Terraform module vpc to create new modules using this as baseline
We eat, drink, sleep and most importantly love DevOps. We are working towards strategies for standardizing architecture while ensuring security for the infrastructure. We are strong believer of the philosophy Bigger problems are always solved by breaking them into smaller manageable problems. Resonating with microservices architecture, it is considered best-practice to run database, cluster, storage in smaller connected yet manageable pieces within the infrastructure.
This module is basically combination of Terraform open source and includes automatation tests and examples. It also helps to create and improve your infrastructure with minimalistic code instead of maintaining the whole infrastructure code yourself.
We have fifty plus terraform modules. A few of them are comepleted and are available for open source usage while a few others are in progress.
This module has a few dependencies:
IMPORTANT: Since the master branch used in source varies based on new modifications, we suggest that you use the release versions here.
Here are some examples of how you can use this module in your inventory structure:
module "vpc" {
source = "clouddrove/vpc/aws"
version = "2.0.0"
name = "vpc"
environment = "example"
cidr_block = "10.0.0.0/16"
enable_flow_log = true # Flow logs will be stored in cloudwatch log group. Variables passed in default.
create_flow_log_cloudwatch_iam_role = true
additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"]
dhcp_options_domain_name = "service.consul"
dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]
} module "vpc" {
source = "clouddrove/vpc/aws"
version = "2.0.0"
name = "vpc"
environment = "example"
cidr_block = "10.0.0.0/16"
enable_flow_log = true
flow_log_destination_type = "s3"
flow_logs_bucket_name = "gc-vpc-flow-logs-bucket"
additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"]
dhcp_options_domain_name = "service.consul"
dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]
}| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| additional_cidr_block | List of secondary CIDR blocks of the VPC. | list(string) |
[] |
no |
| assign_generated_ipv6_cidr_block | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. Conflicts with ipv6_ipam_pool_id | bool |
true |
no |
| aws_default_network_acl | A boolean flag to enable/disable Default Network acl in the VPC. | bool |
true |
no |
| aws_default_route_table | A boolean flag to enable/disable Default Route Table in the VPC. | bool |
true |
no |
| block_http_traffic | True when http traffic has to be blocked for S3. | bool |
true |
no |
| cidr_block | CIDR for the VPC. | string |
"" |
no |
| create_flow_log_cloudwatch_iam_role | Flag to be set true when cloudwatch iam role is to be created when flow log destination type is set to cloudwatch logs. | bool |
false |
no |
| default_network_acl_egress | List of maps of egress rules to set on the Default Network ACL | list(map(string)) |
[ |
no |
| default_network_acl_ingress | List of maps of ingress rules to set on the Default Network ACL | list(map(string)) |
[ |
no |
| default_route_table_routes | Configuration block of routes. | list(map(string)) |
[] |
no |
| default_security_group_egress | List of maps of egress rules to set on the default security group | list(map(string)) |
[] |
no |
| default_security_group_ingress | List of maps of ingress rules to set on the default security group | list(map(string)) |
[] |
no |
| dhcp_options_domain_name | Specifies DNS name for DHCP options set (requires enable_dhcp_options set to true) | string |
"service.consul" |
no |
| dhcp_options_domain_name_servers | Specify a list of DNS server addresses for DHCP options set, default to AWS provided (requires enable_dhcp_options set to true) | list(string) |
[ |
no |
| dhcp_options_netbios_name_servers | Specify a list of netbios servers for DHCP options set (requires enable_dhcp_options set to true) | list(string) |
[] |
no |
| dhcp_options_netbios_node_type | Specify netbios node_type for DHCP options set (requires enable_dhcp_options set to true) | string |
"" |
no |
| dhcp_options_ntp_servers | Specify a list of NTP servers for DHCP options set (requires enable_dhcp_options set to true) | list(string) |
[] |
no |
| dns_hostnames_enabled | A boolean flag to enable/disable DNS hostnames in the VPC. | bool |
true |
no |
| dns_support_enabled | A boolean flag to enable/disable DNS support in the VPC. | bool |
true |
no |
| enable | Flag to control the vpc creation. | bool |
true |
no |
| enable_dhcp_options | Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type | bool |
false |
no |
| enable_flow_log | Enable vpc_flow_log logs. | bool |
false |
no |
| enable_key_rotation | Specifies whether key rotation is enabled. Defaults to true(security best practice) | bool |
true |
no |
| enable_network_address_usage_metrics | Determines whether network address usage metrics are enabled for the VPC | bool |
null |
no |
| enabled_ipv6_egress_only_internet_gateway | A boolean flag to enable/disable IPv6 Egress-Only Internet Gateway creation | bool |
true |
no |
