diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c8299b7a8..23497e143 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,10 +1,10 @@ repos: - repo: git://github.com/antonbabenko/pre-commit-terraform - rev: v1.8.1 + rev: v1.11.0 hooks: - id: terraform_fmt - id: terraform_docs - repo: git://github.com/pre-commit/pre-commit-hooks - rev: v2.1.0 + rev: v2.2.3 hooks: - id: check-merge-conflict diff --git a/README.md b/README.md index ce7b774a0..4754b333f 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ These types of resources are supported: * [VPN Gateway](https://www.terraform.io/docs/providers/aws/r/vpn_gateway.html) * [VPC Endpoint](https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html): * Gateway: S3, DynamoDB - * Interface: EC2, SSM, EC2 Messages, SSM Messages, ECR API, ECR DKR, API Gateway, KMS, ECS, ECS Agent, ECS Telemetry + * Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS, ECS, ECS Agent, ECS Telemetry * [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html) * [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html) * [Redshift Subnet Group](https://www.terraform.io/docs/providers/aws/r/redshift_subnet_group.html) @@ -28,6 +28,12 @@ Sponsored by [Cloudcraft - the best way to draw AWS diagrams](https://cloudcraft Cloudcraft - the best way to draw AWS diagrams +## Terraform versions + +For Terraform 0.12 use version `v2.*` of this module. + +If you are using Terraform 0.11 you can use versions `v1.*`. + ## Usage ```hcl @@ -183,10 +189,6 @@ Sometimes it is handy to have public access to Redshift clusters (for example if enable_public_redshift = true # <= By default Redshift subnets will be associated with the private route table ``` -## Terraform version - -Terraform version 0.10.3 or newer is required for this module to work. - ## Examples * [Simple VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/simple-vpc) @@ -252,6 +254,15 @@ Terraform version 0.10.3 or newer is required for this module to work. | ecr\_dkr\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECR DKR endpoint | string | `"false"` | no | | ecr\_dkr\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECR DKR endpoint | list | `[]` | no | | ecr\_dkr\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECR dkr endpoint. If omitted, private subnets will be used. | list | `[]` | no | +| ecs\_agent\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Agent endpoint | string | `"false"` | no | +| ecs\_agent\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Agent endpoint | list | `[]` | no | +| ecs\_agent\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Agent endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | +| ecs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS endpoint | string | `"false"` | no | +| ecs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS endpoint | list | `[]` | no | +| ecs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | +| ecs\_telemetry\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Telemetry endpoint | string | `"false"` | no | +| ecs\_telemetry\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Telemetry endpoint | list | `[]` | no | +| ecs\_telemetry\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Telemetry endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | | elasticache\_acl\_tags | Additional tags for the elasticache subnets network ACL | map | `{}` | no | | elasticache\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for elasticache subnets | string | `"false"` | no | | elasticache\_inbound\_acl\_rules | Elasticache subnets inbound network ACL rules | list | `[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ]` | no | @@ -269,10 +280,14 @@ Terraform version 0.10.3 or newer is required for this module to work. | enable\_ec2messages\_endpoint | Should be true if you want to provision an EC2MESSAGES endpoint to the VPC | string | `"false"` | no | | enable\_ecr\_api\_endpoint | Should be true if you want to provision an ecr api endpoint to the VPC | string | `"false"` | no | | enable\_ecr\_dkr\_endpoint | Should be true if you want to provision an ecr dkr endpoint to the VPC | string | `"false"` | no | +| enable\_ecs\_agent\_endpoint | Should be true if you want to provision a ECS Agent endpoint to the VPC | string | `"false"` | no | +| enable\_ecs\_endpoint | Should be true if you want to provision a ECS endpoint to the VPC | string | `"false"` | no | +| enable\_ecs\_telemetry\_endpoint | Should be true if you want to provision a ECS Telemetry endpoint to the VPC | string | `"false"` | no | | enable\_kms\_endpoint | Should be true if you want to provision a KMS endpoint to the VPC | string | `"false"` | no | | enable\_nat\_gateway | Should be true