16 |
17 |
18 | 
19 |
20 |
21 | 
22 |
23 |
24 | 
25 |
26 |
27 |
28 | 8 | With our comprehensive DevOps toolkit - streamline operations, automate workflows, enhance collaboration and, most importantly, deploy with confidence. 9 |
10 | 11 | 12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
30 |
31 |
32 | 
33 |
34 |
35 | 
36 |
37 |
38 | 
39 |
40 |
41 | 
42 |
43 |
44 |
We are The Cloud Experts!
181 |We ❤️ Open Source and you can check out our other modules to get help with your new Cloud ideas.
183 | 184 | [website]: https://clouddrove.com 185 | [blog]: https://blog.clouddrove.com 186 | [slack]: https://www.launchpass.com/devops-talks 187 | [github]: https://github.com/clouddrove 188 | [linkedin]: https://cpco.io/linkedin 189 | [twitter]: https://twitter.com/clouddrove/ 190 | [email]: https://clouddrove.com/contact-us.html 191 | [terraform_modules]: https://github.com/clouddrove?utf8=%E2%9C%93&q=terraform-&type=&language= 192 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | # 3 | # This is the canonical configuration for the `README.md` 4 | # Run `make readme` to rebuild the `README.md` 5 | 6 | # Name of this project 7 | name: Terraform AWS VPC 8 | 9 | # License of this project 10 | license: "APACHE" 11 | 12 | # Canonical GitHub repo 13 | github_repo: clouddrove/terraform-aws-vpc 14 | 15 | # Badges to display 16 | badges: 17 | - name: "Latest Release" 18 | image: "https://img.shields.io/github/release/clouddrove/terraform-aws-vpc.svg" 19 | url: "https://github.com/clouddrove/terraform-aws-vpc/releases/latest" 20 | - name: "tfsec" 21 | image: "https://github.com/clouddrove/terraform-aws-vpc/actions/workflows/tfsec.yml/badge.svg" 22 | url: "https://github.com/clouddrove/terraform-aws-vpc/actions/workflows/tfsec.yml" 23 | - name: "Licence" 24 | image: "https://img.shields.io/badge/License-APACHE-blue.svg" 25 | url: "LICENSE.md" 26 | - name: "Changelog" 27 | image: "https://img.shields.io/badge/Changelog-blue" 28 | url: "CHANGELOG.md" 29 | 30 | prerequesties: 31 | - name: Terraform 32 | url: https://learn.hashicorp.com/terraform/getting-started/install.html 33 | version: ">= 1.6.6" 34 | 35 | providers: 36 | - name: aws 37 | url: https://aws.amazon.com/ 38 | version: ">= 5.31.0" 39 | 40 | module_dependencies: 41 | - name: Labels Module 42 | url: https://github.com/clouddrove/terraform-aws-labels 43 | description: Provides resource tagging. 44 | 45 | # description of this project 46 | description: |- 47 | Terraform module vpc to create new modules using this as baseline 48 | 49 | # How to use this project 50 | usage: |- 51 | Here are some examples of how you can use this module in your inventory structure: 52 | 53 | ### vpc basic example 54 | ```hcl 55 | module "vpc" { 56 | source = "clouddrove/vpc/aws" 57 | version = "2.0.0" 58 | name = "vpc" 59 | environment = "example" 60 | cidr_block = "10.0.0.0/16" 61 | enable_flow_log = true # Flow logs will be stored in cloudwatch log group. Variables passed in default. 62 | create_flow_log_cloudwatch_iam_role = true 63 | additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"] 64 | dhcp_options_domain_name = "service.consul" 65 | dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"] 66 | } 67 | ``` 68 | 69 | ### vpc complete example 70 | ```hcl 71 | module "vpc" { 72 | source = "clouddrove/vpc/aws" 73 | version = "2.0.0" 74 | name = "vpc" 75 | environment = "example" 76 | cidr_block = "10.0.0.0/16" 77 | enable_flow_log = true 78 | flow_log_destination_type = "s3" 79 | flow_logs_bucket_name = "gc-vpc-flow-logs-bucket" 80 | additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"] 81 | dhcp_options_domain_name = "service.consul" 82 | dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"] 83 | } 84 | ``` 85 | -------------------------------------------------------------------------------- /docs/io.md: -------------------------------------------------------------------------------- 1 | ## Inputs 2 | 3 | | Name | Description | Type | Default | Required | 4 | |------|-------------|------|---------|:--------:| 5 | | additional\_cidr\_block | List of secondary CIDR blocks of the VPC. | `list(string)` | `[]` | no | 6 | | assign\_generated\_ipv6\_cidr\_block | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. Conflicts with ipv6\_ipam\_pool\_id | `bool` | `true` | no | 7 | | aws\_default\_network\_acl | A boolean flag to enable/disable Default Network acl in the VPC. | `bool` | `true` | no | 8 | | aws\_default\_route\_table | A boolean flag to enable/disable Default Route Table in the VPC. | `bool` | `true` | no | 9 | | block\_http\_traffic | True when http traffic has to be blocked for S3. | `bool` | `true` | no | 10 | | cidr\_block | CIDR for the VPC. | `string` | `""` | no | 11 | | create\_flow\_log\_cloudwatch\_iam\_role | Flag to be set true when cloudwatch iam role is to be created when flow log destination type is set to cloudwatch logs. | `bool` | `false` | no | 12 | | default\_network\_acl\_egress | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` |[| no | 13 | | default\_network\_acl\_ingress | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
{
"action": "allow",
"cidr_block": "0.0.0.0/0",
"from_port": 0,
"protocol": "-1",
"rule_no": 100,
"to_port": 0
},
{
"action": "allow",
"from_port": 0,
"ipv6_cidr_block": "::/0",
"protocol": "-1",
"rule_no": 101,
"to_port": 0
}
]
[| no | 14 | | default\_route\_table\_routes | Configuration block of routes. | `list(map(string))` | `[]` | no | 15 | | default\_security\_group\_egress | List of maps of egress rules to set on the default security group | `list(map(string))` | `[]` | no | 16 | | default\_security\_group\_ingress | List of maps of ingress rules to set on the default security group | `list(map(string))` | `[]` | no | 17 | | dhcp\_options\_domain\_name | Specifies DNS name for DHCP options set (requires enable\_dhcp\_options set to true) | `string` | `"service.consul"` | no | 18 | | dhcp\_options\_domain\_name\_servers | Specify a list of DNS server addresses for DHCP options set, default to AWS provided (requires enable\_dhcp\_options set to true) | `list(string)` |