| environment | Environment (e.g. prod, dev, staging). |
string |
"" |
no |
| flow_log_cloudwatch_log_group_retention_in_days | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | number |
null |
no |
| flow_log_destination_arn | ARN of destination where vpc flow logs are to stored. Can be of existing s3 or existing cloudwatch log group. | string |
null |
no |
| flow_log_destination_type | Type of flow log destination. Can be s3 or cloud-watch-logs | string |
"cloud-watch-logs" |
no |
| flow_log_file_format | (Optional) The format for the flow log. Valid values: plain-text, parquet |
string |
null |
no |
| flow_log_hive_compatible_partitions | (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3 | bool |
false |
no |
| flow_log_iam_role_arn | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow_log_destination_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided | string |
null |
no |
| flow_log_log_format | The fields to include in the flow log record, in the order in which they should appear | string |
null |
no |
| flow_log_max_aggregation_interval | The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: 60 seconds or 600 seconds |
number |
600 |
no |
| flow_log_per_hour_partition | (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries | bool |
false |
no |
| flow_log_traffic_type | The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL | string |
"ALL" |
no |
| flow_logs_bucket_name | Name (e.g. mybucket or bucket101). |
string |
null |
no |
| instance_tenancy | A tenancy option for instances launched into the VPC. | string |
"default" |
no |
| ipam_pool_enable | Flag to be set true when using ipam for cidr. | bool |
false |
no |
| ipv4_ipam_pool_id | The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR. | string |
"" |
no |
| ipv4_netmask_length | The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4_ipam_pool_id | string |
null |
no |
| ipv6_cidr_block | IPv6 CIDR for the VPC. | string |
null |
no |
| ipv6_cidr_block_network_border_group | Set this to restrict advertisement of public addresses to a specific Network Border Group such as a LocalZone. | string |
null |
no |
| ipv6_ipam_pool_id | The ID of an IPv6 IPAM pool you want to use for allocating this VPC's CIDR. | string |
null |
no |
| ipv6_netmask_length | The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv6_ipam_pool_id | string |
null |
no |
| kms_key_deletion_window | KMS Key deletion window in days. | number |
10 |
no |
| label_order | Label order, e.g. name,application. |
list(any) |
[ |
no |
| managedby | ManagedBy, eg 'CloudDrove' | string |
"[email protected]" |
no |
| name | Name (e.g. app or cluster). |
string |
"" |
no |
| repository | Terraform current module repo | string |
"https://github.com/clouddrove/terraform-aws-vpc" |
no |
| restrict_default_sg | Flag to control the restrict default sg creation. | bool |
true |
no |
| s3_sse_algorithm | Server-side encryption algorithm to use. Valid values are AES256 and aws:kms | string |
"aws:kms" |
no |
| vpc_flow_log_permissions_boundary | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | string |
null |
no |
| Name | Description |
|---|---|
| arn | Amazon Resource Name (ARN) of VPC |
| igw_id | The ID of the Internet Gateway. |
| ipv6_cidr_block | The IPv6 CIDR block. |
| ipv6_cidr_block_network_border_group | The IPv6 Network Border Group Zone name |
| ipv6_egress_only_igw_id | The ID of the egress-only Internet Gateway |
| tags | A mapping of tags to assign to the resource. |
| vpc_arn | The ARN of the VPC |
| vpc_cidr_block | The CIDR block of the VPC. |
| vpc_default_network_acl_id | The ID of the network ACL created by default on VPC creation. |
| vpc_default_route_table_id | The ID of the route table created by default on VPC creation. |
| vpc_default_security_group_id | The ID of the security group created by default on VPC creation. |
| vpc_id | The ID of the VPC. |
| vpc_ipv6_association_id | The association ID for the IPv6 CIDR block. |
| vpc_main_route_table_id | The ID of the main route table associated with this VPC. |
In this module testing is performed with terratest and it creates a small piece of infrastructure, matches the output like ARN, ID and Tags name etc and destroy infrastructure in your AWS account. This testing is written in GO, so you need a GO environment in your system.
You need to run the following command in the testing folder:
go test -run TestIf you come accross a bug or have any feedback, please log it in our issue tracker, or feel free to drop us an email at [email protected].
If you have found it worth your time, go ahead and give us a ★ on our GitHub!
At CloudDrove, we offer expert guidance, implementation support and services to help organisations accelerate their journey to the cloud. Our services include docker and container orchestration, cloud migration and adoption, infrastructure automation, application modernisation and remediation, and performance engineering.
We are The Cloud Experts!
We ❤️ Open Source and you can check out our other modules to get help with your new Cloud ideas.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent