 | "severity": "CRITICAL", 15 | "matchSpec": { 16 | "action": "isPresent", 17 | "name": "metadata_options", 18 | "subMatch": { 19 | "action": "and", 20 | "predicateMatchSpec": [ 21 | { 22 | "action": "equals", 23 | "name": "http_tokens", 24 | "value": "required" 25 | 26 | } 27 | ] 28 | } 29 | }, 30 | 31 | "errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.", 32 | "relatedLinks": [ 33 | "https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2", 34 | "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata-options", 35 | "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service" 36 | ] 37 | } 38 | ] 39 | } 40 | -------------------------------------------------------------------------------- /.tfsec/launch_template_imdsv2_tfchecks.json: -------------------------------------------------------------------------------- 1 | { 2 | "checks": [ 3 | { 4 | "code": "CUS001", 5 | "description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template", 6 | "impact": "Instance metadata service can be interacted with freely", 7 | "resolution": "Enable HTTP token requirement for IMDS", 8 | "requiredTypes": [ 9 | "resource" 10 | ], 11 | "requiredLabels": [ 12 | "aws_launch_template" 13 | ], 14 | "severity": "CRITICAL", 15 | "matchSpec": { 16 | "action": "isPresent", 17 | "name": "metadata_options", 18 | "subMatch": { 19 | "action": "and", 20 | "predicateMatchSpec": [ 21 | { 22 | "action": "equals", 23 | "name": "http_tokens", 24 | "value": "required" 25 | 26 | } 27 | ] 28 | } 29 | }, 30 | 31 | "errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.", 32 | "relatedLinks": [ 33 | "https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2", 34 | "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#metadata-options", 35 | "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service" 36 | ] 37 | } 38 | ] 39 | } 40 | -------------------------------------------------------------------------------- /.tfsec/no_launch_config_tfchecks.json: -------------------------------------------------------------------------------- 1 | { 2 | "checks": [ 3 | { 4 | "code": "CUS003", 5 | "description": "Use `aws_launch_template` over `aws_launch_configuration", 6 | "impact": "Launch configurations are not capable of versions", 7 | "resolution": "Convert resource type and attributes to `aws_launch_template`", 8 | "requiredTypes": [ 9 | "resource" 10 | ], 11 | "requiredLabels": [ 12 | "aws_launch_configuration" 13 | ], 14 | "severity": "MEDIUM", 15 | "matchSpec": { 16 | "action": "notPresent", 17 | "name": "image_id" 18 | }, 19 | 20 | "errorMessage": "should be changed to `aws_launch_template` since the functionality is the same but templates can be versioned.", 21 | "relatedLinks": [ 22 | "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template", 23 | "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service" 24 | ] 25 | } 26 | ] 27 | } 28 | -------------------------------------------------------------------------------- /.tfsec/sg_no_embedded_egress_rules_tfchecks.json: -------------------------------------------------------------------------------- 1 | { 2 | "checks": [ 3 | { 4 | "code": "CUS005", 5 | "description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.", 6 | "impact": "Embedded security group rules can cause issues during configuration updates.", 7 | "resolution": "Move `egress` rules to `aws_security_group_rule` and attach to `aws_security_group`.", 8 | "requiredTypes": [ 9 | "resource" 10 | ], 11 | "requiredLabels": [ 12 | "aws_security_group" 13 | ], 14 | "severity": "MEDIUM", 15 | "matchSpec": { 16 | "action": "notPresent", 17 | "name": "egress" 18 | }, 19 | 20 | "errorMessage": "`egress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.", 21 | "relatedLinks": [ 22 | "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule", 23 | "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group" 24 | ] 25 | } 26 | ] 27 | } 28 | -------------------------------------------------------------------------------- /.tfsec/sg_no_embedded_ingress_rules_tfchecks.json: -------------------------------------------------------------------------------- 1 | { 2 | "checks": [ 3 | { 4 | "code": "CUS004", 5 | "description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.", 6 | "impact": "Embedded security group rules can cause issues during configuration updates.", 7 | "resolution": "Move `ingress` rules to `aws_security_group_rule` and attach to `aws_security_group`.", 8 | "requiredTypes": [ 9 | "resource" 10 | ], 11 | "requiredLabels": [ 12 | "aws_security_group" 13 | ], 14 | "severity": "MEDIUM", 15 | "matchSpec": { 16 | "action": "notPresent", 17 | "name": "ingress" 18 | }, 19 | 20 | "errorMessage": "`ingress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.", 21 | "relatedLinks": [ 22 | "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule", 23 | "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group" 24 | ] 25 | } 26 | ] 27 | } 28 | -------------------------------------------------------------------------------- /CODEOWNERS: -------------------------------------------------------------------------------- 1 | * @drewmullen @aws-ia/aws-ia-terraform-core 2 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /NOTICE.txt: -------------------------------------------------------------------------------- 1 | Copyright 2016-2022 Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | 3 | Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at 4 | 5 | http://aws.amazon.com/apache2.0/ 6 | 7 | or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. 8 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | # AWS Cloud WAN Module 3 | 4 | This module can be used to deploy an [AWS Cloud WAN](https://docs.aws.amazon.com/vpc/latest/cloudwan/what-is-cloudwan.html) network - with the Core Network as main resource. A Global Network (the high-level container for the Core Network), can also be created if required. 5 | 6 | In addition, the module abstracts Central VPCs' creation and Core Network attachment - with the Global Network and Core Network created either within or outside the same module definition. Central VPC types supported are Inspection, Egress (with or without inspection), Ingress (with or without inspection), and Shared Services. Below you can find more information about the format and definition of each VPC type. 7 | 8 | ## Global Network and Core Network 9 | 10 | Two variables - `var.global_network` and `var.core_network` - are used to define the Global Network and Core Network. Starting with the **Global Network**, the following attributes can be configured: 11 | 12 | - `description` = (string) Global Network's description. 13 | - `tags` = (Optional|map(string)) Tags to apply to the Global Network resource. 14 | 15 | If a Global Network is already created and it is desired to pass only the resource ID to create a Core Network, use the `var.global_network_id` variable. 16 | 17 | Following with the **Core Network**, the following attributes can be configured: 18 | 19 | - `description` = (string) Core Network's description. 20 | - `policy_document` = (any) Core Network's policy in JSON format. It is recommended the use of the [Core Network Document data source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document). 21 | - `resource_share_name` = (Optional|string) AWS Resource Access Manager (RAM) Resource Share name. Providing this value, RAM resources will be created to share the Core Network with the principals indicated in `var.core_network.ram_share_principals`. 22 | - `resource_share_allow_external_principals` = (Optional|bool) Indicates whether principals outside your AWS Organization can be associated with a Resource Share. 23 | - `ram_share_principals` = (Optional|list(string)) List of principals (AWS Account or AWS Organization) to share the Core Network with. 24 | - `tags` = (Optional|map(string)) Tags to apply to the Core Network and RAM Resource Share (if created) resources. 25 | 26 | If a Core Network is already created and it is desired to pass only the resource ARN to attach Central VPCs, use the `var.core_network_arn` variable. 27 | 28 | ### Examples 29 | 30 | The example below builds an AWS Network Manager Global Network and Core Network from scratch. The Core Network needs the ID of the Global Network created, and also a policy document (to define the global infrastructure). You can find more information about the policy document in the [documentation](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-change-sets.html) 31 | 32 | ```hcl 33 | module "cloudwan" { 34 | source = "aws-ia/cloudwan/aws" 35 | version = "3.x.x" 36 | 37 | global_network = { 38 | description = "Global Network - AWS Cloud WAN Module" 39 | 40 | tags = { 41 | Name "global-network" 42 | } 43 | } 44 | core_network = { 45 | description = "Core Network - AWS Cloud WAN Module" 46 | policy_document = data.aws_networkmanager_core_network_policy_document.main.json 47 | 48 | tags = { 49 | Name = "core-network" 50 | } 51 | } 52 | 53 | tags = { 54 | Module = "aws-ia/cloudwan/aws" 55 | } 56 | } 57 | ``` 58 | 59 | If you already have a Network Manager Global Network created, you can pass the ID as variable and only create the Core Network. 60 | 61 | ```hcl 62 | module "cloudwan" { 63 | source = "aws-ia/cloudwan/aws" 64 | version = "3.x.x" 65 | 66 | global_network_id "global-network-021aedd98c7487b93" 67 | 68 | core_network = { 69 | description = "Global Network - AWS CloudWAN Module" 70 | policy_document = data.aws_networkmanager_core_network_policy_document.main.json 71 | tags = { 72 | Name = "core-network" 73 | } 74 | } 75 | 76 | tags = { 77 | Module = "aws-ia/cloudwan/aws" 78 | } 79 | } 80 | ``` 81 | 82 | In addition, when creating a new Core Network, you can also share it using [AWS Resource Access Manager](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html) (RAM). You can [share a core network](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-share-network.html) across accounts or across your organization. Important to note that **you must share your global resource from the N. Virginia (us-east-1) Region so that all other Regions can see the global resource.** 83 | 84 | ```hcl 85 | module "cloud_wan" { 86 | source = "aws-ia/cloudwan/aws" 87 | version = "3.x.x" 88 | 89 | global_network = { 90 | description = "Global Network - ${var.identifier}" 91 | 92 | tags = { 93 | Name = "global-network" 94 | } 95 | } 96 | 97 | core_network = { 98 | description = "Core Network - ${var.identifier}" 99 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 100 | 101 | resource_share_name = "core-network-share" 102 | resource_share_allow_external_principals = false 103 | ram_share_principals = [org-XXX] 104 | 105 | tags = { 106 | Name = "core-network" 107 | } 108 | } 109 | 110 | tags = { 111 | Project = var.identifier 112 | } 113 | } 114 | ``` 115 | 116 | ### Policy Creation 117 | 118 | Policy documents can be passed as a string of JSON or using the [policy\_document data source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document) (recommended option). 119 | 120 | ```hcl 121 | data "aws_networkmanager_core_network_policy_document" "policy" { 122 | core_network_configuration { 123 | vpn_ecmp_support = false 124 | asn_ranges = ["64512-64520"] 125 | edge_locations { 126 | location = "us-east-1" 127 | asn = 64512 128 | } 129 | } 130 | 131 | segments { 132 | name = "shared" 133 | description = "SegmentForSharedServices" 134 | require_attachment_acceptance = true 135 | } 136 | 137 | segment_actions { 138 | action = "share" 139 | mode = "attachment-route" 140 | segment = "shared" 141 | share_with = ["*"] 142 | } 143 | 144 | attachment_policies { 145 | rule_number = 1 146 | condition_logic = "or" 147 | 148 | conditions { 149 | type = "tag-value" 150 | operator = "equals" 151 | key = "segment" 152 | value = "shared" 153 | } 154 | action { 155 | association_method = "constant" 156 | segment = "shared" 157 | } 158 | } 159 | } 160 | ``` 161 | 162 | ## Network definition 163 | 164 | The variable `var.ipv4_network_definition` is an attribute to configure a supernet (IPv4 CIDR block) or [managed prefix list](https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.html) of your network/VPCs in AWS. This variable is used when configuring VPC routing in some central VPCs. When checking the different VPC types below, you can check whether this variable is required or not. 165 | 166 | ## Central VPCs 167 | 168 | Aside the creation of the Global Network and Core Network, this module also abstracts the creation of Central VPCs - and the attachment to the Core Network. The variable `var.central_vpcs` can be configured with a map of VPC definitions, with the following attributes: 169 | 170 | - `type` = (string) VPC type (`inspection`, `egress`, `egress_with_inspection`, `ingress`, `ingress_with_inspection`, `shared_services`) - each one of them with a specific VPC routing. For more information about the configuration of each VPC type, check each Central VPC type section below. 171 | - `name` = (Optional|string) Name of the VPC. If not defined, the key of the map will be used. 172 | - `cidr_block` = (Optional|string) IPv4 CIDR range. **Cannot set if vpc\_ipv4\_ipam\_pool\_id is set.** 173 | - `vpc_ipv4_ipam_pool_id` = (Optional|string) Set to use IPAM to get an IPv4 CIDR block. **Cannot set if cidr\_block is set.** 174 | - `vpc_ipv4_netmask_length` = (Optional|number) Set to use IPAM to get an IPv4 CIDR block using a specified netmask. Must be set with `var.vpc_ipv4_ipam_pool_id`. 175 | - `az_count` = (number) Searches the number of AZs in the region and takes a slice based on this number - the slice is sorted a-z. 176 | - `vpc_enable_dns_hostnames` = (Optional|bool) Indicates whether the instances launched in the VPC get DNS hostnames. Enabled by default. 177 | - `vpc_enable_dns_support` = (Optional|bool) Indicates whether the DNS resolution is supported for the VPC. If enabled, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC network range "plus two" succeed. If disabled, the Amazon provided DNS service in the VPC that resolves public DNS hostnames to IP addresses is not enabled. Enabled by default. 178 | - `vpc_instance_tenancy` = (Optional|string) The allowed tenancy of instances launched into the VPC. 179 | - `vpc_flow_logs` = (Optional|object(any)) Configuration of the VPC Flow Logs of the VPC configured. Options: "cloudwatch", "s3", "none". 180 | - `subnets` = (any) Configuration of the subnets to create in the VPC - a map of subnets' definition is expected. Depending the VPC type, the format (subnets to configure and resources created by the module) will be different. Check each Central VPC type section below. for more information. 181 | - `tags` = (Optional|map(string)) Tags to apply to all the Central VPC resources. 182 | 183 | To simplify the definition of this module, the following [VPC module](https://registry.terraform.io/modules/aws-ia/vpc/aws/latest) is used to create the VPC resources. We recommend to review its README to have more information about its inputs and outputs. 184 | 185 | ### Inspection VPC 186 | 187 | Defining the type **inspection** will create specific VPC subnets and routing to create a central Inspection VPC - specific for East/West traffic inspection. When defining the VPC subnets (attribute `subnets`) two keys are mandatory: **endpoints** - to place the [AWS Network Firewall](https://aws.amazon.com/network-firewall/) or [Gateway Load Balancer](https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/) endpoints - and **core\_network** - to place the Core Network attachment ENIs -. You are free to create additional subnets, but default configuration and VPC routing won't be created on them. 188 | 189 | When defining the subnets, the following attributes can be configured: 190 | 191 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 192 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 193 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 194 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core\_network* subnet type, these tags will be applied to the Core Network attachment. 