{
"action": "allow",
"cidr_block": "0.0.0.0/0",
"from_port": 0,
"protocol": "-1",
"rule_no": 100,
"to_port": 0
},
{
"action": "allow",
"from_port": 0,
"ipv6_cidr_block": "::/0",
"protocol": "-1",
"rule_no": 101,
"to_port": 0
}
]
[| no | 19 | | dhcp\_options\_netbios\_name\_servers | Specify a list of netbios servers for DHCP options set (requires enable\_dhcp\_options set to true) | `list(string)` | `[]` | no | 20 | | dhcp\_options\_netbios\_node\_type | Specify netbios node\_type for DHCP options set (requires enable\_dhcp\_options set to true) | `string` | `""` | no | 21 | | dhcp\_options\_ntp\_servers | Specify a list of NTP servers for DHCP options set (requires enable\_dhcp\_options set to true) | `list(string)` | `[]` | no | 22 | | dns\_hostnames\_enabled | A boolean flag to enable/disable DNS hostnames in the VPC. | `bool` | `true` | no | 23 | | dns\_support\_enabled | A boolean flag to enable/disable DNS support in the VPC. | `bool` | `true` | no | 24 | | enable | Flag to control the vpc creation. | `bool` | `true` | no | 25 | | enable\_dhcp\_options | Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type | `bool` | `false` | no | 26 | | enable\_flow\_log | Enable vpc\_flow\_log logs. | `bool` | `false` | no | 27 | | enable\_key\_rotation | Specifies whether key rotation is enabled. Defaults to true(security best practice) | `bool` | `true` | no | 28 | | enable\_network\_address\_usage\_metrics | Determines whether network address usage metrics are enabled for the VPC | `bool` | `null` | no | 29 | | enabled\_ipv6\_egress\_only\_internet\_gateway | A boolean flag to enable/disable IPv6 Egress-Only Internet Gateway creation | `bool` | `true` | no | 30 | | environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `""` | no | 31 | | flow\_log\_cloudwatch\_log\_group\_retention\_in\_days | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no | 32 | | flow\_log\_destination\_arn | ARN of destination where vpc flow logs are to stored. Can be of existing s3 or existing cloudwatch log group. | `string` | `null` | no | 33 | | flow\_log\_destination\_type | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no | 34 | | flow\_log\_file\_format | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no | 35 | | flow\_log\_hive\_compatible\_partitions | (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3 | `bool` | `false` | no | 36 | | flow\_log\_iam\_role\_arn | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided | `string` | `null` | no | 37 | | flow\_log\_log\_format | The fields to include in the flow log record, in the order in which they should appear | `string` | `null` | no | 38 | | flow\_log\_max\_aggregation\_interval | The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: `60` seconds or `600` seconds | `number` | `600` | no | 39 | | flow\_log\_per\_hour\_partition | (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries | `bool` | `false` | no | 40 | | flow\_log\_traffic\_type | The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL | `string` | `"ALL"` | no | 41 | | flow\_logs\_bucket\_name | Name (e.g. `mybucket` or `bucket101`). | `string` | `null` | no | 42 | | instance\_tenancy | A tenancy option for instances launched into the VPC. | `string` | `"default"` | no | 43 | | ipam\_pool\_enable | Flag to be set true when using ipam for cidr. | `bool` | `false` | no | 44 | | ipv4\_ipam\_pool\_id | The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR. | `string` | `""` | no | 45 | | ipv4\_netmask\_length | The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4\_ipam\_pool\_id | `string` | `null` | no | 46 | | ipv6\_cidr\_block | IPv6 CIDR for the VPC. | `string` | `null` | no | 47 | | ipv6\_cidr\_block\_network\_border\_group | Set this to restrict advertisement of public addresses to a specific Network Border Group such as a LocalZone. | `string` | `null` | no | 48 | | ipv6\_ipam\_pool\_id | The ID of an IPv6 IPAM pool you want to use for allocating this VPC's CIDR. | `string` | `null` | no | 49 | | ipv6\_netmask\_length | The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv6\_ipam\_pool\_id | `string` | `null` | no | 50 | | kms\_key\_deletion\_window | KMS Key deletion window in days. | `number` | `10` | no | 51 | | label\_order | Label order, e.g. `name`,`application`. | `list(any)` |
"AmazonProvidedDNS"
]
[| no | 52 | | managedby | ManagedBy, eg 'CloudDrove' | `string` | `"hello@clouddrove.com"` | no | 53 | | name | Name (e.g. `app` or `cluster`). | `string` | `""` | no | 54 | | repository | Terraform current module repo | `string` | `"https://github.com/clouddrove/terraform-aws-vpc"` | no | 55 | | restrict\_default\_sg | Flag to control the restrict default sg creation. | `bool` | `true` | no | 56 | | s3\_sse\_algorithm | Server-side encryption algorithm to use. Valid values are AES256 and aws:kms | `string` | `"aws:kms"` | no | 57 | | vpc\_flow\_log\_permissions\_boundary | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no | 58 | 59 | ## Outputs 60 | 61 | | Name | Description | 62 | |------|-------------| 63 | | arn | Amazon Resource Name (ARN) of VPC | 64 | | igw\_id | The ID of the Internet Gateway. | 65 | | ipv6\_cidr\_block | The IPv6 CIDR block. | 66 | | ipv6\_cidr\_block\_network\_border\_group | The IPv6 Network Border Group Zone name | 67 | | ipv6\_egress\_only\_igw\_id | The ID of the egress-only Internet Gateway | 68 | | tags | A mapping of tags to assign to the resource. | 69 | | vpc\_arn | The ARN of the VPC | 70 | | vpc\_cidr\_block | The CIDR block of the VPC. | 71 | | vpc\_default\_network\_acl\_id | The ID of the network ACL created by default on VPC creation. | 72 | | vpc\_default\_route\_table\_id | The ID of the route table created by default on VPC creation. | 73 | | vpc\_default\_security\_group\_id | The ID of the security group created by default on VPC creation. | 74 | | vpc\_id | The ID of the VPC. | 75 | | vpc\_ipv6\_association\_id | The association ID for the IPv6 CIDR block. | 76 | | vpc\_main\_route\_table\_id | The ID of the main route table associated with this VPC. | 77 | 78 | -------------------------------------------------------------------------------- /examples/basic/example.