Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added SSM and EC2 VPC endpoints #202

Merged
merged 1 commit into from
Jan 17, 2019
Merged

Added SSM and EC2 VPC endpoints #202

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
94 changes: 54 additions & 40 deletions README.md
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 3 additions & 0 deletions examples/complete-vpc/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@ Note that this example may create resources which can cost money (AWS Elastic IP
| private\_subnets | List of IDs of private subnets |
| public\_subnets | List of IDs of public subnets |
| redshift\_subnets | List of IDs of redshift subnets |
| vpc\_endpoint\_ssm\_dns\_entry | The DNS entries for the VPC Endpoint for SSM. |
| vpc\_endpoint\_ssm\_id | The ID of VPC endpoint for SSM |
| vpc\_endpoint\_ssm\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SSM. |
| vpc\_id | The ID of the VPC |

<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
28 changes: 25 additions & 3 deletions examples/complete-vpc/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,11 @@ provider "aws" {
region = "eu-west-1"
}

data "aws_security_group" "default" {
name = "default"
vpc_id = "${module.vpc.vpc_id}"
}

module "vpc" {
source = "../../"

Expand All @@ -19,18 +24,35 @@ module "vpc" {

create_database_subnet_group = false

enable_dns_hostnames = true
enable_dns_support = true

enable_nat_gateway = true
single_nat_gateway = true

enable_vpn_gateway = true

enable_s3_endpoint = true
enable_dynamodb_endpoint = true

enable_dhcp_options = true
dhcp_options_domain_name = "service.consul"
dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]

# VPC endpoint for S3
enable_s3_endpoint = true

# VPC endpoint for DynamoDB
enable_dynamodb_endpoint = true

# VPC endpoint for SSM
enable_ssm_endpoint = true
ssm_endpoint_private_dns_enabled = true
ssm_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"]

// ssm_endpoint_subnet_ids = ["..."]
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tbugfinder I've added argument ssm_endpoint_subnet_ids which can be specified to make sure that the list of subnets contains at most just one subnet per AZ. I don't know any easy way to filter values another way automatically.


# VPC Endpoint for EC2
enable_ec2_endpoint = true
ec2_endpoint_private_dns_enabled = true
ec2_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"]
tags = {
Owner = "user"
Environment = "staging"
Expand Down
34 changes: 34 additions & 0 deletions examples/complete-vpc/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,3 +40,37 @@ output "nat_public_ips" {
description = "List of public Elastic IPs created for AWS NAT Gateway"
value = ["${module.vpc.nat_public_ips}"]
}

# VPC endpoints
output "vpc_endpoint_ssm_id" {
description = "The ID of VPC endpoint for SSM"
value = "${module.vpc.vpc_endpoint_ssm_id}"
}

output "vpc_endpoint_ssm_network_interface_ids" {
description = "One or more network interfaces for the VPC Endpoint for SSM."
value = ["${module.vpc.vpc_endpoint_ssm_network_interface_ids}"]
}

output "vpc_endpoint_ssm_dns_entry" {
description = "The DNS entries for the VPC Endpoint for SSM."
value = ["${module.vpc.vpc_endpoint_ssm_dns_entry}"]
}

//
//# VPC endpoints
//output "vpc_endpoint_ec2_id" {
// description = "The ID of VPC endpoint for EC2"
// value = "${module.vpc.vpc_endpoint_ec2_id}"
//}
//
//output "vpc_endpoint_ec2_network_interface_ids" {
// description = "One or more network interfaces for the VPC Endpoint for EC2."
// value = ["${module.vpc.vpc_endpoint_ec2_network_interface_ids}"]
//}
//
//output "vpc_endpoint_ec2_dns_entry" {
// description = "The DNS entries for the VPC Endpoint for EC2."
// value = ["${module.vpc.vpc_endpoint_ec2_dns_entry}"]
//}

2 changes: 1 addition & 1 deletion examples/test_fixture/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ This will destroy any existing test resources, create the resources afresh, run

| Name | Description | Type | Default | Required |
|------|-------------|:----:|:-----:|:-----:|
| region | - | string | `eu-west-1` | no |
| region | | string | `"eu-west-1"` | no |

## Outputs

Expand Down
42 changes: 42 additions & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,6 +393,48 @@ resource "aws_vpc_endpoint_route_table_association" "public_dynamodb" {
route_table_id = "${aws_route_table.public.id}"
}

######################
# VPC Endpoint for SSM
######################
data "aws_vpc_endpoint_service" "ssm" {
count = "${var.create_vpc && var.enable_ssm_endpoint ? 1 : 0}"

service = "ssm"
}

resource "aws_vpc_endpoint" "ssm" {
count = "${var.create_vpc && var.enable_ssm_endpoint ? 1 : 0}"

vpc_id = "${local.vpc_id}"
service_name = "${data.aws_vpc_endpoint_service.ssm.service_name}"
vpc_endpoint_type = "Interface"

security_group_ids = ["${var.ssm_endpoint_security_group_ids}"]
subnet_ids = ["${coalescelist(var.ssm_endpoint_subnet_ids, aws_subnet.private.*.id)}"]
private_dns_enabled = "${var.ssm_endpoint_private_dns_enabled}"
}

######################
# VPC Endpoint for EC2
######################
data "aws_vpc_endpoint_service" "ec2" {
count = "${var.create_vpc && var.enable_ec2_endpoint ? 1 : 0}"

service = "ec2"
}

resource "aws_vpc_endpoint" "ec2" {
count = "${var.create_vpc && var.enable_ec2_endpoint ? 1 : 0}"

vpc_id = "${local.vpc_id}"
service_name = "${data.aws_vpc_endpoint_service.ec2.service_name}"
vpc_endpoint_type = "Interface"

security_group_ids = ["${var.ec2_endpoint_security_group_ids}"]
subnet_ids = ["${coalescelist(var.ec2_endpoint_subnet_ids, aws_subnet.private.*.id)}"]
private_dns_enabled = "${var.ec2_endpoint_private_dns_enabled}"
}

