16 |
17 |
18 | 
19 |
20 |
21 | 
22 |
23 |
24 | 
25 |
26 |
27 |
28 | 8 | With our comprehensive DevOps toolkit - streamline operations, automate workflows, enhance collaboration and, most importantly, deploy with confidence. 9 |
10 | 11 | 12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
30 |
31 |
32 | 
33 |
34 |
35 | 
36 |
37 |
38 | 
39 |
40 |
41 | 
42 |
43 |
44 |
We are The Cloud Experts!
181 |We ❤️ Open Source and you can check out our other modules to get help with your new Cloud ideas.
183 | 184 | [website]: https://clouddrove.com 185 | [blog]: https://blog.clouddrove.com 186 | [slack]: https://www.launchpass.com/devops-talks 187 | [github]: https://github.com/clouddrove 188 | [linkedin]: https://cpco.io/linkedin 189 | [twitter]: https://twitter.com/clouddrove/ 190 | [email]: https://clouddrove.com/contact-us.html 191 | [terraform_modules]: https://github.com/clouddrove?utf8=%E2%9C%93&q=terraform-&type=&language= 192 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | # 3 | # This is the canonical configuration for the `README.md` 4 | # Run `make readme` to rebuild the `README.md` 5 | # 6 | 7 | # Name of this project 8 | name : Terraform AWS Subnet 9 | 10 | # License of this project 11 | license: "APACHE" 12 | 13 | # Canonical GitHub repo 14 | github_repo: clouddrove/terraform-aws-subnet 15 | 16 | # Badges to display 17 | badges: 18 | - name: "Latest Release" 19 | image: "https://img.shields.io/github/release/clouddrove/terraform-aws-subnet.svg" 20 | url: "https://github.com/clouddrove/terraform-aws-subnet/releases/latest" 21 | - name: "tfsec" 22 | image: "https://github.com/clouddrove/terraform-aws-subnet/actions/workflows/tfsec.yml/badge.svg" 23 | url: "https://github.com/clouddrove/terraform-aws-subnet/actions/workflows/tfsec.yml" 24 | - name: "Licence" 25 | image: "https://img.shields.io/badge/License-APACHE-blue.svg" 26 | url: "LICENSE.md" 27 | - name: "Changelog" 28 | image: "https://img.shields.io/badge/Changelog-blue" 29 | url: "CHANGELOG.md" 30 | 31 | prerequesties: 32 | - name: Terraform 33 | url: https://learn.hashicorp.com/terraform/getting-started/install.html 34 | version: ">= 1.6.6" 35 | 36 | providers: 37 | - name: aws 38 | url: https://aws.amazon.com/ 39 | version: ">= 5.31.0" 40 | 41 | module_dependencies: 42 | - name: Labels Module 43 | url: https://github.com/clouddrove/terraform-aws-labels 44 | description: Provides resource tagging. 45 | 46 | description: |- 47 | Terraform module to create public, private and public-private subnet with network acl, route table, Elastic IP, nat gateway, flow log. 48 | 49 | 50 | # How to use this project 51 | usage: |- 52 | Here are some examples of how you can use this module in your inventory structure: 53 | ### PRIVATE SUBNET 54 | ```hcl 55 | module "private-subnets" { 56 | source = "clouddrove/terraform-aws-subnet/aws" 57 | name = "subnets" 58 | environment = "test" 59 | nat_gateway_enabled = true 60 | availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] 61 | vpc_id = module.vpc.vpc_id 62 | type = "private" 63 | cidr_block = module.vpc.vpc_cidr_block 64 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 65 | public_subnet_ids = ["subnet-xxxxxxxxxxxx", "subnet-xxxxxxxxxxxx"] 66 | } 67 | ``` 68 | 69 | ### PUBLIC-PRIVATE SUBNET 70 | ```hcl 71 | module "subnets" { 72 | source = "clouddrove/terraform-aws-subnet/aws" 73 | name = "subnets" 74 | environment = "test" 75 | label_order = ["name", "environment"] 76 | nat_gateway_enabled = true 77 | availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] 78 | vpc_id = module.vpc.vpc_id 79 | type = "public-private" 80 | igw_id = module.vpc.igw_id 81 | cidr_block = module.vpc.vpc_cidr_block 82 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 83 | enable_ipv6 = true 84 | } 85 | ``` 86 | 87 | ### PUBLIC SUBNET 88 | ```hcl 89 | module "subnets" { 90 | source = "clouddrove/terraform-aws-subnet/aws" 91 | name = "subnets" 92 | environment = "test" 93 | label_order = ["name", "environment"] 94 | availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"] 95 | vpc_id = module.vpc.vpc_id 96 | type = "public" 97 | igw_id = module.vpc.igw_id 98 | ipv4_public_cidrs = ["10.0.1.0/24", "10.0.13.0/24", "10.0.18.0/24"] 99 | enable_ipv6 = false 100 | } 101 | ``` 102 | -------------------------------------------------------------------------------- /docs/io.md: -------------------------------------------------------------------------------- 1 | ## Inputs 2 | 3 | | Name | Description | Type | Default | Required | 4 | |------|-------------|------|---------|:--------:| 5 | | attributes | Additional attributes (e.g. `1`). | `list(any)` | `[]` | no | 6 | | availability\_zones | List of Availability Zones (e.g. `['us-east-1a', 'us-east-1b', 'us-east-1c']`). | `list(string)` | `[]` | no | 7 | | cidr\_block | Base CIDR block which is divided into subnet CIDR blocks (e.g. `10.0.0.0/16`). | `string` | `null` | no | 8 | | delimiter | Delimiter to be used between `organization`, `environment`, `name` and `attributes`. | `string` | `"-"` | no | 9 | | enable | Set to false to prevent the module from creating any resources. | `bool` | `true` | no | 10 | | enable\_flow\_log | Enable subnet\_flow\_log logs. | `bool` | `false` | no | 11 | | enable\_ipv6 | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block | `bool` | `false` | no | 12 | | enable\_private\_acl | Set to false to prevent the module from creating any resources. | `bool` | `true` | no | 13 | | enable\_public\_acl | Set to false to prevent the module from creating any resources. | `bool` | `true` | no | 14 | | environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `""` | no | 15 | | extra\_private\_tags | Additional private subnet tags. | `map(any)` | `{}` | no | 16 | | extra\_public\_tags | Additional public subnet tags. | `map(any)` | `{}` | no | 17 | | flow\_log\_destination\_arn | ARN of resource in which flow log will be sent. | `string` | `null` | no | 18 | | flow\_log\_destination\_type | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no | 19 | | flow\_log\_file\_format | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no | 20 | | flow\_log\_hive\_compatible\_partitions | (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3 | `bool` | `false` | no | 21 | | flow\_log\_iam\_role\_arn | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided | `string` | `null` | no | 22 | | flow\_log\_log\_format | The fields to include in the flow log record, in the order in which they should appear | `string` | `null` | no | 23 | | flow\_log\_max\_aggregation\_interval | The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: `60` seconds or `600` seconds | `number` | `600` | no | 24 | | flow\_log\_per\_hour\_partition | (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries | `bool` | `false` | no | 25 | | flow\_log\_traffic\_type | Type of traffic to capture. Valid values: ACCEPT,REJECT, ALL. | `string` | `"ALL"` | no | 26 | | igw\_id | Internet Gateway ID that is used as a default route when creating public subnets (e.g. `igw-9c26a123`). | `string` | `""` | no | 27 | | ipv4\_private\_cidrs | Subnet CIDR blocks (e.g. `10.0.0.0/16`). | `list(any)` | `[]` | no | 28 | | ipv4\_public\_cidrs | Subnet CIDR blocks (e.g. `10.0.0.0/16`). | `list(any)` | `[]` | no | 29 | | ipv6\_cidr\_block | Base CIDR block which is divided into subnet CIDR blocks (e.g. `10.0.0.0/16`). | `string` | `null` | no | 30 | | label\_order | Label order, e.g. `name`,`Environment`. | `list(any)` |[| no | 31 | | managedby | ManagedBy, eg 'CloudDrove'. | `string` | `"hello@clouddrove.com"` | no | 32 | | map\_public\_ip\_on\_launch | Specify true to indicate that instances launched into the public subnet should be assigned a public IP address. | `bool` | `false` | no | 33 | | name | Name (e.g. `prod-subnet` or `subnet`). | `string` | `""` | no | 34 | | nat\_gateway\_destination\_cidr\_block | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no | 35 | | nat\_gateway\_enabled | Flag to enable/disable NAT Gateways creation in public subnets. | `bool` | `false` | no | 36 | | private\_inbound\_acl\_rules | Private subnets inbound network ACLs | `list(map(string))` |