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = "us-west-1" 3 | } 4 | 5 | locals { 6 | name = "vpc" 7 | environment = "example" 8 | } 9 | ##----------------------------------------------------------------------------- 10 | ## VPC Module Call. 11 | ##----------------------------------------------------------------------------- 12 | module "vpc" { 13 | source = "../.." 14 | 15 | name = local.name 16 | environment = local.environment 17 | enable = true 18 | cidr_block = "10.0.0.0/16" 19 | enable_flow_log = true # Flow logs will be stored in cloudwatch log group. Variables passed in default. 20 | create_flow_log_cloudwatch_iam_role = true 21 | additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"] 22 | dhcp_options_domain_name = "service.consul" 23 | dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"] 24 | } 25 | -------------------------------------------------------------------------------- /examples/basic/outputs.tf: -------------------------------------------------------------------------------- 1 | output "id" { 2 | value = module.vpc[*].vpc_id 3 | description = "The ID of the VPC." 4 | } 5 | 6 | output "tags" { 7 | value = module.vpc[*].tags 8 | description = "A mapping of tags to assign to the resource." 9 | } 10 | 11 | output "vpc_cidr" { 12 | value = module.vpc[*].vpc_cidr_block 13 | description = "The primary IPv4 CIDR block" 14 | } 15 | 16 | output "vpc_ipv6_cidr_block" { 17 | value = module.vpc[*].ipv6_cidr_block 18 | description = "The primary IPv6 CIDR block" 19 | } 20 | 21 | output "vpc_ipv6_association_id" { 22 | value = module.vpc[*].vpc_ipv6_association_id 23 | description = "The association ID for the primary IPv6 CIDR block" 24 | } 25 | 26 | output "ipv6_cidr_block_network_border_group" { 27 | value = module.vpc[*].ipv6_cidr_block_network_border_group 28 | description = "The Network Border Group Zone name" 29 | } 30 | -------------------------------------------------------------------------------- /examples/basic/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /examples/complete/example.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = "us-west-1" 3 | } 4 | 5 | locals { 6 | name = "vpc" 7 | environment = "example" 8 | } 9 | ##----------------------------------------------------------------------------- 10 | ## VPC Module Call. 11 | ##----------------------------------------------------------------------------- 12 | module "vpc" { 13 | source = "../.." 14 | 15 | name = local.name 16 | environment = local.environment 17 | cidr_block = "10.0.0.0/16" 18 | enable_flow_log = true 19 | enable = true 20 | flow_log_destination_type = "s3" 21 | flow_logs_bucket_name = "gc-vpc-flow-logs-bucket" 22 | additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"] 23 | dhcp_options_domain_name = "service.consul" 24 | dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"] 25 | } 26 | -------------------------------------------------------------------------------- /examples/complete/outputs.tf: -------------------------------------------------------------------------------- 1 | output "id" { 2 | value = module.vpc[*].vpc_id 3 | description = "The ID of the VPC." 4 | } 5 | 6 | output "tags" { 7 | value = module.vpc[*].tags 8 | description = "A mapping of tags to assign to the resource." 9 | } 10 | 11 | output "vpc_cidr" { 12 | value = module.vpc[*].vpc_cidr_block 13 | description = "The primary IPv4 CIDR block" 14 | } 15 | 16 | output "vpc_ipv6_cidr_block" { 17 | value = module.vpc[*].ipv6_cidr_block 18 | description = "The primary IPv6 CIDR block" 19 | } 20 | 21 | output "vpc_ipv6_association_id" { 22 | value = module.vpc[*].vpc_ipv6_association_id 23 | description = "The association ID for the primary IPv6 CIDR block" 24 | } 25 | 26 | output "ipv6_cidr_block_network_border_group" { 27 | value = module.vpc[*].ipv6_cidr_block_network_border_group 28 | description = "The Network Border Group Zone name" 29 | } 30 | -------------------------------------------------------------------------------- /examples/complete/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | # Managed By : CloudDrove 2 | # Copyright @ CloudDrove. All Right Reserved. 3 | 4 | 5 | ##----------------------------------------------------------------------------- 6 | ## Labels module callled that will be used for naming and tags. 7 | ##----------------------------------------------------------------------------- 8 | module "labels" { 9 | source = "clouddrove/labels/aws" 10 | version = "1.3.0" 11 | name = var.name 12 | environment = var.environment 13 | managedby = var.managedby 14 | label_order = var.label_order 15 | repository = var.repository 16 | } 17 | ##----------------------------------------------------------------------------- 18 | ## Below resources will deploy VPC and its components. 19 | ##----------------------------------------------------------------------------- 20 | #tfsec:ignore:aws-ec2-require-vpc-flow-logs-for-all-vpcs ## Because flow log resource for vpc is defined below. 21 | resource "aws_vpc" "default" { 22 | count = var.enable ? 1 : 0 23 | cidr_block = var.ipam_pool_enable ? null : var.cidr_block 24 | ipv4_ipam_pool_id = var.ipv4_ipam_pool_id 25 | ipv4_netmask_length = var.ipv4_netmask_length 26 | ipv6_cidr_block = var.ipv6_cidr_block 27 | ipv6_ipam_pool_id = var.ipv6_ipam_pool_id 28 | ipv6_netmask_length = var.ipv6_netmask_length 29 | instance_tenancy = var.instance_tenancy 30 | enable_dns_hostnames = var.dns_hostnames_enabled 31 | enable_dns_support = var.dns_support_enabled 32 | assign_generated_ipv6_cidr_block = var.assign_generated_ipv6_cidr_block 33 | ipv6_cidr_block_network_border_group = var.ipv6_cidr_block_network_border_group 34 | enable_network_address_usage_metrics = var.enable_network_address_usage_metrics 35 | tags = module.labels.tags 36 | lifecycle { 37 | # Ignore tags added by kubernetes 38 | ignore_changes = [ 39 | tags, 40 | tags["kubernetes.io"], 41 | tags["SubnetType"], 42 | ] 43 | } 44 | } 45 | 46 | resource "aws_vpc_ipv4_cidr_block_association" "default" { 47 | for_each = { for k in var.additional_cidr_block : k => k if var.enable } 48 | vpc_id = join("", aws_vpc.default[*].id) 49 | cidr_block = each.key 50 | } 51 | 52 | resource "aws_internet_gateway" "default" { 53 | count = var.enable ? 