0
98 | error_message = "At least one record must be provided."
99 | }
100 | validation {
101 | condition = length(distinct(var.records[*].id)) == length(var.records)
102 | error_message = "Each record `id` must be unique in the record set."
103 | }
104 | validation {
105 | condition = alltrue([
106 | for record in var.records :
107 | anytrue([
108 | record.value != null && record.alias == null,
109 | record.value == null && record.alias != null,
110 | ])
111 | ])
112 | error_message = "Each record must have either `value` or `alias`."
113 | }
114 | }
115 |
--------------------------------------------------------------------------------
/modules/record-set/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 1.6"
3 |
4 | required_providers {
5 | aws = {
6 | source = "hashicorp/aws"
7 | version = ">= 5.51"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/modules/registered-domain/README.md:
--------------------------------------------------------------------------------
1 | # registered-domain
2 |
3 | This module creates following resources.
4 |
5 | - `aws_route53domains_registered_domain`
6 |
7 |
8 | ## Requirements
9 |
10 | | Name | Version |
11 | |------|---------|
12 | | [terraform](#requirement\_terraform) | >= 1.6 |
13 | | [aws](#requirement\_aws) | >= 5.41 |
14 |
15 | ## Providers
16 |
17 | | Name | Version |
18 | |------|---------|
19 | | [aws](#provider\_aws) | 5.47.0 |
20 |
21 | ## Modules
22 |
23 | | Name | Source | Version |
24 | |------|--------|---------|
25 | | [resource\_group](#module\_resource\_group) | tedilabs/misc/aws//modules/resource-group | ~> 0.10.0 |
26 |
27 | ## Resources
28 |
29 | | Name | Type |
30 | |------|------|
31 | | [aws_route53domains_registered_domain.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53domains_registered_domain) | resource |
32 |
33 | ## Inputs
34 |
35 | | Name | Description | Type | Default | Required |
36 | |------|-------------|------|---------|:--------:|
37 | | [name](#input\_name) | (Required) The name of the registred domain. | `string` | n/a | yes |
38 | | [admin\_contact](#input\_admin\_contact) | (Optional) The configuration of the domain administrative contact. `admin_contact` as defined below.
(Optional) `type` - Whether the contact is a person, company, association, or public organization. Valid values are `PERSON`, `COMPANY`, `ASSOCIATION`, or `PUBLIC_BODY`, `RESELLER`. Defaults to `PERSON`.
(Optional) `organization` - The name of the organization for contact types other than `PERSON`.
(Optional) `first_name` - First name of contact.
(Optional) `last_name` - Last name of contact.
(Optional) `email` - The email address of the contact.
(Optional) `phone` - The phone number of the contact. Phone number must be specified in the format `+[country dialing code].[number including any area code]`.
(Optional) `fax` - The fax number of the contact. Fax number must be specified in the format `+[country dialing code].[number including any area code]`.
(Optional) `country_code` - The ISO-3166 two-letter country code for the contact address.
(Optional) `state` - The state or province of the contact's city.
(Optional) `city` - The city of the contact's address.
(Optional) `address_line_1` - The first line of the contact address.
(Optional) `address_line_2` - The second line of the contact address, if any.
(Optional) `postal_code` - The zip or postal code of the contact's address.
(Optional) `extra_params` - A key-value map of parameters required by certain top-level domains.
(Optional) `privacy_protection_enabled` - Whether domain contact information is concealed from WHOIS queries. Defaults to `true`. | object({
type = optional(string, "PERSON")
organization = optional(string)
first_name = optional(string)
last_name = optional(string)
email = optional(string)
phone = optional(string)
fax = optional(string)
country_code = optional(string)
state = optional(string)
city = optional(string)
address_line_1 = optional(string)
address_line_2 = optional(string)
postal_code = optional(string)
extra_params = optional(map(string), {})
privacy_protection_enabled = optional(bool, true)
}) | `{}` | no |
39 | | [auto\_renew\_enabled](#input\_auto\_renew\_enabled) | (Optional) Whether the domain registration is set to renew automatically. Defaults to `true`. | `bool` | `true` | no |
40 | | [billing\_contact](#input\_billing\_contact) | (Optional) The configuration of the domain billing contact. `billing_contact` as defined below.
(Optional) `type` - Whether the contact is a person, company, association, or public organization. Valid values are `PERSON`, `COMPANY`, `ASSOCIATION`, or `PUBLIC_BODY`, `RESELLER`. Defaults to `PERSON`.
(Optional) `organization` - The name of the organization for contact types other than `PERSON`.
(Optional) `first_name` - First name of contact.
(Optional) `last_name` - Last name of contact.
(Optional) `email` - The email address of the contact.
(Optional) `phone` - The phone number of the contact. Phone number must be specified in the format `+[country dialing code].[number including any area code]`.
(Optional) `fax` - The fax number of the contact. Fax number must be specified in the format `+[country dialing code].[number including any area code]`.
(Optional) `country_code` - The ISO-3166 two-letter country code for the contact address.
(Optional) `state` - The state or province of the contact's city.
(Optional) `city` - The city of the contact's address.
(Optional) `address_line_1` - The first line of the contact address.
(Optional) `address_line_2` - The second line of the contact address, if any.
(Optional) `postal_code` - The zip or postal code of the contact's address.
(Optional) `extra_params` - A key-value map of parameters required by certain top-level domains.
(Optional) `privacy_protection_enabled` - Whether domain contact information is concealed from WHOIS queries. Defaults to `true`. | object({
type = optional(string, "PERSON")
organization = optional(string)
first_name = optional(string)
last_name = optional(string)
email = optional(string)
phone = optional(string)
fax = optional(string)
country_code = optional(string)
state = optional(string)
city = optional(string)
address_line_1 = optional(string)
address_line_2 = optional(string)
postal_code = optional(string)
extra_params = optional(map(string), {})
privacy_protection_enabled = optional(bool, true)
}) | `{}` | no |
41 | | [module\_tags\_enabled](#input\_module\_tags\_enabled) | (Optional) Whether to create AWS Resource Tags for the module informations. | `bool` | `true` | no |
42 | | [name\_servers](#input\_name\_servers) | (Optional) A set of fully qualified host name of name servers for the registered domain. | `set(string)` | `[]` | no |
43 | | [registrant\_contact](#input\_registrant\_contact) | (Optional) The configuration of the domain registrant contact. `registrant_contact` as defined below.
(Optional) `type` - Whether the contact is a person, company, association, or public organization. Valid values are `PERSON`, `COMPANY`, `ASSOCIATION`, or `PUBLIC_BODY`, `RESELLER`. Defaults to `PERSON`.
(Optional) `organization` - The name of the organization for contact types other than `PERSON`.
(Optional) `first_name` - First name of contact.
(Optional) `last_name` - Last name of contact.
(Optional) `email` - The email address of the contact.
(Optional) `phone` - The phone number of the contact. Phone number must be specified in the format `+[country dialing code].[number including any area code]`.
(Optional) `fax` - The fax number of the contact. Fax number must be specified in the format `+[country dialing code].[number including any area code]`.
(Optional) `country_code` - The ISO-3166 two-letter country code for the contact address.
(Optional) `state` - The state or province of the contact's city.
(Optional) `city` - The city of the contact's address.
(Optional) `address_line_1` - The first line of the contact address.
(Optional) `address_line_2` - The second line of the contact address, if any.
(Optional) `postal_code` - The zip or postal code of the contact's address.
(Optional) `extra_params` - A key-value map of parameters required by certain top-level domains.
