16 |
17 |
18 | 
19 |
20 |
21 | 
22 |
23 |
24 | 
25 |
26 |
27 |
28 | 8 | With our comprehensive DevOps toolkit - streamline operations, automate workflows, enhance collaboration and, most importantly, deploy with confidence. 9 |
10 | 11 | 12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
30 |
31 |
32 | 
33 |
34 |
35 | 
36 |
37 |
38 | 
39 |
40 |
41 | 
42 |
43 |
44 |
We are The Cloud Experts!
181 |We ❤️ Open Source and you can check out our other modules to get help with your new Cloud ideas.
183 | 184 | [website]: https://clouddrove.com 185 | [blog]: https://blog.clouddrove.com 186 | [slack]: https://www.launchpass.com/devops-talks 187 | [github]: https://github.com/clouddrove 188 | [linkedin]: https://cpco.io/linkedin 189 | [twitter]: https://twitter.com/clouddrove/ 190 | [email]: https://clouddrove.com/contact-us.html 191 | [terraform_modules]: https://github.com/clouddrove?utf8=%E2%9C%93&q=terraform-&type=&language= 192 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | # 3 | # This is the canonical configuration for the `README.md` 4 | # Run `make readme` to rebuild the `README.md` 5 | # 6 | 7 | 8 | # Name of this project 9 | name: Terraform AWS VPN 10 | 11 | # License of this project 12 | license: "APACHE" 13 | 14 | # Canonical GitHub repo 15 | github_repo: clouddrove/terraform-aws-vpn 16 | 17 | # Badges to display 18 | badges: 19 | - name: "Latest Release" 20 | image: "https://img.shields.io/github/release/clouddrove//terraform-aws-vpn.svg" 21 | url: "https://github.com/clouddrove//terraform-aws-vpn/releases/latest" 22 | - name: "tfsec" 23 | image: "https://github.com/clouddrove//terraform-aws-vpn/actions/workflows/tfsec.yml/badge.svg" 24 | url: "https://github.com/clouddrove//terraform-aws-vpn/actions/workflows/tfsec.yml" 25 | - name: "Licence" 26 | image: "https://img.shields.io/badge/License-APACHE-blue.svg" 27 | url: "LICENSE.md" 28 | - name: "Changelog" 29 | image: "https://img.shields.io/badge/Changelog-blue" 30 | url: "CHANGELOG.md" 31 | 32 | prerequesties: 33 | - name: Terraform 34 | url: https://learn.hashicorp.com/terraform/getting-started/install.html 35 | version: ">= 1.5.5" 36 | 37 | providers: 38 | - name: aws 39 | url: https://aws.amazon.com/ 40 | version: ">= 5.13.1" 41 | 42 | module_dependencies: 43 | - name: Labels Module 44 | url: https://github.com/clouddrove/terraform-aws-labels 45 | description: Provides resource tagging. 46 | 47 | 48 | # description of this project 49 | description: |- 50 | Terraform module is used to create VPN resource on AWS for network connectivity.. 51 | 52 | # How to use this project 53 | # How to use this project 54 | usage: |- 55 | ### Simple Example 56 | Here is an example of how you can use this module in your inventory structure: 57 | ```hcl 58 | module "vpn" { 59 | source = "clouddrove/vpn/aws" 60 | version = "2.0.0" 61 | 62 | name = local.name 63 | environment = local.environment 64 | vpc_id = module.vpc.vpc_id 65 | customer_ip_address = "115.160.246.74" 66 | local_ipv4_network_cidr = "0.0.0.0/0" 67 | remote_ipv4_network_cidr = module.vpc.vpc_cidr_block 68 | vpn_connection_static_routes_destinations = ["10.80.1.0/24"] 69 | } 70 | ``` 71 | -------------------------------------------------------------------------------- /docs/io.md: -------------------------------------------------------------------------------- 1 | ## Inputs 2 | 3 | | Name | Description | Type | Default | Required | 4 | |------|-------------|------|---------|:--------:| 5 | | bgp\_asn | The gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN). | `number` | `65000` | no | 6 | | certificate\_arn | certificate\_arn (e.g. ''). | `string` | `""` | no | 7 | | create\_virtual\_private\_gateway | Set this to false to use existing Virtual Private Gateway(vgw) and prevent creation of vgw | `bool` | `true` | no | 8 | | customer\_ip\_address | The IP of the Customer Gateway. | `string` | n/a | yes | 9 | | enable\_vpn\_connection | Set to false to prevent the creation of a VPN Connection. | `bool` | `true` | no | 10 | | enable\_vpn\_gateway\_attachment | Set to false to prevent attachment of the vGW to the VPC. | `bool` | `true` | no | 11 | | environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `""` | no | 12 | | label\_order | Label order, e.g. `name`,`application`. | `list(any)` |[| no | 13 | | local\_ipv4\_network\_cidr | n/a | `string` | `"0.0.0.0/0"` | no | 14 | | local\_ipv6\_network\_cidr | (Optional) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection. | `string` | `null` | no | 15 | | managedby | ManagedBy, eg 'CloudDrove' or 'AnmolNagpal'. | `string` | `"anmol@clouddrove.com"` | no | 16 | | name | Name (e.g. `app` or `cluster`). | `string` | `""` | no | 17 | | remote\_ipv4\_network\_cidr | n/a | `string` | `"0.0.0.0/0"` | no | 18 | | remote\_ipv6\_network\_cidr | (Optional) The IPv6 CIDR on AWS side of the VPN connection. | `string` | `null` | no | 19 | | transit\_gateway\_id | The ID of the Transit Gateway. | `string` | `null` | no | 20 | | tunnel1\_dpd\_timeout\_action | (Optional, Default clear) The action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are clear \| none \| restart. | `string` | `"none"` | no | 21 | | tunnel1\_dpd\_timeout\_seconds | (Optional, Default 30) The number