"name",
"environment"
]
[| no | 37 | | private\_ipv6\_cidrs | Private Subnet CIDR blocks (e.g. `2a05:d018:832:ca02::/64`). | `list(any)` | `[]` | no | 38 | | private\_outbound\_acl\_rules | Private subnets outbound network ACLs | `list(map(string))` |
{
"cidr_block": "0.0.0.0/0",
"from_port": 0,
"protocol": "-1",
"rule_action": "deny",
"rule_number": 100,
"to_port": 0
}
]
[| no | 39 | | private\_subnet\_assign\_ipv6\_address\_on\_creation | Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. | `bool` | `false` | no | 40 | | private\_subnet\_enable\_dns64 | Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true` | `bool` | `false` | no | 41 | | private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch | Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false` | `bool` | `false` | no | 42 | | private\_subnet\_enable\_resource\_name\_dns\_aaaa\_record\_on\_launch | Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true` | `bool` | `false` | no | 43 | | private\_subnet\_ipv6\_native | Indicates whether to create an IPv6-only private subnet. Default: `false` | `bool` | `false` | no | 44 | | private\_subnet\_private\_dns\_hostname\_type\_on\_launch | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no | 45 | | public\_inbound\_acl\_rules | Public subnets inbound network ACLs | `list(map(string))` |
{
"cidr_block": "0.0.0.0/0",
"from_port": 0,
"protocol": "-1",
"rule_action": "deny",
"rule_number": 100,
"to_port": 0
}
]
[| no | 46 | | public\_ipv6\_cidrs | Public Subnet CIDR blocks (e.g. `2a05:d018:832:ca02::/64`). | `list(any)` | `[]` | no | 47 | | public\_outbound\_acl\_rules | Public subnets outbound network ACLs | `list(map(string))` |
{
"cidr_block": "0.0.0.0/0",
"from_port": 0,
"protocol": "-1",
"rule_action": "allow",
"rule_number": 100,
"to_port": 0
}
]
[| no | 48 | | public\_rt\_ipv4\_destination\_cidr | The destination ipv4 CIDR block. | `string` | `"0.0.0.0/0"` | no | 49 | | public\_rt\_ipv6\_destination\_cidr | The destination ipv6 CIDR block. | `string` | `"::/0"` | no | 50 | | public\_subnet\_assign\_ipv6\_address\_on\_creation | Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. | `bool` | `false` | no | 51 | | public\_subnet\_enable\_dns64 | Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true` | `bool` | `false` | no | 52 | | public\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch | Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false` | `bool` | `false` | no | 53 | | public\_subnet\_enable\_resource\_name\_dns\_aaaa\_record\_on\_launch | Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true` | `bool` | `false` | no | 54 | | public\_subnet\_ids | A list of public subnet ids. | `list(string)` | `[]` | no | 55 | | public\_subnet\_ipv6\_native | Indicates whether to create an IPv6-only public subnet. Default: `false` | `bool` | `false` | no | 56 | | public\_subnet\_private\_dns\_hostname\_type\_on\_launch | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no | 57 | | repository | Terraform current module repo | `string` | `"https://github.com/clouddrove/terraform-aws-subnet"` | no | 58 | | single\_nat\_gateway | Enable for only single NAT Gateway in one Availability Zone | `bool` | `false` | no | 59 | | type | Type of subnets to create (`private` or `public`). | `string` | `""` | no | 60 | | vpc\_id | VPC ID. | `string` | n/a | yes | 61 | 62 | ## Outputs 63 | 64 | | Name | Description | 65 | |------|-------------| 66 | | nat\_gateway\_private\_ip | The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned. | 67 | | private\_acl | The ID of the network ACL. | 68 | | private\_route\_tables\_id | The ID of the routing table. | 69 | | private\_subnet\_cidrs | CIDR blocks of the created private subnets. | 70 | | private\_subnet\_cidrs\_ipv6 | CIDR blocks of the created private subnets. | 71 | | private\_subnet\_id | The ID of the private subnet. | 72 | | private\_tags | A mapping of private tags to assign to the resource. | 73 | | public\_acl | The ID of the network ACL. | 74 | | public\_route\_tables\_id | The ID of the routing table. | 75 | | public\_subnet\_cidrs | CIDR blocks of the created public subnets. | 76 | | public\_subnet\_cidrs\_ipv6 | CIDR blocks of the created public subnets. | 77 | | public\_subnet\_id | The ID of the subnet. | 78 | | public\_tags | A mapping of public tags to assign to the resource. | 79 | 80 | -------------------------------------------------------------------------------- /examples/basic/example.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | name = "app" 3 | environment = "test" 4 | } 5 | 6 | ##----------------------------------------------------------------------------- 7 | ## Subnet Module Call. 8 | ## Both private and public subnet will be deployed. 9 | ##----------------------------------------------------------------------------- 10 | #tfsec:ignore:aws-ec2-no-excessive-port-access 11 | #tfsec:ignore:aws-ec2-no-public-ingress-acl 12 | module "subnets" { 13 | source = "./../../" 14 | name = local.name 15 | environment = local.environment 16 | nat_gateway_enabled = true 17 | availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] 18 | vpc_id = "vpv_id-xxxxxxx" 19 | type = "public-private" 20 | igw_id = "vpc_igw_id-xxxxxxx" 21 | cidr_block = "10.0.0.0/16" 22 | enable_ipv6 = false 23 | } -------------------------------------------------------------------------------- /examples/basic/outputs.tf: -------------------------------------------------------------------------------- 1 | output "public_subnet_cidrs" { 2 | value = module.subnets.public_subnet_cidrs 3 | description = "The CIDR of the subnet." 4 | } 5 | 6 | output "public_subnet_cidrs_ipv6" { 7 | value = module.subnets.public_subnet_cidrs_ipv6 8 | description = "The CIDR of the subnet." 9 | } 10 | 11 | output "private_subnet_cidrs" { 12 | value = module.subnets.private_subnet_cidrs 13 | description = "The CIDR of the subnet." 14 | } 15 | 16 | output "private_subnet_cidrs_ipv6" { 17 | value = module.subnets.private_subnet_cidrs_ipv6 18 | description = "The CIDR of the subnet." 19 | } 20 | 21 | output "private_tags" { 22 | value = module.subnets.private_tags 23 | description = "A mapping of tags to assign to the resource." 24 | } 25 | 26 | output "public_tags" { 27 | value = module.subnets.public_tags 28 | description = "A mapping of tags to assign to the resource." 29 | } 30 | 31 | output "public_subnet_id" { 32 | value = module.subnets.private_subnet_id 33 | description = "The ID of the public subnet" 34 | } 35 | 36 | output "nat_gateway_private_ip" { 37 | value = module.subnets.nat_gateway_private_ip 38 | description = "The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned." 39 | } 40 | -------------------------------------------------------------------------------- /examples/basic/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /examples/complete/example.