(Optional) `privacy_protection_enabled` - Whether domain contact information is concealed from WHOIS queries. Defaults to `true`. | object({
type = optional(string, "PERSON")
organization = optional(string)
first_name = optional(string)
last_name = optional(string)
email = optional(string)
phone = optional(string)
fax = optional(string)
country_code = optional(string)
state = optional(string)
city = optional(string)
address_line_1 = optional(string)
address_line_2 = optional(string)
postal_code = optional(string)
extra_params = optional(map(string), {})
privacy_protection_enabled = optional(bool, true)
}) | `{}` | no |
44 | | [resource\_group\_description](#input\_resource\_group\_description) | (Optional) The description of Resource Group. | `string` | `"Managed by Terraform."` | no |
45 | | [resource\_group\_enabled](#input\_resource\_group\_enabled) | (Optional) Whether to create Resource Group to find and group AWS resources which are created by this module. | `bool` | `true` | no |
46 | | [resource\_group\_name](#input\_resource\_group\_name) | (Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. | `string` | `""` | no |
47 | | [tags](#input\_tags) | (Optional) A map of tags to add to all resources. | `map(string)` | `{}` | no |
48 | | [technical\_contact](#input\_technical\_contact) | (Optional) The configuration of the domain technical contact. `technical_contact` as defined below.
(Optional) `type` - Whether the contact is a person, company, association, or public organization. Valid values are `PERSON`, `COMPANY`, `ASSOCIATION`, or `PUBLIC_BODY`, `RESELLER`. Defaults to `PERSON`.
(Optional) `organization` - The name of the organization for contact types other than `PERSON`.
(Optional) `first_name` - First name of contact.
(Optional) `last_name` - Last name of contact.
(Optional) `email` - The email address of the contact.
(Optional) `phone` - The phone number of the contact. Phone number must be specified in the format `+[country dialing code].[number including any area code]`.
(Optional) `fax` - The fax number of the contact. Fax number must be specified in the format `+[country dialing code].[number including any area code]`.
(Optional) `country_code` - The ISO-3166 two-letter country code for the contact address.
(Optional) `state` - The state or province of the contact's city.
(Optional) `city` - The city of the contact's address.
(Optional) `address_line_1` - The first line of the contact address.
(Optional) `address_line_2` - The second line of the contact address, if any.
(Optional) `postal_code` - The zip or postal code of the contact's address.
(Optional) `extra_params` - A key-value map of parameters required by certain top-level domains.
(Optional) `privacy_protection_enabled` - Whether domain contact information is concealed from WHOIS queries. Defaults to `true`. | object({
type = optional(string, "PERSON")
organization = optional(string)
first_name = optional(string)
last_name = optional(string)
email = optional(string)
phone = optional(string)
fax = optional(string)
country_code = optional(string)
state = optional(string)
city = optional(string)
address_line_1 = optional(string)
address_line_2 = optional(string)
postal_code = optional(string)
extra_params = optional(map(string), {})
privacy_protection_enabled = optional(bool, true)
}) | `{}` | no |
49 | | [transfer\_lock\_enabled](#input\_transfer\_lock\_enabled) | (Optional) Whether the domain is locked for transfer. Defaults to `true`. Following top-level domains do not support transfer lock: `.fi`. | `bool` | `true` | no |
50 |
51 | ## Outputs
52 |
53 | | Name | Description |
54 | |------|-------------|
55 | | [abuse\_contact](#output\_abuse\_contact) | The contact informations to report incorrect contact information for a domain, to report that the domain is being used to send spam, to report that someone is cybersquatting on a domain name, or report some other type of abuse. |
56 | | [admin\_contact](#output\_admin\_contact) | The configuration of the domain administrative contact. |
57 | | [auto\_renew\_enabled](#output\_auto\_renew\_enabled) | Whether the domain registration is set to renew automatically. |
58 | | [billing\_contact](#output\_billing\_contact) | The configuration of the domain billing contact. |
59 | | [created\_at](#output\_created\_at) | The date when the domain was created as found in the response to a WHOIS query. |
60 | | [expired\_at](#output\_expired\_at) | The date when the registration for the domain is set to expire. |
61 | | [id](#output\_id) | The ID of the registered domain. |
62 | | [name](#output\_name) | The name of the registered domain. |
63 | | [name\_servers](#output\_name\_servers) | A list of name servers for the registered domain. |
64 | | [registrant\_contact](#output\_registrant\_contact) | The configuration of the domain registrant contact. |
65 | | [registrar](#output\_registrar) | The informations about the registrar for the domain. |
66 | | [reseller](#output\_reseller) | Reseller of the domain. |
67 | | [status\_codes](#output\_status\_codes) | A list of domain name status codes. |
68 | | [technical\_contact](#output\_technical\_contact) | The configuration of the domain technical contact. |
69 | | [transfer\_lock\_enabled](#output\_transfer\_lock\_enabled) | Whether the domain is locked for transfer. |
70 | | [updated\_at](#output\_updated\_at) | The last updated date of the domain as found in the response to a WHOIS query. |
71 | | [whois\_server](#output\_whois\_server) | The fully qualified name of the WHOIS server that can answer the WHOIS query for the domain. |
72 |
73 |
--------------------------------------------------------------------------------
/modules/registered-domain/main.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | metadata = {
3 | package = "terraform-aws-domain"
4 | version = trimspace(file("${path.module}/../../VERSION"))
5 | module = basename(path.module)
6 | name = var.name
7 | }
8 | module_tags = var.module_tags_enabled ? {
9 | "module.terraform.io/package" = local.metadata.package
10 | "module.terraform.io/version" = local.metadata.version
11 | "module.terraform.io/name" = local.metadata.module
12 | "module.terraform.io/full-name" = "${local.metadata.package}/${local.metadata.module}"
13 | "module.terraform.io/instance" = local.metadata.name
14 | } : {}
15 | }
16 |
17 | locals {
18 | transfer_lock_unsupported_tlds = [".fi"]
19 | }
20 |
21 | ###################################################
22 | # Registred Domain in Route53 Registry
23 | ###################################################
24 |
25 | # INFO: Not supported attributes
26 | # - `name_server.glue_ips`
27 | resource "aws_route53domains_registered_domain" "this" {
28 | domain_name = var.name
29 |
30 | auto_renew = var.auto_renew_enabled
31 | transfer_lock = (anytrue([
32 | for tld in local.transfer_lock_unsupported_tlds :
33 | endswith(var.name, tld)]
34 | ) ? false : var.transfer_lock_enabled)
35 |
36 |
37 | ## Name Servers
38 | dynamic "name_server" {
39 | for_each = var.name_servers
40 |
41 | content {
42 | name = name_server.value
43 | }
44 | }
45 |
46 |
47 | ## Privacy Protection
48 | admin_privacy = var.admin_contact.privacy_protection_enabled
49 | # billing_privacy = var.privacy_protection_enabled
50 | registrant_privacy = var.registrant_contact.privacy_protection_enabled
51 | tech_privacy = var.technical_contact.privacy_protection_enabled
52 |
53 |
54 | ## Contacts
55 | admin_contact {
56 | contact_type = var.admin_contact.type
57 | organization_name = var.admin_contact.organization
58 | first_name = var.admin_contact.first_name
59 | last_name = var.admin_contact.last_name
60 | email = var.admin_contact.email
61 | phone_number = var.admin_contact.phone
62 | fax = var.admin_contact.fax
63 |
64 | country_code = var.admin_contact.country_code
65 | state = var.admin_contact.state
66 | city = var.admin_contact.city
67 | address_line_1 = var.admin_contact.address_line_1
68 | address_line_2 = var.admin_contact.address_line_2
69 | zip_code = var.admin_contact.postal_code
70 |
71 | extra_params = var.admin_contact.extra_params
72 | }
73 | billing_contact {