1 : 0 54 | vpc_id = join("", aws_vpc.default[*].id) 55 | tags = merge( 56 | module.labels.tags, 57 | { 58 | "Name" = format("%s-igw", module.labels.id) 59 | } 60 | ) 61 | } 62 | 63 | resource "aws_egress_only_internet_gateway" "default" { 64 | count = var.enable && var.enabled_ipv6_egress_only_internet_gateway ? 1 : 0 65 | vpc_id = join("", aws_vpc.default[*].id) 66 | tags = module.labels.tags 67 | } 68 | ##----------------------------------------------------------------------------- 69 | ## Below resource is used to create default security group for vpc communication. 70 | ##----------------------------------------------------------------------------- 71 | resource "aws_default_security_group" "default" { 72 | count = var.enable && var.restrict_default_sg == true ? 1 : 0 73 | vpc_id = join("", aws_vpc.default[*].id) 74 | dynamic "ingress" { 75 | for_each = var.default_security_group_ingress 76 | content { 77 | self = lookup(ingress.value, "self", true) 78 | cidr_blocks = compact(split(",", lookup(ingress.value, "cidr_blocks", ""))) 79 | ipv6_cidr_blocks = compact(split(",", lookup(ingress.value, "ipv6_cidr_blocks", ""))) 80 | prefix_list_ids = compact(split(",", lookup(ingress.value, "prefix_list_ids", ""))) 81 | security_groups = compact(split(",", lookup(ingress.value, "security_groups", ""))) 82 | description = lookup(ingress.value, "description", null) 83 | from_port = lookup(ingress.value, "from_port", 0) 84 | to_port = lookup(ingress.value, "to_port", 0) 85 | protocol = lookup(ingress.value, "protocol", "-1") 86 | } 87 | } 88 | dynamic "egress" { 89 | for_each = var.default_security_group_egress 90 | content { 91 | self = lookup(egress.value, "self", true) 92 | cidr_blocks = compact(split(",", lookup(egress.value, "cidr_blocks", ""))) 93 | ipv6_cidr_blocks = compact(split(",", lookup(egress.value, "ipv6_cidr_blocks", ""))) 94 | prefix_list_ids = compact(split(",", lookup(egress.value, "prefix_list_ids", ""))) 95 | security_groups = compact(split(",", lookup(egress.value, "security_groups", ""))) 96 | description = lookup(egress.value, "description", null) 97 | from_port = lookup(egress.value, "from_port", 0) 98 | to_port = lookup(egress.value, "to_port", 0) 99 | protocol = lookup(egress.value, "protocol", "-1") 100 | } 101 | } 102 | tags = merge( 103 | module.labels.tags, 104 | { 105 | "Name" = format("%s-default-sg", module.labels.id) 106 | } 107 | ) 108 | } 109 | ##----------------------------------------------------------------------------- 110 | ## Below resource will create default route table for vpc communication. 111 | ##----------------------------------------------------------------------------- 112 | resource "aws_default_route_table" "default" { 113 | count = var.enable && var.aws_default_route_table ? 1 : 0 114 | default_route_table_id = aws_vpc.default[0].default_route_table_id 115 | dynamic "route" { 116 | for_each = var.default_route_table_routes 117 | content { 118 | # One of the following destinations must be provided 119 | cidr_block = route.value.cidr_block 120 | ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null) 121 | destination_prefix_list_id = lookup(route.value, "destination_prefix_list_id", null) 122 | # One of the following targets must be provided 123 | egress_only_gateway_id = lookup(route.value, "egress_only_gateway_id", null) 124 | gateway_id = lookup(route.value, "gateway_id", null) 125 | instance_id = lookup(route.value, "instance_id", null) 126 | nat_gateway_id = lookup(route.value, "nat_gateway_id", null) 127 | network_interface_id = lookup(route.value, "network_interface_id", null) 128 | transit_gateway_id = lookup(route.value, "transit_gateway_id", null) 129 | vpc_endpoint_id = lookup(route.value, "vpc_endpoint_id", null) 130 | vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null) 131 | } 132 | } 133 | tags = merge( 134 | module.labels.tags, 135 | { 136 | "Name" = format("%s-default-rt", module.labels.id) 137 | } 138 | ) 139 | } 140 | ##----------------------------------------------------------------------------- 141 | ## Below resource is used to configure vpc dhcp options. 142 | ##----------------------------------------------------------------------------- 143 | resource "aws_vpc_dhcp_options" "vpc_dhcp" { 144 | count = var.enable && var.enable_dhcp_options ? 1 : 0 145 | domain_name = var.dhcp_options_domain_name 146 | domain_name_servers = var.dhcp_options_domain_name_servers 147 | ntp_servers = var.dhcp_options_ntp_servers 148 | netbios_name_servers = var.dhcp_options_netbios_name_servers 149 | netbios_node_type = var.dhcp_options_netbios_node_type 150 | tags = merge( 151 | module.labels.tags, 152 | { 153 | "Name" = format("%s-vpc-dhcp", module.labels.id) 154 | } 155 | ) 156 | } 157 | 158 | resource "aws_vpc_dhcp_options_association" "this" { 159 | count = var.enable && var.enable_dhcp_options ? 1 : 0 160 | vpc_id = join("", aws_vpc.default[*].id) 161 | dhcp_options_id = join("", aws_vpc_dhcp_options.vpc_dhcp[*].id) 162 | } 163 | 164 | ##----------------------------------------------------------------------------- 165 | ## Below resource will create kms key. This key will used for encryption of flow logs stored in S3 bucket or cloudwatch log group. 166 | ##----------------------------------------------------------------------------- 167 | data "aws_caller_identity" "current" {} 168 | data "aws_region" "current" {} 169 | 170 | resource "aws_kms_key" "kms" { 171 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null ? 