of seconds after which a DPD timeout occurs for the first VPN tunnel. Valid value is equal or higher than 30 | `number` | `null` | no | 22 | | tunnel1\_enable\_tunnel\_lifecycle\_control | (Optional) Turn on or off tunnel endpoint lifecycle control feature for the first VPN tunnel. Valid values are true \| false | `bool` | `null` | no | 23 | | tunnel1\_ike\_versions | (Optional) The IKE versions that are permitted for the first VPN tunnel. Valid values are ikev1 \| ikev2. | `list(string)` | `null` | no | 24 | | tunnel1\_inside\_cidr | The CIDR block of the inside IP addresses for the first VPN tunnel. | `string` | `"169.254.33.88/30"` | no | 25 | | tunnel1\_log\_options | (Optional) Options for sending VPN tunnel logs to CloudWatch. | `any` | `{}` | no | 26 | | tunnel1\_phase1\_dh\_group\_numbers | (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are 2 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24. | `list(number)` | `null` | no | 27 | | tunnel1\_phase1\_encryption\_algorithms | (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 \| AES256 \| AES128-GCM-16 \| AES256-GCM-16. | `list(string)` | `null` | no | 28 | | tunnel1\_phase1\_integrity\_algorithms | Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 \| SHA2-256 \| SHA2-384 \| SHA2-512. | `list(string)` |
"environment",
"name"
]
[| no | 29 | | tunnel1\_phase1\_lifetime\_seconds | (Optional, Default 28800) The lifetime for phase 1 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between 900 and 28800 | `number` | `null` | no | 30 | | tunnel1\_phase2\_dh\_group\_numbers | (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are 2 \| 5 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24 | `list(number)` | `null` | no | 31 | | tunnel1\_phase2\_encryption\_algorithms | (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 \| AES256 \| AES128-GCM-16 \| AES256-GCM-16. | `list(string)` | `null` | no | 32 | | tunnel1\_phase2\_integrity\_algorithms | Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 \| SHA2-256 \| SHA2-384 \| SHA2-512. | `list(string)` |
"SHA1"
]
[| no | 33 | | tunnel1\_phase2\_lifetime\_seconds | (Optional, Default 3600) The lifetime for phase 2 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between 900 and 3600 | `number` | `null` | no | 34 | | tunnel1\_preshared\_key | The preshared key of the first VPN tunnel. | `string` | `"123456789"` | no | 35 | | tunnel1\_rekey\_fuzz\_percentage | (Optional, Default 100) The percentage of the rekey window for the first VPN tunnel (determined by tunnel1\_rekey\_margin\_time\_seconds) during which the rekey time is randomly selected. Valid value is between 0 and 100 | `number` | `null` | no | 36 | | tunnel1\_rekey\_margin\_time\_seconds | (Optional, Default 540) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the first VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for tunnel1\_rekey\_fuzz\_percentage. Valid value is between 60 and half of tunnel1\_phase2\_lifetime\_seconds | `number` | `null` | no | 37 | | tunnel1\_replay\_window\_size | (Optional, Default 1024) The number of packets in an IKE replay window for the first VPN tunnel. Valid value is between 64 and 2048. | `number` | `null` | no | 38 | | tunnel1\_startup\_action | (Optional, Default clear) The action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are clear \| none \| restart. | `string` | `"add"` | no | 39 | | tunnel2\_dpd\_timeout\_action | (Optional, Default clear) The action to take after DPD timeout occurs for the second VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are clear \| none \| restart | `string` | `null` | no | 40 | | tunnel2\_enable\_tunnel\_lifecycle\_control | (Optional) Turn on or off tunnel endpoint lifecycle control feature for the second VPN tunnel. Valid values are true \| false | `bool` | `null` | no | 41 | | tunnel2\_ike\_versions | (Optional) The IKE versions that are permitted for the second VPN tunnel. Valid values are ikev1 \| ikev2 | `list(string)` | `null` | no | 42 | | tunnel2\_inside\_cidr | The CIDR block of the inside IP addresses for the second VPN tunnel. | `string` | `""` | no | 43 | | tunnel2\_log\_options | (Optional) Options for sending VPN tunnel logs to CloudWatch. | `any` | `{}` | no | 44 | | tunnel2\_phase1\_dh\_group\_numbers | (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are 2 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24 | `list(number)` | `null` | no | 45 | | tunnel2\_phase1\_encryption\_algorithms | (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 \| AES256 \| AES128-GCM-16 \| AES256-GCM-16. | `list(string)` | `null` | no | 46 | | tunnel2\_phase1\_integrity\_algorithms | Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 \| SHA2-256 \| SHA2-384 \| SHA2-512. | `list(string)` |
"SHA1"
]
