Skip to content

Commit f5291f8

Browse files
mfjarvismfjarvis
committed
VED-26: Add private subnets for connectivity to PDS.
1 parent ac29341 commit f5291f8

File tree

5 files changed

+120
-26
lines changed

5 files changed

+120
-26
lines changed

‎infra/.terraform.lock.hcl‎

Lines changed: 41 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/endpoints.tf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ resource "aws_vpc_endpoint" "sqs_endpoint" {
4444
service_name = "com.amazonaws.${var.aws_region}.sqs"
4545
vpc_endpoint_type = "Interface"
4646

47-
subnet_ids = values(aws_subnet.default_subnets)[*].id
47+
subnet_ids = values(aws_subnet.private)[*].id
4848
security_group_ids = [aws_security_group.lambda_redis_sg.id]
4949
private_dns_enabled = true
5050

@@ -74,7 +74,7 @@ resource "aws_vpc_endpoint" "s3_endpoint" {
7474
vpc_id = aws_vpc.default.id
7575
service_name = "com.amazonaws.${var.aws_region}.s3"
7676

77-
route_table_ids = [aws_route_table.default.id]
77+
route_table_ids = [aws_route_table.private.id]
7878

7979
policy = jsonencode({
8080
Version = "2012-10-17",
@@ -105,7 +105,7 @@ resource "aws_vpc_endpoint" "kinesis_endpoint" {
105105
service_name = "com.amazonaws.${var.aws_region}.kinesis-firehose"
106106
vpc_endpoint_type = "Interface"
107107

108-
subnet_ids = values(aws_subnet.default_subnets)[*].id
108+
subnet_ids = values(aws_subnet.private)[*].id
109109
security_group_ids = [aws_security_group.lambda_redis_sg.id]
110110
private_dns_enabled = true
111111

@@ -135,7 +135,7 @@ resource "aws_vpc_endpoint" "dynamodb" {
135135
vpc_id = aws_vpc.default.id
136136
service_name = "com.amazonaws.${var.aws_region}.dynamodb"
137137

138-
route_table_ids = [aws_route_table.default.id]
138+
route_table_ids = [aws_route_table.private.id]
139139

140140
tags = {
141141
Name = "immunisation-dynamo-endpoint"
@@ -147,7 +147,7 @@ resource "aws_vpc_endpoint" "ecr_api" {
147147
service_name = "com.amazonaws.${var.aws_region}.ecr.api"
148148
vpc_endpoint_type = "Interface"
149149

150-
subnet_ids = values(aws_subnet.default_subnets)[*].id
150+
subnet_ids = values(aws_subnet.private)[*].id
151151
security_group_ids = [aws_security_group.lambda_redis_sg.id]
152152
private_dns_enabled = true
153153
tags = {
@@ -160,7 +160,7 @@ resource "aws_vpc_endpoint" "ecr_dkr" {
160160
service_name = "com.amazonaws.${var.aws_region}.ecr.dkr"
161161
vpc_endpoint_type = "Interface"
162162

163-
subnet_ids = values(aws_subnet.default_subnets)[*].id
163+
subnet_ids = values(aws_subnet.private)[*].id
164164
security_group_ids = [aws_security_group.lambda_redis_sg.id]
165165
private_dns_enabled = true
166166
tags = {
@@ -173,7 +173,7 @@ resource "aws_vpc_endpoint" "cloud_watch" {
173173
service_name = "com.amazonaws.${var.aws_region}.logs"
174174
vpc_endpoint_type = "Interface"
175175

176-
subnet_ids = values(aws_subnet.default_subnets)[*].id
176+
subnet_ids = values(aws_subnet.private)[*].id
177177
security_group_ids = [aws_security_group.lambda_redis_sg.id]
178178
private_dns_enabled = true
179179
tags = {
@@ -187,7 +187,7 @@ resource "aws_vpc_endpoint" "kinesis_stream_endpoint" {
187187
service_name = "com.amazonaws.${var.aws_region}.kinesis-streams"
188188
vpc_endpoint_type = "Interface"
189189

190-
subnet_ids = values(aws_subnet.default_subnets)[*].id
190+
subnet_ids = values(aws_subnet.private)[*].id
191191
security_group_ids = [aws_security_group.lambda_redis_sg.id]
192192
private_dns_enabled = true
193193

@@ -225,7 +225,7 @@ resource "aws_vpc_endpoint" "kms_endpoint" {
225225
service_name = "com.amazonaws.${var.aws_region}.kms"
226226
vpc_endpoint_type = "Interface"
227227

228-
subnet_ids = values(aws_subnet.default_subnets)[*].id
228+
subnet_ids = values(aws_subnet.private)[*].id
229229
security_group_ids = [aws_security_group.lambda_redis_sg.id]
230230
private_dns_enabled = true
231231

@@ -265,7 +265,7 @@ resource "aws_vpc_endpoint" "lambda_endpoint" {
265265
service_name = "com.amazonaws.${var.aws_region}.lambda"
266266
vpc_endpoint_type = "Interface"
267267

268-
subnet_ids = values(aws_subnet.default_subnets)[*].id
268+
subnet_ids = values(aws_subnet.private)[*].id
269269
security_group_ids = [aws_security_group.lambda_redis_sg.id]
270270
private_dns_enabled = true
271271
tags = {