195 | 196 | In addition, additional attributes can be configured for the **core\_network** subnet type: 197 | 198 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `true`. 199 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 200 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 201 | 202 | Regarding the VPC routing, a default route (0.0.0.0/0) is created in the **endpoints** route tables pointing to the Core Network attachment. 203 | 204 | ```hcl 205 | module "inspection_vpc" { 206 | source = "aws-ia/cloudwan/aws" 207 | version = "3.x.x" 208 | 209 | core_network_arn = module.cloud_wan.core_network.arn 210 | 211 | central_vpcs = { 212 | inspection-east-west = { 213 | type = "inspection" 214 | cidr_block = "10.10.0.0/24" 215 | az_count = 2 216 | 217 | subnets = { 218 | endpoints = { cidrs = ["10.10.0.0/28", "10.10.0.16/28"] } 219 | core_network = { 220 | cidrs = ["10.10.0.32/28", "10.10.0.48/28"] 221 | 222 | tags = { domain = "inspection" } 223 | } 224 | } 225 | } 226 | } 227 | } 228 | ``` 229 | 230 | ### Egress VPC 231 | 232 | Defining the type **egress** will create specific VPC subnets and routing to create a central Egress VPC. When defining the VPC subnets (attribute `subnets`) two keys are mandatory: **public** - to place the [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) or [NAT instances](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html) - and **core\_network** - to place the Core Network attachment ENIs -. You are free to create additional subnets, but default configuration and VPC routing won't be created on them. 233 | 234 | When defining the subnets, the following attributes can be configured: 235 | 236 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 237 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 238 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 239 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core\_network* subnet type, these tags will be applied to the Core Network attachment. 240 | 241 | In addition, additional attributes can be configured for both the **public** and **core\_network** subnet types: 242 | 243 | - Public subnets (*public*) 244 | - `nat_gateway_configuration` = (Optional|string) Determines if NAT Gateways should be created and in how many AZs. Valid values = `"none"`, `"single_az"`, `"all_azs"` (default). 245 | - `map_public_ip_on_launch` = (Optional|bool) Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default to `false`. 246 | - Core Network subnets (*core\_network*) 247 | - `connect_to_public_natgw` = (Optional|bool) Determines if a default route to NAT Gateways should be created. Defaults to `true`. 248 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`. 249 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 250 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 251 | 252 | Regarding the VPC routing, the default configuration of the `connect_to_public_natgw` attribute in the **core\_network** subnet type creates a default route (0.0.0.0/0) in the route tables to the NAT gateways. The CIDR block or Prefix List defined in `var.ipv4_network_definition` (required in this VPC type) will be used to create a VPC route to the Core Network in the **public** route tables. 253 | 254 | ```hcl 255 | module "egress_vpc" { 256 | source = "aws-ia/cloudwan/aws" 257 | version = "3.x.x" 258 | 259 | core_network_arn = module.cloud_wan.core_network.arn 260 | 261 | ipv4_network_definition = "10.0.0.0/8" 262 | 263 | central_vpcs = { 264 | central-egress = { 265 | type = "egress" 266 | cidr_block = "10.10.0.0/24" 267 | az_count = 2 268 | 269 | subnets = { 270 | public = { cidrs = ["10.10.0.0/28", "10.10.0.16/28"] } 271 | core_network = { 272 | cidrs = ["10.10.0.32/28", "10.10.0.48/28"] 273 | 274 | tags = { domain = "egress" } 275 | } 276 | } 277 | } 278 | } 279 | } 280 | ``` 281 | 282 | ### Egress VPC (with inspection) 283 | 284 | Defining the type **egress\_with\_inspection** will create specific VPC subnets and routing to create a central Egress VPC with subnets to add an inspection layer between the Core Network attachment and the public subnets - to inspect egress traffic. When defining the VPC subnets (attribute `subnets`) three keys are mandatory: 285 | 286 | - **public** to place the [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) or [NAT instances](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html) 287 | - **endpoints** to place the [AWS Network Firewall](https://aws.amazon.com/network-firewall/) or [Gateway Load Balancer](https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/) endpoints. 288 | - **core\_network** to place the Core Network attachment ENIs. 289 | 290 | You are free to create additional subnets, but default configuration and VPC routing won't be created on them. When defining the subnets, the following attributes can be configured: 291 | 292 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 293 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 294 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 295 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core\_network* subnet type, these tags will be applied to the Core Network attachment. 296 | 297 | In addition, additional attributes can be configured for the **public**, **endpoints**, and **core\_network** subnet types: 298 | 299 | - Public subnets (*public*) 300 | - `nat_gateway_configuration` = (Optional|string) Determines if NAT Gateways should be created and in how many AZs. Valid values = `"none"`, `"single_az"`, `"all_azs"` (default). 301 | - `map_public_ip_on_launch` = (Optional|bool) Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default to `false`. 302 | - Endpoint subnets (*endpoints*) 303 | - `connect_to_public_natgw` = (Optional|bool) Determines if routes to NAT Gateways should be created. Defaults to `true`. 304 | - Core Network subnets (*core\_network*) 305 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `true`. 306 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 307 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 308 | 309 | Regarding the VPC routing, the default configuration of the `connect_to_public_natgw` attribute in the **endpoints** subnet type creates a default route (0.0.0.0/0) in the route tables to the NAT gateways. The CIDR block or Prefix List defined in `var.ipv4_network_definition` (required in this VPC type) will be used to create a VPC route to the Core Network from the **endpoints** route tables. 310 | 311 | ```hcl 312 | module "egress_with_inspection_vpc" { 313 | source = "aws-ia/cloudwan/aws" 314 | version = "3.x.x" 315 | 316 | core_network_arn = module.cloud_wan.core_network.arn 317 | 318 | ipv4_network_definition = "10.0.0.0/8" 319 | 320 | central_vpcs = { 321 | central-egress-inspection = { 322 | type = "egress_with_inspection" 323 | cidr_block = "10.10.0.0/24" 324 | az_count = 2 325 | 326 | subnets = { 327 | public = { netmask = 28 } 328 | endpoints = { netmask = 28 } 329 | core_network = { 330 | netmask = 28 331 | 332 | tags = { domain = "egress" } 333 | } 334 | } 335 | } 336 | } 337 | } 338 | ``` 339 | 340 | ### Ingress VPC 341 | 342 | Defining the type **ingress** will create specific VPC subnets and routing to create a central Ingress VPC. When defining the VPC subnets (attribute `subnets`) two keys are mandatory: **public** - to place the [Elastic Load Balancers](https://aws.amazon.com/elasticloadbalancing/) or your own ingress solution - and **core\_network** - to place the Core Network attachment ENIs -. You are free to create additional subnets, but default configuration and VPC routing won't be created on them. 343 | 344 | When defining the subnets, the following attributes can be configured: 345 | 346 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 347 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 348 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 349 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core\_network* subnet type, these tags will be applied to the Core Network attachment. 350 | 351 | In addition, additional attributes can be configured for both the **public** and **core\_network** subnet types: 352 | 353 | - Public subnets (*public*) 354 | - `connect_to_igw` = (Optional|bool) Determines if the default route (0.0.0.0/0) is created in the public subnets with destination the Internet gateway. Defaults to `true`. 355 | - `map_public_ip_on_launch` = (Optional|bool) Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default to `false`. 356 | - Core Network subnets (*core\_network*) 357 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`. 358 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 359 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 360 | 361 | Regarding the VPC routing, the CIDR block or Prefix List defined in `var.ipv4_network_definition` (required in this VPC type) will be used to create a VPC route to the Core Network in the **public** route tables. 362 | 363 | ```hcl 364 | module "egress_with_inspection_vpc" { 365 | source = "aws-ia/cloudwan/aws" 366 | version = "3.x.x" 367 | 368 | core_network_arn = module.cloud_wan.core_network.arn 369 | 370 | ipv4_network_definition = "10.0.0.0/8" 371 | 372 | central_vpcs = { 373 | ingress = { 374 | type = "ingress" 375 | cidr_block = "10.10.0.0/24" 376 | az_count = 2 377 | 378 | subnets = { 379 | public = { netmask = 28 } 380 | core_network = { 381 | netmask = 28 382 | 383 | tags = { domain = "ingress" } 384 | } 385 | } 386 | } 387 | } 388 | } 389 | ``` 390 | 391 | ### Ingress VPC (with inspection) 392 | 393 | Defining the type **ingress\_with\_inspection** will create specific VPC subnets and routing to create a central Ingress VPC with subnets to add an inspection layer between the Internet gateway and the public subnets - to inspect ingress traffic. When defining the VPC subnets (attribute `subnets`) three keys are mandatory: 394 | 395 | - **endpoints** to place the [AWS Network Firewall](https://aws.amazon.com/network-firewall/) or [Gateway Load Balancer](https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/) endpoints. 396 | - **public** to place the [Elastic Load Balancers](https://aws.amazon.com/elasticloadbalancing/) or your own ingress solution. 397 | - **core\_network** to place the Core Network attachment ENIs. 398 | 399 | You are free to create additional subnets, but default configuration and VPC routing won't be created on them. When defining the subnets, the following attributes can be configured: 400 | 401 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 402 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 403 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 404 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core\_network* subnet type, these tags will be applied to the Core Network attachment. 405 | 406 | In addition, additional attributes can be configured for both the **public** and **core\_network** subnet types: 407 | 408 | - Public subnets (*public*) 409 | - `connect_to_igw` = (Optional|bool) Determines if the default route (0.0.0.0/0) is created in the public subnets with destination the Internet gateway. Defaults to `false`. 410 | - `map_public_ip_on_launch` = (Optional|bool) Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default to `false`. 411 | - Core Network subnets (*core\_network*) 412 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`. 413 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 414 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 415 | 416 | Regarding the VPC routing, the CIDR block or Prefix List defined in `var.ipv4_network_definition` (required in this VPC type) will be used to create a VPC route to the Core Network in the **public** route tables. 417 | 418 | ```hcl 419 | module "egress_with_inspection_vpc" { 420 | source = "aws-ia/cloudwan/aws" 421 | version = "3.x.x" 422 | 423 | core_network_arn = module.cloud_wan.core_network.arn 424 | 425 | ipv4_network_definition = "10.0.0.0/8" 426 | 427 | central_vpcs = { 428 | ingress-with-inspection = { 429 | type = "ingress_with_inspection" 430 | cidr_block = "10.10.0.0/24" 431 | az_count = 2 432 | 433 | subnets = { 434 | endpoints = { netmask = 28 } 435 | public = { netmask = 28 } 436 | core_network = { 437 | netmask = 28 438 | 439 | tags = { domain = "ingress" } 440 | } 441 | } 442 | } 443 | } 444 | } 445 | ``` 446 | 447 | ### Shared Services VPC 448 | 449 | Defining the type **shared\_services** will create specific VPC subnets and routing to create a central Shared Services VPC. When defining the VPC subnets (attribute `subnets`) the only mandatory key is **core\_network** - to place the Core Network attachment ENIs. When defining the subnets, the following attributes can be configured: 450 | 451 | - `cidrs` = (Optional|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of VPC Availability Zones in `az_count`. 452 | - `netmask` = (Optional|number) **Cannot set if `cidrs` is set.**. Netmask of VPC CIDR block to calculate for each subnet. 453 | - `name_prefix` = (Optional|string) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted. 454 | - `tags` = (Optional|map(string)) Tags to set on the subnet and associated resources. For example, for the *core\_network* subnet type, these tags will be applied to the Core Network attachment. 455 | 456 | In addition, additional attributes can be configured for both the **core\_network** subnet type: 457 | 458 | - `appliance_mode_support` = (Optional|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`. 459 | - `require_acceptance` = (Optional|bool) Whether the core network VPC attachment requires acceptance or not. Defaults to `false`. 460 | - `accept_attachment` = (Optional|bool) Whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`. 461 | 462 | Regarding the VPC routing, a default route (0.0.0.0/0) poiting to the Core Network attachment will be created in any private route table you create. 463 | 464 | ```hcl 465 | module "egress_with_inspection_vpc" { 466 | source = "aws-ia/cloudwan/aws" 467 | version = "3.x.x" 468 | 469 | core_network_arn = module.cloud_wan.core_network.arn 470 | 471 | central_vpcs = { 472 | shared-services = { 473 | type = "shared_services" 474 | cidr_block = "10.10.0.0/24" 475 | az_count = 2 476 | 477 | subnets = { 478 | vpc_endpoints = { netmask = 28 } 479 | hybrid_dns = { netmask = 28 } 480 | core_network = { 481 | netmask = 28 482 | 483 | tags = { domain = "shared" } 484 | } 485 | } 486 | } 487 | } 488 | } 489 | ``` 490 | 491 | ## AWS Network Firewall 492 | 493 | The variable `var.aws_network_firewall` allows the configuration of [AWS Network Firewall](https://aws.amazon.com/network-firewall/) resources in those central VPCs where inspection can be added - VPC types `inspection`, `egress_with_inspection` and `ingress_with_inspection`. As we use the following [AWS Network Firewall module](https://registry.terraform.io/modules/aws-ia/networkfirewall/aws/latest), the VPC routing pointing to the firewall endpoints is also abstracted. 494 | 495 | The variable expects a map containing the Network Firewall configuration to apply in each VPC. How do you make sure the Network Firewall resource (and VPC routing) is created in the corresponding central VPC? By using the same **key value** you used in `var.central_vpcs`. Each map definition expects the following attributes: 496 | 497 | - `name` = (string) Name of the AWS Network Firewall resource. 498 | - `description` = (string) Description of the AWS Network Firewall resource. 