1 : 0 172 | deletion_window_in_days = var.kms_key_deletion_window 173 | enable_key_rotation = var.enable_key_rotation 174 | } 175 | 176 | resource "aws_kms_alias" "kms-alias" { 177 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null ? 1 : 0 178 | name = format("alias/%s-flow-log-key", module.labels.id) 179 | target_key_id = aws_kms_key.kms[0].key_id 180 | } 181 | 182 | ##----------------------------------------------------------------------------- 183 | ## Below resource will attach policy to above created kms key. The above created key require policy to be attached so that cloudwatch log group can access it. 184 | ## It will be only created when vpc flow logs are stored in cloudwatch log group. 185 | ##----------------------------------------------------------------------------- 186 | resource "aws_kms_key_policy" "example" { 187 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "cloud-watch-logs" ? 1 : 0 188 | key_id = aws_kms_key.kms[0].id 189 | policy = jsonencode({ 190 | "Version" : "2012-10-17", 191 | "Id" : "key-default-1", 192 | "Statement" : [{ 193 | "Sid" : "Enable IAM User Permissions", 194 | "Effect" : "Allow", 195 | "Principal" : { 196 | "AWS" : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" 197 | }, 198 | "Action" : "kms:*", 199 | "Resource" : "*" 200 | }, 201 | { 202 | "Effect" : "Allow", 203 | "Principal" : { "Service" : "logs.${data.aws_region.current.name}.amazonaws.com" }, 204 | "Action" : [ 205 | "kms:Encrypt*", 206 | "kms:Decrypt*", 207 | "kms:ReEncrypt*", 208 | "kms:GenerateDataKey*", 209 | "kms:Describe*" 210 | ], 211 | "Resource" : "*" 212 | } 213 | ] 214 | }) 215 | 216 | } 217 | ##----------------------------------------------------------------------------- 218 | ## Below resources will create S3 bucket and its components. This S3 bucket will be used to store vpc flow logs if "flow_log_destination_type" variable is set to "s3". 219 | ##----------------------------------------------------------------------------- 220 | resource "aws_s3_bucket" "mybucket" { 221 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "s3" ? 1 : 0 222 | bucket = var.flow_logs_bucket_name 223 | } 224 | 225 | resource "aws_s3_bucket_ownership_controls" "example" { 226 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "s3" ? 1 : 0 227 | bucket = join("", aws_s3_bucket.mybucket[*].id) 228 | rule { 229 | object_ownership = "BucketOwnerPreferred" 230 | } 231 | } 232 | 233 | resource "aws_s3_bucket_acl" "example" { 234 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "s3" ? 1 : 0 235 | depends_on = [aws_s3_bucket_ownership_controls.example] 236 | bucket = join("", aws_s3_bucket.mybucket[*].id) 237 | acl = "private" 238 | } 239 | 240 | resource "aws_s3_bucket_public_access_block" "example" { 241 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "s3" ? 1 : 0 242 | bucket = aws_s3_bucket.mybucket[0].id 243 | block_public_acls = true 244 | block_public_policy = true 245 | ignore_public_acls = true 246 | restrict_public_buckets = true 247 | } 248 | 249 | resource "aws_s3_bucket_server_side_encryption_configuration" "example" { 250 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "s3" ? 1 : 0 251 | bucket = aws_s3_bucket.mybucket[0].id 252 | rule { 253 | apply_server_side_encryption_by_default { 254 | kms_master_key_id = aws_kms_key.kms[0].arn 255 | sse_algorithm = var.s3_sse_algorithm //"aws:kms" 256 | } 257 | } 258 | } 259 | 260 | resource "aws_s3_bucket_policy" "block-http" { 261 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "s3" && var.block_http_traffic ? 1 : 0 262 | bucket = aws_s3_bucket.mybucket[0].id 263 | 264 | policy = jsonencode({ 265 | Version = "2012-10-17" 266 | Id = "Blockhttp" 267 | Statement = [ 268 | { 269 | "Sid" : "AllowSSLRequestsOnly", 270 | "Effect" : "Deny", 271 | "Principal" : "*", 272 | "Action" : "s3:*", 273 | "Resource" : [ 274 | aws_s3_bucket.mybucket[0].arn, 275 | "${aws_s3_bucket.mybucket[0].arn}/*", 276 | ], 277 | "Condition" : { 278 | "Bool" : { 279 | "aws:SecureTransport" : "false" 280 | } 281 | } 282 | }, 283 | ] 284 | }) 285 | } 286 | 287 | ##----------------------------------------------------------------------------- 288 | ## Below resources will create cloudwatch log group and its components. This cloudwatch log group will be used to store vpc flow logs if "flow_log_destination_type" variable is set to "cloud-watch-logs". 289 | ##----------------------------------------------------------------------------- 290 | resource "aws_cloudwatch_log_group" "flow_log" { 291 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "cloud-watch-logs" ? 1 : 0 292 | name = format("%s-vpc-flow-log-cloudwatch_log_group", module.labels.id) 293 | retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days 294 | kms_key_id = aws_kms_key.kms[0].arn 295 | tags = module.labels.tags 296 | } 297 | 298 | resource "aws_iam_role" "vpc_flow_log_cloudwatch" { 299 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "cloud-watch-logs" && var.create_flow_log_cloudwatch_iam_role ? 1 : 0 300 | name = format("%s-vpc-flow-log-role", module.labels.id) 301 | assume_role_policy = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json 302 | permissions_boundary = var.vpc_flow_log_permissions_boundary 303 | tags = module.labels.tags 304 | } 305 | 306 | data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" { 307 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "cloud-watch-logs" && var.create_flow_log_cloudwatch_iam_role ? 1 : 0 308 | statement { 309 | sid = "AWSVPCFlowLogsAssumeRole" 310 | principals { 311 | type = "Service" 312 | identifiers = ["vpc-flow-logs.amazonaws.com"] 313 | } 314 | effect = "Allow" 315 | actions = ["sts:AssumeRole"] 316 | } 317 | } 318 | 319 | resource "aws_iam_role_policy_attachment" "vpc_flow_log_cloudwatch" { 320 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "cloud-watch-logs" && var.create_flow_log_cloudwatch_iam_role ? 