if you want to provision NAT Gateways for each of your private networks | string | `"false"` | no | | enable\_public\_redshift | Controls if redshift should have public routing table | string | `"false"` | no | | enable\_s3\_endpoint | Should be true if you want to provision an S3 endpoint to the VPC | string | `"false"` | no | +| enable\_sqs\_endpoint | Should be true if you want to provision an SQS endpoint to the VPC | string | `"false"` | no | | enable\_ssm\_endpoint | Should be true if you want to provision an SSM endpoint to the VPC | string | `"false"` | no | | enable\_ssmmessages\_endpoint | Should be true if you want to provision a SSMMESSAGES endpoint to the VPC | string | `"false"` | no | | enable\_vpn\_gateway | Should be true if you want to create a new VPN Gateway resource and attach it to the VPC | string | `"false"` | no | @@ -327,21 +342,15 @@ Terraform version 0.10.3 or newer is required for this module to work. | reuse\_nat\_ips | Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable | string | `"false"` | no | | secondary\_cidr\_blocks | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | list | `[]` | no | | single\_nat\_gateway | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | string | `"false"` | no | +| sqs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SQS endpoint | string | `"false"` | no | +| sqs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SQS endpoint | list | `[]` | no | +| sqs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SQS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | | ssm\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SSM endpoint | string | `"false"` | no | | ssm\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SSM endpoint | list | `[]` | no | | ssm\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SSM endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | | ssmmessages\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SSMMESSAGES endpoint | string | `"false"` | no | | ssmmessages\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SSMMESSAGES endpoint | list | `[]` | no | | ssmmessages\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SSMMESSAGES endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | -| ecs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS endpoint | string | `"false"` | no | -| ecs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS endpoint | list | `[]` | no | -| ecs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | -| ecs\_agent\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Agent endpoint | string | `"false"` | no | -| ecs\_agent\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Agent endpoint | list | `[]` | no | -| ecs\_agent\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Agent endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | -| ecs\_telemetry\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Telemetry endpoint | string | `"false"` | no | -| ecs\_telemetry\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Telemetry endpoint | list | `[]` | no | -| ecs\_telemetry\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Telemetry endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no | | tags | A map of tags to add to all resources | map | `{}` | no | | vpc\_tags | Additional tags for the VPC | map | `{}` | no | | vpn\_gateway\_id | ID of VPN Gateway to attach to the VPC | string | `""` | no | @@ -424,26 +433,29 @@ Terraform version 0.10.3 or newer is required for this module to work. | vpc\_endpoint\_ecr\_dkr\_dns\_entry | The DNS entries for the VPC Endpoint for ECR DKR. | | vpc\_endpoint\_ecr\_dkr\_id | The ID of VPC endpoint for ECR DKR | | vpc\_endpoint\_ecr\_dkr\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECR DKR. | +| vpc\_endpoint\_ecs\_agent\_dns\_entry | The DNS entries for the VPC Endpoint for ECS Agent. | +| vpc\_endpoint\_ecs\_agent\_id | The ID of VPC endpoint for ECS Agent | +| vpc\_endpoint\_ecs\_agent\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS Agent. | +| vpc\_endpoint\_ecs\_dns\_entry | The DNS entries for the VPC Endpoint for ECS. | +| vpc\_endpoint\_ecs\_id | The ID of VPC endpoint for ECS | +| vpc\_endpoint\_ecs\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS. | +| vpc\_endpoint\_ecs\_telemetry\_dns\_entry | The DNS entries for the VPC Endpoint for ECS Telemetry. | +| vpc\_endpoint\_ecs\_telemetry\_id | The ID of VPC endpoint for ECS Telemetry | +| vpc\_endpoint\_ecs\_telemetry\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS Telemetry. | | vpc\_endpoint\_kms\_dns\_entry | The DNS entries for the VPC Endpoint for KMS. | | vpc\_endpoint\_kms\_id | The ID of VPC endpoint for KMS | | vpc\_endpoint\_kms\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for