Create module for managing AWS IPAM

_sub/network/ipam-pool/main.tf

@@ -0,0 +1,19 @@
+locals {
+  all_tags = merge(var.tags, { "Name" = var.pool.name })
+}
+
+resource "aws_vpc_ipam_pool" "this" {
+  ipam_scope_id       = var.scope_id
+  address_family      = var.pool.address_family
+  locale              = var.pool.locale
+  auto_import         = var.pool.locale != null ? true : false
+  source_ipam_pool_id = var.source_ipam_pool_id != null ? var.source_ipam_pool_id : null
+  description         = var.pool.name
+  cascade             = var.cascade
+  tags                = local.all_tags
+}
+
+resource "aws_vpc_ipam_pool_cidr" "this" {
+  ipam_pool_id = aws_vpc_ipam_pool.this.id
+  cidr         = var.pool.cidr
+}

_sub/network/ipam-pool/output.tf

@@ -0,0 +1,7 @@
+output "arn" {
+  value = aws_vpc_ipam_pool.this.arn
+}
+
+output "id" {
+  value = aws_vpc_ipam_pool.this.id
+}

_sub/network/ipam-pool/vars.tf

@@ -0,0 +1,31 @@
+variable "pool" {
+  type = object({
+    name           = string
+    cidr           = string
+    address_family = optional(string, "ipv4")
+    locale         = optional(string, null)
+  })
+  description = "The pool to create in the IPAM"
+}
+
+variable "scope_id" {
+  type        = string
+  description = "The IPAM scope id"
+}
+
+variable "source_ipam_pool_id" {
+  type    = string
+  default = null
+}
+
+variable "cascade" {
+  type        = bool
+  description = "Whether to cascade the deletion of the IPAM pool"
+  default     = true
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "A map of tags to apply to all the resources deployed by the module"
+  default     = {}
+}

_sub/network/ipam-pool/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.3.0, < 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.65.0"
+    }
+  }
+}

_sub/network/ipam-pool/versions.tofu

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.8.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.65.0"
+    }
+  }
+}

_sub/network/ipam-scope/main.tf

@@ -0,0 +1,10 @@
+locals {
+  all_tags = merge(var.tags, { "Name" = var.scope_name })
+}
+
+// Create an addional IPAM private scope
+resource "aws_vpc_ipam_scope" "this" {
+  ipam_id     = var.ipam_id
+  description = var.scope_name
+  tags        = local.all_tags
+}

_sub/network/ipam-scope/output.tf

@@ -0,0 +1,7 @@
+output "arn" {
+  value = aws_vpc_ipam_scope.this.arn
+}
+
+output "id" {
+  value = aws_vpc_ipam_scope.this.id
+}

_sub/network/ipam-scope/vars.tf

@@ -0,0 +1,15 @@
+variable "ipam_id" {
+  type        = string
+  description = "The IPAM instance id"
+}
+
+variable "scope_name" {
+  type        = string
+  description = "The name of the IPAM scope"
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "A map of tags to apply to all the resources deployed by the module"
+  default     = {}
+}

_sub/network/ipam-scope/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.3.0, < 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.65.0"
+    }
+  }
+}

_sub/network/ipam-scope/versions.tofu

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.8.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.65.0"
+    }
+  }
+}

_sub/network/ipam/main.tf

@@ -0,0 +1,19 @@
+data "aws_region" "current" {}
+
+locals {
+  all_ipam_regions = distinct(concat([data.aws_region.current.name], var.ipam_regions))
+  all_tags         = merge(var.tags, { "Name" = var.ipam_name })
+}
+
+resource "aws_vpc_ipam" "this" {
+  description = "${var.ipam_name} AWS IPAM"
+  dynamic "operating_regions" {
+    for_each = local.all_ipam_regions
+    content {
+      region_name = operating_regions.value
+    }
+  }
+  tier    = var.ipam_tier
+  cascade = var.cascade
+  tags    = local.all_tags
+}

_sub/network/ipam/output.tf

@@ -0,0 +1,7 @@
+output "arn" {
+  value = aws_vpc_ipam.this.arn
+}
+
+output "id" {
+  value = aws_vpc_ipam.this.id
+}

