xpk/terraform.examples
SHA256
1
0
Fork 0
Code Pull Requests Activity

initial commit

Browse Source
This commit is contained in:
xpk
2026-02-13 15:44:24 +08:00
parent 66be8224f4
commit 09ce4c881a
570 changed files with 61807 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/networking/VpcSubnet/main.tf
+203
View File
@@ -0,0 +1,203 @@
data "aws_caller_identity" "this" {}
data "aws_availability_zones" "available-az" {
state = "available"
}
data "aws_default_tags" "this" {
lifecycle {
postcondition {
condition = length(self.tags) >= 1
error_message = "Validation failed: Provider default_tags not set."
}
}
}
locals {
# no-az = 2 # hard-coding to 2AZ
vpc-cidr = var.vpc-cidr
}
resource "aws_subnet" "private-subnets" {
count = length(var.private-subnet-cidrs)
vpc_id = aws_vpc.vpc.id
availability_zone = element(data.aws_availability_zones.available-az.names, count.index % 2)
cidr_block = var.private-subnet-cidrs[count.index]
tags = merge(data.aws_default_tags.this.tags, {
Name = "${var.resource-prefix}-private-${split("-", element(data.aws_availability_zones.available-az.names, count.index))[2]}-${count.index + 1}"
})
}
resource "aws_subnet" "public-subnets" {
count = length(var.public-subnet-cidrs)
vpc_id = aws_vpc.vpc.id
availability_zone = element(data.aws_availability_zones.available-az.names, count.index % 2)
cidr_block = var.public-subnet-cidrs[count.index]
tags = merge(data.aws_default_tags.this.tags, {
Name = "${var.resource-prefix}-public-${split("-", element(data.aws_availability_zones.available-az.names, count.index))[2]}-${count.index + 1}"
})
}
resource "aws_vpc" "vpc" {
cidr_block = var.vpc-cidr
enable_dns_hostnames = true
enable_dns_support = true
tags = {
Name = "${var.resource-prefix}-vpc"
}
lifecycle {
create_before_destroy = true
}
}
resource "aws_vpc_ipv4_cidr_block_association" "additional_cidr" {
for_each = toset(var.secondary_cidr_blocks)
vpc_id = aws_vpc.vpc.id
cidr_block = each.value
}
resource "aws_internet_gateway" "igw" {
count = length(var.public-subnet-cidrs) > 0 ? 1 : 0
vpc_id = aws_vpc.vpc.id
tags = {
Name = "${var.resource-prefix}-igw"
}
}
resource "aws_eip" "ngw-eip" {
count = var.create-nat-gateway ? 1 : 0
domain = "vpc"
depends_on = [aws_internet_gateway.igw]
}
resource "aws_nat_gateway" "ngw" {
count = var.create-nat-gateway && !var.multiaz-nat-gateway ? 1 : 0
allocation_id = aws_eip.ngw-eip[0].id
subnet_id = aws_subnet.public-subnets[0].id
tags = {
Name = "${var.resource-prefix}-ngw"
}
depends_on = [aws_internet_gateway.igw]
}
resource "aws_eip" "ngw-eip-multiaz" {
count = var.multiaz-nat-gateway ? length(distinct(aws_subnet.private-subnets.*.availability_zone)) : 0
domain = "vpc"
depends_on = [aws_internet_gateway.igw]
}
resource "aws_nat_gateway" "ngw-multiaz" {
count = var.multiaz-nat-gateway ? length(aws_eip.ngw-eip-multiaz) : 0
allocation_id = aws_eip.ngw-eip-multiaz[count.index].id
subnet_id = aws_subnet.public-subnets[count.index].id
tags = {
Name = "${var.resource-prefix}-ngw-${count.index + 1}"
}
depends_on = [aws_internet_gateway.igw]
}
resource "aws_route_table" "public-route-table" {
count = length(var.public-subnet-cidrs) > 0 ? 1 : 0
vpc_id = aws_vpc.vpc.id
tags = {
Name = "${var.resource-prefix}-public"
}
}
module "private-route" {
source = "./modules/RouteTables"
count = var.create-nat-gateway && !var.multiaz-nat-gateway ? length(aws_subnet.private-subnets) : 0
ngw-id = aws_nat_gateway.ngw[0].id
resource-prefix = var.resource-prefix
subnet-id = aws_subnet.private-subnets[count.index].id
vpc-id = aws_vpc.vpc.id
}
module "private-route-multiaz" {
source = "./modules/RouteTables"
count = var.multiaz-nat-gateway ? length(aws_subnet.private-subnets) : 0
ngw-id = aws_nat_gateway.ngw-multiaz[count.index].id
resource-prefix = var.resource-prefix
subnet-id = aws_subnet.private-subnets[count.index].id
vpc-id = aws_vpc.vpc.id
}
# resource "aws_route_table" "private-route-table" {
# count = length(var.private-subnet-cidrs) > 0 ? 1 : 0
# vpc_id = aws_vpc.vpc.id
# tags = {
# Name = "${var.resource-prefix}-privateroutetable"
# }
# }
resource "aws_route" "public-routes" {
count = length(var.public-subnet-cidrs) > 0 ? 1 : 0
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw[0].id
route_table_id = aws_route_table.public-route-table[0].id
}
# resource "aws_route" "private-routes" {
# count = length(var.private-subnet-cidrs) > 0 && var.create-nat-gateway ? 1 : 0
#
# destination_cidr_block = "0.0.0.0/0"
# nat_gateway_id = aws_nat_gateway.ngw[0].id
# route_table_id = aws_route_table.private-route-table[0].id
# }
resource "aws_route_table_association" "public_route_association" {
count = length(aws_subnet.public-subnets)
route_table_id = aws_route_table.public-route-table[0].id
subnet_id = aws_subnet.public-subnets[count.index].id
}
# resource "aws_route_table_association" "private_route_association" {
# count = length(aws_subnet.private-subnets)
# route_table_id = aws_route_table.private-route-table[0].id
# subnet_id = aws_subnet.private-subnets[count.index].id
# }
/*
harden default security group. the default sg created by aws allows all egress.
this resource limits ingress and egress from and to itself
and allow icmp only
*/
resource "aws_default_security_group" "default-sg" {
vpc_id = aws_vpc.vpc.id
ingress {
protocol = "icmp"
self = true
from_port = -1
to_port = -1
description = "Allow traffic coming from this SG"
}
egress {
from_port = -1
protocol = "icmp"
to_port = -1
self = true
description = "Allow traffic going to this SG"
}
tags = {
Name = "${var.resource-prefix}-defaultsg"
}
}
# Enable gateway endpoints which are free
module "vpc-ep" {
count = var.create-free-vpc-endpoints ? 1 : 0
source = "../vpc-endpoints"
gateway-ep-services = ["s3", "dynamodb"]
interface-ep-services = []
resource-prefix = var.resource-prefix
vpc-id = aws_vpc.vpc.id
}