‎infra/mesh.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ module "mesh" {
22
source = "git::https://github.com/nhsdigital/terraform-aws-mesh-client.git//module?ref=v2.1.5"
33
name_prefix = "local-immunisation"
44
mesh_env = "integration"
5-
subnet_ids = aws_subnets.default.ids
6-
mailbox_ids = ["X26OT303"] #TBC
5+
subnet_ids = values(aws_subnet.private)[*].id
6+
mailbox_ids = ["X26OT303"] #TBC
77
verify_ssl = "true"
88
get_message_max_concurrency = 10
99
compress_threshold = 1 * 1024 * 1024

‎infra/networking.tf‎

Lines changed: 66 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
locals {
2-
subnet_config = [
2+
public_subnet_config = [
33
{
44
cidr_block = "172.31.16.0/20"
55
availability_zone = "eu-west-2a"
@@ -13,6 +13,20 @@ locals {
1313
availability_zone = "eu-west-2c"
1414
}
1515
]
16+
private_subnet_config = [
17+
{
18+
cidr_block = "172.31.48.0/20"
19+
availability_zone = "eu-west-2a"
20+
},
21+
{
22+
cidr_block = "172.31.64.0/20"
23+
availability_zone = "eu-west-2b"
24+
},
25+
{
26+
cidr_block = "172.31.80.0/20"
27+
availability_zone = "eu-west-2c"
28+
}
29+
]
1630
environment = var.environment == "non-prod" ? "dev" : var.environment
1731
}
1832

@@ -25,8 +39,9 @@ resource "aws_vpc" "default" {
2539
}
2640
}
2741

28-
resource "aws_subnet" "default_subnets" {
29-
for_each = { for idx, subnet in local.subnet_config : idx => subnet }
42+
resource "aws_subnet" "public" {
43+
for_each = { for idx, subnet in local.public_subnet_config : idx => subnet }
44+
3045
vpc_id = aws_vpc.default.id
3146
cidr_block = each.value.cidr_block
3247
availability_zone = each.value.availability_zone
@@ -40,26 +55,65 @@ resource "aws_internet_gateway" "default" {
4055
}
4156
}
4257

43-
resource "aws_route_table" "default" {
58+
resource "aws_route_table" "public" {
4459
vpc_id = aws_vpc.default.id
4560
tags = {
46-
Name = "imms-${local.environment}-fhir-api-rtb"
61+
Name = "imms-${local.environment}-fhir-api-public-rtb"
4762
}
4863
}
4964

50-
resource "aws_route_table_association" "subnet_associations" {
51-
for_each = aws_subnet.default_subnets
65+
resource "aws_route_table_association" "public_subnets" {
66+
for_each = aws_subnet.public
67+
5268
subnet_id = each.value.id
53-
route_table_id = aws_route_table.default.id
69+
route_table_id = aws_route_table.public.id
5470
}
5571

56-
57-
resource "aws_route" "igw_route" {
58-
route_table_id = aws_route_table.default.id
59-
destination_cidr_block = "0.0.0.0/16"
72+
resource "aws_route" "igw" {
73+
route_table_id = aws_route_table.public.id
74+
destination_cidr_block = "0.0.0.0/0"
6075
gateway_id = aws_internet_gateway.default.id
6176
}
6277

78+
resource "aws_subnet" "private" {
79+
for_each = { for idx, subnet in local.private_subnet_config : idx => subnet }
80+
81+
vpc_id = aws_vpc.default.id
82+
cidr_block = each.value.cidr_block
83+
availability_zone = each.value.availability_zone
84+
}
85+
86+
resource "aws_eip" "nat" {
87+
domain = "vpc"
88+
89+
depends_on = [aws_internet_gateway.default]
90+
}
91+
92+
resource "aws_nat_gateway" "default" {
93+
allocation_id = aws_eip.nat.id
94+
subnet_id = aws_subnet.public[0].id
95+
}
96+
97+
resource "aws_route_table" "private" {
98+
vpc_id = aws_vpc.default.id
99+
tags = {
100+
Name = "imms-${local.environment}-fhir-api-private-rtb"
101+
}
102+
}
103+
104+
resource "aws_route_table_association" "private_subnets" {
105+
for_each = aws_subnet.private
106+
107+
subnet_id = each.value.id
108+
route_table_id = aws_route_table.private.id
109+
}
110+
111+
resource "aws_route" "nat" {
112+
route_table_id = aws_route_table.private.id
113+
destination_cidr_block = "0.0.0.0/0"
114+
nat_gateway_id = aws_nat_gateway.default.id
115+
}
116+
63117
resource "aws_route53_zone" "parent_hosted_zone" {
64118
name = var.parent_route53_zone_name
65119
}

‎infra/redis_cache.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,5 @@ resource "aws_elasticache_cluster" "redis_cluster" {
1212
# Subnet Group for Redis
1313
resource "aws_elasticache_subnet_group" "redis_subnet_group" {
1414
name = "immunisation-redis-subnet-group"
15-
subnet_ids = values(aws_subnet.default_subnets)[*].id
15+
subnet_ids = values(aws_subnet.private)[*].id
1616
}

0 commit comments

Comments
 (0)