499 | - `policy_arn` = (string) ARN of the Network Firewall Policy. 500 | - `delete_protection` = (Optional|bool) Indicates whether it is possible to delete the firewall. Defaults to `false`. 501 | - `policy_change_protection` = (Optional|bool) Indicates whether it is possible to change the firewall policy. Defaults to `false`. 502 | - `subnet_change_protection` = (Optional|bool) Indicates whether it is possible to change the associated subnet(s) after creation. Defaults to `false`. 503 | - `tags` = (Optional|map(string)) Tags to apply to the AWS Network Firewall resource. 504 | 505 | ### Inspection VPC 506 | 507 | If you configure the creation of an AWS Network Firewall resource in an Inspection VPC (type `inspection`), the VPC routes created are the default ones (0.0.0.0/0) pointing to the firewall endpoints in the **core\_network** route tables. 508 | 509 | ```hcl 510 | module "cloudwan_central_vpcs" { 511 | source = "aws-ia/cloudwan/aws" 512 | version = "3.x.x" 513 | 514 | global_network = { 515 | description = "Global Network" 516 | 517 | tags = { 518 | Name = "global-network" 519 | } 520 | } 521 | 522 | core_network = { 523 | description = "Core Network" 524 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 525 | 526 | tags = { 527 | Name = "core-network" 528 | } 529 | } 530 | 531 | ipv4_network_definition = "10.0.0.0/8" 532 | central_vpcs = { 533 | inspection = { 534 | type = "inspection" 535 | cidr_block = "10.10.0.0/24" 536 | az_count = 2 537 | 538 | subnets = { 539 | endpoints = { netmask = 28 } 540 | core_network = { 541 | netmask = 28 542 | 543 | tags = { domain = "inspection" } 544 | } 545 | } 546 | } 547 | } 548 | 549 | aws_network_firewall = { 550 | inspection = { 551 | name = "anfw-inspection" 552 | description = "AWS Network Firewall - East/West" 553 | policy_arn = aws_networkfirewall_firewall_policy.policy.arn 554 | } 555 | } 556 | } 557 | ``` 558 | 559 | ### Egress VPC 560 | 561 | If you configure the creation of an AWS Network Firewall resource in an Egress VPC (type `egress_with_inspection`), the VPC routes created are: 562 | 563 | * Default route (0.0.0.0/0) pointing to the firewall endpoints in the **core\_network** route tables. 564 | * CIDR blocks provided in `var.ipv4_network_definition` pointing to the firewall endpoints in the **public** route tables. 565 | 566 | ```hcl 567 | module "cloudwan_central_vpcs" { 568 | source = "aws-ia/cloudwan/aws" 569 | version = "3.x.x" 570 | 571 | global_network = { 572 | description = "Global Network" 573 | 574 | tags = { 575 | Name = "global-network" 576 | } 577 | } 578 | 579 | core_network = { 580 | description = "Core Network" 581 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 582 | 583 | tags = { 584 | Name = "core-network" 585 | } 586 | } 587 | 588 | ipv4_network_definition = "10.0.0.0/8" 589 | central_vpcs = { 590 | egress-inspection = { 591 | type = "egress_with_inspection" 592 | cidr_block = "10.10.0.0/24" 593 | az_count = 2 594 | 595 | subnets = { 596 | public = { netmask = 28 } 597 | endpoints = { netmask = 28 } 598 | core_network = { 599 | netmask = 28 600 | 601 | tags = { domain = "egress" } 602 | } 603 | } 604 | } 605 | } 606 | 607 | aws_network_firewall = { 608 | egress-inspection = { 609 | name = "anfw-egress-inspection" 610 | description = "AWS Network Firewall - Egress" 611 | policy_arn = aws_networkfirewall_firewall_policy.policy.arn 612 | } 613 | } 614 | } 615 | ``` 616 | 617 | ### Ingress VPC 618 | 619 | If you configure the creation of an AWS Network Firewall resource in an Ingress VPC (type `ingress_with_inspection`), the following resources are created: 620 | 621 | * VPC route table associated to the Internet gateway. 622 | * Public subnet CIDR blocks pointing to the firewall endpoints in the IGW route table. 623 | * Default route (0.0.0.0/0) pointing to the firewall endpoints in the **public** route tables. 624 | 625 | ```hcl 626 | module "cloudwan_central_vpcs" { 627 | source = "aws-ia/cloudwan/aws" 628 | version = "3.x.x" 629 | 630 | global_network = { 631 | description = "Global Network" 632 | 633 | tags = { 634 | Name = "global-network" 635 | } 636 | } 637 | 638 | core_network = { 639 | description = "Core Network" 640 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 641 | 642 | tags = { 643 | Name = "core-network" 644 | } 645 | } 646 | 647 | ipv4_network_definition = "10.0.0.0/8" 648 | central_vpcs = { 649 | ingress-inspection = { 650 | type = "ingress_with_inspection" 651 | cidr_block = "10.10.0.0/24" 652 | az_count = 2 653 | 654 | subnets = { 655 | endpoints = { netmask = 28 } 656 | public = { netmask = 28 } 657 | core_network = { 658 | netmask = 28 659 | 660 | tags = { domain = "ingress" } 661 | } 662 | } 663 | } 664 | } 665 | 666 | aws_network_firewall = { 667 | ingress-inspection = { 668 | name = "anfw-ingress-inspection" 669 | description = "AWS Network Firewall - Ingress" 670 | policy_arn = aws_networkfirewall_firewall_policy.policy.arn 671 | } 672 | } 673 | } 674 | ``` 675 | 676 | ## Common questions 677 | 678 | ### How can I configure tags in the Core Network attachment? 679 | 680 | AWS Cloud WAN automates the association of an attachment to a specific segment, reducing the operational overhead specially in multi-Account environments. If you check how to define a [core network policy](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policies-json.html), you will see that the parameter **attachment-policies** is where you can define how to automate the associations. What can you use to define the attachment's association policy? You can use the Resource ID, Account ID, AWS Region, Attachment Type, and **Tags** - which is the common item to use. 681 | 682 | Now that we have explained the importance of tags when creating Core Network attachments, how can I create these tags using the module? As we use the following [VPC module](https://registry.terraform.io/modules/aws-ia/vpc/aws/latest) to create the central VPCs, the tags defined under the **core\_network** subnet type will be applied to the Core Network attachment. 683 | 684 | ```hcl 685 | core_network = { 686 | netmask = 28 687 | 688 | tags = { domain = "segment" } 689 | } 690 | ``` 691 | 692 | ### Should I create Central VPCs in the same module definition as the Core Network? 693 | 694 | This module has been created to be used once per AWS Region you are creating resources - only 1 provider can be configured. This means that, if you want to create Central VPCs in several AWS Regions, you should have 1 module definition per Region. What about the Global Network and Core Network? These resources are global, and they can be created using a provider definition from any Region - of course, where [Cloud WAN is available](https://docs.aws.amazon.com/network-manager/latest/cloudwan/what-is-cloudwan.html#cloudwan-available-regions). **Important to note that whatever Region you configure for the provider that creates the Cloud WAN resources, the [home region](https://docs.aws.amazon.com/network-manager/latest/cloudwan/what-is-cloudwan.html#cloudwan-home-region) will be US West (Oregon)**. 695 | 696 | Coming back to the question, our recommendation is to create the Global Network and Core Network in a different module definition than the Central VPCs - even if the provider you use to create the global resource is also used to create Central VPCs in that same Region. The main reason of the recommendation is to decouple the definition of global and regional resources. That said, if you want to use the same module definition to create global resources and central VPCs in the Region the provider has configured, the module will allow you to do it (and it's not an anti-pattern). 697 | 698 | ## Troubleshooting 699 | 700 | ### Creating Central VPCs with IPAM configuration - The "for\_each" map includes keys derived from resource attributes that cannot be determined until apply 701 | 702 | When creating Central VPCs referencing an IPAM pool ID, you get the following error: 703 | 704 | ``` 705 | The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource. 706 | When working with unknown values in for_each, it's better to define the map keys statically in your configuration and place apply-time results only in the map values. 707 | Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a second time to fully converge. 708 | ``` 709 | 710 | As described in the error itself, you first need to create the IPAM pool to then later create the VPCs. You can use the [target](https://developer.hashicorp.com/terraform/tutorials/state/resource-targeting) option if the IPAM resources are created in the same document (and state file) as the VPCs. 711 | 712 | ## Requirements 713 | 714 | | Name | Version | 715 | |------|---------| 716 | | [terraform](#requirement\_terraform) | >= 1.3.0 | 717 | | [aws](#requirement\_aws) | >= 5.21.0 | 718 | 719 | ## Providers 720 | 721 | | Name | Version | 722 | |------|---------| 723 | | [aws](#provider\_aws) | >= 5.21.0 | 724 | 725 | ## Modules 726 | 727 | | Name | Source | Version | 728 | |------|--------|---------| 729 | | [central\_vpcs](#module\_central\_vpcs) | aws-ia/vpc/aws | 4.4.4 | 730 | | [core\_network\_tags](#module\_core\_network\_tags) | aws-ia/label/aws | 0.0.6 | 731 | | [global\_network\_tags](#module\_global\_network\_tags) | aws-ia/label/aws | 0.0.6 | 732 | | [network\_firewall](#module\_network\_firewall) | aws-ia/networkfirewall/aws | 1.0.2 | 733 | | [public\_subnet\_cidrs](#module\_public\_subnet\_cidrs) | ./modules/subnet_cidrs | n/a | 734 | | [tags](#module\_tags) | aws-ia/label/aws | 0.0.6 | 735 | 736 | ## Resources 737 | 738 | | Name | Type | 739 | |------|------| 740 | | [aws_networkmanager_core_network.core_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_core_network) | resource | 741 | | [aws_networkmanager_core_network_policy_attachment.policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_core_network_policy_attachment) | resource | 742 | | [aws_networkmanager_global_network.global_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_global_network) | resource | 743 | | [aws_ram_principal_association.principal_association](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_principal_association) | resource | 744 | | [aws_ram_resource_association.resource_association](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_association) | resource | 745 | | [aws_ram_resource_share.resource_share](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share) | resource | 746 | | [aws_route_table.igw_route_table](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource | 747 | | [aws_route_table_association.igw_route_table_association](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource | 748 | | [aws_prefix_list.ipv4_network_definition](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/prefix_list) | data source | 749 | 750 | ## Inputs 751 | 752 | | Name | Description | Type | Default | Required | 753 | |------|-------------|------|---------|:--------:| 754 | | [aws\_network\_firewall](#input\_aws\_network\_firewall) | AWS Network Firewall configuration. This variable expect a map of Network Firewall definitions to create a firewall resource (and corresponding VPC routing to firewall endpoints) in the corresponding VPC. The central VPC to create the resources is specified by using the same map key as in var.central\_vpcs. Resources will be created only in VPC types `inspection`, `egress_with_inspection`, and `ingress_with_inspection`.
Each map item expects the following attributes:
- `name` = (string) Name of the AWS Network Firewall resource.
- `description` = (string) Description of the AWS Network Firewall resource.
- `policy_arn` = (string) ARN of the Network Firewall Policy.
- `delete_protection` = (Optional\|bool) Indicates whether it is possible to delete the firewall. Defaults to `false`.
- `policy_change_protection` = (Optional\|bool) Indicates whether it is possible to change the firewall policy. Defaults to `false`.
- `subnet_change_protection` = (Optional\|bool) Indicates whether it is possible to change the associated subnet(s) after creation. Defaults to `false`.
- `tags` = (Optional\|map(string)) Tags to apply to the AWS Network Firewall resource. | `any` | `{}` | no | 755 | | [central\_vpcs](#input\_central\_vpcs) | Central VPCs definition. This variable expects a map of VPCs. You can specify the following attributes:
- `type` = (string) VPC type (`inspection`, `egress`, `egress_with_inspection`, `ingress`, `ingress_with_inspection`, `shared_services`) - each one of them with a specific VPC routing. For more information about the configuration of each VPC type, check the README.
- `name` = (Optional\|string) Name of the VPC. If not defined, the key of the map will be used.
- `cidr_block` = (Optional\|string) IPv4 CIDR range. **Cannot set if vpc\_ipv4\_ipam\_pool\_id is set.**
- `vpc_ipv4_ipam_pool_id` = (Optional\|string) Set to use IPAM to get an IPv4 CIDR block. **Cannot set if cidr\_block is set.**
- `vpc_ipv4_netmask_length` = (Optional\|number) Set to use IPAM to get an IPv4 CIDR block using a specified netmask. Must be set with `var.vpc_ipv4_ipam_pool_id`.
- `az_count` = (number) Searches the number of AZs in the region and takes a slice based on this number - the slice is sorted a-z.
- `vpc_enable_dns_hostnames` = (Optional\|bool) Indicates whether the instances launched in the VPC get DNS hostnames. Enabled by default.
- `vpc_enable_dns_support` = (Optional\|bool) Indicates whether the DNS resolution is supported for the VPC. If enabled, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC network range "plus two" succeed. If disabled, the Amazon provided DNS service in the VPC that resolves public DNS hostnames to IP addresses is not enabled. Enabled by default.
- `vpc_instance_tenancy` = (Optional\|string) The allowed tenancy of instances launched into the VPC.
- `vpc_flow_logs` = (Optional\|object(any)) Configuration of the VPC Flow Logs of the VPC configured. Options: "cloudwatch", "s3", "none".
- `subnets` = (any) Configuration of the subnets to create in the VPC. Depending the VPC type, the format (subnets to configure and resources created by the module) will be different. Check the README for more information.
- `tags` = (Optional\|map(string)) Tags to apply to all the Central VPC resources. | `any` | `{}` | no | 756 | | [core\_network](#input\_core\_network) | Core Network definition - providing information to this variable will create a new Core Network. Conflicts with `var.core_network_arn`.
This variable expects the following attributes:
- `description` = (string) Core Network's description.
- `policy_document` = (any) Core Network's policy in JSON format.
- `resource_share_name` = (Optional\|string) AWS Resource Access Manager (RAM) Resource Share name. Providing this value, RAM resources will be created to share the Core Network with the principals indicated in `var.core_network.ram_share_principals`.
- `resource_share_allow_external_principals` = (Optional\|bool) Indicates whether principals outside your AWS Organization can be associated with a Resource Share.
- `ram_share_principals` = (Optional\|list(string)) List of principals (AWS Account or AWS Organization) to share the Core Network with.
- `tags` = (Optional\|map(string)) Tags to apply to the Core Network and RAM Resource Share (if created). | `any` | `{}` | no | 757 | | [core\_network\_arn](#input\_core\_network\_arn) | (Optional) Core Network ARN. Conflicts with `var.core_network`. | `string` | `null` | no | 758 | | [global\_network](#input\_global\_network) | Global Network definition - providing information to this variable will create a new Global Network. Conflicts with `var.global_network_id`.
This variable expects the following attributes:
- `description` = (string) Global Network's description.