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = local.region 3 | } 4 | 5 | locals { 6 | name = "app" 7 | environment = "test" 8 | region = "eu-west-1" 9 | } 10 | 11 | ##----------------------------------------------------------------------------- 12 | ## Vpc Module call. 13 | ##----------------------------------------------------------------------------- 14 | module "vpc" { 15 | source = "clouddrove/vpc/aws" 16 | version = "2.0.0" 17 | 18 | enable = true 19 | name = local.name 20 | environment = local.environment 21 | 22 | cidr_block = "10.0.0.0/16" 23 | enable_flow_log = true # Flow logs will be stored in cloudwatch log group. Variables passed in default. 24 | create_flow_log_cloudwatch_iam_role = true 25 | additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"] 26 | dhcp_options_domain_name = "service.consul" 27 | dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"] 28 | assign_generated_ipv6_cidr_block = true 29 | } 30 | 31 | ##----------------------------------------------------------------------------- 32 | ## Subnet Module call. 33 | ## Below module will deploy both public and private subnets. 34 | ##----------------------------------------------------------------------------- 35 | #tfsec:ignore:aws-ec2-no-excessive-port-access 36 | #tfsec:ignore:aws-ec2-no-public-ingress-acl 37 | module "subnets" { 38 | source = "./../../" 39 | 40 | enable = true 41 | name = local.name 42 | environment = local.environment 43 | 44 | nat_gateway_enabled = true 45 | single_nat_gateway = true 46 | availability_zones = ["${local.region}a", "${local.region}b", "${local.region}c"] 47 | vpc_id = module.vpc.vpc_id 48 | type = "public-private" 49 | igw_id = module.vpc.igw_id 50 | cidr_block = module.vpc.vpc_cidr_block 51 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 52 | public_subnet_assign_ipv6_address_on_creation = true 53 | enable_ipv6 = true 54 | private_subnet_assign_ipv6_address_on_creation = true 55 | private_inbound_acl_rules = [ 56 | { 57 | rule_number = 100 58 | rule_action = "allow" 59 | from_port = 0 60 | to_port = 0 61 | protocol = "-1" 62 | cidr_block = module.vpc.vpc_cidr_block 63 | } 64 | ] 65 | private_outbound_acl_rules = [ 66 | { 67 | rule_number = 100 68 | rule_action = "allow" 69 | from_port = 0 70 | to_port = 0 71 | protocol = "-1" 72 | cidr_block = module.vpc.vpc_cidr_block 73 | } 74 | ] 75 | } 76 | -------------------------------------------------------------------------------- /examples/complete/outputs.tf: -------------------------------------------------------------------------------- 1 | output "public_subnet_cidrs" { 2 | value = module.subnets.public_subnet_cidrs 3 | description = "The CIDR of the subnet." 4 | } 5 | 6 | output "public_subnet_cidrs_ipv6" { 7 | value = module.subnets.public_subnet_cidrs_ipv6 8 | description = "The CIDR of the subnet." 9 | } 10 | 11 | output "private_subnet_cidrs" { 12 | value = module.subnets.private_subnet_cidrs 13 | description = "The CIDR of the subnet." 14 | } 15 | 16 | output "private_subnet_cidrs_ipv6" { 17 | value = module.subnets.private_subnet_cidrs_ipv6 18 | description = "The CIDR of the subnet." 19 | } 20 | 21 | output "private_tags" { 22 | value = module.subnets.private_tags 23 | description = "A mapping of tags to assign to the resource." 24 | } 25 | 26 | output "public_tags" { 27 | value = module.subnets.public_tags 28 | description = "A mapping of tags to assign to the resource." 29 | } 30 | 31 | output "public_subnet_id" { 32 | value = module.subnets.private_subnet_id 33 | description = "The ID of the public subnet" 34 | } 35 | 36 | output "nat_gateway_private_ip" { 37 | value = module.subnets.nat_gateway_private_ip 38 | description = "The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned." 39 | } 40 | -------------------------------------------------------------------------------- /examples/complete/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /examples/private-subnet/example.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = "eu-west-1" 3 | } 4 | 5 | locals { 6 | name = "app" 7 | environment = "test" 8 | } 9 | 10 | ##----------------------------------------------------------------------------- 11 | ## Vpc Module call. 12 | ##----------------------------------------------------------------------------- 13 | module "vpc" { 14 | source = "clouddrove/vpc/aws" 15 | version = "2.0.0" 16 | name = local.name 17 | environment = local.environment 18 | cidr_block = "10.0.0.0/16" 19 | enable_flow_log = true # Flow logs will be stored in cloudwatch log group. Variables passed in default. 20 | create_flow_log_cloudwatch_iam_role = true 21 | additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"] 22 | dhcp_options_domain_name = "service.consul" 23 | dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"] 24 | assign_generated_ipv6_cidr_block = true 25 | } 26 | 27 | ##----------------------------------------------------------------------------- 28 | ## Subnet Module call. 29 | ## Below module will deploy only private subnet. 30 | ##----------------------------------------------------------------------------- 31 | #tfsec:ignore:aws-ec2-no-excessive-port-access 32 | #tfsec:ignore:aws-ec2-no-public-ingress-acl 33 | module "private-subnets" { 34 | source = "./../../" 35 | name = local.name 36 | environment = local.environment 37 | nat_gateway_enabled = true 38 | availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] 39 | vpc_id = module.vpc.vpc_id 40 | type = "private" 41 | cidr_block = module.vpc.vpc_cidr_block 42 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 43 | public_subnet_ids = ["subnet-xxxxxxx", "subnet-xxxxxxx"] 44 | } 45 | -------------------------------------------------------------------------------- /examples/private-subnet/outputs.tf: -------------------------------------------------------------------------------- 1 | output "private_subnet_cidrs" { 2 | value = module.private-subnets.private_subnet_cidrs 3 | description = "The ID of the subnet." 4 | } 5 | 6 | output "private_tags" { 7 | value = module.private-subnets.private_tags 8 | description = "A mapping of tags to assign to the resource." 9 | } 10 | output "nat_gateway_private_ip" { 11 | value = module.private-subnets.nat_gateway_private_ip 12 | description = "The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned." 13 | } 14 | 15 | -------------------------------------------------------------------------------- /examples/private-subnet/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /examples/public-private-subnet-single-nat-gateway/example.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = "eu-west-1" 3 | } 4 | 5 | locals { 6 | name = "app" 7 | environment = "test" 8 | } 9 | 10 | ##----------------------------------------------------------------------------- 11 | ## Vpc Module call. 12 | ##----------------------------------------------------------------------------- 13 | module "vpc" { 14 | source = "clouddrove/vpc/aws" 15 | version = "2.0.0" 16 | name = local.name 17 | environment = local.environment 18 | cidr_block = "10.0.0.0/16" 19 | enable_flow_log = true # Flow logs will be stored in cloudwatch log group. Variables passed in default. 