74 | contact_type = var.billing_contact.type
75 | organization_name = var.billing_contact.organization
76 | first_name = var.billing_contact.first_name
77 | last_name = var.billing_contact.last_name
78 | email = var.billing_contact.email
79 | phone_number = var.billing_contact.phone
80 | fax = var.billing_contact.fax
81 |
82 | country_code = var.billing_contact.country_code
83 | state = var.billing_contact.state
84 | city = var.billing_contact.city
85 | address_line_1 = var.billing_contact.address_line_1
86 | address_line_2 = var.billing_contact.address_line_2
87 | zip_code = var.billing_contact.postal_code
88 |
89 | extra_params = var.admin_contact.extra_params
90 | }
91 | registrant_contact {
92 | contact_type = var.registrant_contact.type
93 | organization_name = var.registrant_contact.organization
94 | first_name = var.registrant_contact.first_name
95 | last_name = var.registrant_contact.last_name
96 | email = var.registrant_contact.email
97 | phone_number = var.registrant_contact.phone
98 | fax = var.registrant_contact.fax
99 |
100 | country_code = var.registrant_contact.country_code
101 | state = var.registrant_contact.state
102 | city = var.registrant_contact.city
103 | address_line_1 = var.registrant_contact.address_line_1
104 | address_line_2 = var.registrant_contact.address_line_2
105 | zip_code = var.registrant_contact.postal_code
106 |
107 | extra_params = var.admin_contact.extra_params
108 | }
109 | tech_contact {
110 | contact_type = var.technical_contact.type
111 | organization_name = var.technical_contact.organization
112 | first_name = var.technical_contact.first_name
113 | last_name = var.technical_contact.last_name
114 | email = var.technical_contact.email
115 | phone_number = var.technical_contact.phone
116 | fax = var.technical_contact.fax
117 |
118 | country_code = var.technical_contact.country_code
119 | state = var.technical_contact.state
120 | city = var.technical_contact.city
121 | address_line_1 = var.technical_contact.address_line_1
122 | address_line_2 = var.technical_contact.address_line_2
123 | zip_code = var.technical_contact.postal_code
124 |
125 | extra_params = var.admin_contact.extra_params
126 | }
127 |
128 |
129 | tags = merge(
130 | {
131 | "Name" = local.metadata.name
132 | },
133 | local.module_tags,
134 | var.tags,
135 | )
136 | }
137 |
--------------------------------------------------------------------------------
/modules/registered-domain/outputs.tf:
--------------------------------------------------------------------------------
1 | output "id" {
2 | description = "The ID of the registered domain."
3 | value = aws_route53domains_registered_domain.this.id
4 | }
5 |
6 | output "name" {
7 | description = "The name of the registered domain."
8 | value = aws_route53domains_registered_domain.this.domain_name
9 | }
10 |
11 | output "auto_renew_enabled" {
12 | description = "Whether the domain registration is set to renew automatically."
13 | value = aws_route53domains_registered_domain.this.auto_renew
14 | }
15 |
16 | output "transfer_lock_enabled" {
17 | description = "Whether the domain is locked for transfer."
18 | value = aws_route53domains_registered_domain.this.transfer_lock
19 | }
20 |
21 | output "name_servers" {
22 | description = "A list of name servers for the registered domain."
23 | value = aws_route53domains_registered_domain.this.name_server[*].name
24 | }
25 |
26 | output "admin_contact" {
27 | description = "The configuration of the domain administrative contact."
28 | value = {
29 | type = one(aws_route53domains_registered_domain.this.admin_contact[*].contact_type)
30 | organization = one(aws_route53domains_registered_domain.this.admin_contact[*].organization_name)
31 | first_name = one(aws_route53domains_registered_domain.this.admin_contact[*].first_name)
32 | last_name = one(aws_route53domains_registered_domain.this.admin_contact[*].last_name)
33 | email = one(aws_route53domains_registered_domain.this.admin_contact[*].email)
34 | phone = one(aws_route53domains_registered_domain.this.admin_contact[*].phone_number)
35 | fax = one(aws_route53domains_registered_domain.this.admin_contact[*].fax)
36 |
37 | country_code = one(aws_route53domains_registered_domain.this.admin_contact[*].country_code)
38 | state = one(aws_route53domains_registered_domain.this.admin_contact[*].state)
39 | city = one(aws_route53domains_registered_domain.this.admin_contact[*].city)
40 | address_line_1 = one(aws_route53domains_registered_domain.this.admin_contact[*].address_line_1)
41 | address_line_2 = one(aws_route53domains_registered_domain.this.admin_contact[*].address_line_2)
42 | postal_code = one(aws_route53domains_registered_domain.this.admin_contact[*].zip_code)
43 |
44 | extra_prams = one(aws_route53domains_registered_domain.this.admin_contact[*].extra_params)
45 | privacy_protection_enabled = aws_route53domains_registered_domain.this.admin_privacy
46 | }
47 | }
48 |
49 | output "billing_contact" {
50 | description = "The configuration of the domain billing contact."
51 | value = {
52 | type = one(aws_route53domains_registered_domain.this.billing_contact[*].contact_type)
53 | organization = one(aws_route53domains_registered_domain.this.billing_contact[*].organization_name)
54 | first_name = one(aws_route53domains_registered_domain.this.billing_contact[*].first_name)
55 | last_name = one(aws_route53domains_registered_domain.this.billing_contact[*].last_name)
56 | email = one(aws_route53domains_registered_domain.this.billing_contact[*].email)
57 | phone = one(aws_route53domains_registered_domain.this.billing_contact[*].phone_number)
58 | fax = one(aws_route53domains_registered_domain.this.billing_contact[*].fax)
59 |
60 | country_code = one(aws_route53domains_registered_domain.this.billing_contact[*].country_code)
61 | state = one(aws_route53domains_registered_domain.this.billing_contact[*].state)
62 | city = one(aws_route53domains_registered_domain.this.billing_contact[*].city)
63 | address_line_1 = one(aws_route53domains_registered_domain.this.billing_contact[*].address_line_1)
64 | address_line_2 = one(aws_route53domains_registered_domain.this.billing_contact[*].address_line_2)
65 | postal_code = one(aws_route53domains_registered_domain.this.billing_contact[*].zip_code)
66 |
67 | extra_prams = one(aws_route53domains_registered_domain.this.billing_contact[*].extra_params)
68 | privacy_protection_enabled = aws_route53domains_registered_domain.this.billing_privacy
69 | }
70 | }
71 |
72 | output "registrant_contact" {
73 | description = "The configuration of the domain registrant contact."
74 | value = {
75 | type = one(aws_route53domains_registered_domain.this.registrant_contact[*].contact_type)
76 | organization = one(aws_route53domains_registered_domain.this.registrant_contact[*].organization_name)
77 | first_name = one(aws_route53domains_registered_domain.this.registrant_contact[*].first_name)
78 | last_name = one(aws_route53domains_registered_domain.this.registrant_contact[*].last_name)
79 | email = one(aws_route53domains_registered_domain.this.registrant_contact[*].email)
80 | phone = one(aws_route53domains_registered_domain.this.registrant_contact[*].phone_number)
81 | fax = one(aws_route53domains_registered_domain.this.registrant_contact[*].fax)
82 |
83 | country_code = one(aws_route53domains_registered_domain.this.registrant_contact[*].country_code)
84 | state = one(aws_route53domains_registered_domain.this.registrant_contact[*].state)
85 | city = one(aws_route53domains_registered_domain.this.registrant_contact[*].city)
86 | address_line_1 = one(aws_route53domains_registered_domain.this.registrant_contact[*].address_line_1)
87 | address_line_2 = one(aws_route53domains_registered_domain.this.registrant_contact[*].address_line_2)
88 | postal_code = one(aws_route53domains_registered_domain.this.registrant_contact[*].zip_code)
89 |
90 | extra_prams = one(aws_route53domains_registered_domain.this.registrant_contact[*].extra_params)
91 | privacy_protection_enabled = aws_route53domains_registered_domain.this.registrant_privacy
92 | }
93 | }
94 |
95 | output "technical_contact" {
96 | description = "The configuration of the domain technical contact."
