Skip to content

Commit

Permalink
Merge pull request #88 from drewmullen/rm-preview-resource
Browse files Browse the repository at this point in the history 
Breaking Change: Remove preview_cidr resource reliance, move `transit_gateway_id` outside of nested map
  • Loading branch information
@tlindsay42
tlindsay42 authored Sep 22, 2022
2 parents 8ec1a1d + a51cbda commit dfa6ee1
Show file tree
Hide file tree
Showing 17 changed files with 236 additions and 205 deletions.
25 changes: 18 additions & 7 deletions .header.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,12 @@ module "vpc" {
There are 2 reserved keys for subnet key names in var.subnets corresponding to types "public" and "transit_gateway". Other custom subnet key names are valid are and those subnets will be private subnets.

```terraform
transit_gateway_id = <>
transit_gateway_routes = {
public = "pl-123"
vpce = "10.0.0.0/8"
}
subnets = {
public = {
name_prefix = "my-public" # omit to prefix with "public"
Expand All @@ -64,8 +70,19 @@ subnets = {
# omitting name_prefix defaults value to "privatetwo"
# name_prefix = "private"
netmask = 24
route_to_transit_gateway = ["10.0.0.0/8"]
}
transit_gateway = {
netmask = 28
connect_to_public_natgw = true
transit_gateway_default_route_table_association = true
transit_gateway_default_route_table_propagation = true
transit_gateway_appliance_mode_support = "enable"
transit_gateway_dns_support = "disable"
tags = {
subnet_type = "tgw"
}
}
```

Expand Down Expand Up @@ -167,12 +184,6 @@ Terraform Plan:
...
```

## IPAM Users

If you're building VPCs using AWS IP Address Manager, this module can help you with building 1 VPC at a time from the same IPAM Pool. It is **not possible** to iterate over this module regarding IPAM VPCs. The technical reason due to the fact that we must [preview a cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_preview_next_cidr) before making the VPC in order to calculate the subnet prefixes. You can only preview 1 CIDR at a time since subsequent calls will yield the same CIDR until a VPC allocates it from IPAM.

You can use this module to build multiple IPAM VPCs but they must be created in manual sequence (`-target`).

# Common Errors and their Fixes

## Resource Not Found
Expand Down
30 changes: 21 additions & 9 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,12 @@ module "vpc" {
There are 2 reserved keys for subnet key names in var.subnets corresponding to types "public" and "transit\_gateway". Other custom subnet key names are valid are and those subnets will be private subnets.

```terraform
transit_gateway_id = <>
transit_gateway_routes = {
public = "pl-123"
vpce = "10.0.0.0/8"
}
subnets = {
public = {
name_prefix = "my-public" # omit to prefix with "public"
Expand All @@ -65,8 +71,19 @@ subnets = {
# omitting name_prefix defaults value to "privatetwo"
# name_prefix = "private"
netmask = 24
route_to_transit_gateway = ["10.0.0.0/8"]
}
transit_gateway = {
netmask = 28
connect_to_public_natgw = true
transit_gateway_default_route_table_association = true
transit_gateway_default_route_table_propagation = true
transit_gateway_appliance_mode_support = "enable"
transit_gateway_dns_support = "disable"
tags = {
subnet_type = "tgw"
}
}
```

Expand Down Expand Up @@ -168,12 +185,6 @@ Terraform Plan:
...
```

## IPAM Users

If you're building VPCs using AWS IP Address Manager, this module can help you with building 1 VPC at a time from the same IPAM Pool. It is **not possible** to iterate over this module regarding IPAM VPCs. The technical reason due to the fact that we must [preview a cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_preview_next_cidr) before making the VPC in order to calculate the subnet prefixes. You can only preview 1 CIDR at a time since subsequent calls will yield the same CIDR until a VPC allocates it from IPAM.

You can use this module to build multiple IPAM VPCs but they must be created in manual sequence (`-target`).