- `tags` = (Optional\|map(string)) Tags to apply to the Global Network. | `any` | `{}` | no | 759 | | [global\_network\_id](#input\_global\_network\_id) | (Optional) Global Network ID. Conflicts with `var.global_network`. | `string` | `null` | no | 760 | | [ipv4\_network\_definition](#input\_ipv4\_network\_definition) | Definition of the IPv4 CIDR blocks of the AWS network - needed for the VPC routes in Ingress and Egress VPC types. You can specific either a CIDR range or a Prefix List ID. | `string` | `null` | no | 761 | | [tags](#input\_tags) | (Optional) Tags to apply to all resources. | `map(string)` | `{}` | no | 762 | 763 | ## Outputs 764 | 765 | | Name | Description | 766 | |------|-------------| 767 | | [aws\_network\_firewall](#output\_aws\_network\_firewall) | AWS Network Firewall. Full output of aws\_networkfirewall\_firewall. | 768 | | [central\_vpcs](#output\_central\_vpcs) | Central VPC information. Full output of VPC module - https://registry.terraform.io/modules/aws-ia/vpc/aws/latest. | 769 | | [core\_network](#output\_core\_network) | Core Network. Full output of aws\_networkmanager\_core\_network. | 770 | | [global\_network](#output\_global\_network) | Global Network. Full output of aws\_networkmanager\_global\_network. | 771 | | [ram\_resource\_share](#output\_ram\_resource\_share) | Resource Access Manager (RAM) Resource Share. Full output of aws\_ram\_resource\_share. | 772 | -------------------------------------------------------------------------------- /UPGRADE-GUIDE-1.0.md: -------------------------------------------------------------------------------- 1 | # Changes from 0.x to 1.x 2 | 3 | If you are using a version 0.x of this module and want to move to a version 1.x, you will find that we have migrated from using the [AWSCC](https://registry.terraform.io/providers/hashicorp/awscc/latest) provider to [AWS](https://registry.terraform.io/providers/hashicorp/aws/latest/docs) provider for the Global and Core Network resources. If you want to udpate the version without re-creating the resources, you need to proceed as follows: 4 | 5 | * First, add in your main.tf (or similar file) a new module definition. In this new definition you need to pass the current Global Network without creating a new one. 6 | 7 | ```hcl 8 | module "cloudwan" { 9 | source = "aws-ia/cloudwan/aws" 10 | version = "0.x.x" 11 | 12 | global_network = { 13 | create = true 14 | description = "Global Network - AWS CloudWAN Module" 15 | } 16 | core_network = { 17 | description = "Core Network - AWS CloudWAN Module" 18 | policy_document = data.aws_networkmanager_core_network_policy_document.main.json 19 | } 20 | 21 | tags = { 22 | Name = "create-global-network" 23 | } 24 | } 25 | 26 | module "new_cloudwan" { 27 | source = "aws-ia/cloudwan/aws" 28 | version = "1.x.x" 29 | 30 | global_network = { 31 | create = false 32 | id = "global-network-XXX" 33 | } 34 | core_network = { 35 | description = "Core Network - AWS CloudWAN Module" 36 | policy_document = data.aws_networkmanager_core_network_policy_document.main.json 37 | } 38 | 39 | tags = { 40 | Name = "create-global-network" 41 | } 42 | } 43 | ``` 44 | 45 | * Next, do a Terraform import for the new Global and Core Network resources. 46 | 47 | ``` 48 | terraform import module.new_cloudwan.aws_networkmanager_global_network.global_network[0] global-network-XXX 49 | terraform import module.new_cloudwan.aws_networkmanager_core_network.core_network core-network-XXX 50 | ``` 51 | 52 | * Now you can remove from the Terraform state the old resources 53 | 54 | ``` 55 | terraform state rm module.cloudwan.awscc_networkmanager_global_network.global_network[0] 56 | terraform state rm module.new_cloudwan.awscc_networkmanager_core_network.core_network 57 | ``` 58 | 59 | * Finally, you can remove the definition of the old module (the one using version 0.x) from your main.tf file (or similar) -------------------------------------------------------------------------------- /UPGRADE-GUIDE-2.0.md: -------------------------------------------------------------------------------- 1 | # Changes from 1.x to 2.x 2 | 3 | Changes from version 1 to version 2 of this module are minimal, and **don't entail any downtime**. However, check this guide to understand the new behavior. 4 | 5 | There's a new resource added - `aws_networkmanager_core_network_policy_attachment`- that doesn't create new resources, rather it decouples the creation of the Core Network to the policy document attachment. This is used to avoid circular dependencies when you reference Core Network attachment IDs in the policy document. 6 | 7 | So, if you move from version 1.x.x to 2.x.x and you do a `terraform plan`, you will see 1 new resource to be created. When doing a `terraform apply`, it will generate a new policy version in the Core Network containing the same policy you currently have (unless you apply changes). You won't have any disruption. 8 | 9 | If you want to avoid the creation of this resource and the generation of the new policy version, you can import the resource by doing: 10 | 11 | ``` 12 | terraform import module.cloudwan.aws_networkmanager_core_network_policy_attachment.policy_attachment core-network-XXX 13 | ``` 14 | 15 | If you do a `terraform plan`, you won't see any changes in the infrastructure. -------------------------------------------------------------------------------- /UPGRADE-GUIDE-3.0.md: -------------------------------------------------------------------------------- 1 | # Changes from 2.x to 3.x 2 | 3 | We are moving to version 3 of the module due we have introduced changes in the variables' definition - to simplify the module's functionality as we add new capabilities. With this change, now the creation of the Core Network is optional, which means in the Terraform state the Core Network will move from `` to ``. However, moving from version 2 to version 3 **won't entail any downtime** - as Terraform will automatically catch this change and update the Terraform state appropriately. 4 | 5 | ``` 6 | # module.cloud_wan.aws_networkmanager_core_network_policy_attachment.policy_attachment has moved to module.cloud_wan.aws_networkmanager_core_network_policy_attachment.policy_attachment[0] 7 | ``` 8 | 9 | This guide will explain how the module definition changes from version 2 to 3. 10 | 11 | ## Example 1: Creating both Global Network and Core Network using the module 12 | 13 | * Version 2.x.x 14 | 15 | ```hcl 16 | module "cloud_wan" { 17 | source = "aws-ia/cloudwan/aws" 18 | version = "2.0.0" 19 | 20 | global_network = { 21 | create = true 22 | description = "Global Network - ${var.identifier}" 23 | } 24 | 25 | core_network = { 26 | description = "Core Network - ${var.identifier}" 27 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 28 | } 29 | 30 | tags = { 31 | Name = var.identifier 32 | } 33 | } 34 | ``` 35 | 36 | * Version 3.x.x 37 | 38 | ```hcl 39 | module "cloud_wan" { 40 | source = "aws-ia/cloudwan/aws" 41 | version = "3.0.0" 42 | 43 | global_network = { 44 | description = "Global Network - ${var.identifier}" 45 | } 46 | 47 | core_network = { 48 | description = "Core Network - ${var.identifier}" 49 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 50 | } 51 | 52 | tags = { 53 | Name = var.identifier 54 | } 55 | } 56 | ``` 57 | 58 | ## Example 2: Creating Core Network using the module referencing an existing Global Network 59 | 60 | * Version 2.x.x 61 | 62 | ```hcl 63 | module "cloudwan" { 64 | source = "aws-ia/cloudwan/aws" 65 | version = "2.0.0" 66 | 67 | global_network = { 68 | create = false 69 | id = aws_networkmanager_global_network.global_network.id 70 | } 71 | 72 | core_network = { 73 | description = "Global Network - AWS CloudWAN Module" 74 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 75 | } 76 | 77 | tags = { 78 | Name = var.identifier 79 | } 80 | } 81 | ``` 82 | 83 | * Version 3.x.x 84 | 85 | ```hcl 86 | module "cloudwan" { 87 | source = "aws-ia/cloudwan/aws" 88 | version = "3.0.0" 89 | 90 | global_network_id = aws_networkmanager_global_network.global_network.id 91 | 92 | core_network = { 93 | description = "Global Network - AWS CloudWAN Module" 94 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 95 | } 96 | 97 | tags = { 98 | Name = var.identifier 99 | } 100 | } 101 | ``` -------------------------------------------------------------------------------- /data.tf: -------------------------------------------------------------------------------- 1 | # --- root/data.tf --- 2 | 3 | locals { 4 | # ---------- CREATION OF RESOURCES ---------- 5 | # Global Network & Core Network 6 | create_global_network = length(keys(var.global_network)) > 0 7 | create_core_network = length(keys(var.core_network)) > 0 8 | # Base Policy 9 | create_base_policy = (try(var.core_network.base_policy_document, null) == null) && (try(var.core_network.base_policy_regions, null) == null) ? false : true 10 | # RAM Resources 11 | create_ram_resources = try(var.core_network.resource_share_name, null) != null 12 | 13 | # ---------- CENTRAL VPC - SUBNETS CONFIGURATION ---------- 14 | subnets = { 15 | inspection = { 16 | endpoints = { name_prefix = "endpoints" } 17 | core_network = { appliance_mode_support = true } 18 | } 19 | egress = { 20 | public = { nat_gateway_configuration = "all_azs" } 21 | core_network = { 22 | appliance_mode_support = false 23 | connect_to_public_natgw = true 24 | } 25 | } 26 | egress_with_inspection = { 27 | public = { nat_gateway_configuration = "all_azs" } 28 | endpoints = { connect_to_public_natgw = true } 29 | core_network = { appliance_mode_support = true } 30 | } 31 | shared_services = { 32 | core_network = { appliance_mode_support = false } 33 | } 34 | ingress = { 35 | public = { nat_gateway_configuration = "none" } 36 | core_network = { appliance_mode_support = false } 37 | } 38 | ingress_with_inspection = { 39 | endpoints = { name_prefix = "endpoints" } 40 | public = { 41 | nat_gateway_configuration = "none" 42 | connect_to_igw = false 43 | } 44 | core_network = { appliance_mode_support = false } 45 | } 46 | } 47 | 48 | # ---------- CENTRAL VPC - CORE NETWORK ROUTES CONFIGURATION ---------- 49 | core_network_routes = { 50 | inspection = { endpoints = "0.0.0.0/0" } 51 | egress = { public = var.ipv4_network_definition } 52 | egress_with_inspection = { endpoints = var.ipv4_network_definition } 53 | ingress = { public = var.ipv4_network_definition } 54 | ingress_with_inspection = { public = var.ipv4_network_definition } 55 | } 56 | 57 | # ---------- AWS NETWORK FIREWALL ROUTING CONFIGURATION ---------- 58 | routing_configuration = merge(local.routing_configuration_inspection, local.routing_configuration_egress, local.routing_configuration_ingress) 59 | 60 | # Routing configuration - Inspection VPC 61 | routing_configuration_inspection = { for k, v in module.central_vpcs : k => { 62 | centralized_inspection_without_egress = { 63 | connectivity_subnet_route_tables = { for i, j in v.rt_attributes_by_type_by_az.core_network : i => j.id } 64 | } } 65 | if var.central_vpcs[k].type == "inspection" 66 | } 67 | 68 | # Routing configuration - Egress VPC with inspection 69 | routing_configuration_egress = { for k, v in module.central_vpcs : k => { 70 | centralized_inspection_with_egress = { 71 | connectivity_subnet_route_tables = { for i, j in v.rt_attributes_by_type_by_az.core_network : i => j.id } 72 | public_subnet_route_tables = { for i, j in v.rt_attributes_by_type_by_az.public : i => j.id } 73 | network_cidr_blocks = startswith(try(var.ipv4_network_definition, ""), "pl-") ? data.aws_prefix_list.ipv4_network_definition[0].cidr_blocks : [var.ipv4_network_definition] 74 | } } 75 | if var.central_vpcs[k].type == "egress_with_inspection" 76 | } 77 | 78 | # Routing configuration - Ingress VPC with inspection 79 | routing_configuration_ingress = { for k, v in module.central_vpcs : k => { 80 | single_vpc = { 81 | igw_route_table = aws_route_table.igw_route_table[k].id 82 | protected_subnet_route_tables = { for i, j in v.rt_attributes_by_type_by_az.public : i => j.id } 83 | protected_subnet_cidr_blocks = module.public_subnet_cidrs[k].subnet_cidrs 84 | } } 85 | if var.central_vpcs[k].type == "ingress_with_inspection" 86 | } 87 | } 88 | 89 | # ---------- PREFIX LIST TO LIST OF CIDRS ---------- 90 | # For AWS Network Firewall configuration (Egress with Inspection), a list of CIDRs is needed. If the IPv4 Network Definition passed is a prefix list, we need to translate 91 | data "aws_prefix_list" "ipv4_network_definition" { 92 | count = startswith(coalesce(var.ipv4_network_definition, " "), "pl-") ? 1 : 0 93 | 94 | prefix_list_id = var.ipv4_network_definition 95 | } 96 | 97 | # ---------- SANITIZES TAGS --------- 98 | module "tags" { 99 | source = "aws-ia/label/aws" 100 | version = "0.0.6" 101 | 102 | tags = var.tags 103 | } 104 | 105 | module "global_network_tags" { 106 | source = "aws-ia/label/aws" 107 | version = "0.0.6" 108 | 109 | tags = try(var.global_network.tags, {}) 110 | } 111 | 112 | module "core_network_tags" { 113 | source = "aws-ia/label/aws" 114 | version = "0.0.6" 115 | 116 | tags = try(var.core_network.tags, {}) 117 | } -------------------------------------------------------------------------------- /examples/basic/.header.md: -------------------------------------------------------------------------------- 1 | # AWS Cloud WAN Module - Example without a Network Manager Global Network created 2 | 3 | This example creates a Network Manager Global Network and Cloud WAN Core Network from scratch. 4 | 5 | ## Usage 6 | 7 | - Initialize Terraform using `terraform init`. 8 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 9 | - To delete everything, use `terraform destroy`. -------------------------------------------------------------------------------- /examples/basic/.terraform-docs.yaml: -------------------------------------------------------------------------------- 1 | formatter: markdown 2 | header-from: .header.md 3 | settings: 4 | anchor: true 5 | color: true 6 | default: true 7 | escape: true 8 | html: true 9 | indent: 2 10 | required: true 11 | sensitive: true 12 | type: true 13 | 14 | sort: 15 | enabled: true 16 | by: required 17 | 18 | output: 19 | file: README.md 20 | mode: replace 21 | -------------------------------------------------------------------------------- /examples/basic/README.md: -------------------------------------------------------------------------------- 1 | 2 | # AWS Cloud WAN Module - Example without a Network Manager Global Network created 3 | 4 | This example creates a Network Manager Global Network and Cloud WAN Core Network from scratch. 5 | 6 | ## Usage 7 | 8 | - Initialize Terraform using `terraform init`. 9 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 10 | - To delete everything, use `terraform destroy`. 11 | 12 | ## Requirements 13 | 14 | | Name | Version | 15 | |------|---------| 16 | | [terraform](#requirement\_terraform) | >= 1.3.0 | 17 | | [aws](#requirement\_aws) | >= 5.21.0 | 18 | 19 | ## Providers 20 | 21 | | Name | Version | 22 | |------|---------| 23 | | [aws](#provider\_aws) | >= 5.21.0 | 24 | 25 | ## Modules 26 | 27 | | Name | Source | Version | 28 | |------|--------|---------| 29 | | [cloud\_wan](#module\_cloud\_wan) | ../.. | n/a | 30 | 31 | ## Resources 32 | 33 | | Name | Type | 34 | |------|------| 35 | | [aws_networkmanager_core_network_policy_document.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document) | data source | 36 | 37 | ## Inputs 38 | 39 | | Name | Description | Type | Default | Required | 40 | |------|-------------|------|---------|:--------:| 41 | | [identifier](#input\_identifier) | Example identifier. | `string` | `"basic"` | no | 42 | 43 | ## Outputs 44 | 45 | | Name | Description | 46 | |------|-------------| 47 | | [core\_network\_id](#output\_core\_network\_id) | Core Network ID. | 48 | | [global\_network\_id](#output\_global\_network\_id) | Global Network ID. | 49 | -------------------------------------------------------------------------------- /examples/basic/main.tf: -------------------------------------------------------------------------------- 1 | # --- examples/basic/main.tf --- 2 | 3 | # Calling the CloudWAN Module - we are creating both the Global Network and the Core Network 4 | module "cloud_wan" { 5 | source = "../.." 6 | 7 | global_network = { 8 | description = "Global Network - ${var.identifier}" 9 | 10 | tags = { 11 | Name = "global-network" 12 | } 13 | } 14 | 15 | core_network = { 16 | description = "Core Network - ${var.identifier}" 17 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 18 | 19 | tags = { 20 | Name = "core-network" 21 | } 22 | } 23 | 24 | tags = { 25 | Project = var.identifier 26 | } 27 | } 28 | 29 | data "aws_networkmanager_core_network_policy_document" "policy" { 30 | core_network_configuration { 31 | vpn_ecmp_support = false 32 | asn_ranges = ["64515-64520"] 33 | edge_locations { 34 | location = "eu-west-1" 35 | } 36 | } 37 | 38 | segments { 39 | name = "shared" 40 | description = "SegmentForSharedServices" 41 | require_attachment_acceptance = true 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /examples/basic/outputs.tf: -------------------------------------------------------------------------------- 1 | # --- examples/basic/outputs.tf --- 2 | 3 | # Global Network ID 4 | output "global_network_id" { 5 | value = module.cloud_wan.global_network.id 6 | description = "Global Network ID." 7 | } 8 | 9 | # Core Network ID 10 | output "core_network_id" { 11 | value = module.cloud_wan.core_network.id 12 | description = "Core Network ID." 13 | } -------------------------------------------------------------------------------- /examples/basic/providers.tf: -------------------------------------------------------------------------------- 1 | # --- examples/basic/providers.tf --- 2 | 3 | terraform { 4 | required_version = ">= 1.3.0" 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.21.0" 9 | } 10 | } 11 | } 12 | 13 | provider "aws" {} 14 | -------------------------------------------------------------------------------- /examples/basic/variables.tf: -------------------------------------------------------------------------------- 1 | # --- examples/basic/variables.tf --- 2 | 3 | variable "identifier" { 4 | type = string 5 | description = "Example identifier." 6 | 7 | default = "basic" 8 | } -------------------------------------------------------------------------------- /examples/central_vpcs/.header.md: -------------------------------------------------------------------------------- 1 | # AWS Cloud WAN Module - Central VPCs example 2 | 3 | This example creates a Network Manager Global Network and Cloud WAN Core Network, with central VPCs (1 per each type). 4 | 5 | ## Usage 6 | 7 | - Initialize Terraform using `terraform init`. 8 | - First create the Global Network and Core Network using `terraform apply -target="module.cloud_wan"`. 9 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 10 | - To delete everything, use `terraform destroy`. -------------------------------------------------------------------------------- /examples/central_vpcs/.terraform-docs.yaml: -------------------------------------------------------------------------------- 1 | formatter: markdown 2 | header-from: .header.md 3 | settings: 4 | anchor: true 5 | color: true 6 | default: true 7 | escape: true 8 | html: true 9 | indent: 2 10 | required: true 11 | sensitive: true 12 | type: true 13 | 14 | sort: 15 | enabled: true 16 | by: required 17 | 18 | output: 19 | file: README.md 20 | mode: replace 21 | -------------------------------------------------------------------------------- /examples/central_vpcs/README.md: -------------------------------------------------------------------------------- 1 | 2 | # AWS Cloud WAN Module - Central VPCs example 3 | 4 | This example creates a Network Manager Global Network and Cloud WAN Core Network, with central VPCs (1 per each type). 5 | 6 | ## Usage 7 | 8 | - Initialize Terraform using `terraform init`. 9 | - First create the Global Network and Core Network using `terraform apply -target="module.cloud_wan"`. 10 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 11 | - To delete everything, use `terraform destroy`. 12 | 13 | ## Requirements 14 | 15 | | Name | Version | 16 | |------|---------| 17 | | [terraform](#requirement\_terraform) | >= 1.3.0 | 18 | | [aws](#requirement\_aws) | >= 5.21.0 | 19 | 20 | ## Providers 21 | 22 | | Name | Version | 23 | |------|---------| 24 | | [aws](#provider\_aws) | >= 5.21.0 | 25 | 26 | ## Modules 27 | 28 | | Name | Source | Version | 29 | |------|--------|---------| 30 | | [cloud\_wan](#module\_cloud\_wan) | ../.. | n/a | 31 | | [cwan\_central\_vpcs](#module\_cwan\_central\_vpcs) | ../.. | n/a | 32 | 33 | ## Resources 34 | 35 | | Name | Type | 36 | |------|------| 37 | | [aws_networkmanager_core_network_policy_document.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document) | data source | 38 | 39 | ## Inputs 40 | 41 | | Name | Description | Type | Default | Required | 42 | |------|-------------|------|---------|:--------:| 43 | | [aws\_region](#input\_aws\_region) | AWS Region. | `string` | `"eu-west-1"` | no | 44 | | [identifier](#input\_identifier) | Example identifier. | `string` | `"central-vpcs"` | no | 45 | 46 | ## Outputs 47 | 48 | | Name | Description | 49 | |------|-------------| 50 | | [central\_vpcs](#output\_central\_vpcs) | Central VPC IDs. | 51 | | [cloud\_wan](#output\_cloud\_wan) | AWS Cloud WAN resources. | 52 | -------------------------------------------------------------------------------- /examples/central_vpcs/main.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs/main.tf --- 2 | 3 | # AWS Cloud WAN module 4 | module "cloud_wan" { 5 | source = "../.." 6 | 7 | global_network = { 8 | description = "Global Network" 9 | 10 | tags = { 11 | Name = "global-network" 12 | } 13 | } 14 | 15 | core_network = { 16 | description = "Core Network" 17 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 18 | 19 | tags = { 20 | Name = "core-network" 21 | } 22 | } 23 | } 24 | 25 | module "cwan_central_vpcs" { 26 | source = "../.." 27 | 28 | core_network_arn = module.cloud_wan.core_network.arn 29 | 30 | ipv4_network_definition = "10.0.0.0/8" 31 | central_vpcs = { 32 | egress = { 33 | type = "egress" 34 | cidr_block = "10.10.0.0/24" 35 | az_count = 2 36 | 37 | subnets = { 38 | public = { cidrs = ["10.10.0.0/28", "10.10.0.16/28"] } 39 | core_network = { 40 | cidrs = ["10.10.0.32/28", "10.10.0.48/28"] 41 | 42 | tags = { domain = "egress" } 43 | } 44 | } 45 | } 46 | egress-with-inspection = { 47 | type = "egress_with_inspection" 48 | cidr_block = "10.10.1.0/24" 49 | az_count = 2 50 | 51 | subnets = { 52 | public = { netmask = 28 } 53 | endpoints = { netmask = 28 } 54 | core_network = { 55 | netmask = 28 56 | 57 | tags = { domain = "egress" } 58 | } 59 | } 60 | } 61 | shared-services = { 62 | type = "shared_services" 63 | cidr_block = "10.10.2.0/24" 64 | az_count = 2 65 | 66 | subnets = { 67 | vpc_endpoints = { netmask = 28 } 68 | hybrid_dns = { netmask = 28 } 69 | core_network = { 70 | netmask = 28 71 | 72 | tags = { domain = "shared" } 73 | } 74 | } 75 | } 76 | inspection = { 77 | type = "inspection" 78 | cidr_block = "10.10.3.0/24" 79 | az_count = 2 80 | 81 | subnets = { 82 | endpoints = { cidrs = ["10.10.3.0/28", "10.10.3.16/28"] } 83 | core_network = { 84 | cidrs = ["10.10.3.32/28", "10.10.3.48/28"] 85 | 86 | tags = { domain = "inspection" } 87 | } 88 | } 89 | } 90 | ingress = { 91 | type = "ingress" 92 | cidr_block = "10.10.4.0/24" 93 | az_count = 2 94 | 95 | subnets = { 96 | public = { netmask = 28 } 97 | core_network = { 98 | netmask = 28 99 | 100 | tags = { domain = "ingress" } 101 | } 102 | } 103 | } 104 | ingress-with-inspection = { 105 | type = "ingress_with_inspection" 106 | cidr_block = "10.10.5.0/24" 107 | az_count = 2 108 | 109 | subnets = { 110 | endpoints = { netmask = 28 } 111 | public = { netmask = 28 } 112 | core_network = { 113 | netmask = 28 114 | 115 | tags = { domain = "ingress" } 116 | } 117 | } 118 | } 119 | } 120 | } 121 | 122 | # Core Network policy 123 | locals { 124 | segments = ["egress", "ingress", "inspection", "shared"] 125 | } 126 | 127 | data "aws_networkmanager_core_network_policy_document" "policy" { 128 | core_network_configuration { 129 | vpn_ecmp_support = false 130 | asn_ranges = ["64515-64520"] 131 | edge_locations { 132 | location = var.aws_region 133 | } 134 | } 135 | 136 | dynamic "segments" { 137 | for_each = local.segments 138 | iterator = segment 139 | 140 | content { 141 | name = segment.value 142 | require_attachment_acceptance = false 143 | isolate_attachments = false 144 | } 145 | } 146 | 147 | attachment_policies { 148 | rule_number = 100 149 | condition_logic = "or" 150 | 151 | conditions { 152 | type = "tag-exists" 153 | key = "domain" 154 | } 155 | 156 | action { 157 | association_method = "tag" 158 | tag_value_of_key = "domain" 159 | } 160 | } 161 | } -------------------------------------------------------------------------------- /examples/central_vpcs/outputs.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs/outputs.tf --- 2 | 3 | output "cloud_wan" { 4 | description = "AWS Cloud WAN resources." 5 | value = { 6 | global_network = module.cloud_wan.global_network.id 7 | core_network = module.cloud_wan.core_network.id 8 | } 9 | } 10 | 11 | output "central_vpcs" { 12 | description = "Central VPC IDs." 13 | value = { for k, v in module.cwan_central_vpcs.central_vpcs : k => v.vpc_attributes.id } 14 | } -------------------------------------------------------------------------------- /examples/central_vpcs/providers.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs/providers.tf --- 2 | 3 | terraform { 4 | required_version = ">= 1.3.0" 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.21.0" 9 | } 10 | } 11 | } 12 | 13 | provider "aws" { 14 | region = var.aws_region 15 | } 16 | -------------------------------------------------------------------------------- /examples/central_vpcs/variables.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs_egress_shared_services/variables.tf --- 2 | 3 | variable "identifier" { 4 | type = string 5 | description = "Example identifier." 6 | 7 | default = "central-vpcs" 8 | } 9 | 10 | variable "aws_region" { 11 | type = string 12 | description = "AWS Region." 13 | 14 | default = "eu-west-1" 15 | } -------------------------------------------------------------------------------- /examples/central_vpcs_inspection/.header.md: -------------------------------------------------------------------------------- 1 | # AWS Cloud WAN Module - Central VPCs (with Inspection) example 2 | 3 | This example creates a Network Manager Global Network and Cloud WAN Core Network, with central VPCs (types *inspection*, *egress_with_inspection*, and *ingress_with_inspection*). AWS Network Firewall resource (and VPC routing) is created in each central VPC. 4 | 5 | ## Usage 6 | 7 | - Initialize Terraform using `terraform init`. 8 | - First create the Global Network and Core Network using `terraform apply -target="module.cloud_wan"`. 9 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 10 | - To delete everything, use `terraform destroy`. -------------------------------------------------------------------------------- /examples/central_vpcs_inspection/.terraform-docs.yaml: -------------------------------------------------------------------------------- 1 | formatter: markdown 2 | header-from: .header.md 3 | settings: 4 | anchor: true 5 | color: true 6 | default: true 7 | escape: true 8 | html: true 9 | indent: 2 10 | required: true 11 | sensitive: true 12 | type: true 13 | 14 | sort: 15 | enabled: true 16 | by: required 17 | 18 | output: 19 | file: README.md 20 | mode: replace 21 | -------------------------------------------------------------------------------- /examples/central_vpcs_inspection/README.md: -------------------------------------------------------------------------------- 1 | 2 | # AWS Cloud WAN Module - Central VPCs (with Inspection) example 3 | 4 | This example creates a Network Manager Global Network and Cloud WAN Core Network, with central VPCs (types *inspection*, *egress\_with\_inspection*, and *ingress\_with\_inspection*). AWS Network Firewall resource (and VPC routing) is created in each central VPC. 5 | 6 | ## Usage 7 | 8 | - Initialize Terraform using `terraform init`. 9 | - First create the Global Network and Core Network using `terraform apply -target="module.cloud_wan"`. 10 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 11 | - To delete everything, use `terraform destroy`. 12 | 13 | ## Requirements 14 | 15 | | Name | Version | 16 | |------|---------| 17 | | [terraform](#requirement\_terraform) | >= 1.3.0 | 18 | | [aws](#requirement\_aws) | >= 5.21.0 | 19 | 20 | ## Providers 21 | 22 | | Name | Version | 23 | |------|---------| 24 | | [aws](#provider\_aws) | >= 5.21.0 | 25 | | [http](#provider\_http) | n/a | 26 | 27 | ## Modules 28 | 29 | | Name | Source | Version | 30 | |------|--------|---------| 31 | | [cloud\_wan](#module\_cloud\_wan) | ../.. | n/a | 32 | | [cloudwan\_central\_vpcs](#module\_cloudwan\_central\_vpcs) | ../.. | n/a | 33 | 34 | ## Resources 35 | 36 | | Name | Type | 37 | |------|------| 38 | | [aws_networkfirewall_firewall_policy.egress_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy) | resource | 39 | | [aws_networkfirewall_firewall_policy.ingress_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy) | resource | 40 | | [aws_networkfirewall_firewall_policy.inspection_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy) | resource | 41 | | [aws_networkfirewall_rule_group.allow_domains](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_rule_group) | resource | 42 | | [aws_networkfirewall_rule_group.allow_east_west_https](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_rule_group) | resource | 43 | | [aws_networkfirewall_rule_group.allow_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_rule_group) | resource | 44 | | [aws_networkfirewall_rule_group.drop_remote](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_rule_group) | resource | 45 | | [aws_networkmanager_core_network_policy_document.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document) | data source | 46 | | [http_http.myip](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) | data source | 47 | 48 | ## Inputs 49 | 50 | | Name | Description | Type | Default | Required | 51 | |------|-------------|------|---------|:--------:| 52 | | [aws\_region](#input\_aws\_region) | AWS Region. | `string` | `"eu-west-1"` | no | 53 | | [identifier](#input\_identifier) | Example identifier. | `string` | `"central-vpcs-inspection"` | no | 54 | 55 | ## Outputs 56 | 57 | | Name | Description | 58 | |------|-------------| 59 | | [aws\_network\_firewall](#output\_aws\_network\_firewall) | AWS Network Firewall IDs. | 60 | | [central\_vpcs](#output\_central\_vpcs) | Central VPC IDs. | 61 | | [cloud\_wan](#output\_cloud\_wan) | AWS Cloud WAN resources. | 62 | -------------------------------------------------------------------------------- /examples/central_vpcs_inspection/firewall_policy.