97 | value = {
98 | type = one(aws_route53domains_registered_domain.this.tech_contact[*].contact_type)
99 | organization = one(aws_route53domains_registered_domain.this.tech_contact[*].organization_name)
100 | first_name = one(aws_route53domains_registered_domain.this.tech_contact[*].first_name)
101 | last_name = one(aws_route53domains_registered_domain.this.tech_contact[*].last_name)
102 | email = one(aws_route53domains_registered_domain.this.tech_contact[*].email)
103 | phone = one(aws_route53domains_registered_domain.this.tech_contact[*].phone_number)
104 | fax = one(aws_route53domains_registered_domain.this.tech_contact[*].fax)
105 |
106 | country_code = one(aws_route53domains_registered_domain.this.tech_contact[*].country_code)
107 | state = one(aws_route53domains_registered_domain.this.tech_contact[*].state)
108 | city = one(aws_route53domains_registered_domain.this.tech_contact[*].city)
109 | address_line_1 = one(aws_route53domains_registered_domain.this.tech_contact[*].address_line_1)
110 | address_line_2 = one(aws_route53domains_registered_domain.this.tech_contact[*].address_line_2)
111 | postal_code = one(aws_route53domains_registered_domain.this.tech_contact[*].zip_code)
112 |
113 | extra_prams = one(aws_route53domains_registered_domain.this.tech_contact[*].extra_params)
114 | privacy_protection_enabled = aws_route53domains_registered_domain.this.tech_privacy
115 | }
116 | }
117 |
118 | output "abuse_contact" {
119 | description = "The contact informations to report incorrect contact information for a domain, to report that the domain is being used to send spam, to report that someone is cybersquatting on a domain name, or report some other type of abuse."
120 | value = {
121 | email = aws_route53domains_registered_domain.this.abuse_contact_email
122 | phoen = aws_route53domains_registered_domain.this.abuse_contact_phone
123 | }
124 | }
125 |
126 | output "registrar" {
127 | description = "The informations about the registrar for the domain."
128 | value = {
129 | name = aws_route53domains_registered_domain.this.registrar_name
130 | url = aws_route53domains_registered_domain.this.registrar_url
131 | }
132 | }
133 |
134 | output "reseller" {
135 | description = "Reseller of the domain."
136 | value = aws_route53domains_registered_domain.this.reseller
137 | }
138 |
139 | output "whois_server" {
140 | description = "The fully qualified name of the WHOIS server that can answer the WHOIS query for the domain."
141 | value = aws_route53domains_registered_domain.this.whois_server
142 | }
143 |
144 | output "status_codes" {
145 | description = "A list of domain name status codes."
146 | value = aws_route53domains_registered_domain.this.status_list
147 | }
148 |
149 | output "created_at" {
150 | description = "The date when the domain was created as found in the response to a WHOIS query."
151 | value = aws_route53domains_registered_domain.this.creation_date
152 | }
153 |
154 | output "expired_at" {
155 | description = "The date when the registration for the domain is set to expire."
156 | value = aws_route53domains_registered_domain.this.expiration_date
157 | }
158 |
159 | output "updated_at" {
160 | description = "The last updated date of the domain as found in the response to a WHOIS query."
161 | value = aws_route53domains_registered_domain.this.updated_date
162 | }
163 |
164 | # output "debug" {
165 | # value = {
166 | # for k, v in aws_route53domains_registered_domain.this :
167 | # k => v
168 | # if !contains(["id", "domain_name", "tags", "tags_all", "auto_renew", "transfer_lock", "timeouts", "creation_date", "expiration_date", "updated_date", "registrar_name", "registrar_url", "whois_server", "reseller", "abuse_contact_email", "abuse_contact_phone", "admin_contact", "registrant_contact", "tech_contact", "admin_privacy", "registrant_privacy", "tech_privacy", "billing_contact", "billing_privacy", "status_list"], k)
169 | # }
170 | # }
171 |
--------------------------------------------------------------------------------
/modules/registered-domain/resource-group.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | resource_group_name = (var.resource_group_name != ""
3 | ? var.resource_group_name
4 | : join(".", [
5 | local.metadata.package,
6 | local.metadata.module,
7 | replace(local.metadata.name, "/[^a-zA-Z0-9_\\.-]/", "-"),
8 | ])
9 | )
10 | }
11 |
12 |
13 | module "resource_group" {
14 | source = "tedilabs/misc/aws//modules/resource-group"
15 | version = "~> 0.10.0"
16 |
17 | count = (var.resource_group_enabled && var.module_tags_enabled) ? 1 : 0
18 |
19 | name = local.resource_group_name
20 | description = var.resource_group_description
21 |
22 | query = {
23 | resource_tags = local.module_tags
24 | }
25 |
26 | module_tags_enabled = false
27 | tags = merge(
28 | local.module_tags,
29 | var.tags,
30 | )
31 | }
32 |
--------------------------------------------------------------------------------
/modules/registered-domain/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 1.6"
3 |
4 | required_providers {
5 | aws = {
6 | source = "hashicorp/aws"
7 | version = ">= 5.41"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/modules/resolver-inbound-endpoint/README.md:
--------------------------------------------------------------------------------
1 | # resolver-inbound-endpoint
2 |
3 | This module creates following resources.
4 |
5 | - `aws_route53_resolver_endpoint`
6 | - `aws_security_group`
7 | - `aws_security_group_rule`
8 |
9 |
10 | ## Requirements
11 |
12 | | Name | Version |
13 | |------|---------|
14 | | [terraform](#requirement\_terraform) | >= 1.10 |
15 | | [assert](#requirement\_assert) | >= 0.15 |
16 | | [aws](#requirement\_aws) | >= 5.72 |
17 |
18 | ## Providers
19 |
20 | | Name | Version |
21 | |------|---------|
22 | | [aws](#provider\_aws) | 5.94.1 |
23 |
24 | ## Modules
25 |
26 | | Name | Source | Version |
27 | |------|--------|---------|
28 | | [resource\_group](#module\_resource\_group) | tedilabs/misc/aws//modules/resource-group | ~> 0.10.0 |
29 | | [security\_group](#module\_security\_group) | tedilabs/network/aws//modules/security-group | ~> 0.32.0 |
30 |
31 | ## Resources
32 |
33 | | Name | Type |
34 | |------|------|
35 | | [aws_route53_resolver_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_endpoint) | resource |
36 | | [aws_subnet.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source |
37 |
38 | ## Inputs
39 |
40 | | Name | Description | Type | Default | Required |
41 | |------|-------------|------|---------|:--------:|
42 | | [ip\_allocations](#input\_ip\_allocations) | (Optional) The configuration for IP allocations of the Route53 Resolver Inbound Endpoint. Select at least two Availability Zone and one subnet for each zone. Each item of `ip_allocations` block as defined below.
(Required) `subnet` - The ID of the subnet that contains the IP address. You can specify only one subnet per Availability Zone.
(Optional) `ipv4_address` - IPv4 address from the provided subnet. Defaults to be randomly configured by Amazon.
