-
-
Notifications
You must be signed in to change notification settings - Fork 1
/
variables.tf
319 lines (282 loc) · 17.5 KB
/
variables.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
variable "name" {
description = "(Required) The name of the service. The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen. This name will become part of the service DNS and can't be changed after the VPC Lattice service is created."
type = string
nullable = false
# INFO: Not support negative lookahead
# validation {
# condition = regex("^(?!svc-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+$", var.name)
# error_message = "The name must satisfy regular expression pattern: `^(?!svc-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+$`."
# }
}
variable "description" {
description = "(Optional) The description of the service. This creates a tag with a key of `Description` and a value that you specify."
type = string
default = "Managed by Terraform."
nullable = false
}
variable "policy" {
description = <<EOF
(Optional) A resource-based permission policy for the service. The policy must contain the same actions and condition statements as the Amazon Web Services Resource Access Manager permission for sharing services and service networks.
EOF
type = string
default = null
nullable = true
validation {
condition = var.policy == null || can(jsondecode(var.policy))
error_message = "The policy string in JSON must not contain newlines or blank lines."
}
}
variable "auth_type" {
description = <<EOF
(Optional) The type of authentication and authorization that manages client access to the service. Valid values are `AWS_IAM` or `NONE`. Defaults to `NONE`.
`NONE` - Authentication and authorization is turned off at the service level. Access to this service remains subject to the service network policy, if present. If a policy is not present, all traffic from VPCs associated to the service network is allowed.
`AWS_IAM` - Applies an AWS IAM resource policy on the service giving service owners the ability to enforce authentication and write fine grained permissions. This policy is evaluated in addition to any policy present at the service network.
EOF
type = string
default = "NONE"
nullable = false
validation {
condition = contains(["AWS_IAM", "NONE"], var.auth_type)
error_message = "Valid values for `auth_type` are `AWS_IAM` or `NONE`."
}
}
variable "auth_policy" {
description = <<EOF
(Optional) The auth policy. Authorization decisions are made based on the service network policy, this policy, and IAM permissions attached to the client identity (if referencing IAM identities in this policy). The policy string in JSON must not contain newlines or blank lines.
EOF
type = string
default = null
nullable = true
validation {
condition = var.auth_policy == null || can(jsondecode(var.auth_policy))
error_message = "The policy string in JSON must not contain newlines or blank lines."
}
}
variable "custom_domain" {
description = <<EOF
(Optional) The configuration for a custom domain name to use in addition to the domain name that is generated by VPC Lattice. For HTTPS requests, you must also specify an SSL/TLS certificate that matches the custom domain name. If you specify a custom domain name, you must configure DNS routing after your service is created. This is to map DNS queries for the custom domain name to the VPC Lattice endpoint. If you’re using Route 53 as your DNS service, you can configure a CNAME record within the hosted zone that you own. `custom_domain` as defined below.
(Required) `name` - The name of the custom domain. The custom domain name will be used in addition to the domain name that VPC Lattice generates for the service. You can't change the custom domain name after the service is created. For a custom domain name change, you would need to create a new service.
(Optional) `tls_certificate` - The ARN (Amazon Resource Name) of the SSL/TLS certificate. The certificate will be required to process HTTPS requests for the custom domain name.
EOF
type = object({
name = string
tls_certificate = optional(string)
})
default = null
nullable = true
}
variable "service_network_associations" {
description = <<EOF
(Optional) The configuration for the service network associations with the service. To facilitate network client access to your service, you will need to associate your service to the relevant service networks. Only service networks created in the same account, or that have been shared with you (by way of Resource Access Manager), are available for you to create associations with. Each block of `service_network_associations` as defined below.
(Required) `name` - The name of the service association.
(Required) `service_network` - The ID or ARN (Amazon Resource Name) of the service network.
(Optional) `tags` - A map of tags to add to the service association.
EOF
type = list(object({
name = string
service_network = string
tags = optional(map(string), {})
}))
default = []
nullable = false
}
variable "listeners" {
description = <<EOF
(Optional) The configuration to add one or more listeners for the service. Set up listeners and rules to define how network traffic is routed within the service. A listener is a process that checks for connection requests, using the protocol and port that you configure. Each listener has a default action, and you can optionally define rules to enable content-based routing to the target groups that make up your service. Each block of `listeners` as defined below.
(Required) `name` - The name of the service listener. The name must be unique within the service. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
(Optional) `port` - The number of port on which the listener of the service is listening. Valid values are from `1` to `65535`. If `port` is not specified and `protocol` is `HTTP`, the value will default to `80`. If `port` is not specified and `protocol` is `HTTPS`, the value will default to `443`.
(Required) `protocol` - The protocol for the service listener. Valid values are `HTTP` and `HTTPS`.