20 | create_flow_log_cloudwatch_iam_role = true 21 | additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"] 22 | dhcp_options_domain_name = "service.consul" 23 | dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"] 24 | assign_generated_ipv6_cidr_block = true 25 | } 26 | 27 | ##----------------------------------------------------------------------------- 28 | ## Subnet Module call. 29 | ## Below module will deploy both public and private subnets with single nat gateway. 30 | ##----------------------------------------------------------------------------- 31 | #tfsec:ignore:aws-ec2-no-excessive-port-access 32 | #tfsec:ignore:aws-ec2-no-public-ingress-acl 33 | module "subnets" { 34 | source = "./../../" 35 | nat_gateway_enabled = true 36 | single_nat_gateway = true 37 | name = local.name 38 | environment = local.environment 39 | availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] 40 | vpc_id = module.vpc.vpc_id 41 | type = "public-private" 42 | igw_id = module.vpc.igw_id 43 | cidr_block = module.vpc.vpc_cidr_block 44 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 45 | enable_ipv6 = false 46 | } 47 | -------------------------------------------------------------------------------- /examples/public-private-subnet-single-nat-gateway/outputs.tf: -------------------------------------------------------------------------------- 1 | output "public_subnet_cidrs" { 2 | value = module.subnets.public_subnet_cidrs 3 | description = "The CIDR of the subnet." 4 | } 5 | 6 | output "public_subnet_cidrs_ipv6" { 7 | value = module.subnets.public_subnet_cidrs_ipv6 8 | description = "The CIDR of the subnet." 9 | } 10 | 11 | output "private_subnet_cidrs" { 12 | value = module.subnets.private_subnet_cidrs 13 | description = "The CIDR of the subnet." 14 | } 15 | 16 | output "private_subnet_cidrs_ipv6" { 17 | value = module.subnets.private_subnet_cidrs_ipv6 18 | description = "The CIDR of the subnet." 19 | } 20 | 21 | output "private_tags" { 22 | value = module.subnets.private_tags 23 | description = "A mapping of tags to assign to the resource." 24 | } 25 | 26 | output "public_tags" { 27 | value = module.subnets.public_tags 28 | description = "A mapping of tags to assign to the resource." 29 | } 30 | 31 | output "public_subnet_id" { 32 | value = module.subnets.private_subnet_id 33 | description = "The ID of the public subnet" 34 | } 35 | 36 | output "nat_gateway_private_ip" { 37 | value = module.subnets.nat_gateway_private_ip 38 | description = "The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned." 39 | } 40 | -------------------------------------------------------------------------------- /examples/public-private-subnet-single-nat-gateway/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /examples/public-subnet/example.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = "us-east-1" 3 | } 4 | 5 | locals { 6 | name = "app" 7 | environment = "test" 8 | } 9 | 10 | ##----------------------------------------------------------------------------- 11 | ## Vpc Module call. 12 | ##----------------------------------------------------------------------------- 13 | module "vpc" { 14 | source = "clouddrove/vpc/aws" 15 | version = "2.0.0" 16 | name = local.name 17 | environment = local.environment 18 | cidr_block = "10.0.0.0/16" 19 | enable_flow_log = true # Flow logs will be stored in cloudwatch log group. Variables passed in default. 20 | create_flow_log_cloudwatch_iam_role = true 21 | dhcp_options_domain_name = "service.consul" 22 | dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"] 23 | assign_generated_ipv6_cidr_block = true 24 | } 25 | 26 | ##----------------------------------------------------------------------------- 27 | ## Subnet Module call. 28 | ## Below module will deploy only public subnet. 29 | ##----------------------------------------------------------------------------- 30 | #tfsec:ignore:aws-ec2-no-excessive-port-access 31 | #tfsec:ignore:aws-ec2-no-public-ingress-acl 32 | module "subnets" { 33 | source = "./../../" 34 | name = local.name 35 | environment = local.environment 36 | availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"] 37 | vpc_id = module.vpc.vpc_id 38 | type = "public" 39 | igw_id = module.vpc.igw_id 40 | ipv4_public_cidrs = ["10.0.1.0/24", "10.0.13.0/24", "10.0.18.0/24"] 41 | enable_ipv6 = false 42 | } 43 | -------------------------------------------------------------------------------- /examples/public-subnet/outputs.tf: -------------------------------------------------------------------------------- 1 | output "public_subnet_cidrs" { 2 | value = module.subnets.public_subnet_cidrs 3 | description = "The CIDR of the subnet." 4 | } 5 | 6 | output "public_subnet_cidrs_ipv6" { 7 | value = module.subnets.public_subnet_cidrs_ipv6 8 | description = "The CIDR of the subnet." 9 | } 10 | 11 | output "public_tags" { 12 | value = module.subnets.public_tags 13 | description = "A mapping of tags to assign to the resource." 14 | } 15 | 16 | output "public_subnet_id" { 17 | value = module.subnets.private_subnet_id 18 | description = "The ID of the public subnet" 19 | } 20 | -------------------------------------------------------------------------------- /examples/public-subnet/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | # Managed By : CloudDrove 2 | # Copyright @ CloudDrove. All Right Reserved. 3 | 4 | ##----------------------------------------------------------------------------- 5 | ## Locals declration to determine count of public subnet, private subnet, and nat gateway. 6 | ##----------------------------------------------------------------------------- 7 | locals { 8 | public_count = var.enable == true && (var.type == "public" || var.type == "public-private") ? length(var.availability_zones) : 0 9 | private_count = var.enable == true && (var.type == "private" || var.type == "public-private") ? length(var.availability_zones) : 0 10 | nat_gateway_count = var.enable == true && var.single_nat_gateway ? 1 : (var.enable == true && (var.type == "private" || var.type == "public-private") && var.nat_gateway_enabled == true ? length(var.availability_zones) : 0) 11 | } 12 | ##----------------------------------------------------------------------------- 13 | ## Labels module called that will be used for naming and tags. 14 | ##----------------------------------------------------------------------------- 15 | module "private-labels" { 16 | source = "clouddrove/labels/aws" 17 | version = "1.3.0" 18 | 19 | name = var.name 20 | repository = var.repository 21 | environment = var.environment 22 | managedby = var.managedby 23 | label_order = var.label_order 24 | attributes = compact(concat(var.attributes, ["private"])) 25 | extra_tags = { 26 | Type = "private" 27 | } 28 | } 29 | 30 | module "public-labels" { 31 | source = "clouddrove/labels/aws" 32 | version = "1.3.0" 33 | 34 | name = var.name 35 | repository = var.repository 36 | environment = var.environment 37 | managedby = var.managedby 38 | label_order = var.label_order 39 | attributes = compact(concat(var.attributes, ["public"])) 40 | extra_tags = { 41 | Type = "public" 42 | } 43 | } 44 | 45 | ##----------------------------------------------------------------------------- 46 | ## Below resource will deploy public subnets and its related components in aws environment. 47 | ##----------------------------------------------------------------------------- 48 | resource "aws_subnet" "public" { 49 | count = local.public_count 50 | vpc_id = var.vpc_id 51 | availability_zone = element(var.availability_zones, count.index) 52 | cidr_block = length(var.ipv4_public_cidrs) == 0 ? cidrsubnet(var.cidr_block, ceil(log(local.public_count * 2, 2)), local.public_count + count.index) : var.ipv4_public_cidrs[count.index] 53 | ipv6_cidr_block = var.enable_ipv6 ? (length(var.public_ipv6_cidrs) == 0 ? cidrsubnet(var.ipv6_cidr_block, 8, count.index + 1) : var.public_ipv6_cidrs[count.index]) : null 54 | map_public_ip_on_launch = var.map_public_ip_on_launch 55 | assign_ipv6_address_on_creation = var.enable_ipv6 && var.public_subnet_ipv6_native ? true : var.public_subnet_assign_ipv6_address_on_creation 56 | private_dns_hostname_type_on_launch = var.public_subnet_private_dns_hostname_type_on_launch 57 | ipv6_native = var.enable_ipv6 && var.public_subnet_ipv6_native 58 | enable_resource_name_dns_aaaa_record_on_launch = var.enable_ipv6 && var.public_subnet_enable_resource_name_dns_aaaa_record_on_launch 59 | enable_resource_name_dns_a_record_on_launch = !var.public_subnet_ipv6_native && var.public_subnet_enable_resource_name_dns_a_record_on_launch 60 | enable_dns64 = var.enable_ipv6 && var.public_subnet_enable_dns64 61 | tags = merge( 62 | module.public-labels.tags, var.extra_public_tags, 63 | { 64 | "Name" = format("%s%s%s", module.public-labels.id, var.delimiter, element(var.availability_zones, count.index)) 65 | "AZ" = element(var.availability_zones, count.index) 66 | } 67 | ) 68 | lifecycle { 69 | # Ignore tags added by kubernetes 70 | ignore_changes = [ 71 | tags["kubernetes.io"], 72 | tags["SubnetType"], 73 | ] 74 | } 75 | } 76 | 77 | ##----------------------------------------------------------------------------- 78 | ## Below resource will deploy network acl and its rules that will be attached to public subnets. 79 | ##----------------------------------------------------------------------------- 80 | resource "aws_network_acl" "public" { 81 | count = var.enable && local.public_count > 0 && var.enable_public_acl && (var.type == "public" || var.type == "public-private") ? 1 : 0 82 | vpc_id = var.vpc_id 83 | subnet_ids = aws_subnet.public[*].id 84 | tags = module.public-labels.tags 85 | depends_on = [aws_subnet.public] 86 | } 87 | 88 | resource "aws_network_acl_rule" "public_inbound" { 89 | count = var.enable && local.public_count > 0 && var.enable_public_acl && (var.type == "public" || var.type == "public-private") ? length(var.public_inbound_acl_rules) : 0 90 | network_acl_id = aws_network_acl.public[0].id 91 | egress = false 92 | rule_number = var.public_inbound_acl_rules[count.index]["rule_number"] 93 | rule_action = var.public_inbound_acl_rules[count.index]["rule_action"] 94 | from_port = lookup(var.public_inbound_acl_rules[count.index], "from_port", null) 95 | to_port = lookup(var.public_inbound_acl_rules[count.index], "to_port", null) 96 | icmp_code = lookup(var.public_inbound_acl_rules[count.index], "icmp_code", null) 97 | icmp_type = lookup(var.public_inbound_acl_rules[count.index], "icmp_type", null) 98 | protocol = var.public_inbound_acl_rules[count.index]["protocol"] 99 | cidr_block = lookup(var.public_inbound_acl_rules[count.index], "cidr_block", null) 100 | ipv6_cidr_block = lookup(var.public_inbound_acl_rules[count.index], "ipv6_cidr_block", null) 101 | } 102 | 103 | resource "aws_network_acl_rule" "public_outbound" { 104 | count = var.enable && local.public_count > 0 && var.enable_public_acl && (var.type == "public" || var.type == "public-private") ? length(var.public_outbound_acl_rules) : 0 105 | network_acl_id = aws_network_acl.public[0].id 106 | egress = true 107 | rule_number = var.public_outbound_acl_rules[count.index]["rule_number"] 108 | rule_action = var.public_outbound_acl_rules[count.index]["rule_action"] 109 | from_port = lookup(var.public_outbound_acl_rules[count.index], "from_port", null) 110 | to_port = lookup(var.public_outbound_acl_rules[count.index], "to_port", null) 111 | icmp_code = lookup(var.public_outbound_acl_rules[count.index], "icmp_code", null) 112 | icmp_type = lookup(var.public_outbound_acl_rules[count.index], "icmp_type", null) 113 | protocol = var.public_outbound_acl_rules[count.index]["protocol"] 114 | cidr_block = lookup(var.public_outbound_acl_rules[count.index], "cidr_block", null) 115 | ipv6_cidr_block = lookup(var.public_outbound_acl_rules[count.index], "ipv6_cidr_block", null) 116 | } 117 | 118 | ##----------------------------------------------------------------------------- 119 | ## Below resources will deploy route table and routes for public subnet and will be associated to public subnets. 120 | ##----------------------------------------------------------------------------- 121 | resource "aws_route_table" "public" { 122 | count = local.public_count 123 | vpc_id = var.vpc_id 124 | tags = merge( 125 | module.public-labels.tags, 126 | { 127 | "Name" = format("%s%s%s-rt", module.public-labels.id, var.delimiter, element(var.availability_zones, count.index)) 128 | "AZ" = element(var.availability_zones, count.index) 129 | } 130 | ) 131 | } 132 | 133 | resource "aws_route" "public" { 134 | count = local.public_count 135 | route_table_id = element(aws_route_table.public[*].id, count.index) 136 | gateway_id = var.igw_id 137 | destination_cidr_block = var.public_rt_ipv4_destination_cidr 138 | depends_on = [aws_route_table.public] 139 | timeouts { 140 | create = "5m" 141 | } 142 | } 143 | 144 | resource "aws_route" "public_ipv6" { 145 | count = local.public_count 146 | route_table_id = element(aws_route_table.public[*].id, count.index) 147 | gateway_id = var.igw_id 148 | destination_ipv6_cidr_block = var.public_rt_ipv6_destination_cidr 149 | depends_on = [aws_route_table.public] 150 | } 151 | 152 | resource "aws_route_table_association" "public" { 153 | count = local.public_count 154 | subnet_id = element(aws_subnet.public[*].id, count.index) 155 | route_table_id = element(aws_route_table.public[*].id, count.index) 156 | depends_on = [ 157 | aws_subnet.public, 158 | aws_route_table.public, 159 | ] 160 | } 161 | 162 | ##----------------------------------------------------------------------------- 163 | ## Below resource will deploy flow logs for public subnet. 164 | ##----------------------------------------------------------------------------- 165 | resource "aws_flow_log" "public_subnet_flow_log" { 166 | count = var.enable && var.enable_flow_log && local.public_count > 0 ? 1 : 0 167 | log_destination_type = var.flow_log_destination_type 168 | log_destination = var.flow_log_destination_arn 169 | log_format = var.flow_log_log_format 170 | iam_role_arn = var.flow_log_iam_role_arn 171 | traffic_type = var.flow_log_traffic_type 172 | subnet_id = element(aws_subnet.public[*].id, count.index) 173 | max_aggregation_interval = var.flow_log_max_aggregation_interval 174 | dynamic "destination_options" { 175 | for_each = var.flow_log_destination_type == "s3" ? [true] : [] 176 | 177 | content { 178 | file_format = var.flow_log_file_format 179 | hive_compatible_partitions = var.flow_log_hive_compatible_partitions 180 | per_hour_partition = var.flow_log_per_hour_partition 181 | } 182 | } 183 | tags = merge( 184 | module.public-labels.tags, 185 | { 186 | "Name" = format("%s-flowlog", module.public-labels.name) 187 | } 188 | ) 189 | } 190 | 191 | ##----------------------------------------------------------------------------- 192 | ## Below resource will deploy private subnets and its related components in aws environment. 