Skip to content

Commit 8442510

Browse files
aidenvaines-cgiaidenvaines-cgi
authored
CCM-9140 Adding VPC configuration (#387)
1 parent d3aa544 commit 8442510

File tree

9 files changed

+105
-7
lines changed

9 files changed

+105
-7
lines changed

‎infrastructure/terraform/components/acct/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,20 +25,25 @@
2525
| <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
2626
| <a name="input_root_domain_name"></a> [root\_domain\_name](#input\_root\_domain\_name) | The service's root DNS root nameespace, like nonprod.nhsnotify.national.nhs.uk | `string` | `"nonprod.nhsnotify.national.nhs.uk"` | no |
2727
| <a name="input_support_sandbox_environments"></a> [support\_sandbox\_environments](#input\_support\_sandbox\_environments) | Does this account support dev sandbox environments? | `bool` | `false` | no |
28+
| <a name="input_vpc_cidr"></a> [vpc\_cidr](#input\_vpc\_cidr) | n/a | `string` | `"10.0.0.0/16"` | no |
29+
| <a name="input_vpc_subnet_cidr_bits"></a> [vpc\_subnet\_cidr\_bits](#input\_vpc\_subnet\_cidr\_bits) | Number of additional bits to use for subnetting the VPC CIDR block. The bits are evently distributed | <pre>object({<br/> public = number<br/> private = number<br/> })</pre> | <pre>{<br/> "private": 3,<br/> "public": 12<br/>}</pre> | no |
2830
## Modules
2931

3032
| Name | Source | Version |
3133
|------|--------|---------|
3234
| <a name="module_kms_sandbox"></a> [kms\_sandbox](#module\_kms\_sandbox) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v1.0.8 |
33-
| <a name="module_s3bucket_access_logs"></a> [s3bucket\_access\_logs](#module\_s3bucket\_access\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
35+
| <a name="module_s3bucket_access_logs"></a> [s3bucket\_access\_logs](#module\_s3bucket\_access\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.9 |
3436
| <a name="module_s3bucket_backup_reports"></a> [s3bucket\_backup\_reports](#module\_s3bucket\_backup\_reports) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
37+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.19.0 |
3538
## Outputs
3639

3740
| Name | Description |
3841
|------|-------------|
3942
| <a name="output_dns_zone"></a> [dns\_zone](#output\_dns\_zone) | n/a |
4043
| <a name="output_github_pat_ssm_param_name"></a> [github\_pat\_ssm\_param\_name](#output\_github\_pat\_ssm\_param\_name) | n/a |
4144
| <a name="output_s3_buckets"></a> [s3\_buckets](#output\_s3\_buckets) | n/a |
45+
| <a name="output_vpc_nat_ips"></a> [vpc\_nat\_ips](#output\_vpc\_nat\_ips) | n/a |
46+
| <a name="output_vpc_public_subnets"></a> [vpc\_public\_subnets](#output\_vpc\_public\_subnets) | n/a |
4247
<!-- vale on -->
4348
<!-- markdownlint-enable -->
4449
<!-- END_TF_DOCS -->

‎infrastructure/terraform/components/acct/cloudwatch_event_rule_aws_backup_errors.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
resource "aws_cloudwatch_event_rule" "aws_backup_errors" {
2-
name = "${local.csi}-aws-backup-errors"
2+
name = "${local.csi}-aws-backup-errors"
33
description = "Forwards AWS Backup state changes to Custom Event Bus in Observability Account"
44

55
event_pattern = jsonencode({
6-
source = ["aws.backup"],
6+
source = ["aws.backup"],
77
"detail-type" = ["Backup Job State Change", "Restore Job State Change", "Copy Job State Change"],
88
detail = {
99
state = ["FAILED", "ABORTED"]

‎infrastructure/terraform/components/acct/data_availability_zones_available.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
data "aws_availability_zones" "available" {
2+
state = "available"
3+
}

‎infrastructure/terraform/components/acct/iam_policy_github_deploy_overload.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,25 @@ data "aws_iam_policy_document" "github_deploy" {
3030
]
3131
resources = ["*"]
3232
}
33+
34+
statement {
35+
effect = "Allow"
36+
37+
actions = [
38+
"ec2:AllocateAddress",
39+
"ec2:Associate*",
40+
"ec2:AttachInternetGateway",
41+
"ec2:AuthorizeSecurityGroup*",
42+
"ec2:Create*",
43+
"ec2:Delete*",
44+
"ec2:Describe*",
45+
"ec2:DetachInternetGateway",
46+
"ec2:Disassociate*",
47+
"ec2:ModifySubnet*",
48+
"ec2:ModifyVpc*",
49+
"ec2:ReleaseAddress",
50+
"ec2:Replace*",
51+
]
52+
resources = ["*"]
53+
}
3354
}

