module "vpc_main" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.19.0"

  name = "test"
  cidr = "172.16.16.0/20"

  azs              = local.azs
  public_subnets   = [for no_of_azs, v in local.azs : cidrsubnet("172.16.16.0/20", 5, no_of_azs)]
  private_subnets  = [for no_of_azs, v in local.azs : cidrsubnet("172.16.16.0/20", 5, no_of_azs + 3)]
  database_subnets = [for no_of_azs, v in local.azs : cidrsubnet("172.16.16.0/20", 5, no_of_azs + 6)]

  enable_nat_gateway                 = true
  enable_vpn_gateway                 = false
  propagate_private_route_tables_vgw = true

  create_database_subnet_group = true

  vpc_block_public_access_options = {
    internet_gateway_block_mode = "block-bidirectional"
  }

  vpc_block_public_access_exclusions = {
    for i, subnet in module.vpc_main.public_subnets :
    "exclude_subnet_public_${i}" => {
      exclude_subnet                  = true
      subnet_index                    = i
      subnet_type                     = "public"
      internet_gateway_exclusion_mode = "allow-bidirectional"
    }
  }

  default_network_acl_ingress = [
    {
      action     = "allow"
      cidr_block = "0.0.0.0/0"
      from_port  = 0
      icmp_code  = 0
      icmp_type  = 0
      protocol   = "-1"
      rule_no    = 100
      to_port    = 0
    },
    {
      action     = "deny"
      cidr_block = "0.0.0.0/0"
      from_port  = 22
      icmp_code  = 0
      icmp_type  = 0
      protocol   = "6"
      rule_no    = 90
      to_port    = 22
    },
    {
      action     = "deny"
      cidr_block = "0.0.0.0/0"
      from_port  = 3389
      icmp_code  = 0
      icmp_type  = 0
      protocol   = "6"
      rule_no    = 95
      to_port    = 3389
    }
  ]
}