193 | ##----------------------------------------------------------------------------- 194 | resource "aws_subnet" "private" { 195 | count = local.private_count 196 | vpc_id = var.vpc_id 197 | availability_zone = element(var.availability_zones, count.index) 198 | cidr_block = length(var.ipv4_private_cidrs) == 0 ? cidrsubnet(var.cidr_block, local.public_count == 0 ? ceil(log(local.private_count * 2, 2)) : ceil(log(local.public_count * 2, 2)), count.index) : var.ipv4_private_cidrs[count.index] 199 | ipv6_cidr_block = var.enable_ipv6 ? (length(var.private_ipv6_cidrs) == 0 ? cidrsubnet(var.ipv6_cidr_block, 8, local.public_count + count.index + 1) : var.private_ipv6_cidrs[count.index]) : null 200 | assign_ipv6_address_on_creation = var.enable_ipv6 && var.private_subnet_ipv6_native ? true : var.private_subnet_assign_ipv6_address_on_creation 201 | private_dns_hostname_type_on_launch = var.private_subnet_private_dns_hostname_type_on_launch 202 | ipv6_native = var.enable_ipv6 && var.private_subnet_ipv6_native 203 | enable_resource_name_dns_aaaa_record_on_launch = var.enable_ipv6 && var.private_subnet_enable_resource_name_dns_aaaa_record_on_launch 204 | enable_resource_name_dns_a_record_on_launch = !var.private_subnet_ipv6_native && var.private_subnet_enable_resource_name_dns_a_record_on_launch 205 | enable_dns64 = var.enable_ipv6 && var.private_subnet_enable_dns64 206 | 207 | tags = merge( 208 | module.private-labels.tags, var.extra_private_tags, 209 | { 210 | "Name" = format("%s%s%s", module.private-labels.id, var.delimiter, element(var.availability_zones, count.index)) 211 | "AZ" = element(var.availability_zones, count.index) 212 | } 213 | ) 214 | 215 | lifecycle { 216 | # Ignore tags added by kubernetes 217 | ignore_changes = [ 218 | tags["kubernetes.io"], 219 | tags["SubnetType"], 220 | ] 221 | } 222 | } 223 | 224 | ##----------------------------------------------------------------------------- 225 | ## Below resource will deploy network acl and its rules that will be attached to private subnets. 226 | ##----------------------------------------------------------------------------- 227 | resource "aws_network_acl" "private" { 228 | count = var.enable && var.enable_private_acl && (var.type == "private" || var.type == "public-private") ? 1 : 0 229 | vpc_id = var.vpc_id 230 | subnet_ids = aws_subnet.private[*].id 231 | tags = module.private-labels.tags 232 | depends_on = [aws_subnet.private] 233 | } 234 | 235 | resource "aws_network_acl_rule" "private_inbound" { 236 | count = var.enable && var.enable_private_acl && (var.type == "private" || var.type == "public-private") ? length(var.private_inbound_acl_rules) : 0 237 | network_acl_id = aws_network_acl.private[0].id 238 | egress = false 239 | rule_number = var.private_inbound_acl_rules[count.index]["rule_number"] 240 | rule_action = var.private_inbound_acl_rules[count.index]["rule_action"] 241 | from_port = lookup(var.private_inbound_acl_rules[count.index], "from_port", null) 242 | to_port = lookup(var.private_inbound_acl_rules[count.index], "to_port", null) 243 | icmp_code = lookup(var.private_inbound_acl_rules[count.index], "icmp_code", null) 244 | icmp_type = lookup(var.private_inbound_acl_rules[count.index], "icmp_type", null) 245 | protocol = var.private_inbound_acl_rules[count.index]["protocol"] 246 | cidr_block = lookup(var.private_inbound_acl_rules[count.index], "cidr_block", null) 247 | ipv6_cidr_block = lookup(var.private_inbound_acl_rules[count.index], "ipv6_cidr_block", null) 248 | } 249 | 250 | resource "aws_network_acl_rule" "private_outbound" { 251 | count = var.enable && var.enable_private_acl && (var.type == "private" || var.type == "public-private") ? length(var.private_inbound_acl_rules) : 0 252 | network_acl_id = aws_network_acl.private[0].id 253 | egress = true 254 | rule_number = var.private_outbound_acl_rules[count.index]["rule_number"] 255 | rule_action = var.private_outbound_acl_rules[count.index]["rule_action"] 256 | from_port = lookup(var.private_outbound_acl_rules[count.index], "from_port", null) 257 | to_port = lookup(var.private_outbound_acl_rules[count.index], "to_port", null) 258 | icmp_code = lookup(var.private_outbound_acl_rules[count.index], "icmp_code", null) 259 | icmp_type = lookup(var.private_outbound_acl_rules[count.index], "icmp_type", null) 260 | protocol = var.private_outbound_acl_rules[count.index]["protocol"] 261 | cidr_block = lookup(var.private_outbound_acl_rules[count.index], "cidr_block", null) 262 | ipv6_cidr_block = lookup(var.private_outbound_acl_rules[count.index], "ipv6_cidr_block", null) 263 | } 264 | 265 | ##----------------------------------------------------------------------------- 266 | ## Below resources will deploy route table and routes for private subnet and will be associated to private subnets. 267 | ##----------------------------------------------------------------------------- 268 | resource "aws_route_table" "private" { 269 | count = local.private_count 270 | vpc_id = var.vpc_id 271 | tags = merge( 272 | module.private-labels.tags, 273 | { 274 | "Name" = format("%s%s%s-rt", module.private-labels.id, var.delimiter, element(var.availability_zones, count.index)) 275 | "AZ" = element(var.availability_zones, count.index) 276 | } 277 | ) 278 | } 279 | 280 | resource "aws_route_table_association" "private" { 281 | count = local.private_count 282 | subnet_id = element(aws_subnet.private[*].id, count.index) 283 | route_table_id = element(aws_route_table.private[*].id, var.single_nat_gateway ? 0 : count.index, ) 284 | } 285 | 286 | resource "aws_route" "nat_gateway" { 287 | count = local.nat_gateway_count > 0 ? local.nat_gateway_count : 0 288 | route_table_id = element(aws_route_table.private[*].id, count.index) 289 | destination_cidr_block = var.nat_gateway_destination_cidr_block 290 | nat_gateway_id = element(aws_nat_gateway.private[*].id, count.index) 291 | depends_on = [aws_route_table.private] 292 | } 293 | 294 | ##---------------------------------------------------------------------------------- 295 | ## Below resource will create Elastic IP (EIP) for nat gateway. 296 | ##---------------------------------------------------------------------------------- 297 | resource "aws_eip" "private" { 298 | count = local.nat_gateway_count 299 | domain = "vpc" 300 | tags = merge( 301 | module.private-labels.tags, 302 | { 303 | "Name" = format("%s%s%s-eip", module.private-labels.id, var.delimiter, element(var.availability_zones, count.index)) 304 | } 305 | ) 306 | lifecycle { 307 | create_before_destroy = true 308 | } 309 | } 310 | 311 | ##---------------------------------------------------------------------------------- 312 | ## Below resource will deploy nat gateway for private subnets. 313 | ##---------------------------------------------------------------------------------- 314 | resource "aws_nat_gateway" "private" { 315 | count = local.nat_gateway_count 316 | allocation_id = element(aws_eip.private[*].id, count.index) 317 | subnet_id = length(aws_subnet.public) > 0 ? element(aws_subnet.public[*].id, count.index) : element(var.public_subnet_ids, count.index) 318 | tags = merge( 319 | module.private-labels.tags, 320 | { 321 | "Name" = format("%s%s%s-nat-gateway", module.private-labels.id, var.delimiter, element(var.availability_zones, count.index)) 322 | } 323 | ) 324 | } 325 | 326 | ##----------------------------------------------------------------------------- 327 | ## Below resource will deploy flow logs for private subnet. 