(Optional) `ipv6_address` - IPv6 address from the provided subnet. Defaults to be randomly configured by Amazon. | list(object({
subnet = string
ipv4_address = optional(string)
ipv6_address = optional(string)
})) | n/a | yes |
43 | | [name](#input\_name) | (Required) The name of the Route53 Resolver Inbound Endpoint. | `string` | n/a | yes |
44 | | [default\_security\_group](#input\_default\_security\_group) | (Optional) The configuration of the default security group for the Route53 Resolver Inbound Endpoint. `default_security_group` block as defined below.
(Optional) `enabled` - Whether to use the default security group. Defaults to `true`.
(Optional) `name` - The name of the default security group. If not provided, the Route53 Resolver Inbound Endpoint name is used for the name of security group.
(Optional) `description` - The description of the default security group.
(Optional) `ingress_rules` - A list of ingress rules in a security group. Defaults to `[]`. Each block of `ingress_rules` as defined below.
(Required) `id` - The ID of the ingress rule. This value is only used internally within Terraform code.
(Optional) `description` - The description of the rule.
(Required) `protocol` - The protocol to match. Note that if `protocol` is set to `-1`, it translates to all protocols, all port ranges, and `from_port` and `to_port` values should not be defined.
(Required) `from_port` - The start of port range for the protocols.
(Required) `to_port` - The end of port range for the protocols.
(Optional) `ipv4_cidrs` - The IPv4 network ranges to allow, in CIDR notation.
(Optional) `ipv6_cidrs` - The IPv6 network ranges to allow, in CIDR notation.
(Optional) `prefix_lists` - The prefix list IDs to allow.
(Optional) `security_groups` - The source security group IDs to allow.
(Optional) `self` - Whether the security group itself will be added as a source to this ingress rule.
(Optional) `egress_rules` - A list of egress rules in a security group. Defaults to `[]`. Each block of `egress_rules` as defined below.
(Required) `id` - The ID of the egress rule. This value is only used internally within Terraform code.
(Optional) `description` - The description of the rule.
(Required) `protocol` - The protocol to match. Note that if `protocol` is set to `-1`, it translates to all protocols, all port ranges, and `from_port` and `to_port` values should not be defined.
(Required) `from_port` - The start of port range for the protocols.
(Required) `to_port` - The end of port range for the protocols.
(Optional) `ipv4_cidrs` - The IPv4 network ranges to allow, in CIDR notation.
(Optional) `ipv6_cidrs` - The IPv6 network ranges to allow, in CIDR notation.
(Optional) `prefix_lists` - The prefix list IDs to allow.
(Optional) `security_groups` - The source security group IDs to allow.
(Optional) `self` - Whether the security group itself will be added as a source to this ingress rule.
(Optional) `ingress_ipv4_cidrs` - A list of IPv4 CIDR ranges to allow to query to the endpoint. Defaults to `[]`."
(Optional) `istener_ingress_ipv6_cidrs` - A list of IPv6 CIDR ranges to allow to query to the endpoint. Defaults to `[]`."
(Optional) `ingress_prefix_lists` - A list of prefix list IDs for AWS services to allow to query to the endpoint. Defaults to `[]`."
(Optional) `ingress_security_groups` - A list of security group IDs to allow to query to the endpoint. Defaults to `[]`." | object({
enabled = optional(bool, true)
name = optional(string)
description = optional(string, "Managed by Terraform.")
ingress_rules = optional(
list(object({
id = string
description = optional(string, "Managed by Terraform.")
protocol = string
from_port = number
to_port = number
ipv4_cidrs = optional(list(string), [])
ipv6_cidrs = optional(list(string), [])
prefix_lists = optional(list(string), [])
security_groups = optional(list(string), [])
self = optional(bool, false)
})),
[]
)
egress_rules = optional(
list(object({
id = string
description = optional(string, "Managed by Terraform.")
protocol = string
from_port = number
to_port = number
ipv4_cidrs = optional(list(string), [])
ipv6_cidrs = optional(list(string), [])
prefix_lists = optional(list(string), [])
security_groups = optional(list(string), [])
self = optional(bool, false)
})),
[]
)
ingress_ipv4_cidrs = optional(list(string), [])
ingress_ipv6_cidrs = optional(list(string), [])
ingress_prefix_lists = optional(list(string), [])
ingress_security_groups = optional(list(string), [])
}) | `{}` | no |
45 | | [ip\_address\_type](#input\_ip\_address\_type) | (Optional) The type of IP addresses used by the Route53 Resolver Inbound Endpoint. Valid values are `IPV4`, `IPV6`, `DUALSTACK`. Defaults to `IPV4`. | `string` | `"IPV4"` | no |
46 | | [module\_tags\_enabled](#input\_module\_tags\_enabled) | (Optional) Whether to create AWS Resource Tags for the module informations. | `bool` | `true` | no |
47 | | [protocols](#input\_protocols) | (Optional) A set of protocols to use for the Route53 Resolver Inbound Endpoint. The protocols determine how data is transmitted to this endpoint. Valid values are `DoH`, `Do53`, or `DoH-FIPS`. Defaults to `["Do53"]`.
`Do53`: DNS over port 53. The data is relayed by using the Route 53 Resolver without additional encryption. While the data cannot be read by external parties, it can be viewed within the AWS networks. Uses either UDP or TCP to send the packets. Do53 is primarily used for traffic within and between Amazon VPCs.
`DoH`: The data is transmitted over an encrypted HTTPS session. DoH adds an added level of security where data can't be decrypted by unauthorized users, and cannot be read by anyone except the intended recipient.
`DoH-FIPS`: The data is transmitted over an encrypted HTTPS session that is compliant with the FIPS 140-2 cryptographic standard. Supported for inbound endpoints only. For more information, see FIPS PUB 140-2 | `set(string)` | [
"Do53"
]
| no |
48 | | [resource\_group\_description](#input\_resource\_group\_description) | (Optional) The description of Resource Group. | `string` | `"Managed by Terraform."` | no |
49 | | [resource\_group\_enabled](#input\_resource\_group\_enabled) | (Optional) Whether to create Resource Group to find and group AWS resources which are created by this module. | `bool` | `true` | no |
50 | | [resource\_group\_name](#input\_resource\_group\_name) | (Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. | `string` | `""` | no |
51 | | [security\_groups](#input\_security\_groups) | (Optional) A list of security group IDs to assign to the Route53 Resolver Inbound Endpoint. | `list(string)` | `[]` | no |
52 | | [tags](#input\_tags) | (Optional) A map of tags to add to all resources. | `map(string)` | `{}` | no |
53 |
54 | ## Outputs
55 |
56 | | Name | Description |
57 | |------|-------------|
58 | | [arn](#output\_arn) | The ARN of the Route53 Resolver Endpoint. |
59 | | [default\_security\_group](#output\_default\_security\_group) | The default security group ID of the Route53 Resolver Endpoint. |
60 | | [direction](#output\_direction) | The direction of DNS queries to or from the Route 53 Resolver endpoint. |
61 | | [id](#output\_id) | The ID of the Route53 Resolver Endpoint. |
62 | | [ip\_address\_type](#output\_ip\_address\_type) | The type of IP addresses used by the Route53 Resolver Inbound Endpoint. |
63 | | [ip\_allocations](#output\_ip\_allocations) | The configuration for IP allocations of the Route53 Resolver Inbound Endpoint. |
64 | | [ipv4\_addresses](#output\_ipv4\_addresses) | A set of IPv4 addresses in your VPC that you want DNS queries to pass through on the way from your network to your VPCs. |
65 | | [ipv6\_addresses](#output\_ipv6\_addresses) | A set of IPv6 addresses in your VPC that you want DNS queries to pass through on the way from your network to your VPCs. |
66 | | [name](#output\_name) | The name of the Route53 Resolver Endpoint. |
67 | | [protocols](#output\_protocols) | A set of protocols to use for the Route53 Resolver Inbound Endpoint. |
68 | | [security\_groups](#output\_security\_groups) | A set of security group IDs which is assigned to the Route53 Resolver Endpoint. |
69 | | [subnets](#output\_subnets) | A set of the ID of subnets that IP addresses of resolver endpoint are allocated in. |
70 | | [vpc\_id](#output\_vpc\_id) | The ID of the VPC that you want to create the resolver endpoint in. |
71 |
72 |
--------------------------------------------------------------------------------
/modules/resolver-inbound-endpoint/main.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | metadata = {
3 | package = "terraform-aws-domain"
4 | version = trimspace(file("${path.module}/../../VERSION"))
5 | module = basename(path.module)
6 | name = var.name
7 | }
8 | module_tags = var.module_tags_enabled ? {
9 | "module.terraform.io/package" = local.metadata.package
10 | "module.terraform.io/version" = local.metadata.version
11 | "module.terraform.io/name" = local.metadata.module
12 | "module.terraform.io/full-name" = "${local.metadata.package}/${local.metadata.module}"
13 | "module.terraform.io/instance" = local.metadata.name
14 | } : {}
15 | }
16 |
17 |
18 | ###################################################
19 | # Inbound Endpoint for Route53 Resolver
20 | ###################################################
21 |
22 | resource "aws_route53_resolver_endpoint" "this" {
23 | direction = "INBOUND"
24 | name = local.metadata.name
25 |
26 | protocols = var.protocols
27 | security_group_ids = local.security_groups
28 |
29 | resolver_endpoint_type = var.ip_address_type
30 | dynamic "ip_address" {
31 | for_each = var.ip_allocations
32 |
33 | content {
34 | subnet_id = ip_address.value.subnet
35 | ip = ip_address.value.ipv4_address
36 | ipv6 = ip_address.value.ipv6_address
37 | }
38 | }
39 |
40 | tags = merge(
41 | {
42 | "Name" = local.metadata.name
43 | },
44 | local.module_tags,
45 | var.tags,
46 | )
47 | }
48 |
--------------------------------------------------------------------------------
/modules/resolver-inbound-endpoint/outputs.tf:
--------------------------------------------------------------------------------
1 | output "id" {
2 | description = "The ID of the Route53 Resolver Endpoint."