KMS. | | vpc\_endpoint\_s3\_id | The ID of VPC endpoint for S3 | | vpc\_endpoint\_s3\_pl\_id | The prefix list for the S3 VPC endpoint. | +| vpc\_endpoint\_sqs\_dns\_entry | The DNS entries for the VPC Endpoint for SQS. | +| vpc\_endpoint\_sqs\_id | The ID of VPC endpoint for SQS | +| vpc\_endpoint\_sqs\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SQS. | | vpc\_endpoint\_ssm\_dns\_entry | The DNS entries for the VPC Endpoint for SSM. | | vpc\_endpoint\_ssm\_id | The ID of VPC endpoint for SSM | | vpc\_endpoint\_ssm\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SSM. | | vpc\_endpoint\_ssmmessages\_dns\_entry | The DNS entries for the VPC Endpoint for SSMMESSAGES. | | vpc\_endpoint\_ssmmessages\_id | The ID of VPC endpoint for SSMMESSAGES | | vpc\_endpoint\_ssmmessages\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SSMMESSAGES. | -| vpc\_endpoint\_ecs\_dns\_entry | The DNS entries for the VPC Endpoint for ECS. | -| vpc\_endpoint\_ecs\_id | The ID of VPC endpoint for ECS | -| vpc\_endpoint\_ecs\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS. | -| vpc\_endpoint\_ecs\_agent\_dns\_entry | The DNS entries for the VPC Endpoint for ECS Agent. | -| vpc\_endpoint\_ecs\_agent\_id | The ID of VPC endpoint for ECS Agent | -| vpc\_endpoint\_ecs\_agent\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS Agent. | -| vpc\_endpoint\_ecs\_telemetry\_dns\_entry | The DNS entries for the VPC Endpoint for ECS Telemetry. | -| vpc\_endpoint\_ecs\_telemetry\_id | The ID of VPC endpoint for ECS Telemetry | -| vpc\_endpoint\_ecs\_telemetry\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS Telemetry. | | vpc\_id | The ID of the VPC | | vpc\_instance\_tenancy | Tenancy of instances spin up within VPC | | vpc\_main\_route\_table\_id | The ID of the main route table associated with this VPC | diff --git a/examples/complete-vpc/main.tf b/examples/complete-vpc/main.tf index cee1fbcc2..2d5d71183 100644 --- a/examples/complete-vpc/main.tf +++ b/examples/complete-vpc/main.tf @@ -45,7 +45,7 @@ module "vpc" { # VPC endpoint for SSM enable_ssm_endpoint = true ssm_endpoint_private_dns_enabled = true - ssm_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"] # ssm_endpoint_subnet_ids = ["..."] + ssm_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"] # VPC endpoint for SSMMESSAGES enable_ssmmessages_endpoint = true @@ -77,7 +77,20 @@ module "vpc" { kms_endpoint_private_dns_enabled = true kms_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"] - # kms_endpoint_subnet_ids = ["..."] + # VPC endpoint for ECS + enable_ecs_endpoint = true + ecs_endpoint_private_dns_enabled = true + ecs_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"] + + # VPC endpoint for ECS telemetry + enable_ecs_telemetry_endpoint = true + ecs_telemetry_endpoint_private_dns_enabled = true + ecs_telemetry_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"] + + # VPC endpoint for SQS + enable_sqs_endpoint = true + sqs_endpoint_private_dns_enabled = true + sqs_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"] tags = { Owner = "user" diff --git a/main.tf b/main.tf index 9a2f89232..86bfccc2a 100644 --- a/main.tf +++ b/main.tf @@ -122,7 +122,7 @@ resource "aws_route_table" "database" { } resource "aws_route" "database_internet_gateway" { - count = "${var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.create_database_internet_gateway_route && !var.create_database_nat_gateway_route ? 1 : 0}" + count = "${var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.create_database_internet_gateway_route && ! var.create_database_nat_gateway_route ? 1 : 0}" route_table_id = "${aws_route_table.database.id}" destination_cidr_block = "0.0.0.0/0" @@ -134,7 +134,7 @@ resource "aws_route" "database_internet_gateway" { } resource "aws_route" "database_nat_gateway" { - count = "${var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && !var.create_database_internet_gateway_route && var.create_database_nat_gateway_route && var.enable_nat_gateway ? local.nat_gateway_count : 0}" + count = "${var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && ! var.create_database_internet_gateway_route && var.create_database_nat_gateway_route && var.enable_nat_gateway ? local.nat_gateway_count : 0}" route_table_id = "${element(aws_route_table.private.*.id, count.index)}" destination_cidr_block = "0.0.0.0/0" nat_gateway_id = "${element(aws_nat_gateway.this.