Skip to content

Commit a8c9e4d

Browse files
gambol99gambol99
committed
feat: adding the ability to provision a vpc, and tested with the landing zone implementation
1 parent d44e178 commit a8c9e4d

20 files changed

+529
-123
lines changed

‎.terraform.lock.hcl

+48
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.tflint.hcl

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ plugin "aws" {
55
}
66

77
config {
8-
module = true
8+
call_module_type = "local"
99
force = false
1010
}
1111

‎README.md

+39-16
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,42 @@
11
![Github Actions](../../actions/workflows/terraform.yml/badge.svg)
22

3-
# Terraform <NAME>
3+
# Terraform AWS Central DNS
44

55
## Description
66

7-
Add a description of the module here
7+
This purpose of this module is to manage and provision a central DNS solution with an AWS estate. Under this setup all private hosted zones defined within the spoke accounts have the ability to perform DNS resolution between them.
88

99
## Usage
1010

11-
Add example usage here
12-
1311
```hcl
14-
module "example" {
15-
source = "appvia/dns/aws"
16-
version = "1.0.0"
17-
18-
# insert variables here
12+
module "dns" {
13+
source = "../../"
14+
15+
resolver_name = "outbound-central-dns"
16+
tags = var.tags
17+
18+
resolver_rule_groups = [
19+
{
20+
ram_share_name = "internal"
21+
ram_principals = {
22+
"Deployments" = "arn:aws:organizations::536471746696:ou/o-7enwqk0f2c/ou-1tbg-mq4w830q"
23+
"Workloads" = "arn:aws:organizations::536471746696:ou/o-7enwqk0f2c/ou-1tbg-lk6g79d4"
24+
}
25+
rules = [
26+
{
27+
name = "aws-appvia-local"
28+
domain = "aws.appvia.local"
29+
}
30+
]
31+
}
32+
]
33+
34+
network = {
35+
availability_zones = 2
36+
transit_gateway_id = var.transit_gateway_id
37+
private_netmask = 24
38+
vpc_cidr = "10.90.0.0/21"
39+
}
1940
}
2041
```
2142

@@ -43,7 +64,10 @@ The `terraform-docs` utility is used to generate this README. Follow the below s
4364

4465
## Modules
4566

46-
No modules.
67+
| Name | Source | Version |
68+
|------|--------|---------|
69+
| <a name="module_dns_security_group"></a> [dns\_security\_group](#module\_dns\_security\_group) | terraform-aws-modules/security-group/aws | 5.1.2 |
70+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | appvia/network/aws | 0.3.0 |
4771

4872
## Resources
4973

@@ -55,25 +79,24 @@ No modules.
5579
| [aws_route53_resolver_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_endpoint) | resource |
5680
| [aws_route53_resolver_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_rule) | resource |
5781
| [aws_route53_zone_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
58-
| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
5982