3 | value = aws_route53_resolver_endpoint.this.id
4 | }
5 |
6 | output "arn" {
7 | description = "The ARN of the Route53 Resolver Endpoint."
8 | value = aws_route53_resolver_endpoint.this.arn
9 | }
10 |
11 | output "name" {
12 | description = "The name of the Route53 Resolver Endpoint."
13 | value = aws_route53_resolver_endpoint.this.name
14 | }
15 |
16 | output "direction" {
17 | description = "The direction of DNS queries to or from the Route 53 Resolver endpoint."
18 | value = aws_route53_resolver_endpoint.this.direction
19 | }
20 |
21 | output "protocols" {
22 | description = "A set of protocols to use for the Route53 Resolver Inbound Endpoint."
23 | value = aws_route53_resolver_endpoint.this.protocols
24 | }
25 |
26 | output "vpc_id" {
27 | description = "The ID of the VPC that you want to create the resolver endpoint in."
28 | value = aws_route53_resolver_endpoint.this.host_vpc_id
29 | }
30 |
31 | output "ip_address_type" {
32 | description = "The type of IP addresses used by the Route53 Resolver Inbound Endpoint."
33 | value = aws_route53_resolver_endpoint.this.resolver_endpoint_type
34 | }
35 |
36 | output "ip_allocations" {
37 | description = "The configuration for IP allocations of the Route53 Resolver Inbound Endpoint."
38 | value = {
39 | for ip_allocation in aws_route53_resolver_endpoint.this.ip_address :
40 | data.aws_subnet.this[ip_allocation.subnet_id].availability_zone_id => {
41 | az_id = data.aws_subnet.this[ip_allocation.subnet_id].availability_zone_id
42 | subnet = ip_allocation.subnet_id
43 | id = ip_allocation.ip_id
44 | ipv4_address = ip_allocation.ip
45 | ipv6_address = ip_allocation.ipv6
46 | }
47 | }
48 | }
49 |
50 | output "ipv4_addresses" {
51 | description = "A set of IPv4 addresses in your VPC that you want DNS queries to pass through on the way from your network to your VPCs."
52 | value = toset(aws_route53_resolver_endpoint.this.ip_address[*].ip)
53 | }
54 |
55 | output "ipv6_addresses" {
56 | description = "A set of IPv6 addresses in your VPC that you want DNS queries to pass through on the way from your network to your VPCs."
57 | value = toset(aws_route53_resolver_endpoint.this.ip_address[*].ipv6)
58 | }
59 |
60 | output "default_security_group" {
61 | description = "The default security group ID of the Route53 Resolver Endpoint."
62 | value = one(module.security_group[*].id)
63 | }
64 |
65 | output "security_groups" {
66 | description = "A set of security group IDs which is assigned to the Route53 Resolver Endpoint."
67 | value = aws_route53_resolver_endpoint.this.security_group_ids
68 | }
69 |
70 | output "subnets" {
71 | description = "A set of the ID of subnets that IP addresses of resolver endpoint are allocated in."
72 | value = toset(aws_route53_resolver_endpoint.this.ip_address[*].subnet_id)
73 | }
74 |
75 | # output "debug" {
76 | # value = {
77 | # for k, v in aws_route53_resolver_endpoint.this :
78 | # k => v
79 | # if !contains(["id", "arn", "direction", "name", "host_vpc_id", "security_group_ids", "protocols", "resolver_endpoint_type", "tags", "tags_all", "ip_address", "timeouts"], k)
80 | # }
81 | # }
82 |
--------------------------------------------------------------------------------
/modules/resolver-inbound-endpoint/resource-group.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | resource_group_name = (var.resource_group_name != ""
3 | ? var.resource_group_name
4 | : join(".", [
5 | local.metadata.package,
6 | local.metadata.module,
7 | replace(local.metadata.name, "/[^a-zA-Z0-9_\\.-]/", "-"),
8 | ])
9 | )
10 | }
11 |
12 |
13 | module "resource_group" {
14 | source = "tedilabs/misc/aws//modules/resource-group"
15 | version = "~> 0.10.0"
16 |
17 | count = (var.resource_group_enabled && var.module_tags_enabled) ? 1 : 0
18 |
19 | name = local.resource_group_name
20 | description = var.resource_group_description
21 |
22 | query = {
23 | resource_tags = local.module_tags
24 | }
25 |
26 | module_tags_enabled = false
27 | tags = merge(
28 | local.module_tags,
29 | var.tags,
30 | )
31 | }
32 |
--------------------------------------------------------------------------------
/modules/resolver-inbound-endpoint/security-group.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | security_groups = concat(
3 | (var.default_security_group.enabled
4 | ? module.security_group[*].id
5 | : []
6 | ),
7 | var.security_groups,
8 | )
9 | }
10 |
11 | data "aws_subnet" "this" {
12 | for_each = toset(var.ip_allocations[*].subnet)
13 |
14 | id = each.value
15 | }
16 |
17 |
18 | ###################################################
19 | # Security Group
20 | ###################################################
21 |
22 | module "security_group" {
23 | source = "tedilabs/network/aws//modules/security-group"
24 | version = "~> 0.32.0"
25 |
26 | count = var.default_security_group.enabled ? 1 : 0
27 |
28 | name = coalesce(var.default_security_group.name, local.metadata.name)
29 | description = var.default_security_group.description
30 | vpc_id = values(data.aws_subnet.this)[0].vpc_id
31 |
32 | ingress_rules = concat(
33 | var.default_security_group.ingress_rules,
34 | [
35 | for protocol in ["tcp", "udp"] : {
36 | id = "dns-${protocol}"
37 | description = "Allow to query to Route53 Resolver Inbound Endpoint."
