-
-
-Direct Connect Connection Module
-
- Configures and deploys a DX connection
-
- Explore the docs »
-
-
- Zachary Hill
- ·
- Report Bug
- ·
- Request Feature
-
-
-
-
- Configures and deploys a DX connection
-
- Explore the docs »
-
-
- Zachary Hill
- ·
- Report Bug
- ·
- Request Feature
-
- This module attaches a transit gateway to subnets.
+ This module attaches one or more VPCs to transit gateway. Transit gateways attach to VPCs using VPC attachments. VPC attachments create ENI's in the VPC's subnets allowing traffic to route between the VPC and the transit gateway. This module also supports enabling flow logs on the VPC attachments by default.
Explore the docs »
@@ -62,14 +62,21 @@
## Usage
+### Simple Example
+
+This example attaches a single VPC to the transit gateway.
+
```
module "sdwan_vpc_transit_gateway_attachment" {
source = "github.com/zachreborn/terraform-modules//modules/aws/transit_gateway/attachment"
- name = "sdwan_vpc_attachment"
- subnet_ids = ["subnet-fdsjklafjlkds8421", "subnet-290102034fjkdsa"]
transit_gateway_id = module.transit_gateway.id
- vpc_id = "vpc-4289104jk21lsda"
+ vpc_ids = {
+ "transit_vpc" = {
+ subnet_ids = ["subnet-12345678", "subnet-87654321"]
+ vpc_id = "vpc-12345678"
+ }
+ }
}
```
@@ -109,10 +116,8 @@ _For more examples, please refer to the [Documentation](https://github.com/zachr
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
-| [appliance\_mode\_support](#input\_appliance\_mode\_support) | (Optional) Whether Appliance Mode support is enabled. If enabled, a traffic flow between a source and destination uses the same Availability Zone for the VPC attachment for the lifetime of that flow. | `string` | `"disable"` | no |
| [cloudwatch\_name\_prefix](#input\_cloudwatch\_name\_prefix) | (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. | `string` | `"flow_logs_"` | no |
| [cloudwatch\_retention\_in\_days](#input\_cloudwatch\_retention\_in\_days) | (Optional) Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653, and 0. If you select 0, the events in the log group are always retained and never expire. | `number` | `90` | no |
-| [dns\_support](#input\_dns\_support) | (Optional) Whether DNS support is enabled. Valid values: disable, enable. Default value: enable. | `string` | `"enable"` | no |
| [enable\_flow\_logs](#input\_enable\_flow\_logs) | (Optional) A boolean flag to enable/disable the use of flow logs with the resources. Defaults True. | `bool` | `true` | no |
| [flow\_deliver\_cross\_account\_role](#input\_flow\_deliver\_cross\_account\_role) | (Optional) The ARN of the IAM role that posts logs to CloudWatch Logs in a different account. | `string` | `null` | no |
| [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | (Optional) The type of the logging destination. Valid values: cloud-watch-logs, s3. Default: cloud-watch-logs. | `string` | `"cloud-watch-logs"` | no |
@@ -123,22 +128,20 @@ _For more examples, please refer to the [Documentation](https://github.com/zachr
| [iam\_policy\_path](#input\_iam\_policy\_path) | (Optional, default '/') Path in which to create the policy. See IAM Identifiers for more information. | `string` | `"/"` | no |
| [iam\_role\_description](#input\_iam\_role\_description) | (Optional) The description of the role. | `string` | `"Role utilized for VPC flow logs. This role allows creation of log streams and adding logs to the log streams in cloudwatch"` | no |