6083
## Inputs
6184

6285
| Name | Description | Type | Default | Required |
6386
|------|-------------|------|---------|:--------:|
87+
| <a name="input_network"></a> [network](#input\_network) | The network to use for the endpoints and optinal resolvers | <pre>object({<br> availability_zones = optional(number, 2)<br> # Whether to use ipam when creating the network<br> create = optional(bool, true)<br> # Indicates if we should create a new network or reuse an existing one<br> enable_default_route_table_association = optional(bool, true)<br> # Whether to associate the default route table <br> enable_default_route_table_propagation = optional(bool, true)<br> # Whether to propagate the default route table<br> ipam_pool_id = optional(string, null)<br> # The id of the ipam pool to use when creating the network<br> name = optional(string, "central-dns")<br> # The name of the network to create<br> private_netmask = optional(number, 24)<br> # The subnet mask for private subnets, when creating the network i.e subnet-id => 10.90.0.0/24<br> private_subnet_ids = optional(list(string), [])<br> # The ids of the private subnets to if we are reusing an existing network<br> transit_gateway_id = optional(string, "")<br> ## The transit gateway id to use for the network<br> vpc_cidr = optional(string, "")<br> # The cidrws range to use for the VPC, when creating the network<br> vpc_id = optional(string, "")<br> # The vpc id to use when reusing an existing network <br> vpc_netmask = optional(number, null)<br> # When using ipam this the netmask to use for the VPC<br> })</pre> | n/a | yes |
6488
| <a name="input_resolver_name"></a> [resolver\_name](#input\_resolver\_name) | Name of the Route53 resolver endpoint | `string` | n/a | yes |
65-
| <a name="input_resolver_subnet_ids"></a> [resolver\_subnet\_ids](#input\_resolver\_subnet\_ids) | List of subnet IDs in which to create the Route53 Outbound Resolver | `list(string)` | n/a | yes |
66-
| <a name="input_resolver_vpc_id"></a> [resolver\_vpc\_id](#input\_resolver\_vpc\_id) | The ID of the VPC in which to create the Route53 Outbound Resolver | `string` | n/a | yes |
89+
| <a name="input_tags"></a> [tags](#input\_tags) | Map of tags to apply to resources created by this module | `map(string)` | n/a | yes |
6790
| <a name="input_resolver_endpoint_type"></a> [resolver\_endpoint\_type](#input\_resolver\_endpoint\_type) | The Route 53 Resolver endpoint IP address type. Valid values: IPV4, IPV6, DUALSTACK. | `string` | `"IPV4"` | no |
68-
| <a name="input_resolver_protocols"></a> [resolver\_protocols](#input\_resolver\_protocols) | List of protocols that the Route53 Outbound Resolver should support | `list(string)` | <pre>[<br> "Do53"<br>]</pre> | no |
69-
| <a name="input_resolver_rule_groups"></a> [resolver\_rule\_groups](#input\_resolver\_rule\_groups) | Map of Route53 Resolver Rules by group. Every rule in each group can be shared with principals via AWS RAM. | <pre>map(object({<br> name = optional(string)<br> ram_principals = optional(list(string), [])<br><br> rules = list(object({<br> domain = string<br> targets = list(string)<br> name = optional(string)<br> rule_type = optional(string, "FORWARD")<br> }))<br> }))</pre> | `{}` | no |
91+
| <a name="input_resolver_protocols"></a> [resolver\_protocols](#input\_resolver\_protocols) | List of protocols that the Route53 Outbound Resolver should support | `list(string)` | <pre>[<br> "Do53",<br> "DoH"<br>]</pre> | no |
92+
| <a name="input_resolver_rule_groups"></a> [resolver\_rule\_groups](#input\_resolver\_rule\_groups) | Map of Route53 Resolver Rules by group. Every rule in each group can be shared with principals via AWS RAM. | <pre>list(object({<br> ram_share_name = string<br> # The share share name will be the ram_share_name '-' rule_name<br> ram_principals = optional(map(string), {})<br> ## A map of principals to share the rules with i.e. Infrastructure OU => ou-1234567890<br> rules = list(object({<br> name = string<br> ## The name of the rule, used when creating the ram share <br> domain = string<br> ## The domain to forward the query to <br> targets = optional(list(string), [])<br> ## The name of the resolver rule<br> rule_type = optional(string, "FORWARD")<br> ## The type of rule to create <br> }))<br> ## A list of rules to create in the group <br> }))</pre> | `[]` | no |
7093
| <a name="input_route53_zone_ids"></a> [route53\_zone\_ids](#input\_route53\_zone\_ids) | List of Route53 Zone IDs to be associated with the resolver VPC. | `list(string)` | `[]` | no |
71-
| <a name="input_tags"></a> [tags](#input\_tags) | Map of tags to apply to resources created by this module | `map(string)` | `{}` | no |
7294