[| no | 47 | | tunnel2\_phase2\_dh\_group\_numbers | (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are 2 \| 5 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24 | `list(number)` | `null` | no | 48 | | tunnel2\_phase2\_encryption\_algorithms | (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 \| AES256 \| AES128-GCM-16 \| AES256-GCM-16. | `list(string)` | `null` | no | 49 | | tunnel2\_phase2\_integrity\_algorithms | (Optional) List of one or more integrity algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are SHA1 \| SHA2-256 \| SHA2-384 \| SHA2-512 | `list(string)` | `null` | no | 50 | | tunnel2\_phase2\_lifetime\_seconds | (Optional, Default 3600) The lifetime for phase 2 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between 900 and 3600 | `number` | `null` | no | 51 | | tunnel2\_preshared\_key | The preshared key of the second VPN tunnel. | `string` | `""` | no | 52 | | tunnel2\_rekey\_fuzz\_percentage | (Optional, Default 100) The percentage of the rekey window for the second VPN tunnel (determined by tunnel1\_rekey\_margin\_time\_seconds) during which the rekey time is randomly selected. Valid value is between 0 and 100 | `number` | `null` | no | 53 | | tunnel2\_rekey\_margin\_time\_seconds | (Optional, Default 540) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the second VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for tunnel2\_rekey\_fuzz\_percentage. Valid value is between 60 and half of tunnel2\_phase2\_lifetime\_seconds | `number` | `null` | no | 54 | | tunnel2\_replay\_window\_size | (Optional, Default 1024) The number of packets in an IKE replay window for the second VPN tunnel. Valid value is between 64 and 2048. | `number` | `null` | no | 55 | | tunnel2\_startup\_action | (Optional, Default add) The action to take when the establishing the tunnel for the second VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are add \| start | `string` | `null` | no | 56 | | tunnel\_inside\_ip\_version | (Optional) Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Valid values are ipv4 \| ipv6. ipv6 Supports only EC2 Transit Gateway. | `string` | `"ipv4"` | no | 57 | | virtual\_private\_gateway\_id | Provide id of existing Virtual Private Gateway | `string` | `null` | no | 58 | | vpc\_id | The id of the VPC where the VPN Gateway lives. | `string` | n/a | yes | 59 | | vpc\_subnet\_route\_table\_count | The number of subnet route table ids being passed in via `vpc_subnet_route_table_ids`. | `string` | `0` | no | 60 | | vpc\_subnet\_route\_table\_ids | The ids of the VPC subnets for which routes from the VPN Gateway will be propagated. | `list(string)` | `[]` | no | 61 | | vpn\_connection\_static\_routes\_destinations | List of CIDRs to be used as destination for static routes (used with `vpn_connection_static_routes_only = true`). Routes to destinations set here will be propagated to the routing tables of the subnets defined in `vpc_subnet_route_table_ids`. | `list(string)` | `[]` | no | 62 | | vpn\_connection\_static\_routes\_only | Set to true for the enabled VPN connection to use static routes exclusively (only if `enable_vpn_connection = true`). Static routes must be used for devices that don't support BGP. | `bool` | `true` | no | 63 | | vpn\_connection\_type | The type of VPN connection. The only type AWS supports at this time is 'ipsec.1'. | `string` | `"ipsec.1"` | no | 64 | | vpn\_gateway\_amazon\_side\_asn | The Autonomous System Number (ASN) for the Amazon side of the VPN gateway. If you don't specify an ASN, the Virtual Private Gateway is created with the default ASN | `number` | `64512` | no | 65 | 66 | ## Outputs 67 | 68 | | Name | Description | 69 | |------|-------------| 70 | | customer\_gateway\_id | The ID of the VPN Connection Route. | 71 | | gateway\_attachment\_id | The ID of the Gateway Attachment. | 72 | | tags | A mapping of tags to assign to the resource. | 73 | | vpn\_connection\_id | The ID of the VPN Connection. | 74 | | vpn\_connection\_tunnel1\_address | A list with the the public IP address of the first VPN tunnel if `create_vpn_connection = true`, or empty otherwise | 75 | | vpn\_connection\_tunnel1\_cgw\_inside\_address | A list with the the RFC 6890 link-local address of the first VPN tunnel (Customer Gateway Side) if `create_vpn_connection = true`, or empty otherwise | 76 | | vpn\_gateway\_id | The ID of the VPN gateway. | 77 | 78 | -------------------------------------------------------------------------------- /examples/example.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = "eu-west-1" 3 | } 4 | 5 | locals { 6 | name = "app" 7 | environment = "test" 8 | } 9 | 10 | ##----------------------------------------------------------------------------- 11 | ## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center. 12 | ##----------------------------------------------------------------------------- 13 | module "vpc" { 14 | source = "clouddrove/vpc/aws" 15 | version = "2.0.0" 16 | name = local.name 17 | environment = local.environment 18 | cidr_block = "172.16.0.0/16" 19 | } 20 | 21 | ##----------------------------------------------------- 22 | ## A subnet is a range of IP addresses in your VPC. 23 | ##----------------------------------------------------- 24 | module "public_subnets" { 25 | source = "clouddrove/subnet/aws" 26 | version = "2.0.1" 27 | 28 | name = local.name 29 | environment = local.environment 30 | availability_zones = ["eu-west-1b", "eu-west-1c"] 31 | vpc_id = module.vpc.vpc_id 32 | type = "public" 33 | igw_id = module.vpc.igw_id 34 | cidr_block = module.vpc.vpc_cidr_block 35 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 36 | } 37 | 38 | ##----------------------------------------------------------------------------- 39 | ## vpn module call. 40 | ##----------------------------------------------------------------------------- 41 | module "vpn" { 42 | source = "./../" 43 | 44 | name = local.name 45 | environment = local.environment 46 | vpc_id = module.vpc.vpc_id 47 | customer_ip_address = "115.160.246.74" 48 | local_ipv4_network_cidr = "0.0.0.0/0" 49 | remote_ipv4_network_cidr = module.vpc.vpc_cidr_block 50 | vpn_connection_static_routes_destinations = ["10.80.1.0/24"] 51 | 52 | } 53 | -------------------------------------------------------------------------------- /examples/outputs.tf: -------------------------------------------------------------------------------- 1 | output "id" { 2 | value = module.vpn.vpn_gateway_id 3 | description = "The ID of the VPN gateway." 4 | } 5 | 6 | output "tags" { 7 | value = module.vpn.tags 8 | description = "A mapping of tags to assign to the resource." 9 | } 10 | 11 | output "vpn_connection_id" { 12 | value = module.vpn.vpn_connection_id 13 | description = "VPN connection id" 14 | } 15 | 16 | output "vpn_connection_tunnel1_cgw_inside_address" { 17 | value = module.vpn.vpn_connection_tunnel1_cgw_inside_address 18 | description = "Tunnel1 CGW address" 19 | } 20 | 21 | output "vpn_connection_tunnel1_address" { 22 | value = module.vpn.vpn_connection_tunnel1_address 23 | description = "Tunnel1 address" 24 | } 25 | -------------------------------------------------------------------------------- /examples/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.5.5" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.13.1" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | ##----------------------------------------------------------------------------- 2 | ## Labels module callled that will be used for naming and tags. 3 | ##----------------------------------------------------------------------------- 4 | module "labels" { 5 | source = "clouddrove/labels/aws" 6 | version = "1.3.0" 7 | 8 | name = var.name 9 | environment = var.environment 10 | label_order = var.label_order 11 | managedby = var.managedby 12 | } 13 | 14 | locals { 15 | preshared_key_provided = length(var.tunnel1_preshared_key) > 0 && length(var.tunnel2_preshared_key) > 0 16 | preshared_key_not_provided = false == local.preshared_key_provided 17 | internal_cidr_provided = length(var.tunnel1_inside_cidr) > 0 && length(var.tunnel2_inside_cidr) > 0 18 | internal_cidr_not_provided = false == local.internal_cidr_provided 19 | tunnel_details_not_specified = local.internal_cidr_not_provided && local.preshared_key_not_provided 20 | } 21 | 22 | ##----------------------------------------------------------------------------- 23 | ## aws_vpn_connection. Manages a Site-to-Site VPN connection. 24 | ##----------------------------------------------------------------------------- 25 | resource "aws_vpn_connection" "default" { 26 | count = var.enable_vpn_connection && local.tunnel_details_not_specified ? 1 : 0 27 | 28 | vpn_gateway_id = var.virtual_private_gateway_id != null ? var.virtual_private_gateway_id : join("", aws_vpn_gateway.vpn[*].id) 29 | customer_gateway_id = join("", aws_customer_gateway.main[*].id) 30 | transit_gateway_id = var.transit_gateway_id 31 | type = var.vpn_connection_type 32 | static_routes_only = var.vpn_connection_static_routes_only 33 | local_ipv4_network_cidr = var.local_ipv4_network_cidr 34 | remote_ipv4_network_cidr = var.remote_ipv4_network_cidr 35 | local_ipv6_network_cidr = var.local_ipv6_network_cidr 36 | remote_ipv6_network_cidr = var.remote_ipv6_network_cidr 37 | tunnel1_dpd_timeout_action = var.tunnel1_dpd_timeout_action 38 | tunnel1_preshared_key = var.tunnel1_preshared_key 39 | tunnel1_startup_action = var.tunnel1_startup_action 40 | tunnel1_phase1_encryption_algorithms = var.tunnel1_phase1_encryption_algorithms 41 | tunnel1_phase2_encryption_algorithms = var.tunnel1_phase2_encryption_algorithms 42 | tunnel1_phase1_integrity_algorithms = var.tunnel1_phase1_integrity_algorithms 43 | tunnel1_phase2_integrity_algorithms = var.tunnel1_phase2_integrity_algorithms 44 | tunnel1_phase1_dh_group_numbers = var.tunnel1_phase1_dh_group_numbers 45 | tunnel1_phase2_dh_group_numbers = var.tunnel1_phase2_dh_group_numbers 46 | tunnel1_phase1_lifetime_seconds = var.tunnel1_phase1_lifetime_seconds 47 | tunnel1_ike_versions = var.tunnel1_ike_versions 48 | tunnel1_inside_cidr = var.tunnel1_inside_cidr 49 | tunnel1_dpd_timeout_seconds = var.tunnel1_dpd_timeout_seconds 50 | tunnel1_enable_tunnel_lifecycle_control = var.tunnel1_enable_tunnel_lifecycle_control 51 | tunnel1_phase2_lifetime_seconds = var.tunnel1_phase2_lifetime_seconds 52 | tunnel1_rekey_fuzz_percentage = var.tunnel1_rekey_fuzz_percentage 53 | tunnel1_rekey_margin_time_seconds = var.tunnel1_rekey_margin_time_seconds 54 | tunnel1_replay_window_size = var.tunnel1_replay_window_size 55 | tunnel_inside_ip_version = var.tunnel_inside_ip_version 56 | 57 | tunnel2_dpd_timeout_action = var.tunnel2_dpd_timeout_action 58 | tunnel2_enable_tunnel_lifecycle_control = var.tunnel2_enable_tunnel_lifecycle_control 59 | tunnel2_phase2_dh_group_numbers = var.tunnel2_phase2_dh_group_numbers 60 | tunnel2_phase2_encryption_algorithms = var.tunnel2_phase2_encryption_algorithms 