| [iam\_role\_name\_prefix](#input\_iam\_role\_name\_prefix) | (Required, Forces new resource) Creates a unique friendly name beginning with the specified prefix. Conflicts with name. | `string` | `"flow_logs_role_"` | no |
-| [ipv6\_support](#input\_ipv6\_support) | (Optional) Whether IPv6 support is enabled. Valid values: disable, enable. Default value: disable. | `string` | `"disable"` | no |
| [key\_name\_prefix](#input\_key\_name\_prefix) | (Optional) Creates an unique alias beginning with the specified prefix. The name must start with the word alias followed by a forward slash (alias/). | `string` | `"alias/flow_logs_key_"` | no |
-| [name](#input\_name) | (Required) The name of the transit gateway attachment | `string` | n/a | yes |
-| [subnet\_ids](#input\_subnet\_ids) | (Required) Identifiers of EC2 Subnets. | `list(any)` | n/a | yes |
-| [tags](#input\_tags) | (Optional) Map of tags for the EC2 Transit Gateway. | `map(any)` |
{
"environment": "prod",
"project": "core_infrastructure",
"terraform": "true"
} | no |
-| [transit\_gateway\_default\_route\_table\_association](#input\_transit\_gateway\_default\_route\_table\_association) | (Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: true. | `bool` | `true` | no |
-| [transit\_gateway\_default\_route\_table\_propagation](#input\_transit\_gateway\_default\_route\_table\_propagation) | (Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: true. | `bool` | `true` | no |
-| [transit\_gateway\_id](#input\_transit\_gateway\_id) | (Required) Identifier of EC2 Transit Gateway. | `string` | n/a | yes |
-| [vpc\_id](#input\_vpc\_id) | (Required) Identifier of the VPC. | `string` | n/a | yes |
+| [tags](#input\_tags) | (Optional) Map of tags for the EC2 transit gateway. | `map(any)` | {
"environment": "prod",
"project": "core_infrastructure",
"terraform": "true"
} | no |
+| [transit\_gateway\_default\_route\_table\_association](#input\_transit\_gateway\_default\_route\_table\_association) | (Optional) Boolean whether the VPC attachment should be associated with the EC2 transit gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 transit gateways. Default value: true. | `bool` | `true` | no |
+| [transit\_gateway\_default\_route\_table\_propagation](#input\_transit\_gateway\_default\_route\_table\_propagation) | (Optional) Boolean whether the VPC attachment should propagate routes with the EC2 transit gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 transit gateways. Default value: true. | `bool` | `true` | no |
+| [transit\_gateway\_id](#input\_transit\_gateway\_id) | (Required) Identifier of EC2 transit gateway. | `string` | n/a | yes |
+| [vpc\_ids](#input\_vpc\_ids) | (Required) Identifier of the VPC. | map(object({
appliance_mode_support = optional(string, "disable") # (Optional) Whether Appliance Mode support is enabled. If enabled, a traffic flow between a source and destination uses the same Availability Zone for the VPC attachment for the lifetime of that flow.
dns_support = optional(string, "enable") # (Optional) Whether DNS support is enabled. Valid values: disable, enable. Default value: enable.
ipv6_support = optional(string, "disable") # (Optional) Whether IPv6 support is enabled. Valid values: disable, enable. Default value: disable.
subnet_ids = list(string) # (Required) Subnet IDs where the transit gateway attachments will be made. Typically this should be private subnets.
vpc_id = string # The VPC ID where the transit gateway attachments will be made.