_sub/network/ipam/vars.tf

@@ -0,0 +1,33 @@
+variable "ipam_name" {
+  type        = string
+  description = "The name of the IPAM"
+  default     = "Company"
+}
+
+variable "ipam_regions" {
+  type        = list(string)
+  description = "The regions to support for IPAM"
+  default     = ["eu-west-1", "eu-central-1"]
+}
+
+variable "ipam_tier" {
+  type        = string
+  description = "The tier of the IPAM"
+  default     = "advanced"
+  validation {
+    condition     = can(regex("^(free|advanced)$", var.ipam_tier))
+    error_message = "Tier must be either 'free' or 'advanced'"
+  }
+}
+
+variable "cascade" {
+  type        = bool
+  description = "Whether to cascade the deletion of the IPAM"
+  default     = true
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "A map of tags to apply to all the resources deployed by the module"
+  default     = {}
+}

_sub/network/ipam/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.3.0, < 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.65.0"
+    }
+  }
+}

_sub/network/ipam/versions.tofu

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.8.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.65.0"
+    }
+  }
+}

network/ipam/main.tf

@@ -0,0 +1,87 @@
+module "ipam" {
+  source       = "../../_sub/network/ipam"
+  ipam_name    = var.ipam_name
+  ipam_regions = var.ipam_regions
+  cascade      = var.ipam_cascade
+  tags         = var.tags
+}
+
+module "ipam_scope" {
+  source     = "../../_sub/network/ipam-scope"
+  ipam_id    = module.ipam.id
+  scope_name = var.ipam_scope_name
+  tags       = var.tags
+}
+
+module "main_pool" {
+  source   = "../../_sub/network/ipam-pool"
+  scope_id = module.ipam_scope.id
+  pool = {
+    name = "main"
+    cidr = var.ipam_pools["main"].cidr
+  }
+  cascade = var.ipam_pools_cascade
+  tags    = var.tags
+}
+
+module "platform_pool" {
+  source   = "../../_sub/network/ipam-pool"
+  scope_id = module.ipam_scope.id
+  pool = {
+    name = "platform"
+    cidr = var.ipam_pools["platform"].cidr
+  }
+  source_ipam_pool_id = module.main_pool.id
+  cascade             = var.ipam_pools_cascade
+  tags                = var.tags
+}
+
+module "capabilities_pool" {
+  source   = "../../_sub/network/ipam-pool"
+  scope_id = module.ipam_scope.id
+  pool = {
+    name = "capabilities"
+    cidr = var.ipam_pools["capabilities"].cidr
+  }
+  source_ipam_pool_id = module.main_pool.id
+  cascade             = var.ipam_pools_cascade
+  tags                = var.tags
+}
+
+module "unused_pool" {
+  source   = "../../_sub/network/ipam-pool"
+  scope_id = module.ipam_scope.id
+  pool = {
+    name = "unused"
+    cidr = var.ipam_pools["unused"].cidr
+  }
+  source_ipam_pool_id = module.main_pool.id
+  cascade             = var.ipam_pools_cascade
+  tags                = var.tags
+}
+
+module "regional_platform_pools" {
+  source   = "../../_sub/network/ipam-pool"
+  for_each = var.ipam_pools["platform"].sub_pools
+  scope_id = module.ipam_scope.id
+  pool = {
+    name   = "platform-${each.key}"
+    cidr   = each.value.cidr
+    locale = each.key
+  }
+  source_ipam_pool_id = module.platform_pool.id
+  tags                = var.tags
+}
+
+module "regional_capabilities_pools" {
+  source   = "../../_sub/network/ipam-pool"
+  for_each = var.ipam_pools["capabilities"].sub_pools
+  scope_id = module.ipam_scope.id
+  pool = {
+    name   = "capabilities-${each.key}"
+    cidr   = each.value.cidr
+    locale = each.key
+  }
+  source_ipam_pool_id = module.capabilities_pool.id
+  tags                = var.tags
+}

network/ipam/providers.tf

@@ -0,0 +1,15 @@
+provider "aws" {
+  region = var.aws_region
+
+  assume_role {
+    role_arn = var.aws_assume_role_arn
+  }
+
+  default_tags {
+    tags = var.tags
+  }
+}
+
+terraform {
+  backend "s3" {}
+}