7395
## Outputs
7496

7597
| Name | Description |
7698
|------|-------------|
99+
| <a name="output_all_resolver_rules"></a> [all\_resolver\_rules](#output\_all\_resolver\_rules) | Map of all resolver rules. |
77100
| <a name="output_endpoint"></a> [endpoint](#output\_endpoint) | Details of the Route53 Outbound Resolver endpoint. |
78101
| <a name="output_resource_shares"></a> [resource\_shares](#output\_resource\_shares) | Map of AWS RAM Shares by group. |
79102
| <a name="output_rules"></a> [rules](#output\_rules) | Map of resolver rules by group. |

‎examples/basic/.terraform.lock.hcl ‎examples/complete/.terraform.lock.hcl

File renamed without changes.

‎examples/complete/README.md

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
## Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
7+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0.0 |
8+
9+
## Providers
10+
11+
No providers.
12+
13+
## Modules
14+
15+
| Name | Source | Version |
16+
|------|--------|---------|
17+
| <a name="module_dns"></a> [dns](#module\_dns) | ../../ | n/a |
18+
19+
## Resources
20+
21+
No resources.
22+
23+
## Inputs
24+
25+
| Name | Description | Type | Default | Required |
26+
|------|-------------|------|---------|:--------:|
27+
| <a name="input_tags"></a> [tags](#input\_tags) | Map of tags to apply to resources created by this module | `map(string)` | <pre>{<br> "Environment": "Testing",<br> "GitRepo": "https://github.com/appvia/terraform-aws-dns"<br>}</pre> | no |
28+
| <a name="input_transit_gateway_id"></a> [transit\_gateway\_id](#input\_transit\_gateway\_id) | The id of the transit gateway to use for the network | `string` | `"tgw-04ad8f026be8b7eb6"` | no |
29+
30+
## Outputs
31+
32+
No outputs.
33+
<!-- END_TF_DOCS -->

‎examples/complete/main.tf

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#####################################################################################
2+
# Terraform module examples are meant to show an _example_ on how to use a module
3+
# per use-case. The code below should not be copied directly but referenced in order
4+
# to build your own root module that invokes this module
5+
#####################################################################################
6+
7+
module "dns" {
8+
source = "../../"
9+
10+
resolver_name = "outbound-central-dns"
11+
tags = var.tags
12+
13+
resolver_rule_groups = [
14+
{
15+
ram_share_name = "internal"
16+
ram_principals = {
17+
"Deployments" = "arn:aws:organizations::536471746696:ou/o-7enwqk0f2c/ou-1tbg-mq4w830q"
18+
"Workloads" = "arn:aws:organizations::536471746696:ou/o-7enwqk0f2c/ou-1tbg-lk6g79d4"
19+
}
20+
rules = [
21+
{
22+
name = "aws-appvia-local"
23+
domain = "aws.appvia.local"
24+
}
25+
]
26+
}
27+
]
28+
29+
network = {
30+
availability_zones = 2
31+
transit_gateway_id = var.transit_gateway_id
32+
private_netmask = 24
33+
vpc_cidr = "10.90.0.0/21"
34+
}
35+
}
36+

‎examples/complete/outputs.tf

Whitespace-only changes.

‎examples/basic/terraform.tf ‎examples/complete/terraform.tf

File renamed without changes.

‎examples/complete/variables.tf

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
2+
variable "tags" {
3+
description = "Map of tags to apply to resources created by this module"
4+
type = map(string)
5+
default = {
6+
"Environment" = "Testing"
7+
"GitRepo" = "https://github.com/appvia/terraform-aws-dns"
8+
}
9+
}
10+
11+
variable "transit_gateway_id" {
12+
description = "The id of the transit gateway to use for the network"
13+
type = string
14+
default = "tgw-04ad8f026be8b7eb6"
15+
}
16+

