Improve networking Module

infrastructure/modules/networking/main.tf

@@ -1,14 +1,10 @@
 terraform {
-  required_version = ">= 1.0"
+  required_version = "1.14.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = "~> 3.0"
+      version = "6.22.0"
     }
   }
 }
@@ -34,6 +30,32 @@ data "aws_iam_policy_document" "flow_logs_policy" {
   }
 }
 
+module "nacl" {
+  source = "./modules/nacl"
+
+  common_tags        = var.common_tags
+  environment        = var.environment
+  private_subnet_ids = aws_subnet.private[*].id
+  project_name       = var.project_name
+  public_subnet_ids  = aws_subnet.public[*].id
+  vpc_cidr           = var.vpc_cidr
+  vpc_id             = aws_vpc.main.id
+}
+
+module "vpc_endpoint" {
+  source = "./modules/vpc-endpoint"
+
+  aws_region             = var.aws_region
+  common_tags            = var.common_tags
+  environment            = var.environment
+  private_route_table_id = aws_route_table.private.id
+  private_subnet_ids     = aws_subnet.private[*].id
+  project_name           = var.project_name
+  public_route_table_id  = aws_route_table.public.id
+  vpc_cidr               = var.vpc_cidr
+  vpc_id                 = aws_vpc.main.id
+}
+
 resource "aws_vpc" "main" {
   cidr_block           = var.vpc_cidr
   enable_dns_hostnames = true

infrastructure/modules/networking/modules/nacl/main.tf

@@ -0,0 +1,128 @@
+terraform {
+  required_version = "1.14.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.22.0"
+    }
+  }
+}
+
+resource "aws_network_acl" "private" {
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-private-nacl"
+  })
+  vpc_id = var.vpc_id
+}
+
+resource "aws_network_acl" "public" {
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-public-nacl"
+  })
+  vpc_id = var.vpc_id
+}
+
+resource "aws_network_acl_association" "private" {
+  count          = length(var.private_subnet_ids)
+  network_acl_id = aws_network_acl.private.id
+  subnet_id      = var.private_subnet_ids[count.index]
+}
+
+resource "aws_network_acl_association" "public" {
+  count          = length(var.public_subnet_ids)
+  network_acl_id = aws_network_acl.public.id
+  subnet_id      = var.public_subnet_ids[count.index]
+}
+
+resource "aws_network_acl_rule" "private_inbound_ephemeral" {
+  cidr_block     = "0.0.0.0/0"
+  from_port      = 1024
+  network_acl_id = aws_network_acl.private.id
+  protocol       = "tcp"
+  rule_action    = "allow"
+  rule_number    = 100
+  to_port        = 65535
+}
+
+resource "aws_network_acl_rule" "private_inbound_https" {
+  cidr_block     = var.vpc_cidr
+  from_port      = 443
+  network_acl_id = aws_network_acl.private.id
+  protocol       = "tcp"
+  rule_action    = "allow"
+  rule_number    = 110
+  to_port        = 443
+}
+
+resource "aws_network_acl_rule" "private_inbound_postgres" {
+  cidr_block     = var.vpc_cidr
+  from_port      = 5432
+  network_acl_id = aws_network_acl.private.id
+  protocol       = "tcp"
+  rule_action    = "allow"
+  rule_number    = 120
+  to_port        = 5432
+}
+
+resource "aws_network_acl_rule" "private_inbound_redis" {
+  cidr_block     = var.vpc_cidr
+  from_port      = 6379
+  network_acl_id = aws_network_acl.private.id
+  protocol       = "tcp"
+  rule_action    = "allow"
+  rule_number    = 130
+  to_port        = 6379
+}
+
+resource "aws_network_acl_rule" "private_outbound_all" {
+  cidr_block     = "0.0.0.0/0"
+  egress         = true
+  from_port      = 0
+  network_acl_id = aws_network_acl.private.id
+  protocol       = "-1"
+  rule_action    = "allow"
+  rule_number    = 100
+  to_port        = 0
+}
+
+resource "aws_network_acl_rule" "public_inbound_ephemeral" {
+  cidr_block     = "0.0.0.0/0"
+  from_port      = 1024
+  network_acl_id = aws_network_acl.public.id
+  protocol       = "tcp"
+  rule_action    = "allow"
+  rule_number    = 100
+  to_port        = 65535
+}
+
+resource "aws_network_acl_rule" "public_inbound_http" {
+  cidr_block     = "0.0.0.0/0"
+  from_port      = 80
+  network_acl_id = aws_network_acl.public.id
+  protocol       = "tcp"
+  rule_action    = "allow"
+  rule_number    = 110
+  to_port        = 80
+}
+
+resource "aws_network_acl_rule" "public_inbound_https" {
+  cidr_block     = "0.0.0.0/0"
+  from_port      = 443
+  network_acl_id = aws_network_acl.public.id
+  protocol       = "tcp"
+  rule_action    = "allow"
+  rule_number    = 120
+  to_port        = 443
+}
+
+resource "aws_network_acl_rule" "public_outbound_all" {
+  cidr_block     = "0.0.0.0/0"
+  egress         = true
+  from_port      = 0
+  network_acl_id = aws_network_acl.public.id
+  protocol       = "-1"
+  rule_action    = "allow"
+  rule_number    = 100
+  to_port        = 0
+}