1 : 0 321 | role = aws_iam_role.vpc_flow_log_cloudwatch[0].name 322 | policy_arn = aws_iam_policy.vpc_flow_log_cloudwatch[0].arn 323 | } 324 | 325 | resource "aws_iam_policy" "vpc_flow_log_cloudwatch" { 326 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "cloud-watch-logs" && var.create_flow_log_cloudwatch_iam_role ? 1 : 0 327 | name = format("%s-vpc-flow-log-to-cloudwatch", module.labels.id) 328 | policy = data.aws_iam_policy_document.vpc_flow_log_cloudwatch[0].json 329 | tags = module.labels.tags 330 | } 331 | 332 | data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" { 333 | count = var.enable && var.enable_flow_log && var.flow_log_destination_arn == null && var.flow_log_destination_type == "cloud-watch-logs" && var.create_flow_log_cloudwatch_iam_role ? 1 : 0 334 | statement { 335 | sid = "AWSVPCFlowLogsPushToCloudWatch" 336 | effect = "Allow" 337 | actions = [ 338 | "logs:CreateLogStream", 339 | "logs:PutLogEvents", 340 | "logs:DescribeLogGroups", 341 | "logs:DescribeLogStreams", 342 | ] 343 | resources = ["*"] 344 | } 345 | } 346 | ##--------------------------------------------------------------------------------------------- 347 | ## Below resource will deploy vpc flow logs for vpc created above. VPC flow log can be stored in either S3 bucket or Cloudwatch log group, as per your requirement. 348 | ##--------------------------------------------------------------------------------------------- 349 | resource "aws_flow_log" "vpc_flow_log" { 350 | count = var.enable && var.enable_flow_log == true ? 1 : 0 351 | log_destination_type = var.flow_log_destination_type 352 | log_destination = var.flow_log_destination_arn == null ? (var.flow_log_destination_type == "s3" ? aws_s3_bucket.mybucket[0].arn : aws_cloudwatch_log_group.flow_log[0].arn) : var.flow_log_destination_arn 353 | log_format = var.flow_log_log_format 354 | iam_role_arn = var.create_flow_log_cloudwatch_iam_role ? aws_iam_role.vpc_flow_log_cloudwatch[0].arn : var.flow_log_iam_role_arn 355 | traffic_type = var.flow_log_traffic_type 356 | vpc_id = join("", aws_vpc.default[*].id) 357 | max_aggregation_interval = var.flow_log_max_aggregation_interval 358 | dynamic "destination_options" { 359 | for_each = var.flow_log_destination_type == "s3" ? [true] : [] 360 | 361 | content { 362 | file_format = var.flow_log_file_format 363 | hive_compatible_partitions = var.flow_log_hive_compatible_partitions 364 | per_hour_partition = var.flow_log_per_hour_partition 365 | } 366 | } 367 | tags = module.labels.tags 368 | } 369 | ##---------------------------------------------------------------------------------------------------- 370 | ## Below resource will deploy default network acl for vpc communication. 371 | ##------------------------------------------------------------------------------------------------------- 372 | resource "aws_default_network_acl" "default" { 373 | count = var.enable && var.aws_default_network_acl ? 1 : 0 374 | default_network_acl_id = aws_vpc.default[0].default_network_acl_id 375 | dynamic "ingress" { 376 | for_each = var.default_network_acl_ingress 377 | content { 378 | action = ingress.value.action 379 | cidr_block = lookup(ingress.value, "cidr_block", null) 380 | from_port = ingress.value.from_port 381 | icmp_code = lookup(ingress.value, "icmp_code", null) 382 | icmp_type = lookup(ingress.value, "icmp_type", null) 383 | ipv6_cidr_block = lookup(ingress.value, "ipv6_cidr_block", null) 384 | protocol = ingress.value.protocol 385 | rule_no = ingress.value.rule_no 386 | to_port = ingress.value.to_port 387 | } 388 | } 389 | dynamic "egress" { 390 | for_each = var.default_network_acl_egress 391 | content { 392 | action = egress.value.action 393 | cidr_block = lookup(egress.value, "cidr_block", null) 394 | from_port = egress.value.from_port 395 | icmp_code = lookup(egress.value, "icmp_code", null) 396 | icmp_type = lookup(egress.value, "icmp_type", null) 397 | ipv6_cidr_block = lookup(egress.value, "ipv6_cidr_block", null) 398 | protocol = egress.value.protocol 399 | rule_no = egress.value.rule_no 400 | to_port = egress.value.to_port 401 | } 402 | } 403 | tags = merge( 404 | module.labels.tags, 405 | { 406 | "Name" = format("%s-nacl", module.labels.id) 407 | } 408 | ) 409 | } 410 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | #Module : VPC 2 | #Description : Terraform module to VPC outputs. 3 | output "vpc_id" { 4 | value = join("", aws_vpc.default[*].id) 5 | description = "The ID of the VPC." 6 | } 7 | 8 | output "vpc_arn" { 9 | value = join("", aws_vpc.default[*].arn) 10 | description = "The ARN of the VPC" 11 | } 12 | 13 | output "vpc_cidr_block" { 14 | value = join("", aws_vpc.default[*].cidr_block) 15 | description = "The CIDR block of the VPC." 16 | } 17 | 18 | output "ipv6_cidr_block" { 19 | value = join("", aws_vpc.default[*].ipv6_cidr_block) 20 | description = "The IPv6 CIDR block." 21 | } 22 | 23 | output "vpc_ipv6_association_id" { 24 | value = join("", aws_vpc.default[*].ipv6_association_id) 25 | description = "The association ID for the IPv6 CIDR block." 26 | } 27 | 28 | output "ipv6_cidr_block_network_border_group" { 29 | value = join("", aws_vpc.default[*].ipv6_cidr_block_network_border_group) 30 | description = "The IPv6 Network Border Group Zone name" 31 | } 32 | 33 | output "vpc_main_route_table_id" { 34 | value = join("", aws_vpc.default[*].main_route_table_id) 35 | description = "The ID of the main route table associated with this VPC." 36 | } 37 | 38 | output "vpc_default_network_acl_id" { 39 | value = join("", aws_vpc.default[*].default_network_acl_id) 40 | description = "The ID of the network ACL created by default on VPC creation." 41 | } 42 | 43 | output "vpc_default_security_group_id" { 44 | value = join("", aws_vpc.default[*].default_security_group_id) 45 | description = "The ID of the security group created by default on VPC creation." 46 | } 47 | 48 | output "vpc_default_route_table_id" { 49 | value = join("", aws_vpc.default[*].default_route_table_id) 50 | description = "The ID of the route table created by default on VPC creation." 