61 | tunnel2_phase1_integrity_algorithms = var.tunnel2_phase1_integrity_algorithms 62 | tunnel2_phase2_integrity_algorithms = var.tunnel2_phase2_integrity_algorithms 63 | tunnel2_phase2_lifetime_seconds = var.tunnel2_phase2_lifetime_seconds 64 | tunnel2_rekey_fuzz_percentage = var.tunnel2_rekey_fuzz_percentage 65 | tunnel2_rekey_margin_time_seconds = var.tunnel2_rekey_margin_time_seconds 66 | tunnel2_replay_window_size = var.tunnel2_replay_window_size 67 | tunnel2_startup_action = var.tunnel2_startup_action 68 | tunnel2_phase1_encryption_algorithms = var.tunnel2_phase1_encryption_algorithms 69 | tunnel2_ike_versions = var.tunnel2_ike_versions 70 | tunnel2_phase1_dh_group_numbers = var.tunnel2_phase1_dh_group_numbers 71 | 72 | dynamic "tunnel1_log_options" { 73 | for_each = [var.tunnel1_log_options] 74 | 75 | content { 76 | dynamic "cloudwatch_log_options" { 77 | for_each = tunnel1_log_options.value 78 | 79 | content { 80 | log_enabled = lookup(cloudwatch_log_options.value, "log_enabled", null) 81 | log_group_arn = lookup(cloudwatch_log_options.value, "log_group_arn", null) 82 | log_output_format = lookup(cloudwatch_log_options.value, "log_output_format", null) 83 | } 84 | } 85 | } 86 | } 87 | 88 | dynamic "tunnel2_log_options" { 89 | for_each = [var.tunnel2_log_options] 90 | 91 | content { 92 | dynamic "cloudwatch_log_options" { 93 | for_each = tunnel2_log_options.value 94 | 95 | content { 96 | log_enabled = lookup(cloudwatch_log_options.value, "log_enabled", null) 97 | log_group_arn = lookup(cloudwatch_log_options.value, "log_group_arn", null) 98 | log_output_format = lookup(cloudwatch_log_options.value, "log_output_format", null) 99 | } 100 | } 101 | } 102 | } 103 | 104 | tags = module.labels.tags 105 | } 106 | 107 | ##----------------------------------------------------------------------------- 108 | ## Provides a Virtual Private Gateway attachment resource, allowing for an existing hardware VPN gateway to be attached and/or detached from a VPC 109 | ##----------------------------------------------------------------------------- 110 | resource "aws_vpn_gateway_attachment" "default" { 111 | count = var.enable_vpn_connection && var.create_virtual_private_gateway && var.enable_vpn_gateway_attachment ? 1 : 0 112 | vpc_id = var.vpc_id 113 | vpn_gateway_id = var.virtual_private_gateway_id != null ? var.virtual_private_gateway_id : join("", aws_vpn_gateway.vpn[*].id) 114 | } 115 | 116 | ##----------------------------------------------------------------------------- 117 | ## Requests automatic route propagation between a VPN gateway and a route table. 118 | ##----------------------------------------------------------------------------- 119 | resource "aws_vpn_gateway_route_propagation" "private_subnets_vpn_routing" { 120 | count = var.enable_vpn_connection ? var.vpc_subnet_route_table_count : 0 121 | vpn_gateway_id = join("", aws_vpn_gateway.vpn[*].id) 122 | route_table_id = element(var.vpc_subnet_route_table_ids, count.index) 123 | } 124 | 125 | ##----------------------------------------------------------------------------- 126 | ## Provides a static route between a VPN connection and a customer gateway. 127 | ##----------------------------------------------------------------------------- 128 | resource "aws_vpn_connection_route" "default" { 129 | count = var.enable_vpn_connection ? var.vpn_connection_static_routes_only ? length(var.vpn_connection_static_routes_destinations) : 0 : 0 130 | vpn_connection_id = join("", aws_vpn_connection.default[*].id) 131 | destination_cidr_block = element(var.vpn_connection_static_routes_destinations, count.index) 132 | } 133 | 134 | ##----------------------------------------------------------------------------- 135 | ## Provides a customer gateway inside a VPC. These objects can be connected to VPN gateways via VPN connections, and allow you to establish tunnels between your network and the VPC. 136 | ##----------------------------------------------------------------------------- 137 | resource "aws_customer_gateway" "main" { 138 | count = var.enable_vpn_connection && var.enable_vpn_gateway_attachment ? 1 : 0 139 | bgp_asn = var.bgp_asn 140 | ip_address = var.customer_ip_address 141 | type = var.vpn_connection_type 142 | certificate_arn = var.certificate_arn 143 | tags = merge( 144 | module.labels.tags, 145 | { 146 | "Name" = format("%s-cgw", module.labels.id) 147 | } 148 | ) 149 | } 150 | 151 | ##----------------------------------------------------------------------------- 152 | ## VPN gateways provide secure connectivity between multiple sites, such as on-premises data centers, Google Cloud Virtual Private Cloud (VPC) networks, and Google Cloud VMware Engine private clouds. 153 | ##----------------------------------------------------------------------------- 154 | resource "aws_vpn_gateway" "vpn" { 155 | count = var.enable_vpn_connection && var.enable_vpn_gateway_attachment && var.create_virtual_private_gateway ? 1 : 0 156 | vpc_id = var.vpc_id 157 | amazon_side_asn = var.vpn_gateway_amazon_side_asn 158 | 159 | tags = merge( 160 | module.labels.tags, 161 | { 162 | "Name" = format("%s-vgw", module.labels.id) 163 | } 164 | ) 165 | } 166 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | #Module : VPN 2 | # Description : This Script is used to create VPN, CUSTOMER GATEWAY, and VPN GATEWAY. 