Terraform AWS VPC Stack

Terraform module for deployment and management of an AWS Virtual Private Cloud (VPC) and related resources.

This module is well suited to both basic and advanced use cases with very few required inputs, but the ability to configure just about every feature available.

Requirements

• Terraform 0.11.0 or newer
• AWS provider

Quick Start

The following code will yield a fully functioning VPC environment:

module "vpc_base" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//base"
}

module "az" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//az"

  vpc_id = "${module.vpc_base.vpc_id}"
}

Base Module

The Base module provisions the VPC, Internet Gateway and DMZ routing table. It additionally enables flow log capture over the entire VPC.

Input Variables

Name	Type	Required	Description
enable_classiclink	string	Default: false	Specifies whether ClassicLink is enabled for the VPC.
enable_dns	string	Default: true	Specifies whether DNS resolution is supported for the VPC.
enable_hostnames	string	Default: true	Specifies whether the instances launched in the VPC get DNS hostnames.
flow_log_traffic_type	string	Default: ALL	The type of traffic to capture. Valid values: ACCEPT,REJECT,ALL.
instance_tenancy	string	Default: default	The allowed tenancy of instances launched into the VPC. Other options at this time are dedicated and host. These will both force any instance launched into the VPC to be dedicated, regardless of the tenancy option specified when the instance is launched. See EC2 Dedicated Instance Doc for more information.
stack_item_label	string	Default: qckstrt	Short form identifier for this stack. This value is used to create the "Name" tag for resources created by this stack item, and also serves as a unique key for re-use.
stack_item_fullname	string	Default: VPC Quick Start	Long form descriptive name for this stack item. This value is used to create the "application" tag for resources created by this stack item.
vpc_cidr	string	Default: 172.16.0.0/21	The CIDR block you want the VPC to cover.
vgw_ids	string		A list of virtual gateways to associate with the routing tables for route propagation.

Usage

module "vpc_base" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//base"

  enable_dns          = "true"
  enable_hostnames    = "false"
  stack_item_fullname = "My Stack"
  stack_item_label    = "mystack"
  vpc_cidr            = "172.16.0.0/21"
}

Outputs

Name	Type	Description
flow_log_id	string	ID of the AWS flow log.
igw_id	string	ID of the Internet gateway.
rt_dmz_id	string	ID of the DMZ routing table.
vpc_id	string	ID of the VPC.

DHCP module

The DHCP module provisions a DHCP options resource and associates it with the specified VPC resource.

Input Variables

Name	Type	Required	Description
domain_name	string		The suffix domain name to use by default when resolving non Fully Qualified Domain Names. In other words, this is what ends up being the search value in the /etc/resolv.conf file.
name_servers	list	Default: ["AmazonProvidedDNS"]	List of name servers to configure in /etc/resolv.conf.
netbios_name_servers	list		List of NETBIOS name servers.
netbios_node_type	string		The NetBIOS node type (1, 2, 4, or 8). AWS recommends to specify 2 since broadcast and multicast are not supported in their network. For more information about these node types, see RFC 2132.
ntp_servers	list		List of NTP servers to configure.
stack_item_fullname	string	yes	Long form descriptive name for this stack item. This value is used to create the "application" tag for resources created by this stack item.
stack_item_label	string	yes	Short form identifier for this stack. This value is used to create the "Name" tag for resources created by this stack item, and also serves as a unique key for re-use.
vpc_id	string	yes	ID of the VPC to associate the DHCP Options Set with.

Usage

module "vpc_base" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//base"
}

module "dhcp" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//dhcp"

  domain_name          = "mydomain.com"
  name_servers         = ["172.16.0.2"]
  netbios_name_servers = ["172.16.0.2"]
  netbios_node_type    = 2
  ntp_servers          = ["172.16.0.2"]
  stack_item_fullname  = "My Stack"
  stack_item_label     = "mystack"
  vpc_id               = "${module.vpc_base.vpc_id}"
}

Outputs

Name	Type	Description
dhcp_id	string	ID of the DHCP Options set.

VPG Module

Creates a VPC VPN Gateway

Input Variables

Name	Type	Required	Description
stack_item_fullname	string	yes	Long form descriptive name for this stack item. This value is used to create the "application" tag for resources created by this stack item.
stack_item_label	string	yes	Short form identifier for this stack. This value is used to create the "Name" tag for resources created by this stack item, and also serves as a unique key for re-use.
vpc_attach	string		Specifies whether the VPN gateway should be associated with a VPC.
vpc_id	string		The VPC to associate the VPN gateway with.

Usage

module "vpc_base" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//base"
}

module "vpg" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//vpg"

  stack_item_fullname = "My Stack"
  stack_item_label    = "mystack"
  vpc_attach          = "true"
  vpc_id              = "${module.vpc_base.vpc_id}"
}

Outputs

Name	Type	Description
vpg_id	string	ID of the newly created VPN Gateway.

AZ Module

The AZ module provisions subnets, routing tables and NATing. It has support for both Internet facing and private subnets, static and dynamic routing (VPN propagation) as well as gateway or EC2 based NATing. It will handle basic CIDR calculations for up to 4 availability zones and 2 private subnets per availability zone. All parameters are overidable for more advanced configurations.

Input Variables

Name	Type	Required	Description
azs_provisioned	string	Default: 2	The number of availability zones to be provisioned. Either this or azs_provisioned_override must be specified. Auto-provisioning will support up to 4 AZs without the need for overrides.
azs_provisioned_override	list		List of availability zone letters to be provisioned. Useful in regions where not all AZs are VPC ready. Either this or azs_provisioned must be specified.
dmz_cidrs_override	list		The CIDR block(s) you want the public subnet(s) to cover.
enable_dmz_public_ips	string		Specify true to indicate that instances launched into the DMZ subnet should be assigned a public IP address.
lan_cidrs_override	list		The CIDR block(s) you want the LAN subnet(s) to cover.
lans_per_az	string	Default: 1	The number of private subnets to be provisioned per AZ. Auto-provisioning will support up to 2 private subnets per AZ without the need for overrides.
nat_ami_override	string		Custom NAT Amazon Machine Image (AMI).
nat_eips_enabled	string	Default: false	Flag for specifying allocation of Elastic IPs to NATs for the purposes of whitelisting. This value is overriden to true when utilizing NAT gateways.
nat_gateways_enabled	string	Default: false	Flag for specifying utilization of managed NAT gateways over EC2 based NAT instances.
nat_instance_type	string	Default: t2.nano	NAT EC2 instance type.
nat_key_name	string		Name of the EC2 key pair to install on EC2 based NAT instances.
rt_dmz_id	string	yes	The ID of the DMZ routing table.
stack_item_fullname	string	Default: VPC Quick Start	Long form descriptive name for this stack item. This value is used to create the "application" tag for resources created by this stack item.
stack_item_label	string	Default: qckstrt	Short form identifier for this stack. This value is used to create the "Name" tag for resources created by this stack item, and also serves as a unique key for re-use.
vgw_ids	list		A list of virtual gateways to associate with the routing tables for route propagation.
vpc_id	string	yes	ID of the VPC.

Usage

module "vpc_base" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//base"
}

module "az" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//az"

  azs_provisioned       = 2
  enable_dmz_public_ips = "true"
  rt_dmz_id             = "${module.vpc_base.rt_dmz_id}"
  stack_item_fullname   = "My Stack"
  stack_item_label      = "mystck"
  vgw_ids               = "${aws_vpn_gateway.vpg.id}"
  vpc_id                = "${module.vpc_base.vpc_id}"
}

Outputs

** The order and association of the IDs match the order of the availability zones passed to the module.

Name	Type	Description
dmz_ids	list	List of subnet IDs of the DMZ subnetworks.
lan_ids	list	List of subnet IDs of the LAN subnetworks.
dmz_cidrs	list	List of subnet CIDR blocks of the DMZ subnetworks.
lan_cidrs	list	List of subnet CIDR blocks of the LAN subnetworks.
eip_nat_ids	list	List of Elastic IP IDs for each of the NAT gateways.
nat_ids	list	List of NAT gateways IDs.
eip_nat_ips	list	List of NAT gateway public IPs.
rt_lan_ids	list	List of routing table IDs for the LAN subnets.

Peer Module

Creates a VPC peering connection

Input Variables

Name	Type	Required	Description
accepter_allow_classic_link_to_remote	string		Allow a local linked EC2-Classic instance to communicate with instances in a peer VPC. This enables an outbound communication from the local ClassicLink connection to the remote VPC.
accepter_allow_remote_dns	string	Default: false	Allow accepter VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the requester VPC.
accepter_allow_to_remote_classic_link	string		Allow a local VPC to communicate with a linked EC2-Classic instance in a peer VPC. This enables an outbound communication from the local VPC to the remote ClassicLink connection.
accepter_auto_accept	string		Accept the peering (both VPCs need to be in the same AWS account).
accepter_owner_id	string		The AWS account ID of the owner of the peer VPC.
accepter_vpc_id	string		The ID of the VPC with which you are creating the VPC Peering Connection.
requester_allow_classic_link_to_remote	string		Allow a local linked EC2-Classic instance to communicate with instances in a peer VPC. This enables an outbound communication from the local ClassicLink connection to the remote VPC.
requester_allow_remote_dns	string	Default: false	Allow accepter VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the requester VPC.
requester_allow_to_remote_classic_link	string		Allow a local VPC to communicate with a linked EC2-Classic instance in a peer VPC. This enables an outbound communication from the local VPC to the remote ClassicLink connection.
requester_vpc_id	string		The ID of the requester VPC.
stack_item_fullname	string	yes	Long form descriptive name for this stack item. This value is used to create the "application" tag for resources created by this stack item.
stack_item_label	string	yes	Short form identifier for this stack. This value is used to create the "Name" tag for resources created by this stack item, and also serves as a unique key for re-use.

Usage

module "vpc_peer" {
  source = "github.com/unifio/terraform-aws-vpc?ref=master//peer"

  accepter_allow_remote_dns  = "false"
  accepter_owner_id          = "${var.peer_owner_id}"
  accepter_vpc_id            = "${var.peer_vpc_id}"
  requester_allow_remote_dns = "true"
  requester_vpc_id           = "${var.owner_vpc_id}"
  stack_item_fullname        = "${var.stack_item_fullname}"
  stack_item_label           = "${var.stack_item_label}"
}

Outputs

Name	Type	Description
peer_connection_id	string	ID of the newly created peering connection.

Examples

See the examples directory for a complete set of example source files.

License

MPL 2. See LICENSE for full details.