51 | } 52 | 53 | output "tags" { 54 | value = module.labels.tags 55 | description = "A mapping of tags to assign to the resource." 56 | } 57 | 58 | ####------------------------------------------------------------------------------------- 59 | #Module : INTERNET GATEWAY 60 | #Description : Terraform internet gateway module output variables. 61 | ####-------------------------------------------------------------------------------------- 62 | output "igw_id" { 63 | value = join("", aws_internet_gateway.default[*].id) 64 | description = "The ID of the Internet Gateway." 65 | } 66 | 67 | output "ipv6_egress_only_igw_id" { 68 | value = join("", aws_egress_only_internet_gateway.default[*].id) 69 | description = "The ID of the egress-only Internet Gateway" 70 | } 71 | 72 | output "arn" { 73 | value = join("", aws_flow_log.vpc_flow_log[*].arn) 74 | description = "Amazon Resource Name (ARN) of VPC" 75 | } 76 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | #Module : LABEL 2 | #Description : Terraform label module variables. 3 | variable "name" { 4 | type = string 5 | default = "" 6 | description = "Name (e.g. `app` or `cluster`)." 7 | } 8 | 9 | variable "environment" { 10 | type = string 11 | default = "" 12 | description = "Environment (e.g. `prod`, `dev`, `staging`)." 13 | } 14 | 15 | variable "repository" { 16 | type = string 17 | default = "https://github.com/clouddrove/terraform-aws-vpc" 18 | description = "Terraform current module repo" 19 | } 20 | 21 | variable "label_order" { 22 | type = list(any) 23 | default = ["name", "environment"] 24 | description = "Label order, e.g. `name`,`application`." 25 | } 26 | 27 | variable "managedby" { 28 | type = string 29 | default = "hello@clouddrove.com" 30 | description = "ManagedBy, eg 'CloudDrove'" 31 | } 32 | 33 | #Module : VPC 34 | #Description : Terraform VPC module variables. 35 | variable "enable" { 36 | type = bool 37 | default = true 38 | description = "Flag to control the vpc creation." 39 | } 40 | 41 | variable "restrict_default_sg" { 42 | type = bool 43 | default = true 44 | description = "Flag to control the restrict default sg creation." 45 | } 46 | 47 | variable "cidr_block" { 48 | type = string 49 | default = "" 50 | description = "CIDR for the VPC." 51 | } 52 | 53 | variable "additional_cidr_block" { 54 | type = list(string) 55 | default = [] 56 | description = " List of secondary CIDR blocks of the VPC." 57 | } 58 | 59 | variable "ipv6_cidr_block" { 60 | type = string 61 | default = null 62 | description = "IPv6 CIDR for the VPC." 63 | } 64 | 65 | variable "instance_tenancy" { 66 | type = string 67 | default = "default" 68 | description = "A tenancy option for instances launched into the VPC." 69 | } 70 | 71 | variable "dns_hostnames_enabled" { 72 | type = bool 73 | default = true 74 | description = "A boolean flag to enable/disable DNS hostnames in the VPC." 75 | } 76 | 77 | variable "dns_support_enabled" { 78 | type = bool 79 | default = true 80 | description = "A boolean flag to enable/disable DNS support in the VPC." 81 | } 82 | 83 | #Module : FLOW LOG 84 | #Description : Terraform flow log module variables. 85 | variable "enable_flow_log" { 86 | type = bool 87 | default = false 88 | description = "Enable vpc_flow_log logs." 89 | } 90 | 91 | variable "ipv4_ipam_pool_id" { 92 | type = string 93 | default = "" 94 | description = "The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR." 95 | } 96 | 97 | variable "ipv4_netmask_length" { 98 | type = string 99 | default = null 100 | description = "The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4_ipam_pool_id" 101 | } 102 | 103 | variable "ipv6_ipam_pool_id" { 104 | type = string 105 | default = null 106 | description = "The ID of an IPv6 IPAM pool you want to use for allocating this VPC's CIDR." 107 | } 108 | 109 | variable "ipv6_netmask_length" { 110 | type = string 111 | default = null 112 | description = "The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv6_ipam_pool_id" 113 | } 114 | 115 | variable "default_security_group_ingress" { 116 | type = list(map(string)) 117 | default = [] 118 | description = "List of maps of ingress rules to set on the default security group" 119 | } 120 | 121 | variable "default_security_group_egress" { 122 | type = list(map(string)) 123 | default = [] 124 | description = "List of maps of egress rules to set on the default security group" 125 | } 126 | 127 | variable "enable_dhcp_options" { 128 | type = bool 129 | default = false 130 | description = "Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type" 131 | } 132 | 133 | variable "dhcp_options_domain_name" { 134 | type = string 135 | default = "service.consul" 136 | description = "Specifies DNS name for DHCP options set (requires enable_dhcp_options set to true)" 137 | } 138 | 139 | variable "dhcp_options_domain_name_servers" { 140 | type = list(string) 141 | default = ["AmazonProvidedDNS"] 142 | description = "Specify a list of DNS server addresses for DHCP options set, default to AWS provided (requires enable_dhcp_options set to true)" 143 | } 144 | 145 | variable "dhcp_options_ntp_servers" { 146 | type = list(string) 147 | default = [] 148 | description = "Specify a list of NTP servers for DHCP options set (requires enable_dhcp_options set to true)" 149 | } 150 | 151 | variable "dhcp_options_netbios_name_servers" { 152 | type = list(string) 153 | default = [] 154 | description = "Specify a list of netbios servers for DHCP options set (requires enable_dhcp_options set to true)" 155 | } 156 | 157 | variable "dhcp_options_netbios_node_type" { 158 | type = string 159 | default = "" 160 | description = "Specify netbios node_type for DHCP options set (requires enable_dhcp_options set to true)" 161 | } 162 | 163 | variable "enabled_ipv6_egress_only_internet_gateway" { 164 | type = bool 165 | default = true 166 | description = "A boolean flag to enable/disable IPv6 Egress-Only Internet Gateway creation" 167 | } 168 | 169 | variable "ipv6_cidr_block_network_border_group" { 170 | type = string 171 | default = null 172 | description = "Set this to restrict advertisement of public addresses to a specific Network Border Group such as a LocalZone." 