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs_inspection/firewall_policy.tf --- 2 | 3 | # ---------- NETWORK FIREWALL POLICY ---------- 4 | # Firewall policy - East/West traffic 5 | resource "aws_networkfirewall_firewall_policy" "inspection_policy" { 6 | name = "central-firewall-policy-${var.identifier}" 7 | 8 | firewall_policy { 9 | # Stateless configuration 10 | stateless_default_actions = ["aws:forward_to_sfe"] 11 | stateless_fragment_default_actions = ["aws:forward_to_sfe"] 12 | 13 | stateless_rule_group_reference { 14 | priority = 10 15 | resource_arn = aws_networkfirewall_rule_group.drop_remote.arn 16 | } 17 | 18 | # Stateful configuration 19 | stateful_engine_options { 20 | rule_order = "STRICT_ORDER" 21 | } 22 | stateful_default_actions = ["aws:drop_strict", "aws:alert_strict"] 23 | stateful_rule_group_reference { 24 | priority = 10 25 | resource_arn = aws_networkfirewall_rule_group.allow_domains.arn 26 | } 27 | } 28 | } 29 | 30 | # Firewall policy - Egress traffic 31 | resource "aws_networkfirewall_firewall_policy" "egress_policy" { 32 | name = "egress-firewall-policy-${var.identifier}" 33 | 34 | firewall_policy { 35 | # Stateless configuration 36 | stateless_default_actions = ["aws:forward_to_sfe"] 37 | stateless_fragment_default_actions = ["aws:forward_to_sfe"] 38 | 39 | stateless_rule_group_reference { 40 | priority = 10 41 | resource_arn = aws_networkfirewall_rule_group.drop_remote.arn 42 | } 43 | 44 | # Stateful configuration 45 | stateful_engine_options { 46 | rule_order = "STRICT_ORDER" 47 | } 48 | stateful_default_actions = ["aws:drop_strict", "aws:alert_strict"] 49 | stateful_rule_group_reference { 50 | priority = 10 51 | resource_arn = aws_networkfirewall_rule_group.allow_domains.arn 52 | } 53 | } 54 | } 55 | 56 | # Firewall policy - Ingress traffic 57 | resource "aws_networkfirewall_firewall_policy" "ingress_policy" { 58 | name = "ingress-firewall-policy-${var.identifier}" 59 | 60 | firewall_policy { 61 | # Stateless configuration 62 | stateless_default_actions = ["aws:forward_to_sfe"] 63 | stateless_fragment_default_actions = ["aws:forward_to_sfe"] 64 | 65 | stateless_rule_group_reference { 66 | priority = 10 67 | resource_arn = aws_networkfirewall_rule_group.drop_remote.arn 68 | } 69 | 70 | # Stateful configuration 71 | stateful_engine_options { 72 | rule_order = "STRICT_ORDER" 73 | } 74 | stateful_default_actions = ["aws:drop_strict", "aws:alert_strict"] 75 | stateful_rule_group_reference { 76 | priority = 10 77 | resource_arn = aws_networkfirewall_rule_group.allow_domains.arn 78 | } 79 | } 80 | } 81 | 82 | # Stateless Rule Group - Dropping SSH traffic 83 | resource "aws_networkfirewall_rule_group" "drop_remote" { 84 | capacity = 2 85 | name = "drop-remote-${var.identifier}" 86 | type = "STATELESS" 87 | rule_group { 88 | rules_source { 89 | stateless_rules_and_custom_actions { 90 | 91 | stateless_rule { 92 | priority = 1 93 | rule_definition { 94 | actions = ["aws:drop"] 95 | match_attributes { 96 | protocols = [6] 97 | source { 98 | address_definition = "0.0.0.0/0" 99 | } 100 | source_port { 101 | from_port = 0 102 | to_port = 65535 103 | } 104 | destination { 105 | address_definition = "0.0.0.0/0" 106 | } 107 | destination_port { 108 | from_port = 22 109 | to_port = 22 110 | } 111 | } 112 | } 113 | } 114 | } 115 | } 116 | } 117 | } 118 | 119 | # Stateful Rule Group - Allowing access to .amazon.com (HTTPS) 120 | resource "aws_networkfirewall_rule_group" "allow_domains" { 121 | capacity = 100 122 | name = "allow-domains-${var.identifier}" 123 | type = "STATEFUL" 124 | rule_group { 125 | rules_source { 126 | rules_string = < $EXTERNAL_NET 443 (msg:"Allowing TCP in port 443"; flow:not_established; sid:892123; rev:1;) 128 | pass tls any any -> $EXTERNAL_NET 443 (tls.sni; dotprefix; content:".amazon.com"; endswith; msg:"Allowing .amazon.com HTTPS requests"; sid:892125; rev:1;) 129 | EOF 130 | } 131 | stateful_rule_options { 132 | rule_order = "STRICT_ORDER" 133 | } 134 | } 135 | } 136 | 137 | # Stateful Rule Group - Allowing HTTPS connections between VPCs within the network 138 | resource "aws_networkfirewall_rule_group" "allow_east_west_https" { 139 | capacity = 100 140 | name = "allow-east-west-${var.identifier}" 141 | type = "STATEFUL" 142 | rule_group { 143 | rule_variables { 144 | ip_sets { 145 | key = "SUPERNET" 146 | ip_set { 147 | definition = ["10.0.0.0/8"] 148 | } 149 | } 150 | } 151 | rules_source { 152 | rules_string = < $SUPERNET 443 (msg:"Allowing TCP in port 443"; flow:not_established; sid:892123; rev:1;) 154 | pass tls $SUPERNET any -> $SUPERNET 443 (msg:"Allowing HTTPS requests"; sid:892125; rev:1;) 155 | EOF 156 | } 157 | stateful_rule_options { 158 | rule_order = "STRICT_ORDER" 159 | } 160 | } 161 | } 162 | 163 | # Stateful Rule Group - Allowing access to .amazon.com (HTTPS) 164 | resource "aws_networkfirewall_rule_group" "allow_ingress" { 165 | capacity = 100 166 | name = "allow-ingress-${var.identifier}" 167 | type = "STATEFUL" 168 | rule_group { 169 | rules_source { 170 | stateful_rule { 171 | action = "PASS" 172 | header { 173 | destination = "ANY" 174 | destination_port = "ANY" 175 | protocol = "HTTP" 176 | direction = "ANY" 177 | source_port = "ANY" 178 | source = local.ifconfig_co_json.ip 179 | } 180 | rule_option { 181 | keyword = "sid" 182 | settings = ["1"] 183 | } 184 | } 185 | } 186 | stateful_rule_options { 187 | rule_order = "STRICT_ORDER" 188 | } 189 | } 190 | } 191 | 192 | # My IP - for testing purposes 193 | data "http" "myip" { 194 | url = "https://ifconfig.co/json" 195 | request_headers = { 196 | Accept = "application/json" 197 | } 198 | } 199 | 200 | locals { 201 | ifconfig_co_json = jsondecode(data.http.myip.response_body) 202 | } -------------------------------------------------------------------------------- /examples/central_vpcs_inspection/main.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs_inspection/main.tf --- 2 | 3 | # AWS Cloud WAN module - Calling the module first time to create Global Network & Core Network 4 | module "cloud_wan" { 5 | source = "../.." 6 | 7 | global_network = { 8 | description = "Global Network" 9 | 10 | tags = { 11 | Name = "global-network" 12 | } 13 | } 14 | 15 | core_network = { 16 | description = "Core Network" 17 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 18 | 19 | tags = { 20 | Name = "core-network" 21 | } 22 | } 23 | } 24 | 25 | # AWS Cloud WAN module - Global Network, Core Network, and Central VPCs (with inspection) 26 | module "cloudwan_central_vpcs" { 27 | source = "../.." 28 | 29 | core_network_arn = module.cloud_wan.core_network.arn 30 | 31 | ipv4_network_definition = "10.0.0.0/8" 32 | central_vpcs = { 33 | inspection = { 34 | type = "inspection" 35 | cidr_block = "10.10.0.0/24" 36 | az_count = 2 37 | 38 | subnets = { 39 | endpoints = { netmask = 28 } 40 | core_network = { 41 | netmask = 28 42 | 43 | tags = { domain = "inspection" } 44 | } 45 | } 46 | } 47 | egress-inspection = { 48 | type = "egress_with_inspection" 49 | cidr_block = "10.10.2.0/24" 50 | az_count = 2 51 | 52 | subnets = { 53 | public = { netmask = 28 } 54 | endpoints = { netmask = 28 } 55 | core_network = { 56 | netmask = 28 57 | 58 | tags = { domain = "egress" } 59 | } 60 | } 61 | } 62 | ingress-inspection = { 63 | type = "ingress_with_inspection" 64 | cidr_block = "10.10.2.0/24" 65 | az_count = 2 66 | 67 | subnets = { 68 | endpoints = { netmask = 28 } 69 | public = { netmask = 28 } 70 | core_network = { 71 | netmask = 28 72 | 73 | tags = { domain = "ingress" } 74 | } 75 | } 76 | } 77 | } 78 | 79 | aws_network_firewall = { 80 | inspection = { 81 | name = "anfw-inspection" 82 | description = "AWS Network Firewall - East/West" 83 | policy_arn = aws_networkfirewall_firewall_policy.inspection_policy.arn 84 | } 85 | egress-inspection = { 86 | name = "anfw-egress-inspection" 87 | description = "AWS Network Firewall - Egress" 88 | policy_arn = aws_networkfirewall_firewall_policy.egress_policy.arn 89 | } 90 | ingress-inspection = { 91 | name = "anfw-ingress-inspection" 92 | description = "AWS Network Firewall - Ingress" 93 | policy_arn = aws_networkfirewall_firewall_policy.ingress_policy.arn 94 | } 95 | } 96 | } 97 | 98 | # Core Network policy 99 | locals { 100 | segments = ["prod", "inspection", "egress", "ingress"] 101 | } 102 | 103 | data "aws_networkmanager_core_network_policy_document" "policy" { 104 | core_network_configuration { 105 | vpn_ecmp_support = false 106 | asn_ranges = ["64515-64520"] 107 | edge_locations { 108 | location = var.aws_region 109 | } 110 | } 111 | 112 | dynamic "segments" { 113 | for_each = local.segments 114 | iterator = segment 115 | 116 | content { 117 | name = segment.value 118 | require_attachment_acceptance = false 119 | isolate_attachments = false 120 | } 121 | } 122 | 123 | attachment_policies { 124 | rule_number = 100 125 | condition_logic = "or" 126 | 127 | conditions { 128 | type = "tag-exists" 129 | key = "domain" 130 | } 131 | 132 | action { 133 | association_method = "tag" 134 | tag_value_of_key = "domain" 135 | } 136 | } 137 | } -------------------------------------------------------------------------------- /examples/central_vpcs_inspection/outputs.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs_inspection/outputs.tf --- 2 | 3 | output "cloud_wan" { 4 | description = "AWS Cloud WAN resources." 5 | value = { 6 | global_network = module.cloud_wan.global_network.id 7 | core_network = module.cloud_wan.core_network.id 8 | } 9 | } 10 | 11 | output "central_vpcs" { 12 | description = "Central VPC IDs." 13 | value = { for k, v in module.cloudwan_central_vpcs.central_vpcs : k => v.vpc_attributes.id } 14 | } 15 | 16 | output "aws_network_firewall" { 17 | description = "AWS Network Firewall IDs." 18 | value = { for k, v in module.cloudwan_central_vpcs.aws_network_firewall : k => v.id } 19 | } 20 | -------------------------------------------------------------------------------- /examples/central_vpcs_inspection/providers.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs/providers.tf --- 2 | 3 | terraform { 4 | required_version = ">= 1.3.0" 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.21.0" 9 | } 10 | } 11 | } 12 | 13 | provider "aws" { 14 | region = var.aws_region 15 | } 16 | -------------------------------------------------------------------------------- /examples/central_vpcs_inspection/variables.tf: -------------------------------------------------------------------------------- 1 | # --- examples/central_vpcs_inspection/variables.tf --- 2 | 3 | variable "identifier" { 4 | type = string 5 | description = "Example identifier." 6 | 7 | default = "central-vpcs-inspection" 8 | } 9 | 10 | variable "aws_region" { 11 | type = string 12 | description = "AWS Region." 13 | 14 | default = "eu-west-1" 15 | } -------------------------------------------------------------------------------- /examples/core_network_share/.header.md: -------------------------------------------------------------------------------- 1 | # AWS Cloud WAN Module - Sharing Core Network 2 | 3 | This example creates an AWS Network Manager Global Network and Core Network from scratch, sharing the Core Network with the AWS Account provided in the `aws_account_share` - we recommend the use of a *terraform.tfvars* file to indicate the AWS Account in your testing environment. 4 | 5 | **Remember that if you are using the AWS Cloud WAN to share the Core Network, you need to create the resources in us-east-1 (North Virginia)** 6 | 7 | ## Usage 8 | 9 | - Initialize Terraform using `terraform init`. 10 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 11 | - To delete everything, use `terraform destroy`. -------------------------------------------------------------------------------- /examples/core_network_share/.terraform-docs.yaml: -------------------------------------------------------------------------------- 1 | formatter: markdown 2 | header-from: .header.md 3 | settings: 4 | anchor: true 5 | color: true 6 | default: true 7 | escape: true 8 | html: true 9 | indent: 2 10 | required: true 11 | sensitive: true 12 | type: true 13 | 14 | sort: 15 | enabled: true 16 | by: required 17 | 18 | output: 19 | file: README.md 20 | mode: replace 21 | -------------------------------------------------------------------------------- /examples/core_network_share/README.md: -------------------------------------------------------------------------------- 1 | 2 | # AWS Cloud WAN Module - Sharing Core Network 3 | 4 | This example creates an AWS Network Manager Global Network and Core Network from scratch, sharing the Core Network with the AWS Account provided in the `aws_account_share` - we recommend the use of a *terraform.tfvars* file to indicate the AWS Account in your testing environment. 5 | 6 | **Remember that if you are using the AWS Cloud WAN to share the Core Network, you need to create the resources in us-east-1 (North Virginia)** 7 | 8 | ## Usage 9 | 10 | - Initialize Terraform using `terraform init`. 11 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 12 | - To delete everything, use `terraform destroy`. 13 | 14 | ## Requirements 15 | 16 | | Name | Version | 17 | |------|---------| 18 | | [terraform](#requirement\_terraform) | >= 1.3.0 | 19 | | [aws](#requirement\_aws) | >= 5.21.0 | 20 | 21 | ## Providers 22 | 23 | | Name | Version | 24 | |------|---------| 25 | | [aws](#provider\_aws) | >= 5.21.0 | 26 | 27 | ## Modules 28 | 29 | | Name | Source | Version | 30 | |------|--------|---------| 31 | | [cloud\_wan](#module\_cloud\_wan) | ../.. | n/a | 32 | 33 | ## Resources 34 | 35 | | Name | Type | 36 | |------|------| 37 | | [aws_networkmanager_core_network_policy_document.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document) | data source | 38 | 39 | ## Inputs 40 | 41 | | Name | Description | Type | Default | Required | 42 | |------|-------------|------|---------|:--------:| 43 | | [aws\_account\_share](#input\_aws\_account\_share) | AWS Account ID (to share the Core Network) | `string` | n/a | yes | 44 | | [aws\_region](#input\_aws\_region) | AWS Region. | `string` | `"us-east-1"` | no | 45 | | [identifier](#input\_identifier) | Example identifier. | `string` | `"core-network-share"` | no | 46 | 47 | ## Outputs 48 | 49 | | Name | Description | 50 | |------|-------------| 51 | | [core\_network\_id](#output\_core\_network\_id) | Core Network ID. | 52 | | [global\_network\_id](#output\_global\_network\_id) | Global Network ID. | 53 | | [ram\_resource\_share](#output\_ram\_resource\_share) | AWS RAM Resource Share. | 54 | -------------------------------------------------------------------------------- /examples/core_network_share/main.tf: -------------------------------------------------------------------------------- 1 | # --- examples/core_network_share/main.tf --- 2 | 3 | # AWS Cloud WAN module 4 | module "cloud_wan" { 5 | source = "../.." 