38 | protocol = protocol
39 | from_port = 53
40 | to_port = 53
41 |
42 | ipv4_cidrs = var.default_security_group.ingress_ipv4_cidrs
43 | ipv6_cidrs = var.default_security_group.ingress_ipv6_cidrs
44 | prefix_lists = var.default_security_group.ingress_prefix_lists
45 | security_groups = var.default_security_group.ingress_security_groups
46 | }
47 | if anytrue([
48 | length(var.default_security_group.ingress_ipv4_cidrs) > 0,
49 | length(var.default_security_group.ingress_ipv6_cidrs) > 0,
50 | length(var.default_security_group.ingress_prefix_lists) > 0,
51 | length(var.default_security_group.ingress_security_groups) > 0,
52 | ])
53 | ]
54 | )
55 | egress_rules = concat(
56 | var.default_security_group.egress_rules,
57 | )
58 |
59 | revoke_rules_on_delete = true
60 | resource_group_enabled = false
61 | module_tags_enabled = false
62 |
63 | tags = merge(
64 | local.module_tags,
65 | var.tags,
66 | )
67 | }
68 |
--------------------------------------------------------------------------------
/modules/resolver-inbound-endpoint/variables.tf:
--------------------------------------------------------------------------------
1 | variable "name" {
2 | description = "(Required) The name of the Route53 Resolver Inbound Endpoint."
3 | type = string
4 | nullable = false
5 | }
6 |
7 | variable "protocols" {
8 | description = <= 2
138 | error_message = "To improve reliability, Resolver requires that you specify two IP addresses for DNS queries. We recommend that you specify IP addresses in two different Availability Zones. After you add the first two IP addresses, you can optionally add more in the same or different Availability Zones."
139 | }
140 | validation {
141 | condition = alltrue([
142 | for ip_allocation in var.ip_allocations :
143 | (ip_allocation.ipv4_address != null
144 | ? provider::assert::ipv4(ip_allocation.ipv4_address)
145 | : true
146 | )
147 | ])
148 | error_message = "Value of `ipv4_address` is not valid IPv4 address."
149 | }
150 | validation {
151 | condition = alltrue([
152 | for ip_allocation in var.ip_allocations :
153 | (ip_allocation.ipv6_address != null
154 | ? provider::assert::ipv6(ip_allocation.ipv6_address)
155 | : true
156 | )
157 | ])
158 | error_message = "Value of `ipv6_address` is not valid IPv6 address."
159 | }
160 | }
161 |
162 | variable "tags" {
163 | description = "(Optional) A map of tags to add to all resources."
164 | type = map(string)
165 | default = {}
166 | nullable = false
167 | }
168 |
169 | variable "module_tags_enabled" {
170 | description = "(Optional) Whether to create AWS Resource Tags for the module informations."
171 | type = bool
172 | default = true
173 | nullable = false
174 | }
175 |
176 |
177 | ###################################################
178 | # Resource Group
179 | ###################################################
180 |
181 | variable "resource_group_enabled" {
182 | description = "(Optional) Whether to create Resource Group to find and group AWS resources which are created by this module."
183 | type = bool
184 | default = true
185 | nullable = false
186 | }
187 |
188 | variable "resource_group_name" {
189 | description = "(Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`."
190 | type = string
191 | default = ""
192 | nullable = false
193 | }
194 |
195 | variable "resource_group_description" {
196 | description = "(Optional) The description of Resource Group."
197 | type = string
198 | default = "Managed by Terraform."
199 | nullable = false
200 | }
201 |
--------------------------------------------------------------------------------
/modules/resolver-inbound-endpoint/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 1.10"
3 |
4 | required_providers {
5 | assert = {
6 | source = "hashicorp/assert"
7 | version = ">= 0.15"
8 | }
9 | aws = {
10 | source = "hashicorp/aws"
11 | version = ">= 5.72"
12 | }
13 | }
14 | }
15 |
--------------------------------------------------------------------------------
/modules/resolver-query-logging/README.md:
--------------------------------------------------------------------------------
1 | # resolver-query-logging
2 |
3 | This module creates following resources.
4 |
5 | - `aws_route53_resolver_query_log_config`
6 | - `aws_route53_resolver_query_log_config_association` (optional)
7 | - `aws_ram_resource_share` (optional)
8 | - `aws_ram_principal_association` (optional)
9 | - `aws_ram_resource_association` (optional)
10 |
11 |
12 | ## Requirements
13 |
14 | | Name | Version |
15 | |------|---------|
16 | | [terraform](#requirement\_terraform) | >= 1.9 |
17 | | [aws](#requirement\_aws) | >= 5.72 |
18 |
19 | ## Providers
20 |
21 | | Name | Version |
22 | |------|---------|
23 | | [aws](#provider\_aws) | 5.94.1 |
24 |
25 | ## Modules
26 |
27 | | Name | Source | Version |
28 | |------|--------|---------|
29 | | [resource\_group](#module\_resource\_group) | tedilabs/misc/aws//modules/resource-group | ~> 0.10.0 |
30 | | [share](#module\_share) | tedilabs/account/aws//modules/ram-share | ~> 0.22.0 |
31 |
32 | ## Resources
33 |
34 | | Name | Type |
35 | |------|------|
36 | | [aws_route53_resolver_query_log_config.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_query_log_config) | resource |
37 | | [aws_route53_resolver_query_log_config_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_query_log_config_association) | resource |
38 |
39 | ## Inputs
40 |
41 | | Name | Description | Type | Default | Required |
42 | |------|-------------|------|---------|:--------:|
43 | | [destination](#input\_destination) | (Required) The ARN of the resource that you want Route 53 Resolver to send query logs. You can send query logs to an S3 bucket, a CloudWatch Logs log group, or a Kinesis Data Firehose delivery stream. | `string` | n/a | yes |
44 | | [name](#input\_name) | (Required) The name of the Route 53 Resolver query logging configuration. | `string` | n/a | yes |
45 | | [module\_tags\_enabled](#input\_module\_tags\_enabled) | (Optional) Whether to create AWS Resource Tags for the module informations. | `bool` | `true` | no |
46 | | [resource\_group\_description](#input\_resource\_group\_description) | (Optional) The description of Resource Group. | `string` | `"Managed by Terraform."` | no |
47 | | [resource\_group\_enabled](#input\_resource\_group\_enabled) | (Optional) Whether to create Resource Group to find and group AWS resources which are created by this module. | `bool` | `true` | no |
48 | | [resource\_group\_name](#input\_resource\_group\_name) | (Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. | `string` | `""` | no |
49 | | [shares](#input\_shares) | (Optional) A list of resource shares via RAM (Resource Access Manager). | list(object({
name = optional(string)
permissions = optional(set(string), ["AWSRAMDefaultPermissionResolverQueryLogConfig"])
external_principals_allowed = optional(bool, false)
principals = optional(set(string), [])
tags = optional(map(string), {})
})) | `[]` | no |
50 | | [tags](#input\_tags) | (Optional) A map of tags to add to all resources. | `map(string)` | `{}` | no |
51 | | [vpc\_associations](#input\_vpc\_associations) | (Optional) A list of VPC IDs that you want this query logging configuration to log queries for. | `list(string)` | `[]` | no |
52 |
53 | ## Outputs
54 |
55 | | Name | Description |
56 | |------|-------------|
57 | | [arn](#output\_arn) | The ARN of the Route 53 Resolver query logging configuration. |
58 | | [destination](#output\_destination) | The ARN of the resource that Route 53 Resolver send query logs. This can be S3 bucket, CloudWatch Logs log group, or Kinesis Data Firehose delivery stream. |
59 | | [id](#output\_id) | The ID of the Route 53 Resolver query logging configuration. |
60 | | [name](#output\_name) | The name of the Route 53 Resolver query logging configuration. |
61 | | [owner\_id](#output\_owner\_id) | The AWS Account ID the account that created the query logging configuration. |
62 | | [sharing](#output\_sharing) | The configuration for sharing of the Route53 Resolver query logging configuration.