# Common Errors and their Fixes

## Resource Not Found
Expand Down Expand Up @@ -243,7 +254,6 @@ Please see our [developer documentation](https://github.com/aws-ia/terraform-aws
| [aws_subnet.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
| [aws_subnet.tgw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
| [aws_vpc.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc) | resource |
| [aws_vpc_ipam_preview_next_cidr.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_preview_next_cidr) | resource |
| [aws_vpc_ipv4_cidr_block_association.secondary](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipv4_cidr_block_association) | resource |
| [awscc_ec2_route_table.private](https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/ec2_route_table) | resource |
| [awscc_ec2_route_table.public](https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/ec2_route_table) | resource |
Expand All @@ -260,9 +270,11 @@ Please see our [developer documentation](https://github.com/aws-ia/terraform-aws
|------|-------------|------|---------|:--------:|
| <a name="input_az_count"></a> [az\_count](#input\_az\_count) | Searches region for # of AZs to use and takes a slice based on count. Assume slice is sorted a-z. | `number` | n/a | yes |
| <a name="input_name"></a> [name](#input\_name) | Name to give VPC. Note: does not effect subnet names, which get assigned name based on name\_prefix. | `string` | n/a | yes |
| <a name="input_subnets"></a> [subnets](#input\_subnets) | Configuration of subnets to build in VPC. 1 Subnet per AZ is created. Subnet types are defined as maps with the available keys: "private", "public", "transit\_gateway". Each Subnet type offers its own set of available arguments detailed below.<br><br>**Attributes shared across subnet types:**<br>- `cidrs` = (Optional\|list(string)) **Cannot set if `netmask` is set.** List of CIDRs to set to subnets. Count of CIDRs defined must match quatity of azs in `az_count`.<br>- `netmask` = (Optional\|Int) Netmask of the `var.cidr_block` to calculate for each subnet. **Cannot set if `cidrs` is set.**<br>- `name_prefix` = (Optional\|String) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted (aka private, public, transit\_gateway). Example `name_prefix = "private"` for `var.subnets.private` is redundant.<br>- `tags` = (Optional\|map(string)) Tags to set on the subnet and associated resources.<br><br>**Any private subnet type options:**<br>- All shared keys above<br>- `connect_to_public_natgw` = (Optional\|string) Determines if routes to NAT Gateways should be created. Specify the CIDR range or a prefix-list-id that you want routed to nat gateway. Usually `0.0.0.0/0`. Must also set `var.subnets.public.nat_gateway_configuration`.<br>- `route_to_transit_gateway` = (Optional\|string) Optionally create routes from private subnets to transit gateway subnets. Specify the CIDR range or a prefix-list-id that you want routed to the transit gateway.<br><br>**public subnet type options:**<br>- All shared keys above<br>- `nat_gateway_configuration` = (Optional\|string) Determines if NAT Gateways should be created and in how many AZs. Valid values = `"none"`, `"single_az"`, `"all_azs"`. Default = "none". Must also set `var.subnets.private.connect_to_public_natgw = true`.<br>- `route_to_transit_gateway` = (Optional\|string) Optionally create routes from public subnets to transit gateway subnets. Specify the CIDR range or a prefix-list-id that you want routed to the transit gateway.<br><br>**transit\_gateway subnet type options:**<br>- All shared keys above<br>- `connect_to_public_natgw` = (Optional\|string) Determines if routes to NAT Gateways should be created. Specify the CIDR range or a prefix-list-id that you want routed to nat gateway. Usually `0.0.0.0/0`. Must also set `var.subnets.public.nat_gateway_configuration`.<br>- `transit_gateway_id` = (Required\|string) Transit gateway to attach VPC to.<br>- `transit_gateway_default_route_table_association` = (Optional\|bool) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways.<br>- `transit_gateway_default_route_table_propagation` = (Optional\|bool) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways.<br>- `transit_gateway_appliance_mode_support` = (Optional\|string) Whether Appliance Mode is enabled. If enabled, a traffic flow between a source and a destination uses the same Availability Zone for the VPC attachment for the lifetime of that flow. Valid values: `disable` (default) and `enable`.<br>- `transit_gateway_dns_support` = (Optional\|string) DNS Support is used if you need the VPC to resolve public IPv4 DNS host names to private IPv4 addresses when queried from instances in another VPC attached to the transit gateway. Valid values: `enable` (default) and `disable`.<br><br>Example:<pre>subnets = {<br> public = {<br> netmask = 24<br> nat_gateway_configuration = "single_az"<br> route_to_transit_gateway = "10.1.0.0/16"<br> }<br><br> private = {<br> netmask = 24<br> connect_to_public_natgw = true<br> route_to_transit_gateway = "10.1.0.0/16"<br> }<br><br> transit_gateway = {<br> netmask = 24<br> transit_gateway_id = aws_ec2_transit_gateway.example.id<br> connect_to_public_natgw = true<br> transit_gateway_default_route_table_association = true<br> transit_gateway_default_route_table_propagation = true<br> }<br>}</pre> | `any` | n/a | yes |