6 | 7 | global_network = { 8 | description = "Global Network - ${var.identifier}" 9 | 10 | tags = { 11 | Name = "global-network" 12 | } 13 | } 14 | 15 | core_network = { 16 | description = "Core Network - ${var.identifier}" 17 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 18 | 19 | resource_share_name = var.identifier 20 | resource_share_allow_external_principals = true 21 | ram_share_principals = [var.aws_account_share] 22 | 23 | tags = { 24 | Name = "core-network" 25 | } 26 | } 27 | 28 | tags = { 29 | Project = var.identifier 30 | } 31 | } 32 | 33 | data "aws_networkmanager_core_network_policy_document" "policy" { 34 | core_network_configuration { 35 | vpn_ecmp_support = false 36 | asn_ranges = ["64515-64520"] 37 | edge_locations { 38 | location = var.aws_region 39 | } 40 | } 41 | 42 | segments { 43 | name = "shared" 44 | description = "SegmentForSharedServices" 45 | require_attachment_acceptance = true 46 | } 47 | } -------------------------------------------------------------------------------- /examples/core_network_share/outputs.tf: -------------------------------------------------------------------------------- 1 | # --- examples/core_network_share/outputs.tf --- 2 | 3 | # Global Network ID 4 | output "global_network_id" { 5 | value = module.cloud_wan.global_network.id 6 | description = "Global Network ID." 7 | } 8 | 9 | # Core Network ID 10 | output "core_network_id" { 11 | value = module.cloud_wan.core_network.id 12 | description = "Core Network ID." 13 | } 14 | 15 | # AWS RAM Resource Share 16 | output "ram_resource_share" { 17 | value = module.cloud_wan.ram_resource_share.arn 18 | description = "AWS RAM Resource Share." 19 | } -------------------------------------------------------------------------------- /examples/core_network_share/providers.tf: -------------------------------------------------------------------------------- 1 | # --- examples/core_network_share/providers.tf --- 2 | 3 | terraform { 4 | required_version = ">= 1.3.0" 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.21.0" 9 | } 10 | } 11 | } 12 | 13 | provider "aws" { 14 | region = var.aws_region 15 | } -------------------------------------------------------------------------------- /examples/core_network_share/variables.tf: -------------------------------------------------------------------------------- 1 | # --- examples/core_network_share/variables.tf --- 2 | 3 | variable "identifier" { 4 | type = string 5 | description = "Example identifier." 6 | 7 | default = "core-network-share" 8 | } 9 | 10 | variable "aws_region" { 11 | type = string 12 | description = "AWS Region." 13 | 14 | default = "us-east-1" 15 | } 16 | 17 | variable "aws_account_share" { 18 | type = string 19 | description = "AWS Account ID (to share the Core Network)" 20 | } -------------------------------------------------------------------------------- /examples/reference_global_network/.header.md: -------------------------------------------------------------------------------- 1 | # AWS Cloud WAN Module - Example with a Network Manager Global Network created 2 | 3 | This example creates a Cloud WAN Core Network from scratch. It supposes that a Network Manager Global Network is already created, so it takes the ID as parameter. 4 | 5 | ## Usage 6 | 7 | - Initialize Terraform using `terraform init`. 8 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 9 | - To delete everything, use `terraform destroy`. -------------------------------------------------------------------------------- /examples/reference_global_network/.terraform-docs.yaml: -------------------------------------------------------------------------------- 1 | formatter: markdown 2 | header-from: .header.md 3 | settings: 4 | anchor: true 5 | color: true 6 | default: true 7 | escape: true 8 | html: true 9 | indent: 2 10 | required: true 11 | sensitive: true 12 | type: true 13 | 14 | sort: 15 | enabled: true 16 | by: required 17 | 18 | output: 19 | file: README.md 20 | mode: replace 21 | -------------------------------------------------------------------------------- /examples/reference_global_network/README.md: -------------------------------------------------------------------------------- 1 | 2 | # AWS Cloud WAN Module - Example with a Network Manager Global Network created 3 | 4 | This example creates a Cloud WAN Core Network from scratch. It supposes that a Network Manager Global Network is already created, so it takes the ID as parameter. 5 | 6 | ## Usage 7 | 8 | - Initialize Terraform using `terraform init`. 9 | - Now you can deploy the rest of the infrastructure using `terraform apply`. 10 | - To delete everything, use `terraform destroy`. 11 | 12 | ## Requirements 13 | 14 | | Name | Version | 15 | |------|---------| 16 | | [terraform](#requirement\_terraform) | >= 1.3.0 | 17 | | [aws](#requirement\_aws) | >= 5.21.0 | 18 | 19 | ## Providers 20 | 21 | | Name | Version | 22 | |------|---------| 23 | | [aws](#provider\_aws) | >= 5.21.0 | 24 | 25 | ## Modules 26 | 27 | | Name | Source | Version | 28 | |------|--------|---------| 29 | | [cloudwan](#module\_cloudwan) | ../.. | n/a | 30 | 31 | ## Resources 32 | 33 | | Name | Type | 34 | |------|------| 35 | | [aws_networkmanager_global_network.global_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_global_network) | resource | 36 | | [aws_networkmanager_core_network_policy_document.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/networkmanager_core_network_policy_document) | data source | 37 | 38 | ## Inputs 39 | 40 | | Name | Description | Type | Default | Required | 41 | |------|-------------|------|---------|:--------:| 42 | | [identifier](#input\_identifier) | Example identifier. | `string` | `"reference-global-network"` | no | 43 | 44 | ## Outputs 45 | 46 | | Name | Description | 47 | |------|-------------| 48 | | [core\_network\_id](#output\_core\_network\_id) | Core Network ID. | 49 | | [global\_network\_id](#output\_global\_network\_id) | Global Network ID. | 50 | -------------------------------------------------------------------------------- /examples/reference_global_network/main.tf: -------------------------------------------------------------------------------- 1 | # --- examples/reference_global_network/main.tf --- 2 | 3 | # Creating Global Network outside the module 4 | resource "aws_networkmanager_global_network" "global_network" { 5 | description = "Global Network - ${var.identifier}" 6 | 7 | tags = { 8 | Name = "Global Network - ${var.identifier}" 9 | } 10 | } 11 | 12 | # AWS Cloud WAN module - creating Core Network 13 | module "cloudwan" { 14 | source = "../.." 15 | 16 | global_network_id = aws_networkmanager_global_network.global_network.id 17 | 18 | core_network = { 19 | description = "Global Network - AWS CloudWAN Module" 20 | policy_document = data.aws_networkmanager_core_network_policy_document.policy.json 21 | 22 | tags = { 23 | Name = "core-network" 24 | } 25 | } 26 | 27 | tags = { 28 | Project = var.identifier 29 | } 30 | } 31 | -------------------------------------------------------------------------------- /examples/reference_global_network/outputs.tf: -------------------------------------------------------------------------------- 1 | # --- examples/reference_global_network/outputs.tf --- 2 | 3 | # Global Network ID 4 | output "global_network_id" { 5 | value = aws_networkmanager_global_network.global_network.id 6 | description = "Global Network ID." 7 | } 8 | 9 | # Core Network ID 10 | output "core_network_id" { 11 | value = module.cloudwan.core_network.id 12 | description = "Core Network ID." 13 | } 14 | -------------------------------------------------------------------------------- /examples/reference_global_network/policy.tf: -------------------------------------------------------------------------------- 1 | # --- examples/reference_global_network/policy.tf --- 2 | 3 | # Core Network policy document - using the data source 4 | data "aws_networkmanager_core_network_policy_document" "policy" { 5 | 6 | core_network_configuration { 7 | vpn_ecmp_support = false 8 | asn_ranges = ["64512-64520"] 9 | edge_locations { 10 | location = "us-east-1" 11 | asn = 64512 12 | } 13 | edge_locations { 14 | location = "eu-west-1" 15 | asn = 64513 16 | } 17 | } 18 | 19 | segments { 20 | name = "prod" 21 | description = "Production traffic" 22 | require_attachment_acceptance = true 23 | } 24 | segments { 25 | name = "shared" 26 | description = "Shared Services" 27 | require_attachment_acceptance = false 28 | } 29 | 30 | segment_actions { 31 | action = "share" 32 | mode = "attachment-route" 33 | segment = "shared" 34 | share_with = ["*"] 35 | } 36 | 37 | attachment_policies { 38 | rule_number = 100 39 | condition_logic = "or" 40 | 41 | conditions { 42 | type = "tag-value" 43 | operator = "equals" 44 | key = "env" 45 | value = "shared" 46 | } 47 | action { 48 | association_method = "constant" 49 | segment = "shared" 50 | } 51 | } 52 | 53 | attachment_policies { 54 | rule_number = 200 55 | condition_logic = "or" 56 | 57 | conditions { 58 | type = "tag-value" 59 | operator = "equals" 60 | key = "env" 61 | value = "prod" 62 | } 63 | action { 64 | association_method = "constant" 65 | segment = "prod" 66 | } 67 | } 68 | } -------------------------------------------------------------------------------- /examples/reference_global_network/providers.tf: -------------------------------------------------------------------------------- 1 | # --- examples/reference_global_network/providers.tf --- 2 | 3 | terraform { 4 | required_version = ">= 1.3.0" 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.21.0" 9 | } 10 | } 11 | } 12 | 13 | provider "aws" {} 14 | -------------------------------------------------------------------------------- /examples/reference_global_network/variables.tf: -------------------------------------------------------------------------------- 1 | # --- examples/reference_global_network/variables.tf --- 2 | 3 | variable "identifier" { 4 | type = string 5 | description = "Example identifier." 6 | 7 | default = "reference-global-network" 8 | } -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | # --- root/main.tf --- 2 | 3 | # ---------- GLOBAL NETWORK ---------- 4 | resource "aws_networkmanager_global_network" "global_network" { 5 | count = local.create_global_network ? 1 : 0 6 | 7 | description = var.global_network.description 8 | 9 | tags = merge( 10 | module.tags.tags_aws, 11 | module.global_network_tags.tags_aws 12 | ) 13 | } 14 | 15 | # ---------- CORE NETWORK ---------- 16 | resource "aws_networkmanager_core_network" "core_network" { 17 | count = local.create_core_network ? 1 : 0 18 | 19 | description = var.core_network.description 20 | global_network_id = local.create_global_network ? aws_networkmanager_global_network.global_network[0].id : var.global_network_id 21 | 22 | create_base_policy = true 23 | base_policy_document = jsonencode({ 24 | for k, v in jsondecode(var.core_network.policy_document) : k => v 25 | if k == "version" || k == "core-network-configuration" || k == "segments" 26 | }) 27 | 28 | tags = merge( 29 | module.tags.tags_aws, 30 | module.core_network_tags.tags_aws 31 | ) 32 | } 33 | 34 | resource "aws_networkmanager_core_network_policy_attachment" "policy_attachment" { 35 | count = local.create_core_network ? 1 : 0 36 | 37 | core_network_id = aws_networkmanager_core_network.core_network[0].id 38 | policy_document = var.core_network.policy_document 39 | } 40 | 41 | # ---------- RAM SHARE (CORE NETWORK) ---------- 42 | # RAM Resource Share 43 | resource "aws_ram_resource_share" "resource_share" { 44 | count = local.create_ram_resources && local.create_core_network ? 1 : 0 45 | 46 | name = var.core_network.resource_share_name 47 | allow_external_principals = try(var.core_network.resource_share_allow_external_principals, null) 48 | 49 | tags = merge( 50 | module.tags.tags_aws, 51 | module.core_network_tags.tags_aws 52 | ) 53 | } 54 | 55 | # RAM Resource Association 56 | resource "aws_ram_resource_association" "resource_association" { 57 | count = local.create_ram_resources && local.create_core_network ? 1 : 0 58 | 59 | resource_arn = aws_networkmanager_core_network.core_network[0].arn 60 | resource_share_arn = aws_ram_resource_share.resource_share[0].arn 61 | } 62 | 63 | # RAM Principal Association 64 | resource "aws_ram_principal_association" "principal_association" { 65 | count = local.create_ram_resources && local.create_core_network ? length(try(var.core_network.ram_share_principals, [])) : 0 66 | 67 | principal = var.core_network.ram_share_principals[count.index] 68 | resource_share_arn = aws_ram_resource_share.resource_share[0].arn 69 | } 70 | 71 | # ---------- CENTRAL VPCS ---------- 72 | module "central_vpcs" { 73 | source = "aws-ia/vpc/aws" 74 | version = "4.4.4" 75 | for_each = try(var.central_vpcs, {}) 76 | 77 | name = try(each.value.name, each.key) 78 | cidr_block = try(each.value.cidr_block, null) 79 | az_count = each.value.az_count 80 | 81 | vpc_ipv4_ipam_pool_id = try(each.value.vpc_ipv4_ipam_pool_id, null) 82 | vpc_ipv4_netmask_length = try(each.value.vpc_ipv4_netmask_length, null) 83 | 84 | vpc_enable_dns_hostnames = try(each.value.vpc_enable_dns_hostnames, true) 85 | vpc_enable_dns_support = try(each.value.vpc_enable_dns_support, true) 86 | vpc_instance_tenancy = try(each.value.vpc_instance_tenancy, "default") 87 | 88 | vpc_flow_logs = try(each.value.vpc_flow_logs, { log_destination_type = "none" }) 89 | 90 | core_network = { 91 | arn = try(aws_networkmanager_core_network.core_network[0].arn, var.core_network_arn) 92 | id = try(aws_networkmanager_core_network.core_network[0].id, split("/", var.core_network_arn)[1]) 93 | } 94 | core_network_routes = each.value.type == "shared_services" ? { for k, v in each.value.subnets : k => "0.0.0.0/0" if k != "public" || k != "core_network" } : local.core_network_routes[each.value.type] 95 | 96 | subnets = merge( 97 | local.subnets[each.value.type], 98 | { for k, subnet in try(each.value.subnets, {}) : k => merge(try(local.subnets[each.value.type][k], {}), subnet) } 99 | ) 100 | 101 | tags = merge( 102 | module.tags.tags_aws, 103 | try(each.value.tags, {}) 104 | ) 105 | } 106 | 107 | # ---------- AWS NETWORK FIREWALL ---------- 108 | module "network_firewall" { 109 | source = "aws-ia/networkfirewall/aws" 110 | version = "1.0.2" 111 | for_each = { 112 | for k, v in try(var.central_vpcs, {}) : k => v 113 | if contains(["inspection", "egress_with_inspection", "ingress_with_inspection"], v.type) && contains(keys(var.aws_network_firewall), k) 114 | } 115 | 116 | network_firewall_name = var.aws_network_firewall[each.key].name 117 | network_firewall_description = var.aws_network_firewall[each.key].description 118 | network_firewall_policy = var.aws_network_firewall[each.key].policy_arn 119 | 120 | network_firewall_delete_protection = try(var.aws_network_firewall[each.key].delete_protection, false) 121 | network_firewall_policy_change_protection = try(var.aws_network_firewall[each.key].policy_change_protection, false) 122 | network_firewall_subnet_change_protection = try(var.aws_network_firewall[each.key].subnet_change_protection, false) 123 | 124 | vpc_id = module.central_vpcs[each.key].vpc_attributes.id 125 | vpc_subnets = { for k, v in module.central_vpcs[each.key].private_subnet_attributes_by_az : split("/", k)[1] => v.id if split("/", k)[0] == "endpoints" } 126 | number_azs = each.value.az_count 127 | 128 | routing_configuration = local.routing_configuration[each.key] 129 | 130 | tags = merge( 131 | module.tags.tags_aws, 132 | try(var.aws_network_firewall[each.key].tags, {}) 133 | ) 134 | } 135 | 136 | # For VPC type "ingress_with_inspection", IGW route table has to be created 137 | resource "aws_route_table" "igw_route_table" { 138 | for_each = { 139 | for k, v in module.central_vpcs : k => v 140 | if var.central_vpcs[k].type == "ingress_with_inspection" 141 | } 142 | 143 | vpc_id = each.value.vpc_attributes.id 144 | } 145 | 146 | resource "aws_route_table_association" "igw_route_table_association" { 147 | for_each = { 148 | for k, v in module.central_vpcs : k => v 149 | if var.central_vpcs[k].type == "ingress_with_inspection" 150 | } 151 | 152 | gateway_id = each.value.internet_gateway.id 153 | route_table_id = aws_route_table.igw_route_table[each.key].id 154 | } 155 | 156 | # For VPC type "ingress_with_inspection", we obtain the CIDR blocks of the public subnets 157 | module "public_subnet_cidrs" { 158 | source = "./modules/subnet_cidrs" 159 | for_each = { 160 | for k, v in module.central_vpcs : k => v 161 | if var.central_vpcs[k].type == "ingress_with_inspection" 162 | } 163 | 164 | subnet_ids = { for i, j in each.value.public_subnet_attributes_by_az : i => j.id } 165 | number_azs = var.central_vpcs[each.key].az_count 166 | } -------------------------------------------------------------------------------- /modules/subnet_cidrs/main.tf: -------------------------------------------------------------------------------- 1 | # --- modules/subnet_cidrs/main.tf --- 2 | 3 | locals { 4 | # List of Availability Zone IDs from map 5 | azs = keys(var.subnet_ids) 6 | # List of Subnet IDs from map 7 | subnet_ids = values(var.subnet_ids) 8 | } 9 | 10 | data "aws_subnet" "subnet" { 11 | count = var.number_azs 12 | 13 | id = local.subnet_ids[count.index] 14 | } -------------------------------------------------------------------------------- /modules/subnet_cidrs/outputs.tf: -------------------------------------------------------------------------------- 1 | # --- modules/subnet_cidrs/outputs.tf --- 2 | 3 | output "subnet_cidrs" { 4 | description = "VPC subnet CIDRs." 