173 | } 174 | 175 | variable "aws_default_route_table" { 176 | type = bool 177 | default = true 178 | description = "A boolean flag to enable/disable Default Route Table in the VPC." 179 | } 180 | 181 | variable "enable_network_address_usage_metrics" { 182 | type = bool 183 | default = null 184 | description = "Determines whether network address usage metrics are enabled for the VPC" 185 | } 186 | 187 | variable "assign_generated_ipv6_cidr_block" { 188 | type = bool 189 | default = true 190 | description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. Conflicts with ipv6_ipam_pool_id" 191 | } 192 | 193 | variable "aws_default_network_acl" { 194 | type = bool 195 | default = true 196 | description = "A boolean flag to enable/disable Default Network acl in the VPC." 197 | } 198 | 199 | variable "flow_logs_bucket_name" { 200 | type = string 201 | default = null 202 | description = "Name (e.g. `mybucket` or `bucket101`)." 203 | } 204 | 205 | variable "ipam_pool_enable" { 206 | type = bool 207 | default = false 208 | description = "Flag to be set true when using ipam for cidr." 209 | } 210 | 211 | variable "default_route_table_routes" { 212 | type = list(map(string)) 213 | default = [] 214 | description = "Configuration block of routes." 215 | } 216 | 217 | variable "default_network_acl_ingress" { 218 | description = "List of maps of ingress rules to set on the Default Network ACL" 219 | type = list(map(string)) 220 | default = [ 221 | { 222 | rule_no = 100 223 | action = "allow" 224 | from_port = 0 225 | to_port = 0 226 | protocol = "-1" 227 | cidr_block = "0.0.0.0/0" 228 | }, 229 | { 230 | rule_no = 101 231 | action = "allow" 232 | from_port = 0 233 | to_port = 0 234 | protocol = "-1" 235 | ipv6_cidr_block = "::/0" 236 | }, 237 | ] 238 | } 239 | 240 | variable "default_network_acl_egress" { 241 | description = "List of maps of egress rules to set on the Default Network ACL" 242 | type = list(map(string)) 243 | default = [ 244 | { 245 | rule_no = 100 246 | action = "allow" 247 | from_port = 0 248 | to_port = 0 249 | protocol = "-1" 250 | cidr_block = "0.0.0.0/0" 251 | }, 252 | { 253 | rule_no = 101 254 | action = "allow" 255 | from_port = 0 256 | to_port = 0 257 | protocol = "-1" 258 | ipv6_cidr_block = "::/0" 259 | }, 260 | ] 261 | } 262 | 263 | variable "flow_log_destination_type" { 264 | type = string 265 | default = "cloud-watch-logs" 266 | description = "Type of flow log destination. Can be s3 or cloud-watch-logs" 267 | } 268 | 269 | variable "flow_log_log_format" { 270 | type = string 271 | default = null 272 | description = "The fields to include in the flow log record, in the order in which they should appear" 273 | } 274 | 275 | variable "flow_log_file_format" { 276 | type = string 277 | default = null 278 | description = "(Optional) The format for the flow log. Valid values: `plain-text`, `parquet`" 279 | } 280 | 281 | variable "flow_log_hive_compatible_partitions" { 282 | type = bool 283 | default = false 284 | description = "(Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3" 285 | } 286 | 287 | variable "flow_log_per_hour_partition" { 288 | type = bool 289 | default = false 290 | description = "(Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries" 291 | } 292 | 293 | variable "flow_log_max_aggregation_interval" { 294 | type = number 295 | default = 600 296 | description = "The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: `60` seconds or `600` seconds" 297 | } 298 | 299 | variable "flow_log_traffic_type" { 300 | type = string 301 | default = "ALL" 302 | description = "The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL" 303 | } 304 | 305 | variable "create_flow_log_cloudwatch_iam_role" { 306 | type = bool 307 | default = false 308 | description = "Flag to be set true when cloudwatch iam role is to be created when flow log destination type is set to cloudwatch logs." 309 | } 310 | 311 | variable "flow_log_cloudwatch_log_group_retention_in_days" { 312 | type = number 313 | default = null 314 | description = "Specifies the number of days you want to retain log events in the specified log group for VPC flow logs" 315 | } 316 | 317 | variable "vpc_flow_log_permissions_boundary" { 318 | type = string 319 | default = null 320 | description = "The ARN of the Permissions Boundary for the VPC Flow Log IAM Role" 321 | } 322 | 323 | variable "flow_log_iam_role_arn" { 324 | type = string 325 | default = null 326 | description = "The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow_log_destination_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided" 327 | } 328 | 329 | variable "kms_key_deletion_window" { 330 | type = number 331 | default = 10 332 | description = "KMS Key deletion window in days." 333 | } 334 | 335 | variable "flow_log_destination_arn" { 336 | type = string 337 | default = null 338 | description = "ARN of destination where vpc flow logs are to stored. Can be of existing s3 or existing cloudwatch log group." 339 | } 340 | 341 | variable "s3_sse_algorithm" { 342 | type = string 343 | default = "aws:kms" 344 | description = "Server-side encryption algorithm to use. Valid values are AES256 and aws:kms" 345 | } 346 | 347 | variable "enable_key_rotation" { 348 | type = bool 349 | default = true 350 | description = "Specifies whether key rotation is enabled. Defaults to true(security best practice)" 351 | } 352 | 353 | variable "block_http_traffic" { 354 | type = bool 355 | default = true 356 | description = "True when http traffic has to be blocked for S3." 357 | } -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.6" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | --------------------------------------------------------------------------------
"name",
"environment"
]