| <a name="input_subnets"></a> [subnets](#input\_subnets) | Configuration of subnets to build in VPC. 1 Subnet per AZ is created. Subnet types are defined as maps with the available keys: "private", "public", "transit\_gateway". Each Subnet type offers its own set of available arguments detailed below.<br><br>**Attributes shared across subnet types:**<br>- `cidrs` = (Optional\|list(string)) **Cannot set if `netmask` is set.** List of CIDRs to set to subnets. Count of CIDRs defined must match quatity of azs in `az_count`.<br>- `netmask` = (Optional\|Int) Netmask of the `var.cidr_block` to calculate for each subnet. **Cannot set if `cidrs` is set.**<br>- `name_prefix` = (Optional\|String) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted (aka private, public, transit\_gateway). Example `name_prefix = "private"` for `var.subnets.private` is redundant.<br>- `tags` = (Optional\|map(string)) Tags to set on the subnet and associated resources.<br><br>**Any private subnet type options:**<br>- All shared keys above<br>- `connect_to_public_natgw` = (Optional\|string) Determines if routes to NAT Gateways should be created. Specify the CIDR range or a prefix-list-id that you want routed to nat gateway. Usually `0.0.0.0/0`. Must also set `var.subnets.public.nat_gateway_configuration`.<br><br>**public subnet type options:**<br>- All shared keys above<br>- `nat_gateway_configuration` = (Optional\|string) Determines if NAT Gateways should be created and in how many AZs. Valid values = `"none"`, `"single_az"`, `"all_azs"`. Default = "none". Must also set `var.subnets.private.connect_to_public_natgw = true`.<br><br>**transit\_gateway subnet type options:**<br>- All shared keys above<br>- `connect_to_public_natgw` = (Optional\|string) Determines if routes to NAT Gateways should be created. Specify the CIDR range or a prefix-list-id that you want routed to nat gateway. Usually `0.0.0.0/0`. Must also set `var.subnets.public.nat_gateway_configuration`.<br>- `transit_gateway_default_route_table_association` = (Optional\|bool) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways.<br>- `transit_gateway_default_route_table_propagation` = (Optional\|bool) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways.<br>- `transit_gateway_appliance_mode_support` = (Optional\|string) Whether Appliance Mode is enabled. If enabled, a traffic flow between a source and a destination uses the same Availability Zone for the VPC attachment for the lifetime of that flow. Valid values: `disable` (default) and `enable`.<br>- `transit_gateway_dns_support` = (Optional\|string) DNS Support is used if you need the VPC to resolve public IPv4 DNS host names to private IPv4 addresses when queried from instances in another VPC attached to the transit gateway. Valid values: `enable` (default) and `disable`.<br><br>Example:<pre>subnets = {<br> public = {<br> netmask = 24<br> nat_gateway_configuration = "single_az"<br> }<br><br> private = {<br> netmask = 24<br> connect_to_public_natgw = true<br> }<br><br> transit_gateway = {<br> netmask = 24<br> connect_to_public_natgw = true<br> transit_gateway_default_route_table_association = true<br> transit_gateway_default_route_table_propagation = true<br> }<br>}</pre> | `any` | n/a | yes |
| <a name="input_cidr_block"></a> [cidr\_block](#input\_cidr\_block) | CIDR range to assign to VPC if creating VPC or to associte as a secondary CIDR. Overridden by var.vpc\_id output from data.aws\_vpc. | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to apply to all resources. | `map(string)` | `{}` | no |
| <a name="input_transit_gateway_id"></a> [transit\_gateway\_id](#input\_transit\_gateway\_id) | Transit gateway id to attach the VPC to. Required when `transit_gateway` subnet is defined. | `string` | `null` | no |
| <a name="input_transit_gateway_routes"></a> [transit\_gateway\_routes](#input\_transit\_gateway\_routes) | Configuration of route(s) to transit gateway.<br>For each `public` and/or `private` subnets named in the `subnets` variable,<br>Optionally create routes from the subnet to transit gateway. Specify the CIDR range or a prefix-list-id that you want routed to the transit gateway.<br>Example:<pre>transit_gateway_routes = {<br> public = "10.0.0.0/8"<br> private = "pl-123"<br>}</pre> | `any` | `{}` | no |
| <a name="input_vpc_enable_dns_hostnames"></a> [vpc\_enable\_dns\_hostnames](#input\_vpc\_enable\_dns\_hostnames) | Indicates whether the instances launched in the VPC get DNS hostnames. If enabled, instances in the VPC get DNS hostnames; otherwise, they do not. Disabled by default for nondefault VPCs. | `bool` | `true` | no |
| <a name="input_vpc_enable_dns_support"></a> [vpc\_enable\_dns\_support](#input\_vpc\_enable\_dns\_support) | Indicates whether the DNS resolution is supported for the VPC. If enabled, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC network range "plus two" succeed. If disabled, the Amazon provided DNS service in the VPC that resolves public DNS hostnames to IP addresses is not enabled. Enabled by default. | `bool` | `true` | no |
| <a name="input_vpc_flow_logs"></a> [vpc\_flow\_logs](#input\_vpc\_flow\_logs) | Whether or not to create VPC flow logs and which type. Options: "cloudwatch", "s3", "none". By default creates flow logs to `cloudwatch`. Variable overrides null value types for some keys, defined in defaults.tf. | <pre>object({<br> log_destination = optional(string)<br> iam_role_arn = optional(string)<br> kms_key_id = optional(string)<br><br> log_destination_type = string<br> retention_in_days = optional(number)<br> tags = optional(map(string))<br> traffic_type = optional(string)<br> destination_options = optional(object({<br> file_format = optional(string)<br> hive_compatible_partitions = optional(bool)<br> per_hour_partition = optional(bool)<br> }))<br> })</pre> | <pre>{<br> "log_destination_type": "none"<br>}</pre> | no |
Expand Down
Loading

0 comments on commit dfa6ee1

Please sign in to comment.