*.id, count.index)}" @@ -181,7 +181,7 @@ resource "aws_route_table" "intra" { # Public subnet ################ resource "aws_subnet" "public" { - count = "${var.create_vpc && length(var.public_subnets) > 0 && (!var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0}" + count = "${var.create_vpc && length(var.public_subnets) > 0 && (! var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0}" vpc_id = "${local.vpc_id}" cidr_block = "${element(concat(var.public_subnets, list("")), count.index)}" @@ -558,7 +558,7 @@ locals { } resource "aws_eip" "nat" { - count = "${var.create_vpc && (var.enable_nat_gateway && !var.reuse_nat_ips) ? local.nat_gateway_count : 0}" + count = "${var.create_vpc && (var.enable_nat_gateway && ! var.reuse_nat_ips) ? local.nat_gateway_count : 0}" vpc = true @@ -662,6 +662,27 @@ resource "aws_vpc_endpoint_route_table_association" "public_dynamodb" { route_table_id = "${aws_route_table.public.id}" } +####################### +# VPC Endpoint for SQS +####################### +data "aws_vpc_endpoint_service" "sqs" { + count = "${var.create_vpc && var.enable_sqs_endpoint ? 1 : 0}" + + service = "sqs" +} + +resource "aws_vpc_endpoint" "sqs" { + count = "${var.create_vpc && var.enable_sqs_endpoint ? 1 : 0}" + + vpc_id = "${local.vpc_id}" + service_name = "${data.aws_vpc_endpoint_service.sqs.service_name}" + vpc_endpoint_type = "Interface" + + security_group_ids = ["${var.sqs_endpoint_security_group_ids}"] + subnet_ids = ["${coalescelist(var.sqs_endpoint_subnet_ids, aws_subnet.private.*.id)}"] + private_dns_enabled = "${var.sqs_endpoint_private_dns_enabled}" +} + ####################### # VPC Endpoint for SSM ####################### @@ -888,7 +909,7 @@ resource "aws_vpc_endpoint" "ecs_telemetry" { count = "${var.create_vpc && var.enable_ecs_telemetry_endpoint ? 1 : 0}" vpc_id = "${local.vpc_id}" - service_name = "${data.aws_vpc_endpoint_service.ecs.service_name}" + service_name = "${data.aws_vpc_endpoint_service.ecs_telemetry.service_name}" vpc_endpoint_type = "Interface" security_group_ids = ["${var.ecs_telemetry_endpoint_security_group_ids}"] @@ -914,7 +935,7 @@ resource "aws_route_table_association" "database" { } resource "aws_route_table_association" "redshift" { - count = "${var.create_vpc && length(var.redshift_subnets) > 0 && !var.enable_public_redshift ? length(var.redshift_subnets) : 0}" + count = "${var.create_vpc && length(var.redshift_subnets) > 0 && ! var.enable_public_redshift ? length(var.redshift_subnets) : 0}" subnet_id = "${element(aws_subnet.redshift.*.id, count.index)}" route_table_id = "${element(coalescelist(aws_route_table.redshift.*.id, aws_route_table.private.*.id), (var.single_nat_gateway || var.create_redshift_subnet_route_table ? 0 : count.index))}" diff --git a/outputs.tf b/outputs.tf index 107d801b8..fc8a43b9e 100644 --- a/outputs.tf +++ b/outputs.tf @@ -344,6 +344,21 @@ output "vpc_endpoint_dynamodb_pl_id" { value = "${element(concat(aws_vpc_endpoint.dynamodb.*.prefix_list_id, list("")), 0)}" } +output "vpc_endpoint_sqs_id" { + description = "The ID of VPC endpoint for SQS" + value = "${element(concat(aws_vpc_endpoint.sqs.*.id, list("")), 0)}" +} + +output "vpc_endpoint_sqs_network_interface_ids" { + description = "One or more network interfaces for the VPC Endpoint for SQS." + value = "${flatten(aws_vpc_endpoint.sqs.*.network_interface_ids)}" +} + +output "vpc_endpoint_sqs_dns_entry" { + description = "The DNS entries for the VPC Endpoint for SQS." + value = "${flatten(aws_vpc_endpoint.sqs.*.dns_entry)}" +} + output "vpc_endpoint_ssm_id" { description = "The ID of VPC endpoint for SSM" value = "${element(concat(aws_vpc_endpoint.ssm.*.id, list("")), 0)}" diff --git a/variables.tf b/variables.tf index 9c24a808f..eb2b4d897 100644 --- a/variables.tf +++ b/variables.tf @@ -184,6 +184,26 @@ variable "enable_s3_endpoint" { default = false } +variable "enable_sqs_endpoint" { + description = "Should be true if you want to provision an SQS endpoint to the VPC" + default = false +} + +variable "sqs_endpoint_security_group_ids" { + description = "The ID of one or more security groups to associate with the network interface for SQS endpoint" + default = [] +} + +variable "sqs_endpoint_subnet_ids" { + description = "The ID of one or more subnets in which to create a network interface for SQS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." + default = [] +} + +variable "sqs_endpoint_private_dns_enabled" { + description = "Whether or not to associate a private hosted zone with the specified VPC for SQS endpoint" + default = false +} + variable "enable_ssm_endpoint" { description = "Should be true if you want to provision an SSM endpoint to the VPC" default = false @@ -687,7 +707,7 @@ variable "default_network_acl_ingress" { to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" - }, + }, { rule_no = 101 action = "allow" @@ -709,7 +729,7 @@ variable "default_network_acl_egress" { to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" - }, + }, { rule_no = 101 action = "allow"