5 | value = zipmap(local.azs, data.aws_subnet.subnet[*].cidr_block) 6 | } -------------------------------------------------------------------------------- /modules/subnet_cidrs/providers.tf: -------------------------------------------------------------------------------- 1 | # --- modules/subnet_cidrs/providers.tf --- 2 | 3 | terraform { 4 | required_version = ">= 1.3.0" 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.21.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /modules/subnet_cidrs/variables.tf: -------------------------------------------------------------------------------- 1 | # --- modules/subnet_cidrs/variables.tf --- 2 | 3 | variable "subnet_ids" { 4 | description = "VPC subnet IDs." 5 | type = map(string) 6 | } 7 | 8 | variable "number_azs" { 9 | description = "Number of AZs in the VPC." 10 | type = string 11 | } -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | # --- root/outputs.tf --- 2 | 3 | # GLOBAL NETORK 4 | output "global_network" { 5 | value = local.create_global_network ? aws_networkmanager_global_network.global_network[0] : null 6 | description = "Global Network. Full output of aws_networkmanager_global_network." 7 | } 8 | 9 | # CORE NETWORK 10 | output "core_network" { 11 | value = local.create_core_network ? aws_networkmanager_core_network.core_network[0] : null 12 | description = "Core Network. Full output of aws_networkmanager_core_network." 13 | } 14 | 15 | # RESOURCE SHARE 16 | output "ram_resource_share" { 17 | value = local.create_ram_resources ? aws_ram_resource_share.resource_share[0] : null 18 | description = "Resource Access Manager (RAM) Resource Share. Full output of aws_ram_resource_share." 19 | } 20 | 21 | # CENTRAL VPCS 22 | output "central_vpcs" { 23 | value = try(module.central_vpcs, null) 24 | description = "Central VPC information. Full output of VPC module - https://registry.terraform.io/modules/aws-ia/vpc/aws/latest." 25 | } 26 | 27 | # AWS NETWORK FIREWALL 28 | output "aws_network_firewall" { 29 | value = { for k, v in try(module.network_firewall, {}) : k => v.aws_network_firewall } 30 | description = "AWS Network Firewall. Full output of aws_networkfirewall_firewall." 31 | } -------------------------------------------------------------------------------- /providers.tf: -------------------------------------------------------------------------------- 1 | # --- root/providers.tf --- 2 | 3 | terraform { 4 | required_version = ">= 1.3.0" 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.21.0" 9 | } 10 | } 11 | } -------------------------------------------------------------------------------- /tests/examples_basic.tftest.hcl: -------------------------------------------------------------------------------- 1 | run "validate" { 2 | command = apply 3 | module { 4 | source = "./examples/basic" 5 | } 6 | } -------------------------------------------------------------------------------- /tests/examples_central_vpcs.tftest.hcl: -------------------------------------------------------------------------------- 1 | run "core_network" { 2 | command = apply 3 | 4 | plan_options { 5 | target = [module.cloud_wan] 6 | } 7 | 8 | module { 9 | source = "./examples/central_vpcs" 10 | } 11 | } 12 | 13 | run "validate" { 14 | command = apply 15 | module { 16 | source = "./examples/central_vpcs" 17 | } 18 | } 19 | 20 | -------------------------------------------------------------------------------- /tests/examples_central_vpcs_inspection.hcl: -------------------------------------------------------------------------------- 1 | run "core_network" { 2 | command = apply 3 | 4 | plan_options { 5 | target = [module.cloud_wan] 6 | } 7 | 8 | module { 9 | source = "./examples/central_vpcs_inspection" 10 | } 11 | } 12 | 13 | run "validate" { 14 | command = apply 15 | module { 16 | source = "./examples/central_vpcs_inspection" 17 | } 18 | } -------------------------------------------------------------------------------- /tests/examples_core_network_share.tftest.hcl: -------------------------------------------------------------------------------- 1 | run "validate" { 2 | command = apply 3 | module { 4 | source = "./examples/core_network_share" 5 | } 6 | } -------------------------------------------------------------------------------- /tests/examples_reference_global_network.tftest.hcl: -------------------------------------------------------------------------------- 1 | run "validate" { 2 | command = apply 3 | module { 4 | source = "./examples/reference_global_network" 5 | } 6 | } -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | # --- root/variables.tf --- 2 | 3 | # ---------- GLOBAL NETWORK --------- 4 | variable "global_network_id" { 5 | type = string 6 | description = "(Optional) Global Network ID. Conflicts with `var.global_network`." 7 | default = null 8 | } 9 | 10 | variable "global_network" { 11 | description = <<-EOF 12 | Global Network definition - providing information to this variable will create a new Global Network. Conflicts with `var.global_network_id`. 13 | This variable expects the following attributes: 14 | - `description` = (string) Global Network's description. 15 | - `tags` = (Optional|map(string)) Tags to apply to the Global Network. 16 | EOF 17 | type = any 18 | default = {} 19 | 20 | validation { 21 | error_message = "Only valid key values for var.global_network: \"description\", \"tags\"." 22 | condition = length(setsubtract(keys(var.global_network), [ 23 | "description", 24 | "tags" 25 | ])) == 0 26 | } 27 | } 28 | 29 | # ---------- CORE NETWORK ---------- 30 | variable "core_network_arn" { 31 | type = string 32 | description = "(Optional) Core Network ARN. Conflicts with `var.core_network`." 33 | default = null 34 | } 35 | 36 | variable "core_network" { 37 | description = <<-EOF 38 | Core Network definition - providing information to this variable will create a new Core Network. Conflicts with `var.core_network_arn`. 39 | This variable expects the following attributes: 40 | - `description` = (string) Core Network's description. 41 | - `policy_document` = (any) Core Network's policy in JSON format. 42 | - `resource_share_name` = (Optional|string) AWS Resource Access Manager (RAM) Resource Share name. Providing this value, RAM resources will be created to share the Core Network with the principals indicated in `var.core_network.ram_share_principals`. 43 | - `resource_share_allow_external_principals` = (Optional|bool) Indicates whether principals outside your AWS Organization can be associated with a Resource Share. 44 | - `ram_share_principals` = (Optional|list(string)) List of principals (AWS Account or AWS Organization) to share the Core Network with. 45 | - `tags` = (Optional|map(string)) Tags to apply to the Core Network and RAM Resource Share (if created). 46 | EOF 47 | type = any 48 | default = {} 49 | 50 | validation { 51 | error_message = "Only valid key values for var.core_network: \"description\", \"policy_document\", \"base_policy_document\", \"base_policy_regions\", \"resource_share_name\", \"resource_share_allow_external_principals\", \"ram_share_principals\", \"tags\"." 52 | condition = length(setsubtract(keys(var.core_network), [ 53 | "description", 54 | "policy_document", 55 | "resource_share_name", 56 | "resource_share_allow_external_principals", 57 | "ram_share_principals", 58 | "tags" 59 | ])) == 0 60 | } 61 | } 62 | 63 | # ---------- CENTRAL VPCS ---------- 64 | variable "central_vpcs" { 65 | description = <<-EOF 66 | Central VPCs definition. This variable expects a map of VPCs. You can specify the following attributes: 67 | - `type` = (string) VPC type (`inspection`, `egress`, `egress_with_inspection`, `ingress`, `ingress_with_inspection`, `shared_services`) - each one of them with a specific VPC routing. For more information about the configuration of each VPC type, check the README. 68 | - `name` = (Optional|string) Name of the VPC. If not defined, the key of the map will be used. 69 | - `cidr_block` = (Optional|string) IPv4 CIDR range. **Cannot set if vpc_ipv4_ipam_pool_id is set.** 70 | - `vpc_ipv4_ipam_pool_id` = (Optional|string) Set to use IPAM to get an IPv4 CIDR block. **Cannot set if cidr_block is set.** 71 | - `vpc_ipv4_netmask_length` = (Optional|number) Set to use IPAM to get an IPv4 CIDR block using a specified netmask. Must be set with `var.vpc_ipv4_ipam_pool_id`. 72 | - `az_count` = (number) Searches the number of AZs in the region and takes a slice based on this number - the slice is sorted a-z. 73 | - `vpc_enable_dns_hostnames` = (Optional|bool) Indicates whether the instances launched in the VPC get DNS hostnames. Enabled by default. 74 | - `vpc_enable_dns_support` = (Optional|bool) Indicates whether the DNS resolution is supported for the VPC. If enabled, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC network range "plus two" succeed. If disabled, the Amazon provided DNS service in the VPC that resolves public DNS hostnames to IP addresses is not enabled. Enabled by default. 75 | - `vpc_instance_tenancy` = (Optional|string) The allowed tenancy of instances launched into the VPC. 76 | - `vpc_flow_logs` = (Optional|object(any)) Configuration of the VPC Flow Logs of the VPC configured. Options: "cloudwatch", "s3", "none". 77 | - `subnets` = (any) Configuration of the subnets to create in the VPC. Depending the VPC type, the format (subnets to configure and resources created by the module) will be different. Check the README for more information. 78 | - `tags` = (Optional|map(string)) Tags to apply to all the Central VPC resources. 79 | EOF 80 | type = any 81 | default = {} 82 | 83 | # Key values for Central VPCs 84 | validation { 85 | error_message = "Valid key values for Central VPCs: \"type\", \"name\", \"cidr_block\", \"az_count\", \"vpc_ipv4_ipam_pool_id\", \"vpc_ipv4_netmask_length\", \"vpc_enable_dns_hostnames\", \"vpc_enable_dns_support\", \"vpc_instance_tenancy\", \"subnets\", \"vpc_flow_logs\", \"tags\"." 86 | condition = alltrue([ 87 | for vpc in try(var.central_vpcs, {}) : length(setsubtract(keys(vpc), [ 88 | "type", 89 | "name", 90 | "cidr_block", 91 | "az_count", 92 | "vpc_ipv4_ipam_pool_id", 93 | "vpc_ipv4_netmask_length", 94 | "vpc_enable_dns_hostnames", 95 | "vpc_enable_dns_support", 96 | "vpc_instance_tenancy", 97 | "vpc_flow_logs", 98 | "subnets", 99 | "tags" 100 | ])) == 0 101 | ]) 102 | } 103 | 104 | # Valid VPC types 105 | validation { 106 | error_message = "Central VPC type can only be: \"egress\", \"inspection\", \"inspection_egress\", \"shared_services\", \"ingress\", \"inspection_ingress\"." 107 | condition = alltrue([ 108 | for vpc in try(var.central_vpcs, {}) : contains(["inspection", "egress", "egress_with_inspection", "shared_services", "ingress", "ingress_with_inspection"], vpc.type) 109 | ]) 110 | } 111 | } 112 | 113 | # ---------- NETWORK DEFINITION (IPV4) ---------- 114 | variable "ipv4_network_definition" { 115 | type = string 116 | description = "Definition of the IPv4 CIDR blocks of the AWS network - needed for the VPC routes in Ingress and Egress VPC types. You can specific either a CIDR range or a Prefix List ID." 117 | 118 | default = null 119 | } 120 | 121 | # ---------- AWS NETWORK FIREWALL ---------- 122 | variable "aws_network_firewall" { 123 | description = <<-EOF 124 | AWS Network Firewall configuration. This variable expect a map of Network Firewall definitions to create a firewall resource (and corresponding VPC routing to firewall endpoints) in the corresponding VPC. The central VPC to create the resources is specified by using the same map key as in var.central_vpcs. Resources will be created only in VPC types `inspection`, `egress_with_inspection`, and `ingress_with_inspection`. 125 | Each map item expects the following attributes: 126 | - `name` = (string) Name of the AWS Network Firewall resource. 127 | - `description` = (string) Description of the AWS Network Firewall resource. 128 | - `policy_arn` = (string) ARN of the Network Firewall Policy. 129 | - `delete_protection` = (Optional|bool) Indicates whether it is possible to delete the firewall. Defaults to `false`. 130 | - `policy_change_protection` = (Optional|bool) Indicates whether it is possible to change the firewall policy. Defaults to `false`. 131 | - `subnet_change_protection` = (Optional|bool) Indicates whether it is possible to change the associated subnet(s) after creation. Defaults to `false`. 132 | - `tags` = (Optional|map(string)) Tags to apply to the AWS Network Firewall resource. 133 | EOF 134 | type = any 135 | default = {} 136 | 137 | # Key values for AWS Network Firewall definitions 138 | validation { 139 | error_message = "Valid key values each AWS Network Firewall definition: \"name\", \"description\", \"policy_arn\", \"delete_protection\", \"policy_change_protection\", \"subnet_change_protection\", \"tags\"." 140 | condition = alltrue([ 141 | for vpc in try(var.aws_network_firewall, {}) : length(setsubtract(keys(vpc), [ 142 | "name", 143 | "description", 144 | "policy_arn", 145 | "delete_protection", 146 | "policy_change_protection", 147 | "subnet_change_protection", 148 | "tags" 149 | ])) == 0 150 | ]) 151 | } 152 | } 153 | 154 | # ---------- TAGS ---------- 155 | variable "tags" { 156 | description = "(Optional) Tags to apply to all resources." 157 | type = map(string) 158 | 159 | default = {} 160 | } 161 | --------------------------------------------------------------------------------