-
-
Notifications
You must be signed in to change notification settings - Fork 166
/
private.tf
149 lines (115 loc) · 4.96 KB
/
private.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
module "private_label" {
source = "cloudposse/label/null"
version = "0.25.0"
attributes = [var.private_label]
tags = merge(
var.private_subnets_additional_tags,
var.subnet_type_tag_key != null && var.subnet_type_tag_value_format != null ? { (var.subnet_type_tag_key) = format(var.subnet_type_tag_value_format, var.private_label) } : {}
)
context = module.this.context
}
resource "aws_subnet" "private" {
count = local.private_enabled ? local.subnet_az_count : 0
vpc_id = local.vpc_id
availability_zone = local.subnet_availability_zones[count.index]
cidr_block = local.private4_enabled ? local.ipv4_private_subnet_cidrs[count.index] : null
ipv6_cidr_block = local.private6_enabled ? local.ipv6_private_subnet_cidrs[count.index] : null
ipv6_native = local.private6_enabled && !local.private4_enabled
tags = merge(
module.private_label.tags,
{
"Name" = format("%s%s%s", module.private_label.id, local.delimiter, local.subnet_az_abbreviations[count.index])
}
)
assign_ipv6_address_on_creation = local.private6_enabled ? var.private_assign_ipv6_address_on_creation : null
enable_dns64 = local.private6_enabled ? local.private_dns64_enabled : null
enable_resource_name_dns_a_record_on_launch = local.private4_enabled ? var.ipv4_private_instance_hostnames_enabled : null
enable_resource_name_dns_aaaa_record_on_launch = local.private6_enabled ? var.ipv6_private_instance_hostnames_enabled || !local.private4_enabled : null
private_dns_hostname_type_on_launch = local.private4_enabled ? var.ipv4_private_instance_hostname_type : null
lifecycle {
# Ignore tags added by kops or kubernetes
ignore_changes = [tags.kubernetes, tags.SubnetType]
}
timeouts {
create = var.subnet_create_timeout
delete = var.subnet_delete_timeout
}
}
resource "aws_route_table" "private" {
# Currently private_route_table_count == subnet_az_count,
# but keep parallel to public route table configuration
count = local.private_route_table_count
vpc_id = local.vpc_id
tags = merge(
module.private_label.tags,
{
"Name" = format("%s%s%s", module.private_label.id, local.delimiter, local.subnet_az_abbreviations[count.index])
}
)
}
resource "aws_route" "private6" {
count = local.ipv6_egress_only_configured ? local.private_route_table_count : 0
route_table_id = local.private_route_table_ids[count.index]
destination_ipv6_cidr_block = "::/0"
egress_only_gateway_id = var.ipv6_egress_only_igw_id[0]
timeouts {
create = local.route_create_timeout
delete = local.route_delete_timeout
}
}
resource "aws_route_table_association" "private" {
count = local.private_route_table_enabled ? local.subnet_az_count : 0
subnet_id = aws_subnet.private[count.index].id
# Use element() to "wrap around" and allow for a single table to be associated with all subnets
route_table_id = element(local.private_route_table_ids, count.index)
}
resource "aws_network_acl" "private" {
count = local.private_open_network_acl_enabled ? 1 : 0
vpc_id = local.vpc_id
subnet_ids = aws_subnet.private[*].id
tags = module.private_label.tags
}
resource "aws_network_acl_rule" "private4_ingress" {
count = local.private_open_network_acl_enabled && local.private4_enabled ? 1 : 0
network_acl_id = aws_network_acl.private[0].id
rule_action = "allow"
rule_number = var.open_network_acl_ipv4_rule_number
egress = false
cidr_block = "0.0.0.0/0" #tfsec:ignore:aws-ec2-no-public-ingress-acl
from_port = 0
to_port = 0
protocol = "-1" #tfsec:ignore:aws-ec2-no-excessive-port-access
}
resource "aws_network_acl_rule" "private4_egress" {
count = local.private_open_network_acl_enabled && local.private4_enabled ? 1 : 0
network_acl_id = aws_network_acl.private[0].id
rule_action = "allow"
rule_number = var.open_network_acl_ipv4_rule_number
egress = true
cidr_block = "0.0.0.0/0"
from_port = 0
to_port = 0
protocol = "-1" #tfsec:ignore:aws-ec2-no-excessive-port-access
}
resource "aws_network_acl_rule" "private6_ingress" {
count = local.private_open_network_acl_enabled && local.private6_enabled ? 1 : 0
network_acl_id = aws_network_acl.private[0].id
rule_action = "allow"
rule_number = var.open_network_acl_ipv6_rule_number
egress = false
ipv6_cidr_block = "::/0" #tfsec:ignore:aws-ec2-no-public-ingress-acl
from_port = 0
to_port = 0
protocol = "-1" #tfsec:ignore:aws-ec2-no-excessive-port-access
}
resource "aws_network_acl_rule" "private6_egress" {
count = local.private_open_network_acl_enabled && local.private6_enabled ? 1 : 0
network_acl_id = aws_network_acl.private[0].id
rule_action = "allow"
rule_number = var.open_network_acl_ipv6_rule_number
egress = true
ipv6_cidr_block = "::/0" #tfsec:ignore:aws-ec2-no-excessive-port-access
from_port = 0
to_port = 0
protocol = "-1" #tfsec:ignore:aws-ec2-no-excessive-port-access
}