Skip to content

Commit 41be795

Browse files
mfjarvismfjarvis
authored
VED-26: Add private subnets for connectivity to PDS. (#644)
* VED-26: Add private subnets for connectivity to PDS. * VED-26: Add more tags. TF init. * VED-26: Name subnets. Don't map public IPs to avoid hitting account limits.
1 parent 2f648bb commit 41be795

File tree

4 files changed

+126
-27
lines changed

4 files changed

+126
-27
lines changed

‎infra/.terraform.lock.hcl‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/endpoints.tf‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,23 @@ resource "aws_security_group" "lambda_redis_sg" {
3737
protocol = "-1"
3838
self = true
3939
}
40+
41+
egress {
42+
description = "HTTPS outbound for PDS callout"
43+
cidr_blocks = ["0.0.0.0/0"]
44+
from_port = 443
45+
to_port = 443
46+
protocol = "tcp"
47+
self = false
48+
}
4049
}
4150

4251
resource "aws_vpc_endpoint" "sqs_endpoint" {
4352
vpc_id = aws_vpc.default.id
4453
service_name = "com.amazonaws.${var.aws_region}.sqs"
4554
vpc_endpoint_type = "Interface"
4655

47-
subnet_ids = values(aws_subnet.default_subnets)[*].id
56+
subnet_ids = values(aws_subnet.private)[*].id
4857
security_group_ids = [aws_security_group.lambda_redis_sg.id]
4958
private_dns_enabled = true
5059

@@ -74,7 +83,7 @@ resource "aws_vpc_endpoint" "s3_endpoint" {
7483
vpc_id = aws_vpc.default.id
7584
service_name = "com.amazonaws.${var.aws_region}.s3"
7685

77-
route_table_ids = [aws_route_table.default.id]
86+
route_table_ids = [aws_route_table.private.id]
7887

7988
policy = jsonencode({
8089
Version = "2012-10-17",
@@ -105,7 +114,7 @@ resource "aws_vpc_endpoint" "kinesis_endpoint" {
105114
service_name = "com.amazonaws.${var.aws_region}.kinesis-firehose"
106115
vpc_endpoint_type = "Interface"
107116

108-
subnet_ids = values(aws_subnet.default_subnets)[*].id
117+
subnet_ids = values(aws_subnet.private)[*].id
109118
security_group_ids = [aws_security_group.lambda_redis_sg.id]
110119
private_dns_enabled = true
111120

@@ -135,7 +144,7 @@ resource "aws_vpc_endpoint" "dynamodb" {
135144
vpc_id = aws_vpc.default.id
136145
service_name = "com.amazonaws.${var.aws_region}.dynamodb"
137146

138-
route_table_ids = [aws_route_table.default.id]
147+
route_table_ids = [aws_route_table.private.id]
139148

140149
tags = {
141150
Name = "immunisation-dynamo-endpoint"
@@ -147,7 +156,7 @@ resource "aws_vpc_endpoint" "ecr_api" {
147156
service_name = "com.amazonaws.${var.aws_region}.ecr.api"
148157
vpc_endpoint_type = "Interface"
149158

150-
subnet_ids = values(aws_subnet.default_subnets)[*].id
159+
subnet_ids = values(aws_subnet.private)[*].id
151160
security_group_ids = [aws_security_group.lambda_redis_sg.id]
152161
private_dns_enabled = true
153162
tags = {
@@ -160,7 +169,7 @@ resource "aws_vpc_endpoint" "ecr_dkr" {
160169
service_name = "com.amazonaws.${var.aws_region}.ecr.dkr"
161170
vpc_endpoint_type = "Interface"
162171

163-
subnet_ids = values(aws_subnet.default_subnets)[*].id
172+
subnet_ids = values(aws_subnet.private)[*].id
164173
security_group_ids = [aws_security_group.lambda_redis_sg.id]
165174
private_dns_enabled = true
166175
tags = {
@@ -173,7 +182,7 @@ resource "aws_vpc_endpoint" "cloud_watch" {
173182
service_name = "com.amazonaws.${var.aws_region}.logs"
174183
vpc_endpoint_type = "Interface"
175184