})) | n/a | yes |
## Outputs
| Name | Description |
|------|-------------|
-| [id](#output\_id) | n/a |
-| [vpc\_owner\_id](#output\_vpc\_owner\_id) | n/a |
+| [ids](#output\_ids) | Map of VPC IDs and their transit gateway attachment IDs. |
+| [ids\_list](#output\_ids\_list) | List of transit gateway attachment IDs |
+| [vpc\_owner\_id](#output\_vpc\_owner\_id) | Map of VPC IDs and their owner IDs |
diff --git a/modules/aws/transit_gateway/attachment/main.tf b/modules/aws/transit_gateway/attachment/main.tf
index 74aa29fb5..fb67c8c19 100644
--- a/modules/aws/transit_gateway/attachment/main.tf
+++ b/modules/aws/transit_gateway/attachment/main.tf
@@ -11,28 +11,26 @@ terraform {
###########################
# Transit Gateway Attachment
###########################
-
resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
- appliance_mode_support = var.appliance_mode_support
- dns_support = var.dns_support
- ipv6_support = var.ipv6_support
- subnet_ids = var.subnet_ids
- tags = merge(tomap({ Name = var.name }), var.tags)
+ for_each = var.vpc_ids
+ appliance_mode_support = each.value.appliance_mode_support
+ dns_support = each.value.dns_support
+ ipv6_support = each.value.ipv6_support
+ subnet_ids = each.value.subnet_ids
+ tags = merge(tomap({ Name = each.key }), var.tags)
transit_gateway_id = var.transit_gateway_id
transit_gateway_default_route_table_association = var.transit_gateway_default_route_table_association
transit_gateway_default_route_table_propagation = var.transit_gateway_default_route_table_propagation
- vpc_id = var.vpc_id
+ vpc_id = each.value.vpc_id
}
-
###########################
# Flow Logs
###########################
-
module "vpc_flow_logs" {
source = "../../flow_logs"
- count = var.enable_flow_logs ? 1 : 0
+ for_each = var.enable_flow_logs ? var.vpc_ids : {}
cloudwatch_name_prefix = var.cloudwatch_name_prefix
cloudwatch_retention_in_days = var.cloudwatch_retention_in_days
iam_policy_name_prefix = var.iam_policy_name_prefix
@@ -45,6 +43,6 @@ module "vpc_flow_logs" {
flow_log_format = var.flow_log_format
flow_max_aggregation_interval = var.flow_max_aggregation_interval
flow_traffic_type = var.flow_traffic_type
- flow_transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.this.id
+ flow_transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.this[each.key].id
tags = var.tags
}
diff --git a/modules/aws/transit_gateway/attachment/outputs.tf b/modules/aws/transit_gateway/attachment/outputs.tf
index 414106463..300f5b01a 100644
--- a/modules/aws/transit_gateway/attachment/outputs.tf
+++ b/modules/aws/transit_gateway/attachment/outputs.tf
@@ -1,7 +1,14 @@
-output "id" {
- value = aws_ec2_transit_gateway_vpc_attachment.this.id
+output "ids" {
+ description = "Map of VPC IDs and their transit gateway attachment IDs."
+ value = { for attachment, value in aws_ec2_transit_gateway_vpc_attachment.this : value.vpc_id => value.id }
+}
+
+output "ids_list" {
+ description = "List of transit gateway attachment IDs"
+ value = values(aws_ec2_transit_gateway_vpc_attachment.this)[*].id
}
output "vpc_owner_id" {
- value = aws_ec2_transit_gateway_vpc_attachment.this.vpc_owner_id
+ description = "Map of VPC IDs and their owner IDs"
+ value = { for attachment, value in aws_ec2_transit_gateway_vpc_attachment.this : value.vpc_id => value.vpc_owner_id }
}
diff --git a/modules/aws/transit_gateway/attachment/variables.tf b/modules/aws/transit_gateway/attachment/variables.tf
index ae2a4f21c..5faadc2cf 100644
--- a/modules/aws/transit_gateway/attachment/variables.tf
+++ b/modules/aws/transit_gateway/attachment/variables.tf
@@ -1,67 +1,43 @@
###########################
# Transit Gateway Attachment
###########################
-variable "appliance_mode_support" {
- description = "(Optional) Whether Appliance Mode support is enabled. If enabled, a traffic flow between a source and destination uses the same Availability Zone for the VPC attachment for the lifetime of that flow."
- default = "disable"
- type = string
-}
-
-variable "dns_support" {
- description = "(Optional) Whether DNS support is enabled. Valid values: disable, enable. Default value: enable."
- default = "enable"
- type = string
-}
-
-variable "ipv6_support" {
- description = "(Optional) Whether IPv6 support is enabled. Valid values: disable, enable. Default value: disable."
- default = "disable"
- type = string
-}
-
-variable "name" {
- description = "(Required) The name of the transit gateway attachment"
- type = string
-}
-
-variable "subnet_ids" {
- description = "(Required) Identifiers of EC2 Subnets."