(Required) `default_action_type` - The type of default routing action. Default action apply to traffic that does not meet the conditions of rules on your listener. Rules can be configured after the listener is created. Valid values are `FORWARD`, `FIXED_RESPONSE`.
(Optional) `default_action_parameters` - The configuration for the parameters of the default routing action. `default_action_parameters` block as defined below.
(Optional) `status_code` - Custom HTTP status code to drop client requests and return a custom HTTP response. Valid values are `404`. Only supported if `default_action_type` is `FIXED_RESPONSE`.
(Optional) `destinations` - A list of one or more target groups to route traffic. Only supported if `default_action_type` is `FORWARD`. Each item of `destinations` block as defined below.
(Required) `target_group` - The ID or ARN of the target group to which to route traffic.
(Optional) `weight` - The weight to use routing traffic to `target_group`. how requests are distributed to the target group. Only required if you specify multiple target groups for a forward action. For example, if you specify two target groups, one with a weight of 10 and the other with a weight of 20, the target group with a weight of 20 receives twice as many requests as the other target group. Valid value is `0` to `999`. Defaults to `100`.
(Optional) `rules` - A list of rules to enable content-based routing to the target groups that make up the service. Each rule consists of a priority, one or more actions, and one or more conditions. Each block of `rules` block as defined below.
(Required) `priority` - The priority assigned to the rule. Each rule for a specific listener must have a unique priority. The lower the priority number the higher the priority.
(Optional) `name` - A rule name can describe the purpose of the rule or the type of traffic it is intended to handle. Rule names can't be changed after creation. Defaults to `$(service)-$(priority)`.
(Required) `conditions` - The rule conditions. `conditions` block as defined below.
(Optional) `method` - The condition of HTTP request method. Valid values are `GET`, `HEAD`, `POST`, `PUT`, `DELETE`, `CONNECT`, `OPTIONS`, `TRACE`, `PATCH`.
(Required) `path` - The condition of HTTP request path. `path` block as defined below.
(Required) `value` - The path pattern. The pattern must start with `/`.
(Optional) `operator` - The operator that you want to use to determine whether an HTTP request path matches the conditions. Valid values are `EXACT`, `PREFIX`. Defaults to `PREFIX`.
(Optional) `case_sensitive` - Whether to match the `value` condition using a case-sensitive match. Defaults to `false`.
(Optional) `headers` - The condition of HTTP request headers. Each block of `headers` as defined below.
(Required) `name` - The name of the HTTP header field.
(Required) `value` - The value of the HTTP header field.
(Optional) `operator` - The operator that you want to use to determine whether an HTTP header matches the conditions. Valid values are `EXACT`, `PREFIX`, `CONTAINS`. Defaults to `EXACT`.
(Optional) `case_sensitive` - Whether to match the `value` condition using a case-sensitive match. Defaults to `false`.
(Required) `action_type` - The action type for the rule of the service. Valid values are `FORWARD`, `FIXED_RESPONSE`.
(Optional) `action_parameters` - The configuration for the parameters of the routing action. `action_parameters` block as defined below.
(Optional) `status_code` - Custom HTTP status code to drop client requests and return a custom HTTP response. Valid values are `404`. Only supported if `action_type` is `FIXED_RESPONSE`.
(Optional) `destinations` - A list of one or more target groups to route traffic. Only supported if `action_type` is `FORWARD`. Each item of `destinations` block as defined below.
(Required) `target_group` - The ID or ARN of the target group to which to route traffic.
(Optional) `weight` - The weight to use routing traffic to `target_group`. how requests are distributed to the target group. Only required if you specify multiple target groups for a forward action. For example, if you specify two target groups, one with a weight of 10 and the other with a weight of 20, the target group with a weight of 20 receives twice as many requests as the other target group. Valid value is `0` to `999`. Defaults to `100`.
(Optional) `tags` - A map of tags to add to the service listeners.
EOF
type = list(object({
name = string
port = optional(number)
protocol = string
default_action_type = string
default_action_parameters = optional(object({
status_code = optional(number, 404)
destinations = optional(list(object({
target_group = string
weight = optional(number, 100)
})), [])
}), {})
rules = optional(list(object({
priority = number
name = optional(string)
conditions = object({
method = optional(string)
path = object({
value = string
operator = optional(string, "PREFIX")
case_sensitive = optional(bool, false)
})
headers = optional(list(object({
name = string
value = string
operator = optional(string, "EXACT")
case_sensitive = optional(bool, false)
})), [])
})
action_type = string
action_parameters = optional(object({
status_code = optional(number, 404)
destinations = optional(list(object({
target_group = string
weight = optional(number, 100)
})), [])
}), {})
})), [])
tags = optional(map(string), {})
}))
default = []
nullable = false
validation {
condition = length(var.listeners) <= 2
error_message = "Valid values for `auth_type` are `AWS_IAM` or `NONE`."