##########################
# Route table association
##########################
Expand Down
72 changes: 52 additions & 20 deletions outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,31 +193,11 @@ output "igw_id" {
value = "${element(concat(aws_internet_gateway.this.*.id, list("")), 0)}"
}

output "vpc_endpoint_s3_id" {
description = "The ID of VPC endpoint for S3"
value = "${element(concat(aws_vpc_endpoint.s3.*.id, list("")), 0)}"
}

output "vpc_endpoint_s3_pl_id" {
description = "The prefix list for the S3 VPC endpoint."
value = "${element(concat(aws_vpc_endpoint.s3.*.prefix_list_id, list("")), 0)}"
}

output "vpc_endpoint_dynamodb_id" {
description = "The ID of VPC endpoint for DynamoDB"
value = "${element(concat(aws_vpc_endpoint.dynamodb.*.id, list("")), 0)}"
}

output "vgw_id" {
description = "The ID of the VPN Gateway"
value = "${element(concat(aws_vpn_gateway.this.*.id, aws_vpn_gateway_attachment.this.*.vpn_gateway_id, list("")), 0)}"
}

output "vpc_endpoint_dynamodb_pl_id" {
description = "The prefix list for the DynamoDB VPC endpoint."
value = "${element(concat(aws_vpc_endpoint.dynamodb.*.prefix_list_id, list("")), 0)}"
}

output "default_vpc_id" {
description = "The ID of the VPC"
value = "${element(concat(aws_default_vpc.this.*.id, list("")), 0)}"
Expand Down Expand Up @@ -278,6 +258,58 @@ output "default_vpc_main_route_table_id" {
// value = "${element(concat(aws_default_vpc.this.*.ipv6_cidr_block, list("")), 0)}"
//}

# VPC Endpoints
output "vpc_endpoint_s3_id" {
description = "The ID of VPC endpoint for S3"
value = "${element(concat(aws_vpc_endpoint.s3.*.id, list("")), 0)}"
}

output "vpc_endpoint_s3_pl_id" {
description = "The prefix list for the S3 VPC endpoint."
value = "${element(concat(aws_vpc_endpoint.s3.*.prefix_list_id, list("")), 0)}"
}

output "vpc_endpoint_dynamodb_id" {
description = "The ID of VPC endpoint for DynamoDB"
value = "${element(concat(aws_vpc_endpoint.dynamodb.*.id, list("")), 0)}"
}

output "vpc_endpoint_dynamodb_pl_id" {
description = "The prefix list for the DynamoDB VPC endpoint."
value = "${element(concat(aws_vpc_endpoint.dynamodb.*.prefix_list_id, list("")), 0)}"
}

output "vpc_endpoint_ssm_id" {
description = "The ID of VPC endpoint for SSM"
value = "${element(concat(aws_vpc_endpoint.ssm.*.id, list("")), 0)}"
}

output "vpc_endpoint_ssm_network_interface_ids" {
description = "One or more network interfaces for the VPC Endpoint for SSM."
value = "${flatten(aws_vpc_endpoint.ssm.*.network_interface_ids)}"
}

output "vpc_endpoint_ssm_dns_entry" {
description = "The DNS entries for the VPC Endpoint for SSM."
value = "${flatten(aws_vpc_endpoint.ssm.*.dns_entry)}"
}

output "vpc_endpoint_ec2_id" {
description = "The ID of VPC endpoint for EC2"
value = "${element(concat(aws_vpc_endpoint.ec2.*.id, list("")), 0)}"
}

output "vpc_endpoint_ec2_network_interface_ids" {
description = "One or more network interfaces for the VPC Endpoint for EC2"
value = "${flatten(aws_vpc_endpoint.ec2.*.network_interface_ids)}"
}

output "vpc_endpoint_ec2_dns_entry" {
description = "The DNS entries for the VPC Endpoint for EC2."
value = "${flatten(aws_vpc_endpoint.ec2.*.dns_entry)}"
}

# Static values (arguments)
output "azs" {
description = "A list of availability zones specified as argument to this module"
value = "${var.azs}"
Expand Down
40 changes: 40 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,46 @@ variable "enable_s3_endpoint" {
default = false
}

variable "enable_ssm_endpoint" {
description = "Should be true if you want to provision an SSM endpoint to the VPC"
default = false
}

variable "ssm_endpoint_security_group_ids" {
description = "The ID of one or more security groups to associate with the network interface for SSM endpoint"
default = []
}

variable "ssm_endpoint_subnet_ids" {
description = "The ID of one or more subnets in which to create a network interface for SSM endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
default = []
}

variable "ssm_endpoint_private_dns_enabled" {
description = "Whether or not to associate a private hosted zone with the specified VPC for SSM endpoint"
default = false
}

variable "enable_ec2_endpoint" {
description = "Should be true if you want to provision an EC2 endpoint to the VPC"
default = false
}

variable "ec2_endpoint_security_group_ids" {
description = "The ID of one or more security groups to associate with the network interface for EC2 endpoint"
default = []
}

variable "ec2_endpoint_private_dns_enabled" {
description = "Whether or not to associate a private hosted zone with the specified VPC for EC2 endpoint"
default = false
}

variable "ec2_endpoint_subnet_ids" {
description = "The ID of one or more subnets in which to create a network interface for EC2 endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
default = []
}

variable "map_public_ip_on_launch" {
description = "Should be false if you do not want to auto-assign public IP on launch"
default = true
Expand Down