`status` - An indication of whether the query logging configuration is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`.
`shares` - The list of resource shares via RAM (Resource Access Manager). |
63 | | [vpc\_associations](#output\_vpc\_associations) | A list of associated VPC IDs to query logging configuration. |
64 |
65 |
--------------------------------------------------------------------------------
/modules/resolver-query-logging/main.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | metadata = {
3 | package = "terraform-aws-domain"
4 | version = trimspace(file("${path.module}/../../VERSION"))
5 | module = basename(path.module)
6 | name = var.name
7 | }
8 | module_tags = var.module_tags_enabled ? {
9 | "module.terraform.io/package" = local.metadata.package
10 | "module.terraform.io/version" = local.metadata.version
11 | "module.terraform.io/name" = local.metadata.module
12 | "module.terraform.io/full-name" = "${local.metadata.package}/${local.metadata.module}"
13 | "module.terraform.io/instance" = local.metadata.name
14 | } : {}
15 | }
16 |
17 | resource "aws_route53_resolver_query_log_config" "this" {
18 | name = local.metadata.name
19 | destination_arn = var.destination
20 |
21 | tags = merge(
22 | {
23 | "Name" = local.metadata.name
24 | },
25 | local.module_tags,
26 | var.tags,
27 | )
28 | }
29 |
30 | resource "aws_route53_resolver_query_log_config_association" "this" {
31 | for_each = toset(var.vpc_associations)
32 |
33 | resolver_query_log_config_id = aws_route53_resolver_query_log_config.this.id
34 | resource_id = each.value
35 | }
36 |
--------------------------------------------------------------------------------
/modules/resolver-query-logging/outputs.tf:
--------------------------------------------------------------------------------
1 | output "id" {
2 | description = "The ID of the Route 53 Resolver query logging configuration."
3 | value = aws_route53_resolver_query_log_config.this.id
4 | }
5 |
6 | output "arn" {
7 | description = "The ARN of the Route 53 Resolver query logging configuration."
8 | value = aws_route53_resolver_query_log_config.this.arn
9 | }
10 |
11 | output "owner_id" {
12 | description = "The AWS Account ID the account that created the query logging configuration."
13 | value = aws_route53_resolver_query_log_config.this.owner_id
14 | }
15 |
16 | output "name" {
17 | description = "The name of the Route 53 Resolver query logging configuration."
18 | value = aws_route53_resolver_query_log_config.this.name
19 | }
20 |
21 | output "vpc_associations" {
22 | description = "A list of associated VPC IDs to query logging configuration."
23 | value = keys(aws_route53_resolver_query_log_config_association.this)
24 | }
25 |
26 | output "destination" {
27 | description = "The ARN of the resource that Route 53 Resolver send query logs. This can be S3 bucket, CloudWatch Logs log group, or Kinesis Data Firehose delivery stream."
28 | value = aws_route53_resolver_query_log_config.this.destination_arn
29 | }
30 |
31 | output "sharing" {
32 | description = < share
12 | }
13 |
14 | name = "route53-resolver.query-log-config.${var.name}.${each.key}"
15 |
16 | resources = [
17 | aws_route53_resolver_query_log_config.this.arn,
18 | ]
19 | permissions = each.value.permissions
20 |
21 | external_principals_allowed = each.value.external_principals_allowed
22 | principals = each.value.principals
23 |
24 | resource_group_enabled = false
25 | module_tags_enabled = false
26 |
27 | tags = merge(
28 | local.module_tags,
29 | var.tags,
30 | each.value.tags,
31 | )
32 | }
33 |
--------------------------------------------------------------------------------
/modules/resolver-query-logging/resource-group.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | resource_group_name = (var.resource_group_name != ""
3 | ? var.resource_group_name
4 | : join(".", [
5 | local.metadata.package,
6 | local.metadata.module,
7 | replace(local.metadata.name, "/[^a-zA-Z0-9_\\.-]/", "-"),
8 | ])
9 | )
10 | }
11 |
12 |
13 | module "resource_group" {
14 | source = "tedilabs/misc/aws//modules/resource-group"
15 | version = "~> 0.10.0"
16 |
17 | count = (var.resource_group_enabled && var.module_tags_enabled) ? 1 : 0
18 |
19 | name = local.resource_group_name
20 | description = var.resource_group_description
21 |
22 | query = {
23 | resource_tags = local.module_tags
24 | }
25 |
26 | module_tags_enabled = false
27 | tags = merge(
28 | local.module_tags,
29 | var.tags,
30 | )
31 | }
32 |
--------------------------------------------------------------------------------
/modules/resolver-query-logging/variables.tf:
--------------------------------------------------------------------------------
1 | variable "name" {
2 | description = "(Required) The name of the Route 53 Resolver query logging configuration."
3 | type = string
4 | }
5 |
6 | variable "destination" {
7 | description = "(Required) The ARN of the resource that you want Route 53 Resolver to send query logs. You can send query logs to an S3 bucket, a CloudWatch Logs log group, or a Kinesis Data Firehose delivery stream."
8 | type = string
9 | }
10 |
11 | variable "vpc_associations" {
12 | description = "(Optional) A list of VPC IDs that you want this query logging configuration to log queries for."
13 | type = list(string)
14 | default = []
15 | nullable = false
16 | }
17 |
18 | variable "tags" {
19 | description = "(Optional) A map of tags to add to all resources."
20 | type = map(string)
21 | default = {}
22 | nullable = false
23 | }
24 |
25 | variable "module_tags_enabled" {
26 | description = "(Optional) Whether to create AWS Resource Tags for the module informations."
27 | type = bool
28 | default = true
29 | nullable = false
30 | }
31 |
32 |
33 | ###################################################
34 | # Resource Group
35 | ###################################################
36 |
37 | variable "resource_group_enabled" {
38 | description = "(Optional) Whether to create Resource Group to find and group AWS resources which are created by this module."
39 | type = bool
40 | default = true
41 | nullable = false
42 | }
43 |
44 | variable "resource_group_name" {
45 | description = "(Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`."
46 | type = string
47 | default = ""
48 | nullable = false
49 | }
50 |
51 | variable "resource_group_description" {
52 | description = "(Optional) The description of Resource Group."
53 | type = string
54 | default = "Managed by Terraform."
55 | nullable = false
56 | }
57 |
58 |
59 | ###################################################
60 | # Resource Sharing by RAM (Resource Access Manager)
61 | ###################################################
62 |
63 | variable "shares" {
64 | description = "(Optional) A list of resource shares via RAM (Resource Access Manager)."
65 | type = list(object({
66 | name = optional(string)
67 |
68 | permissions = optional(set(string), ["AWSRAMDefaultPermissionResolverQueryLogConfig"])
69 |
70 | external_principals_allowed = optional(bool, false)
71 | principals = optional(set(string), [])
72 |
73 | tags = optional(map(string), {})
74 | }))
75 | default = []
76 | nullable = false
77 | }
78 |
--------------------------------------------------------------------------------
/modules/resolver-query-logging/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 1.9"
3 |
4 | required_providers {
5 | aws = {
6 | source = "hashicorp/aws"
7 | version = ">= 5.72"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------