}
}
variable "logging_to_cloudwatch" {
description = <<EOF
(Optional) The configuration to enable access logs to be sent to Amazon CloudWatch Log Group. The service owner can use the access logs to audit the services in the network. The service owner will only see access logs from clients and services that are associated with their service. Access log entries represent traffic originated from VPCs associated with that network. `logging_to_cloudwatch` as defined below.
(Optional) `enabled` - Whether to enable access logs to be sent to Amazon CloudWatch Log Group.
(Optional) `log_group` - The ARN (Amazon Resource Name) of the CloudWatch Log Group.
EOF
type = object({
enabled = optional(bool, false)
log_group = optional(string, "")
})
default = {}
nullable = false
validation {
condition = anytrue([
var.logging_to_cloudwatch.enabled == false,
var.logging_to_cloudwatch.enabled && startswith(var.logging_to_cloudwatch.log_group, "arn:aws:logs:"),
])
error_message = "Valid value for `log_group` must be the ARN (Amazon Resource Name) of the CloudWatch Log Group."
}
}
variable "logging_to_kinesis_data_firehose" {
description = <<EOF
(Optional) The configuration to enable access logs to be sent to Amazon Kinesis Data Firehose. The service owner can use the access logs to audit the services in the network. The service owner will only see access logs from clients and services that are associated with their service. Access log entries represent traffic originated from VPCs associated with that network. `logging_to_kinesis_data_firehose` as defined below.
(Optional) `enabled` - Whether to enable access logs to be sent to Amazon Kinesis Data
Firehose.
(Optional) `delivery_stream` - The ARN (Amazon Resource Name) of the Kinesis Data Firehose
delivery stream.
EOF
type = object({
enabled = optional(bool, false)
delivery_stream = optional(string, "")
})
default = {}
nullable = false
validation {
condition = anytrue([
var.logging_to_kinesis_data_firehose.enabled == false,
var.logging_to_kinesis_data_firehose.enabled && startswith(var.logging_to_kinesis_data_firehose.delivery_stream, "arn:aws:firehose:"),
])
error_message = "Valid value for `delivery_stream` must be the ARN (Amazon Resource Name) of the Kinesis Data Firehose Delivery Stream."
}
}
variable "logging_to_s3" {
description = <<EOF
(Optional) The configuration to enable access logs to be sent to Amazon S3 Bucket. The service owner can use the access logs to audit the services in the network. The service owner will only see access logs from clients and services that are associated with their service. Access log entries represent traffic originated from VPCs associated with that network. `logging_to_s3` as defined below.
(Optional) `enabled` - Whether to enable access logs to be sent to Amazon S3 Bucket.
(Optional) `bucket` - The ARN (Amazon Resource Name) of the S3 Bucket.
EOF
type = object({
enabled = optional(bool, false)
bucket = optional(string, "")
})
default = {}
nullable = false
validation {
condition = anytrue([
var.logging_to_s3.enabled == false,
var.logging_to_s3.enabled && startswith(var.logging_to_s3.bucket, "arn:aws:s3:"),
])
error_message = "Valid value for `bucket` must be the ARN (Amazon Resource Name) of the S3 Bucket."
}
}
variable "timeouts" {
description = "(Optional) How long to wait for the service to be created/deleted."
type = object({
create = optional(string, "5m")
delete = optional(string, "5m")
})
default = {}
nullable = false
}
variable "tags" {
description = "(Optional) A map of tags to add to all resources."
type = map(string)
default = {}
nullable = false
}
variable "module_tags_enabled" {
description = "(Optional) Whether to create AWS Resource Tags for the module informations."
type = bool
default = true
nullable = false
}
###################################################
# Resource Group
###################################################
variable "resource_group_enabled" {
description = "(Optional) Whether to create Resource Group to find and group AWS resources which are created by this module."
type = bool
default = true
nullable = false
}
variable "resource_group_name" {
description = "(Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`."
type = string
default = ""
nullable = false
}
variable "resource_group_description" {
description = "(Optional) The description of Resource Group."
type = string
default = "Managed by Terraform."
nullable = false
}
###################################################
# Resource Sharing by RAM (Resource Access Manager)
###################################################
variable "shares" {
description = "(Optional) A list of resource shares via RAM (Resource Access Manager)."
type = list(object({
name = optional(string)
permissions = optional(set(string), ["AWSRAMPermissionVpcLatticeServiceReadWrite"])
external_principals_allowed = optional(bool, false)
principals = optional(set(string), [])
tags = optional(map(string), {})
}))
default = []
nullable = false
}