‎infrastructure/terraform/components/acct/locals.tf‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
11
locals {
2-
event_bus_arn = "arn:aws:events:eu-west-2:${var.observability_account_id}:event-bus/nhs-notify-main-acct-alerts-bus"
2+
event_bus_arn = "arn:aws:events:eu-west-2:${var.observability_account_id}:event-bus/nhs-notify-main-acct-alerts-bus"
3+
4+
# VPC Subnet Maths (Equally devise a number of subnets across the availble AZs from a provided supernet)
5+
required_bits_public = ceil(log(length(data.aws_availability_zones.available.names), 2))
6+
required_bits_private = ceil(log(length(data.aws_availability_zones.available.names), 2))
7+
8+
public_subnet_cidrs = [
9+
for az_index, az in data.aws_availability_zones.available.names :
10+
cidrsubnet(var.vpc_cidr, max(var.vpc_subnet_cidr_bits.public, local.required_bits_public), az_index)
11+
]
12+
13+
private_subnet_cidrs = [
14+
for az_index, az in data.aws_availability_zones.available.names :
15+
cidrsubnet(var.vpc_cidr, max(var.vpc_subnet_cidr_bits.private, local.required_bits_private), az_index + length(data.aws_availability_zones.available.names))
16+
]
317
}

‎infrastructure/terraform/components/acct/module_s3bucket_access_logs.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
module "s3bucket_access_logs" {
2-
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v1.0.8"
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v1.0.9"
33

44
name = "access-logs"
55

@@ -96,7 +96,7 @@ data "aws_iam_policy_document" "s3bucket_access_logs" {
9696
]
9797

9898
principals {
99-
type = "AWS"
99+
type = "AWS"
100100
identifiers = [
101101
"arn:aws:iam::${var.aws_account_id}:root"
102102
]
@@ -116,7 +116,7 @@ data "aws_iam_policy_document" "s3bucket_access_logs" {
116116
]
117117

118118
principals {
119-
type = "AWS"
119+
type = "AWS"
120120
identifiers = [
121121
"arn:aws:iam::${var.aws_account_id}:root"
122122
]

‎infrastructure/terraform/components/acct/module_vpc.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
module "vpc" {
2+
source = "terraform-aws-modules/vpc/aws"
3+
version = "5.19.0"
4+
5+
name = local.csi
6+
cidr = var.vpc_cidr
7+
8+
azs = data.aws_availability_zones.available.names
9+
public_subnets = local.public_subnet_cidrs
10+
private_subnets = local.private_subnet_cidrs
11+
12+
enable_nat_gateway = true
13+
single_nat_gateway = true
14+
15+
create_database_subnet_group = false
16+
create_elasticache_subnet_group = false
17+
create_redshift_subnet_group = false
18+
19+
manage_default_vpc = false
20+
manage_default_network_acl = false
21+
manage_default_route_table = false
22+
manage_default_security_group = false
23+
24+
private_subnet_tags = {
25+
Subnet = "Private"
26+
}
27+
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,14 @@ output "s3_buckets" {
1919
}
2020
}
2121
}
22+
23+
output "vpc_public_subnets" {
24+
value = {
25+
public = module.vpc.public_subnets
26+
private = module.vpc.private_subnets
27+
}
28+
}
29+
30+
output "vpc_nat_ips" {
31+
value = module.vpc.nat_public_ips
32+
}

‎infrastructure/terraform/components/acct/variables.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,20 @@ variable "support_sandbox_environments" {
8787
description = "Does this account support dev sandbox environments?"
8888
default = false
8989
}
90+
91+
variable "vpc_cidr" {
92+
type = string
93+
default = "10.0.0.0/16"
94+
}
95+
96+
variable "vpc_subnet_cidr_bits" {
97+
type = object({
98+
public = number
99+
private = number
100+
})
101+
description = "Number of additional bits to use for subnetting the VPC CIDR block. The bits are evently distributed "
102+
default = {
103+
public = 12 # Smaller subnets for public resources. 12 creates /28 subnets over 3x Az
104+
private = 3 # Larger subnets for private resources, 3 creates /19 subnets over 3x Az
105+
}
106+
}

0 commit comments

Comments
 (0)