176-
subnet_ids = values(aws_subnet.default_subnets)[*].id
185+
subnet_ids = values(aws_subnet.private)[*].id
177186
security_group_ids = [aws_security_group.lambda_redis_sg.id]
178187
private_dns_enabled = true
179188
tags = {
@@ -187,7 +196,7 @@ resource "aws_vpc_endpoint" "kinesis_stream_endpoint" {
187196
service_name = "com.amazonaws.${var.aws_region}.kinesis-streams"
188197
vpc_endpoint_type = "Interface"
189198

190-
subnet_ids = values(aws_subnet.default_subnets)[*].id
199+
subnet_ids = values(aws_subnet.private)[*].id
191200
security_group_ids = [aws_security_group.lambda_redis_sg.id]
192201
private_dns_enabled = true
193202

@@ -220,7 +229,7 @@ resource "aws_vpc_endpoint" "kms_endpoint" {
220229
service_name = "com.amazonaws.${var.aws_region}.kms"
221230
vpc_endpoint_type = "Interface"
222231

223-
subnet_ids = values(aws_subnet.default_subnets)[*].id
232+
subnet_ids = values(aws_subnet.private)[*].id
224233
security_group_ids = [aws_security_group.lambda_redis_sg.id]
225234
private_dns_enabled = true
226235

@@ -255,7 +264,7 @@ resource "aws_vpc_endpoint" "lambda_endpoint" {
255264
service_name = "com.amazonaws.${var.aws_region}.lambda"
256265
vpc_endpoint_type = "Interface"
257266

258-
subnet_ids = values(aws_subnet.default_subnets)[*].id
267+
subnet_ids = values(aws_subnet.private)[*].id
259268
security_group_ids = [aws_security_group.lambda_redis_sg.id]
260269
private_dns_enabled = true
261270
tags = {

‎infra/networking.tf‎

Lines changed: 105 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,64 +1,139 @@
11
locals {
2-
subnet_config = [
2+
public_subnet_config = [
33
{
4+
name = "imms-${var.environment}-fhir-api-public-subnet-a"
45
cidr_block = "172.31.16.0/20"
56
availability_zone = "eu-west-2a"
67
},
78
{
9+
name = "imms-${var.environment}-fhir-api-public-subnet-b"
810
cidr_block = "172.31.32.0/20"
911
availability_zone = "eu-west-2b"
1012
},
1113
{
14+
name = "imms-${var.environment}-fhir-api-public-subnet-c"
1215
cidr_block = "172.31.0.0/20"
1316
availability_zone = "eu-west-2c"
1417
}
1518
]
19+
private_subnet_config = [
20+
{
21+
name = "imms-${var.environment}-fhir-api-private-subnet-a"
22+
cidr_block = "172.31.48.0/20"
23+
availability_zone = "eu-west-2a"
24+
},
25+
{
26+
name = "imms-${var.environment}-fhir-api-private-subnet-b"
27+
cidr_block = "172.31.64.0/20"
28+
availability_zone = "eu-west-2b"
29+
},
30+
{
31+
name = "imms-${var.environment}-fhir-api-private-subnet-c"
32+
cidr_block = "172.31.80.0/20"
33+
availability_zone = "eu-west-2c"
34+
}
35+
]
1636
}
1737

1838
resource "aws_vpc" "default" {
1939
cidr_block = "172.31.0.0/16"
2040
enable_dns_support = true
2141
enable_dns_hostnames = true
42+
2243
tags = {
2344
Name = "imms-${var.environment}-fhir-api-vpc"
2445
}
2546
}
2647

27-
resource "aws_subnet" "default_subnets" {
28-
for_each = { for idx, subnet in local.subnet_config : idx => subnet }
29-
vpc_id = aws_vpc.default.id
30-
cidr_block = each.value.cidr_block
31-
availability_zone = each.value.availability_zone
32-
map_public_ip_on_launch = true
48+
resource "aws_subnet" "public" {
49+
for_each = { for idx, subnet in local.public_subnet_config : idx => subnet }
50+
51+
vpc_id = aws_vpc.default.id
52+
cidr_block = each.value.cidr_block
53+
availability_zone = each.value.availability_zone
54+
55+
tags = {
56+
Name = each.value.name
57+
}
3358
}
3459

