Merge pull request #14 from DNXLabs/s3-endpoint

Add a S3 endpoint to the network stack

Author: jeremiasroma

README.md

@@ -21,6 +21,7 @@ The following resources will be created:
  - Nat Gateway
  - Network Access Control List (NACL) for all subnets
  - Database Subnet group - Provides an RDS DB subnet group resources
+ - S3 VPC endpoint
 
 
 

s3-endpoint.tf

@@ -0,0 +1,29 @@
+resource "aws_vpc_endpoint" "s3" {
+  vpc_id       = aws_vpc.default.id
+  service_name = "com.amazonaws.${data.aws_region.current.name}.s3"
+
+  policy = <<POLICY
+    {
+        "Statement": [
+            {
+                "Action": "*","Effect": "Allow","Resource": "*","Principal": "*"
+            }
+        ]
+    }
+    POLICY
+
+  lifecycle {
+    ignore_changes = [policy]
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      "Name"    = "${var.name}-S3-Endpoint"
+      "EnvName" = var.name
+    },
+  )
+
+  depends_on = [aws_vpc.default]
+
+}

subnet-private.tf

@@ -61,6 +61,12 @@ resource aws_route_table_association "private" {
   }
 }
 
+resource "aws_vpc_endpoint_route_table_association" "private" {
+  count           = length(aws_subnet.private)
+  route_table_id  = var.multi_nat ? aws_route_table.private[count.index].id : aws_route_table.private[0].id
+  vpc_endpoint_id = aws_vpc_endpoint.s3.id
+}
+
 # resource "aws_route_table_association" "private_single" {
 #   count          = var.nat_count == length(data.aws_availability_zones.available.names) ? 0 : 1
 #   subnet_id      = aws_subnet.private.*.id[count.index]

subnet-public.tf

@@ -52,3 +52,8 @@ resource "aws_route_table_association" "public" {
     create_before_destroy = true
   }
 }
+
+resource "aws_vpc_endpoint_route_table_association" "public" {
+  route_table_id  = aws_route_table.public.id
+  vpc_endpoint_id = aws_vpc_endpoint.s3.id
+}

subnet-secure.tf

@@ -44,3 +44,8 @@ resource "aws_route_table_association" "secure" {
     create_before_destroy = true
   }
 }
+
+resource "aws_vpc_endpoint_route_table_association" "secure" {
+  route_table_id  = aws_route_table.secure.id
+  vpc_endpoint_id = aws_vpc_endpoint.s3.id
+}

subnet-transit.tf

@@ -54,3 +54,9 @@ resource "aws_route_table_association" "transit" {
     create_before_destroy = true
   }
 }
+
+resource "aws_vpc_endpoint_route_table_association" "transit" {
+  count           = var.transit_subnet ? 1 : 0
+  route_table_id  = aws_route_table.transit[0].id
+  vpc_endpoint_id = aws_vpc_endpoint.s3.id
+}