‎examples/reuse/.terraform.lock.hcl

+48
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/reuse/README.md

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Reuse Existing VPC
2+
3+
In order to reuse and existing VPC, the module requires to following inputs
4+
5+
- `var.network.transit_gateway_id` - The id of the transit gateway to use for the network.
6+
- `var.network.vpc_id` - The id of the VPC to use for the network.
7+
- `var.network.vpc_cidr` - The CIDR block of the VPC to use for the network.
8+
- `var.network.subnet_ids` - The list subnet ids for the private subnets.
9+
10+
<!-- BEGIN_TF_DOCS -->
11+
## Requirements
12+
13+
| Name | Version |
14+
|------|---------|
15+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
16+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0.0 |
17+
18+
## Providers
19+
20+
No providers.
21+
22+
## Modules
23+
24+
| Name | Source | Version |
25+
|------|--------|---------|
26+
| <a name="module_dns"></a> [dns](#module\_dns) | ../../ | n/a |
27+
| <a name="module_network"></a> [network](#module\_network) | appvia/network/aws | 0.3.0 |
28+
29+
## Resources
30+
31+
No resources.
32+
33+
## Inputs
34+
35+
| Name | Description | Type | Default | Required |
36+
|------|-------------|------|---------|:--------:|
37+
| <a name="input_ipam_pool_id"></a> [ipam\_pool\_id](#input\_ipam\_pool\_id) | The id of the ipam pool to use when creating the network | `string` | `"ipam-pool-054836edbcccd8983"` | no |
38+
| <a name="input_tags"></a> [tags](#input\_tags) | Map of tags to apply to resources created by this module | `map(string)` | <pre>{<br> "Environment": "Testing",<br> "GitRepo": "https://github.com/appvia/terraform-aws-dns"<br>}</pre> | no |
39+
| <a name="input_transit_gateway_id"></a> [transit\_gateway\_id](#input\_transit\_gateway\_id) | The id of the transit gateway to use for the network | `string` | `"tgw-04ad8f026be8b7eb6"` | no |
40+
41+
## Outputs
42+
43+
No outputs.
44+
<!-- END_TF_DOCS -->
45+

‎examples/reuse/main.tf

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#####################################################################################
2+
# Terraform module examples are meant to show an _example_ on how to use a module
3+
# per use-case. The code below should not be copied directly but referenced in order
4+
# to build your own root module that invokes this module
5+
#####################################################################################
6+
7+
## Create a network for the endpoints to reuse
8+
module "network" {
9+
source = "appvia/network/aws"
10+
version = "0.3.0"
11+
12+
availability_zones = 2
13+
enable_ipam = true
14+
enable_route53_resolver_rules = true
15+
enable_transit_gateway = true
16+
enable_transit_gateway_appliance_mode = true
17+
ipam_pool_id = var.ipam_pool_id
18+
name = "central-dns"
19+
private_subnet_netmask = 24
20+
tags = var.tags
21+
transit_gateway_id = var.transit_gateway_id
22+
vpc_netmask = 21
23+
}
24+
25+
module "dns" {
26+
source = "../../"
27+
28+
resolver_name = "outbound-central-dns"
29+
tags = var.tags
30+
31+
resolver_rule_groups = [
32+
{
33+
ram_share_name = "internal"
34+
ram_principals = {
35+
"Deployments" = "arn:aws:organizations::536471746696:ou/o-7enwqk0f2c/ou-1tbg-mq4w830q"
36+
"Workloads" = "arn:aws:organizations::536471746696:ou/o-7enwqk0f2c/ou-1tbg-lk6g79d4"
37+
}
38+
rules = [
39+
{
40+
name = "aws-appvia-local"
41+
domain = "aws.appvia.local"
42+
}
43+
]
44+
}
45+
]
46+
47+
network = {
48+
availability_zones = 2
49+
create = false
50+
private_subnet_ids = module.network.private_subnet_ids
51+
transit_gateway_id = var.transit_gateway_id
52+
vpc_cidr = module.network.vpc_cidr
53+
vpc_id = module.network.vpc_id
54+
}
55+
}
56+

‎examples/reuse/outputs.tf

Whitespace-only changes.

0 commit comments

Comments
 (0)