328 | ##----------------------------------------------------------------------------- 329 | resource "aws_flow_log" "private_subnet_flow_log" { 330 | count = var.enable && var.enable_flow_log && local.private_count > 0 ? 1 : 0 331 | log_destination_type = var.flow_log_destination_type 332 | log_destination = var.flow_log_destination_arn 333 | log_format = var.flow_log_log_format 334 | iam_role_arn = var.flow_log_iam_role_arn 335 | traffic_type = var.flow_log_traffic_type 336 | subnet_id = element(aws_subnet.private[*].id, count.index) 337 | max_aggregation_interval = var.flow_log_max_aggregation_interval 338 | dynamic "destination_options" { 339 | for_each = var.flow_log_destination_type == "s3" ? [true] : [] 340 | 341 | content { 342 | file_format = var.flow_log_file_format 343 | hive_compatible_partitions = var.flow_log_hive_compatible_partitions 344 | per_hour_partition = var.flow_log_per_hour_partition 345 | } 346 | } 347 | tags = merge( 348 | module.private-labels.tags, 349 | { 350 | "Name" = format("%s-flowlog", module.private-labels.name) 351 | } 352 | ) 353 | } 354 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | #Module : SUBNET 2 | #Description : Terraform module to create public, private and public-private subnet with 3 | # network acl, route table, Elastic IP, nat gateway, flow log. 4 | output "public_subnet_id" { 5 | value = aws_subnet.public[*].id 6 | description = "The ID of the subnet." 7 | } 8 | 9 | output "public_subnet_cidrs" { 10 | value = aws_subnet.public[*].cidr_block 11 | description = "CIDR blocks of the created public subnets." 12 | } 13 | 14 | output "public_subnet_cidrs_ipv6" { 15 | value = aws_subnet.public[*].ipv6_cidr_block 16 | description = "CIDR blocks of the created public subnets." 17 | } 18 | 19 | output "private_subnet_id" { 20 | value = aws_subnet.private[*].id 21 | description = "The ID of the private subnet." 22 | } 23 | 24 | output "private_subnet_cidrs" { 25 | value = aws_subnet.private[*].cidr_block 26 | description = "CIDR blocks of the created private subnets." 27 | } 28 | 29 | output "private_subnet_cidrs_ipv6" { 30 | value = aws_subnet.private[*].ipv6_cidr_block 31 | description = "CIDR blocks of the created private subnets." 32 | } 33 | 34 | output "public_route_tables_id" { 35 | value = aws_route_table.public[*].id 36 | description = "The ID of the routing table." 37 | } 38 | 39 | output "private_route_tables_id" { 40 | value = aws_route_table.private[*].id 41 | description = "The ID of the routing table." 42 | } 43 | 44 | output "private_tags" { 45 | value = module.private-labels.tags 46 | description = "A mapping of private tags to assign to the resource." 47 | } 48 | 49 | output "public_tags" { 50 | value = module.public-labels.tags 51 | description = "A mapping of public tags to assign to the resource." 52 | } 53 | 54 | output "public_acl" { 55 | value = join("", aws_network_acl.public[*].id) 56 | description = "The ID of the network ACL." 57 | } 58 | 59 | output "private_acl" { 60 | value = join("", aws_network_acl.private[*].id) 61 | description = "The ID of the network ACL." 62 | } 63 | 64 | output "nat_gateway_private_ip" { 65 | value = aws_nat_gateway.private[*].private_ip 66 | description = "The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned." 67 | } 68 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | #Module : LABEL 2 | #Description : Terraform label module variables. 3 | variable "name" { 4 | type = string 5 | default = "" 6 | description = "Name (e.g. `prod-subnet` or `subnet`)." 7 | } 8 | 9 | variable "repository" { 10 | type = string 11 | default = "https://github.com/clouddrove/terraform-aws-subnet" 12 | description = "Terraform current module repo" 13 | 14 | validation { 15 | # regex(...) fails if it cannot find a match 16 | condition = can(regex("^https://", var.repository)) 17 | error_message = "The module-repo value must be a valid Git repo link." 18 | } 19 | } 20 | 21 | variable "environment" { 22 | type = string 23 | default = "" 24 | description = "Environment (e.g. `prod`, `dev`, `staging`)." 25 | } 26 | 27 | variable "label_order" { 28 | type = list(any) 29 | default = ["name", "environment"] 30 | description = "Label order, e.g. `name`,`Environment`." 31 | } 32 | 33 | variable "attributes" { 34 | type = list(any) 35 | default = [] 36 | description = "Additional attributes (e.g. `1`)." 37 | } 38 | 39 | variable "delimiter" { 40 | type = string 41 | default = "-" 42 | description = "Delimiter to be used between `organization`, `environment`, `name` and `attributes`." 43 | } 44 | 45 | variable "extra_public_tags" { 46 | type = map(any) 47 | default = {} 48 | description = "Additional public subnet tags." 49 | } 50 | 51 | variable "extra_private_tags" { 52 | type = map(any) 53 | default = {} 54 | description = "Additional private subnet tags." 55 | } 56 | 57 | variable "managedby" { 58 | type = string 59 | default = "hello@clouddrove.com" 60 | description = "ManagedBy, eg 'CloudDrove'." 61 | } 62 | 63 | #Module : SUBNET 64 | #Description : Terraform SUBNET module variables. 65 | variable "availability_zones" { 66 | type = list(string) 67 | default = [] 68 | description = "List of Availability Zones (e.g. `['us-east-1a', 'us-east-1b', 'us-east-1c']`)." 69 | } 70 | 71 | variable "type" { 72 | type = string 73 | default = "" 74 | description = "Type of subnets to create (`private` or `public`)." 75 | } 76 | 77 | variable "vpc_id" { 78 | type = string 79 | description = "VPC ID." 80 | sensitive = true 81 | } 82 | 83 | variable "cidr_block" { 84 | type = string 85 | default = null 86 | description = "Base CIDR block which is divided into subnet CIDR blocks (e.g. `10.0.0.0/16`)." 87 | } 88 | 89 | variable "ipv6_cidr_block" { 90 | type = string 91 | default = null 92 | description = "Base CIDR block which is divided into subnet CIDR blocks (e.g. `10.0.0.0/16`)." 93 | } 94 | 95 | variable "public_subnet_ids" { 96 | type = list(string) 97 | default = [] 98 | description = "A list of public subnet ids." 99 | sensitive = true 100 | 101 | } 102 | 103 | variable "igw_id" { 104 | type = string 105 | default = "" 106 | description = "Internet Gateway ID that is used as a default route when creating public subnets (e.g. `igw-9c26a123`)." 107 | sensitive = true 108 | } 109 | 110 | variable "enable" { 111 | type = bool 112 | default = true 113 | description = "Set to false to prevent the module from creating any resources." 114 | } 115 | 116 | variable "enable_public_acl" { 117 | type = bool 118 | default = true 119 | description = "Set to false to prevent the module from creating any resources." 120 | } 121 | 122 | variable "enable_private_acl" { 123 | type = bool 124 | default = true 125 | description = "Set to false to prevent the module from creating any resources." 126 | } 127 | 128 | variable "nat_gateway_enabled" { 129 | type = bool 130 | default = false 131 | description = "Flag to enable/disable NAT Gateways creation in public subnets." 132 | } 133 | 134 | variable "enable_flow_log" { 135 | type = bool 136 | default = false 137 | description = "Enable subnet_flow_log logs." 138 | } 139 | 140 | variable "map_public_ip_on_launch" { 141 | type = bool 142 | default = false 143 | description = "Specify true to indicate that instances launched into the public subnet should be assigned a public IP address." 144 | } 145 | 146 | #Module : FLOW LOG 147 | #Description : Terraform flow log module variables. 148 | variable "flow_log_destination_arn" { 149 | type = string 150 | default = null 151 | description = "ARN of resource in which flow log will be sent." 152 | sensitive = true 153 | } 154 | 155 | variable "flow_log_destination_type" { 156 | type = string 157 | default = "cloud-watch-logs" 158 | description = "Type of flow log destination. Can be s3 or cloud-watch-logs" 159 | } 160 | 161 | variable "flow_log_traffic_type" { 162 | type = string 163 | default = "ALL" 164 | description = "Type of traffic to capture. Valid values: ACCEPT,REJECT, ALL." 165 | } 166 | 167 | variable "flow_log_log_format" { 168 | type = string 169 | default = null 170 | description = "The fields to include in the flow log record, in the order in which they should appear" 171 | } 172 | 173 | variable "flow_log_iam_role_arn" { 174 | type = string 175 | default = null 176 | description = "The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow_log_destination_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided" 177 | } 178 | 179 | variable "flow_log_max_aggregation_interval" { 180 | type = number 181 | default = 600 182 | description = "The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: `60` seconds or `600` seconds" 183 | } 184 | 185 | variable "flow_log_file_format" { 186 | type = string 187 | default = null 188 | description = "(Optional) The format for the flow log. Valid values: `plain-text`, `parquet`" 189 | } 190 | 191 | variable "flow_log_hive_compatible_partitions" { 192 | type = bool 193 | default = false 194 | description = "(Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3" 195 | } 196 | 197 | variable "flow_log_per_hour_partition" { 198 | type = bool 199 | default = false 200 | description = "(Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries" 201 | } 202 | 203 | variable "public_ipv6_cidrs" { 204 | type = list(any) 205 | default = [] 206 | description = "Public Subnet CIDR blocks (e.g. `2a05:d018:832:ca02::/64`)." 207 | } 208 | 209 | variable "private_ipv6_cidrs" { 210 | type = list(any) 211 | default = [] 212 | description = "Private Subnet CIDR blocks (e.g. `2a05:d018:832:ca02::/64`)." 213 | } 214 | 215 | variable "ipv4_public_cidrs" { 216 | type = list(any) 217 | default = [] 218 | description = "Subnet CIDR blocks (e.g. `10.0.0.0/16`)." 219 | } 220 | variable "ipv4_private_cidrs" { 221 | type = list(any) 222 | default = [] 223 | description = "Subnet CIDR blocks (e.g. `10.0.0.0/16`)." 224 | } 225 | 226 | variable "single_nat_gateway" { 227 | type = bool 228 | default = false 229 | description = "Enable for only single NAT Gateway in one Availability Zone" 230 | } 231 | 232 | variable "public_subnet_assign_ipv6_address_on_creation" { 233 | type = bool 234 | default = false 235 | description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address." 236 | } 237 | 238 | variable "private_subnet_assign_ipv6_address_on_creation" { 239 | type = bool 240 | default = false 241 | description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address." 242 | } 243 | 244 | variable "public_subnet_private_dns_hostname_type_on_launch" { 245 | type = string 246 | default = null 247 | description = "The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`" 248 | } 249 | 250 | variable "private_subnet_private_dns_hostname_type_on_launch" { 251 | type = string 252 | default = null 253 | description = "The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`" 254 | } 255 | 256 | variable "public_subnet_ipv6_native" { 257 | type = bool 258 | default = false 259 | description = "Indicates whether to create an IPv6-only public subnet. Default: `false`" 260 | } 261 | 262 | variable "private_subnet_ipv6_native" { 263 | type = bool 264 | default = false 265 | description = "Indicates whether to create an IPv6-only private subnet. Default: `false`" 266 | } 267 | 268 | variable "enable_ipv6" { 269 | type = bool 270 | default = false 271 | description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block" 272 | } 273 | 274 | variable "public_subnet_enable_dns64" { 275 | type = bool 276 | default = false 277 | description = "Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`" 278 | } 279 | 280 | variable "private_subnet_enable_dns64" { 281 | type = bool 282 | default = false 283 | description = "Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`" 284 | } 285 | 286 | variable "public_subnet_enable_resource_name_dns_a_record_on_launch" { 287 | type = bool 288 | default = false 289 | description = "Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`" 290 | } 291 | 292 | variable "private_subnet_enable_resource_name_dns_a_record_on_launch" { 293 | type = bool 294 | default = false 295 | description = "Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`" 296 | } 297 | 298 | variable "public_subnet_enable_resource_name_dns_aaaa_record_on_launch" { 299 | type = bool 300 | default = false 301 | description = "Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`" 302 | } 303 | 304 | variable "private_subnet_enable_resource_name_dns_aaaa_record_on_launch" { 305 | type = bool 306 | default = false 307 | description = "Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`" 308 | } 309 | 310 | variable "public_inbound_acl_rules" { 311 | type = list(map(string)) 312 | default = [ 313 | { 314 | rule_number = 100 315 | rule_action = "allow" 316 | from_port = 0 317 | to_port = 0 318 | protocol = "-1" 319 | cidr_block = "0.0.0.0/0" 320 | }, 321 | ] 322 | description = "Public subnets inbound network ACLs" 323 | } 324 | 325 | variable "public_outbound_acl_rules" { 326 | type = list(map(string)) 327 | default = [ 328 | { 329 | rule_number = 100 330 | rule_action = "allow" 331 | from_port = 0 332 | to_port = 0 333 | protocol = "-1" 334 | cidr_block = "0.0.0.0/0" 335 | }, 336 | ] 337 | description = "Public subnets outbound network ACLs" 338 | } 339 | 340 | variable "private_inbound_acl_rules" { 341 | type = list(map(string)) 342 | default = [ 343 | { 344 | rule_number = 100 345 | rule_action = "deny" 346 | from_port = 0 347 | to_port = 0 348 | protocol = "-1" 349 | cidr_block = "0.0.0.0/0" 350 | }, 351 | ] 352 | description = "Private subnets inbound network ACLs" 353 | } 354 | 355 | variable "private_outbound_acl_rules" { 356 | type = list(map(string)) 357 | default = [ 358 | { 359 | rule_number = 100 360 | rule_action = "deny" 361 | from_port = 0 362 | to_port = 0 363 | protocol = "-1" 364 | cidr_block = "0.0.0.0/0" 365 | }, 366 | ] 367 | description = "Private subnets outbound network ACLs" 368 | } 369 | 370 | variable "nat_gateway_destination_cidr_block" { 371 | type = string 372 | default = "0.0.0.0/0" 373 | description = "Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route" 374 | } 375 | 376 | variable "public_rt_ipv4_destination_cidr" { 377 | type = string 378 | default = "0.0.0.0/0" 379 | description = "The destination ipv4 CIDR block." 380 | } 381 | 382 | variable "public_rt_ipv6_destination_cidr" { 383 | type = string 384 | default = "::/0" 385 | description = "The destination ipv6 CIDR block." 386 | } 387 | -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | --------------------------------------------------------------------------------
{
"cidr_block": "0.0.0.0/0",
"from_port": 0,
"protocol": "-1",
"rule_action": "allow",
"rule_number": 100,
"to_port": 0
}
]