3560
resource "aws_internet_gateway" "default" {
3661
vpc_id = aws_vpc.default.id
62+
3763
tags = {
3864
Name = "imms-${var.environment}-fhir-api-igw"
3965
}
4066
}
4167

42-
resource "aws_route_table" "default" {
68+
resource "aws_route_table" "public" {
4369
vpc_id = aws_vpc.default.id
70+
4471
tags = {
45-
Name = "imms-${var.environment}-fhir-api-rtb"
72+
Name = "imms-${var.environment}-fhir-api-public-rtb"
4673
}
4774
}
4875

49-
resource "aws_route_table_association" "subnet_associations" {
50-
for_each = aws_subnet.default_subnets
76+
resource "aws_route_table_association" "public_subnets" {
77+
for_each = aws_subnet.public
78+
5179
subnet_id = each.value.id
52-
route_table_id = aws_route_table.default.id
80+
route_table_id = aws_route_table.public.id
5381
}
5482

55-
56-
resource "aws_route" "igw_route" {
57-
route_table_id = aws_route_table.default.id
58-
destination_cidr_block = "0.0.0.0/16"
83+
resource "aws_route" "igw" {
84+
route_table_id = aws_route_table.public.id
85+
destination_cidr_block = "0.0.0.0/0"
5986
gateway_id = aws_internet_gateway.default.id
6087
}
6188

89+
resource "aws_subnet" "private" {
90+
for_each = { for idx, subnet in local.private_subnet_config : idx => subnet }
91+
92+
vpc_id = aws_vpc.default.id
93+
cidr_block = each.value.cidr_block
94+
availability_zone = each.value.availability_zone
95+
96+
tags = {
97+
Name = each.value.name
98+
}
99+
}
100+
101+
resource "aws_eip" "nat" {
102+
domain = "vpc"
103+
104+
depends_on = [aws_internet_gateway.default]
105+
}
106+
107+
resource "aws_nat_gateway" "default" {
108+
allocation_id = aws_eip.nat.id
109+
subnet_id = aws_subnet.public[0].id
110+
111+
tags = {
112+
Name = "imms-${var.environment}-fhir-api-nat"
113+
}
114+
}
115+
116+
resource "aws_route_table" "private" {
117+
vpc_id = aws_vpc.default.id
118+
119+
tags = {
120+
Name = "imms-${var.environment}-fhir-api-private-rtb"
121+
}
122+
}
123+
124+
resource "aws_route_table_association" "private_subnets" {
125+
for_each = aws_subnet.private
126+
127+
subnet_id = each.value.id
128+
route_table_id = aws_route_table.private.id
129+
}
130+
131+
resource "aws_route" "nat" {
132+
route_table_id = aws_route_table.private.id
133+
destination_cidr_block = "0.0.0.0/0"
134+
nat_gateway_id = aws_nat_gateway.default.id
135+
}
136+
62137
resource "aws_route53_zone" "parent_hosted_zone" {
63138
name = var.parent_route53_zone_name
64139
}
@@ -74,3 +149,17 @@ resource "aws_route53_record" "imms_ns" {
74149
ttl = 172800
75150
records = [for ns in aws_route53_zone.child_hosted_zone.name_servers : "${ns}."]
76151
}
152+
153+
# TODO - remove once state has been updated
154+
moved {
155+
from = aws_subnet.default_subnets
156+
to = aws_subnet.public
157+
}
158+
moved {
159+
from = aws_route_table.default
160+
to = aws_route_table.public
161+
}
162+
moved {
163+
from = aws_route.igw_route
164+
to = aws_route.igw
165+
}

‎infra/redis_cache.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,5 @@ resource "aws_elasticache_cluster" "redis_cluster" {
1212
# Subnet Group for Redis
1313
resource "aws_elasticache_subnet_group" "redis_subnet_group" {
1414
name = "immunisation-redis-subnet-group"
15-
subnet_ids = values(aws_subnet.default_subnets)[*].id
15+
subnet_ids = values(aws_subnet.private)[*].id
1616
}

0 commit comments

Comments
 (0)