3 | 4 | output "vpn_connection_id" { 5 | value = concat( 6 | aws_vpn_connection.default[*].id 7 | )[0] 8 | description = "The ID of the VPN Connection." 9 | } 10 | 11 | output "gateway_attachment_id" { 12 | value = var.create_virtual_private_gateway ? concat( 13 | aws_vpn_gateway_attachment.default[*].id 14 | )[0] : "n/a" 15 | description = "The ID of the Gateway Attachment." 16 | } 17 | 18 | output "customer_gateway_id" { 19 | value = concat( 20 | aws_customer_gateway.main[*].id 21 | )[0] 22 | description = "The ID of the VPN Connection Route." 23 | } 24 | 25 | output "vpn_gateway_id" { 26 | value = var.create_virtual_private_gateway ? concat( 27 | aws_vpn_gateway.vpn[*].id 28 | )[0] : var.create_virtual_private_gateway 29 | description = "The ID of the VPN gateway." 30 | } 31 | 32 | output "tags" { 33 | value = module.labels.tags 34 | description = "A mapping of tags to assign to the resource." 35 | } 36 | 37 | output "vpn_connection_tunnel1_cgw_inside_address" { 38 | value = try(aws_vpn_connection.default[0].tunnel1_cgw_inside_address) 39 | description = "A list with the the RFC 6890 link-local address of the first VPN tunnel (Customer Gateway Side) if `create_vpn_connection = true`, or empty otherwise" 40 | } 41 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | #Module : LABEL 2 | #Description : Terraform label module variables. 3 | variable "name" { 4 | type = string 5 | default = "" 6 | description = "Name (e.g. `app` or `cluster`)." 7 | } 8 | 9 | variable "certificate_arn" { 10 | type = string 11 | default = "" 12 | description = "certificate_arn (e.g. '')." 13 | } 14 | 15 | variable "environment" { 16 | type = string 17 | default = "" 18 | description = "Environment (e.g. `prod`, `dev`, `staging`)." 19 | } 20 | 21 | variable "local_ipv4_network_cidr" { 22 | type = string 23 | default = "0.0.0.0/0" 24 | } 25 | 26 | variable "remote_ipv4_network_cidr" { 27 | type = string 28 | default = "0.0.0.0/0" 29 | } 30 | 31 | variable "label_order" { 32 | type = list(any) 33 | default = ["environment", "name"] 34 | description = "Label order, e.g. `name`,`application`." 35 | } 36 | 37 | variable "managedby" { 38 | type = string 39 | default = "anmol@clouddrove.com" 40 | description = "ManagedBy, eg 'CloudDrove' or 'AnmolNagpal'." 41 | } 42 | 43 | ########################################################################################################################################### 44 | ## aws vpn 45 | ########################################################################################################################################### 46 | 47 | variable "customer_ip_address" { 48 | type = string 49 | description = "The IP of the Customer Gateway." 50 | } 51 | 52 | variable "enable_vpn_connection" { 53 | type = bool 54 | default = true 55 | description = "Set to false to prevent the creation of a VPN Connection." 56 | } 57 | 58 | variable "vpc_id" { 59 | type = string 60 | description = "The id of the VPC where the VPN Gateway lives." 61 | } 62 | 63 | variable "vpc_subnet_route_table_ids" { 64 | type = list(string) 65 | default = [] 66 | description = "The ids of the VPC subnets for which routes from the VPN Gateway will be propagated." 67 | } 68 | 69 | variable "vpc_subnet_route_table_count" { 70 | type = string 71 | default = 0 72 | description = "The number of subnet route table ids being passed in via `vpc_subnet_route_table_ids`." 73 | } 74 | 75 | variable "vpn_connection_static_routes_only" { 76 | type = bool 77 | default = true 78 | description = "Set to true for the enabled VPN connection to use static routes exclusively (only if `enable_vpn_connection = true`). Static routes must be used for devices that don't support BGP." 79 | } 80 | 81 | variable "vpn_connection_static_routes_destinations" { 82 | type = list(string) 83 | default = [] 84 | description = "List of CIDRs to be used as destination for static routes (used with `vpn_connection_static_routes_only = true`). Routes to destinations set here will be propagated to the routing tables of the subnets defined in `vpc_subnet_route_table_ids`." 85 | } 86 | 87 | variable "virtual_private_gateway_id" { 88 | type = string 89 | default = null 90 | description = "Provide id of existing Virtual Private Gateway" 91 | } 92 | 93 | variable "create_virtual_private_gateway" { 94 | type = bool 95 | default = true 96 | description = "Set this to false to use existing Virtual Private Gateway(vgw) and prevent creation of vgw" 97 | } 98 | 99 | ########################################################################################################################################### 100 | ## tunnel 1 101 | ########################################################################################################################################### 102 | 103 | 104 | 105 | variable "tunnel1_inside_cidr" { 106 | type = string 107 | default = "169.254.33.88/30" 108 | description = "The CIDR block of the inside IP addresses for the first VPN tunnel." 109 | } 110 | 111 | 112 | variable "tunnel1_preshared_key" { 113 | type = string 114 | default = "123456789" 115 | description = "The preshared key of the first VPN tunnel." 116 | } 117 | 118 | variable "tunnel1_phase1_encryption_algorithms" { 119 | type = list(string) 120 | default = null 121 | description = "(Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16." 122 | } 123 | 124 | variable "tunnel1_phase2_encryption_algorithms" { 125 | type = list(string) 126 | default = null 127 | description = "(Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16." 128 | } 129 | 130 | variable "tunnel1_phase1_integrity_algorithms" { 131 | type = list(string) 132 | default = ["SHA1"] 133 | description = "Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 | SHA2-256 | SHA2-384 | SHA2-512." 134 | } 135 | 136 | variable "tunnel1_phase2_integrity_algorithms" { 137 | type = list(string) 138 | default = ["SHA1"] 139 | description = "Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 | SHA2-256 | SHA2-384 | SHA2-512." 140 | } 141 | 142 | variable "tunnel1_phase1_dh_group_numbers" { 143 | type = list(number) 144 | default = null 145 | description = "(Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24." 146 | } 147 | 148 | variable "tunnel1_phase2_dh_group_numbers" { 149 | type = list(number) 150 | default = null 151 | description = "(Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are 2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24" 152 | } 153 | 154 | variable "tunnel1_ike_versions" { 155 | type = list(string) 156 | default = null 157 | description = "(Optional) The IKE versions that are permitted for the first VPN tunnel. Valid values are ikev1 | ikev2." 158 | } 159 | 160 | variable "tunnel1_dpd_timeout_action" { 161 | type = string 162 | default = "none" 163 | description = "(Optional, Default clear) The action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are clear | none | restart." 164 | } 165 | 166 | 167 | variable "tunnel1_startup_action" { 168 | type = string 169 | default = "add" 170 | description = "(Optional, Default clear) The action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are clear | none | restart." 171 | } 172 | 173 | variable "tunnel2_inside_cidr" { 174 | type = string 175 | default = "" 176 | description = "The CIDR block of the inside IP addresses for the second VPN tunnel." 177 | } 178 | 179 | variable "tunnel2_preshared_key" { 180 | type = string 181 | default = "" 182 | description = "The preshared key of the second VPN tunnel." 183 | } 184 | 185 | variable "tunnel2_phase1_encryption_algorithms" { 186 | type = list(string) 187 | default = null 188 | description = "(Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16." 189 | } 190 | 191 | variable "enable_vpn_gateway_attachment" { 192 | type = bool 193 | default = true 194 | description = "Set to false to prevent attachment of the vGW to the VPC." 195 | } 196 | 197 | variable "transit_gateway_id" { 198 | type = string 199 | default = null 200 | description = "The ID of the Transit Gateway." 201 | } 202 | 203 | variable "tunnel2_phase1_dh_group_numbers" { 204 | type = list(number) 205 | default = null 206 | description = "(Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24" 207 | } 208 | 209 | variable "tunnel1_phase1_lifetime_seconds" { 210 | type = number 211 | default = null 212 | description = "(Optional, Default 28800) The lifetime for phase 1 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between 900 and 28800" 213 | } 214 | 215 | variable "tunnel1_dpd_timeout_seconds" { 216 | type = number 217 | default = null 218 | description = "(Optional, Default 30) The number of seconds after which a DPD timeout occurs for the first VPN tunnel. Valid value is equal or higher than 30" 219 | } 220 | 221 | variable "tunnel1_enable_tunnel_lifecycle_control" { 222 | type = bool 223 | default = null 224 | description = "(Optional) Turn on or off tunnel endpoint lifecycle control feature for the first VPN tunnel. Valid values are true | false" 225 | } 226 | 227 | variable "tunnel1_phase2_lifetime_seconds" { 228 | type = number 229 | default = null 230 | description = "(Optional, Default 3600) The lifetime for phase 2 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between 900 and 3600" 231 | } 232 | 233 | variable "local_ipv6_network_cidr" { 234 | type = string 235 | default = null 236 | description = "(Optional) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection." 237 | } 238 | 239 | variable "remote_ipv6_network_cidr" { 240 | type = string 241 | default = null 242 | description = "(Optional) The IPv6 CIDR on AWS side of the VPN connection." 243 | } 244 | 245 | variable "tunnel1_rekey_fuzz_percentage" { 246 | type = number 247 | default = null 248 | description = "(Optional, Default 100) The percentage of the rekey window for the first VPN tunnel (determined by tunnel1_rekey_margin_time_seconds) during which the rekey time is randomly selected. Valid value is between 0 and 100" 249 | } 250 | 251 | variable "tunnel1_rekey_margin_time_seconds" { 252 | type = number 253 | default = null 254 | description = "(Optional, Default 540) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the first VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for tunnel1_rekey_fuzz_percentage. Valid value is between 60 and half of tunnel1_phase2_lifetime_seconds" 255 | } 256 | 257 | variable "tunnel1_replay_window_size" { 258 | type = number 259 | default = null 260 | description = "(Optional, Default 1024) The number of packets in an IKE replay window for the first VPN tunnel. Valid value is between 64 and 2048." 261 | } 262 | 263 | variable "tunnel_inside_ip_version" { 264 | description = "(Optional) Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Valid values are ipv4 | ipv6. ipv6 Supports only EC2 Transit Gateway." 265 | type = string 266 | default = "ipv4" 267 | } 268 | 269 | variable "vpn_connection_type" { 270 | type = string 271 | default = "ipsec.1" 272 | description = "The type of VPN connection. The only type AWS supports at this time is 'ipsec.1'." 273 | } 274 | 275 | variable "bgp_asn" { 276 | type = number 277 | default = 65000 278 | description = "The gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN)." 279 | } 280 | 281 | variable "vpn_gateway_amazon_side_asn" { 282 | type = number 283 | default = 64512 284 | description = "The Autonomous System Number (ASN) for the Amazon side of the VPN gateway. If you don't specify an ASN, the Virtual Private Gateway is created with the default ASN" 285 | } 286 | 287 | variable "tunnel2_dpd_timeout_action" { 288 | type = string 289 | default = null 290 | description = "(Optional, Default clear) The action to take after DPD timeout occurs for the second VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are clear | none | restart" 291 | } 292 | 293 | variable "tunnel2_enable_tunnel_lifecycle_control" { 294 | type = bool 295 | default = null 296 | description = "(Optional) Turn on or off tunnel endpoint lifecycle control feature for the second VPN tunnel. Valid values are true | false" 297 | } 298 | 299 | variable "tunnel2_phase2_dh_group_numbers" { 300 | type = list(number) 301 | default = null 302 | description = "(Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are 2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24" 303 | } 304 | 305 | variable "tunnel2_phase2_encryption_algorithms" { 306 | type = list(string) 307 | default = null 308 | description = "(Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16." 309 | } 310 | 311 | variable "tunnel2_phase1_integrity_algorithms" { 312 | type = list(string) 313 | default = ["SHA1"] 314 | description = "Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 | SHA2-256 | SHA2-384 | SHA2-512." 315 | } 316 | 317 | variable "tunnel2_phase2_integrity_algorithms" { 318 | type = list(string) 319 | default = null 320 | description = "(Optional) List of one or more integrity algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are SHA1 | SHA2-256 | SHA2-384 | SHA2-512" 321 | } 322 | 323 | variable "tunnel2_phase2_lifetime_seconds" { 324 | type = number 325 | default = null 326 | description = "(Optional, Default 3600) The lifetime for phase 2 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between 900 and 3600" 327 | } 328 | 329 | variable "tunnel2_rekey_fuzz_percentage" { 330 | type = number 331 | default = null 332 | description = "(Optional, Default 100) The percentage of the rekey window for the second VPN tunnel (determined by tunnel1_rekey_margin_time_seconds) during which the rekey time is randomly selected. Valid value is between 0 and 100" 333 | } 334 | 335 | variable "tunnel2_rekey_margin_time_seconds" { 336 | type = number 337 | default = null 338 | description = "(Optional, Default 540) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the second VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for tunnel2_rekey_fuzz_percentage. Valid value is between 60 and half of tunnel2_phase2_lifetime_seconds" 339 | } 340 | 341 | variable "tunnel2_replay_window_size" { 342 | description = "(Optional, Default 1024) The number of packets in an IKE replay window for the second VPN tunnel. Valid value is between 64 and 2048." 343 | type = number 344 | default = null 345 | } 346 | 347 | variable "tunnel2_startup_action" { 348 | description = "(Optional, Default add) The action to take when the establishing the tunnel for the second VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are add | start" 349 | type = string 350 | default = null 351 | } 352 | 353 | variable "tunnel2_ike_versions" { 354 | type = list(string) 355 | default = null 356 | description = "(Optional) The IKE versions that are permitted for the second VPN tunnel. Valid values are ikev1 | ikev2" 357 | } 358 | 359 | variable "tunnel1_log_options" { 360 | type = any 361 | default = {} 362 | description = "(Optional) Options for sending VPN tunnel logs to CloudWatch." 363 | } 364 | 365 | variable "tunnel2_log_options" { 366 | type = any 367 | default = {} 368 | description = "(Optional) Options for sending VPN tunnel logs to CloudWatch." 369 | } 370 | 371 | output "vpn_connection_tunnel1_address" { 372 | value = try(aws_vpn_connection.default[0].tunnel1_address) 373 | description = "A list with the the public IP address of the first VPN tunnel if `create_vpn_connection = true`, or empty otherwise" 374 | } 375 | -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.5.5" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.13.1" 9 | } 10 | } 11 | } 12 | --------------------------------------------------------------------------------
"SHA1"
]