infrastructure/modules/networking/modules/nacl/variables.tf

@@ -0,0 +1,34 @@
+variable "common_tags" {
+  description = "Common tags to apply to all resources"
+  type        = map(string)
+}
+
+variable "environment" {
+  description = "Environment name"
+  type        = string
+}
+
+variable "private_subnet_ids" {
+  description = "List of private subnet IDs"
+  type        = list(string)
+}
+
+variable "project_name" {
+  description = "Project name"
+  type        = string
+}
+
+variable "public_subnet_ids" {
+  description = "List of public subnet IDs"
+  type        = list(string)
+}
+
+variable "vpc_cidr" {
+  description = "VPC CIDR block"
+  type        = string
+}
+
+variable "vpc_id" {
+  description = "VPC ID"
+  type        = string
+}

infrastructure/modules/networking/modules/vpc-endpoint/main.tf

@@ -0,0 +1,108 @@
+terraform {
+  required_version = "1.14.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.22.0"
+    }
+  }
+}
+
+resource "aws_security_group" "vpc_endpoints" {
+  description = "Security group for VPC endpoints"
+  name        = "${var.project_name}-${var.environment}-vpc-endpoints-sg"
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-vpc-endpoints-sg"
+  })
+  vpc_id = var.vpc_id
+}
+
+resource "aws_security_group_rule" "vpc_endpoints_ingress_https" {
+  cidr_blocks       = [var.vpc_cidr]
+  description       = "Allow HTTPS from VPC"
+  from_port         = 443
+  protocol          = "tcp"
+  security_group_id = aws_security_group.vpc_endpoints.id
+  to_port           = 443
+  type              = "ingress"
+}
+
+resource "aws_vpc_endpoint" "cloudwatch_logs" {
+  private_dns_enabled = true
+  security_group_ids  = [aws_security_group.vpc_endpoints.id]
+  service_name        = "com.amazonaws.${var.aws_region}.logs"
+  subnet_ids          = var.private_subnet_ids
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-cloudwatch-logs-endpoint"
+  })
+  vpc_endpoint_type = "Interface"
+  vpc_id            = var.vpc_id
+}
+
+resource "aws_vpc_endpoint" "ecr_api" {
+  private_dns_enabled = true
+  security_group_ids  = [aws_security_group.vpc_endpoints.id]
+  service_name        = "com.amazonaws.${var.aws_region}.ecr.api"
+  subnet_ids          = var.private_subnet_ids
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-ecr-api-endpoint"
+  })
+  vpc_endpoint_type = "Interface"
+  vpc_id            = var.vpc_id
+}
+
+resource "aws_vpc_endpoint" "ecr_dkr" {
+  private_dns_enabled = true
+  security_group_ids  = [aws_security_group.vpc_endpoints.id]
+  service_name        = "com.amazonaws.${var.aws_region}.ecr.dkr"
+  subnet_ids          = var.private_subnet_ids
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-ecr-dkr-endpoint"
+  })
+  vpc_endpoint_type = "Interface"
+  vpc_id            = var.vpc_id
+}
+
+resource "aws_vpc_endpoint" "s3" {
+  service_name = "com.amazonaws.${var.aws_region}.s3"
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-s3-endpoint"
+  })
+  vpc_endpoint_type = "Gateway"
+  vpc_id            = var.vpc_id
+}
+
+resource "aws_vpc_endpoint" "secretsmanager" {
+  private_dns_enabled = true
+  security_group_ids  = [aws_security_group.vpc_endpoints.id]
+  service_name        = "com.amazonaws.${var.aws_region}.secretsmanager"
+  subnet_ids          = var.private_subnet_ids
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-secretsmanager-endpoint"
+  })
+  vpc_endpoint_type = "Interface"
+  vpc_id            = var.vpc_id
+}
+
+resource "aws_vpc_endpoint" "ssm" {
+  private_dns_enabled = true
+  security_group_ids  = [aws_security_group.vpc_endpoints.id]
+  service_name        = "com.amazonaws.${var.aws_region}.ssm"
+  subnet_ids          = var.private_subnet_ids
+  tags = merge(var.common_tags, {
+    Name = "${var.project_name}-${var.environment}-ssm-endpoint"
+  })
+  vpc_endpoint_type = "Interface"
+  vpc_id            = var.vpc_id
+}
+
+resource "aws_vpc_endpoint_route_table_association" "s3_private" {
+  route_table_id  = var.private_route_table_id
+  vpc_endpoint_id = aws_vpc_endpoint.s3.id
+}
+
+resource "aws_vpc_endpoint_route_table_association" "s3_public" {
+  route_table_id  = var.public_route_table_id
+  vpc_endpoint_id = aws_vpc_endpoint.s3.id
+}

infrastructure/modules/networking/modules/vpc-endpoint/outputs.tf

@@ -0,0 +1,4 @@
+output "security_group_id" {
+  description = "Security group ID for VPC endpoints"
+  value       = aws_security_group.vpc_endpoints.id
+}