- type = list(any)
-}
-
-variable "tags" {
- description = "(Optional) Map of tags for the EC2 Transit Gateway."
- default = {
- terraform = "true"
- environment = "prod"
- project = "core_infrastructure"
- }
- type = map(any)
-}
-
variable "transit_gateway_id" {
- description = "(Required) Identifier of EC2 Transit Gateway."
+ description = "(Required) Identifier of EC2 transit gateway."
type = string
}
variable "transit_gateway_default_route_table_association" {
type = bool
- description = "(Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: true."
+ description = "(Optional) Boolean whether the VPC attachment should be associated with the EC2 transit gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 transit gateways. Default value: true."
default = true
}
variable "transit_gateway_default_route_table_propagation" {
type = bool
- description = "(Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: true."
+ description = "(Optional) Boolean whether the VPC attachment should propagate routes with the EC2 transit gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 transit gateways. Default value: true."
default = true
}
-variable "vpc_id" {
+variable "vpc_ids" {
description = "(Required) Identifier of the VPC."
- type = string
+ type = map(object({
+ appliance_mode_support = optional(string, "disable") # (Optional) Whether Appliance Mode support is enabled. If enabled, a traffic flow between a source and destination uses the same Availability Zone for the VPC attachment for the lifetime of that flow.
+ dns_support = optional(string, "enable") # (Optional) Whether DNS support is enabled. Valid values: disable, enable. Default value: enable.
+ ipv6_support = optional(string, "disable") # (Optional) Whether IPv6 support is enabled. Valid values: disable, enable. Default value: disable.
+ subnet_ids = list(string) # (Required) Subnet IDs where the transit gateway attachments will be made. Typically this should be private subnets.
+ vpc_id = string # The VPC ID where the transit gateway attachments will be made.
+ }))
+ # vpc_ids = {
+ # "transit_vpc" = {
+ # appliance_mode_support = "disable"
+ # dns_support = "enable"
+ # ipv6_support = "disable"
+ # subnet_ids = ["subnet-12345678", "subnet-87654321"]
+ # vpc_id = "vpc-12345678"
+ # }
+ # }
}
-
###########################
# Flow Log
###########################
@@ -145,4 +121,14 @@ variable "enable_flow_logs" {
description = "(Optional) A boolean flag to enable/disable the use of flow logs with the resources. Defaults True."
default = true
type = bool
-}
\ No newline at end of file
+}
+
+variable "tags" {
+ description = "(Optional) Map of tags for the EC2 transit gateway."
+ default = {
+ terraform = "true"
+ environment = "prod"
+ project = "core_infrastructure"
+ }
+ type = map(any)
+}
diff --git a/modules/aws/vpc/README.md b/modules/aws/vpc/README.md
index a034d0f97..34656c366 100755
--- a/modules/aws/vpc/README.md
+++ b/modules/aws/vpc/README.md
@@ -281,6 +281,7 @@ _For more examples, please refer to the [Documentation](https://github.com/zachr
| [igw\_id](#output\_igw\_id) | n/a |
| [mgmt\_route\_table\_ids](#output\_mgmt\_route\_table\_ids) | n/a |
| [mgmt\_subnet\_ids](#output\_mgmt\_subnet\_ids) | n/a |
+| [name](#output\_name) | The name of the VPC |
| [nat\_eips](#output\_nat\_eips) | n/a |
| [nat\_eips\_public\_ips](#output\_nat\_eips\_public\_ips) | n/a |
| [natgw\_ids](#output\_natgw\_ids) | n/a |
diff --git a/modules/aws/vpc/outputs.tf b/modules/aws/vpc/outputs.tf
index 9d57e2c05..48c0fddb6 100644
--- a/modules/aws/vpc/outputs.tf
+++ b/modules/aws/vpc/outputs.tf
@@ -85,3 +85,8 @@ output "igw_id" {
output "availability_zone" {
value = aws_subnet.private_subnets[*].availability_zone
}
+
+output "name" {
+ description = "The name of the VPC"
+ value = aws_vpc.vpc.tags["Name"]
+}