feat(aws): add public/private VPC

aws/vpc/.tflint.hcl

@@ -0,0 +1,10 @@
+plugin "terraform" {
+  enabled = true
+  preset  = "recommended"
+}
+
+plugin "aws" {
+  enabled = true
+  version = "0.17.1"
+  source  = "github.com/terraform-linters/tflint-ruleset-aws"
+}

aws/vpc/README.md

@@ -0,0 +1,71 @@
+# AWS ACM certificate
+
+This module creates an ACM certificate
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.3 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.30.0, < 5.0.0 |
+| <a name="requirement_time"></a> [time](#requirement\_time) | ~> 0.9.1 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.30.0, < 5.0.0 |
+| <a name="provider_time"></a> [time](#provider\_time) | ~> 0.9.1 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_eip.nat_gw_eips](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
+| [aws_internet_gateway.igw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/internet_gateway) | resource |
+| [aws_nat_gateway.nat_gw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/nat_gateway) | resource |
+| [aws_route.private_default_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
+| [aws_route.public_default_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
+| [aws_route_table.private_rt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource |
+| [aws_route_table.public_rt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource |
+| [aws_route_table_association.private_rta](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |
+| [aws_route_table_association.public_rta](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |
+| [aws_subnet.priv_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
+| [aws_subnet.pub_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
+| [aws_vpc.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc) | resource |
+| [aws_vpc_dhcp_options.dhcp_opts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options) | resource |
+| [aws_vpc_dhcp_options_association.dhcp_opts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options_association) | resource |
+| [time_static.last_update](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/static) | resource |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | AWS AZs to be used in the current region | `list(string)` | <pre>[<br>  "eu-west-3a",<br>  "eu-west-3b",<br>  "eu-west-3c"<br>]</pre> | no |
+| <a name="input_cidr_block"></a> [cidr\_block](#input\_cidr\_block) | CIDR block to be userd by the VPC | `string` | `"10.1.0.0/16"` | no |
+| <a name="input_customer"></a> [customer](#input\_customer) | Customer for the current deployment | `string` | `""` | no |
+| <a name="input_environment"></a> [environment](#input\_environment) | Environment for the current deployment | `string` | `""` | no |
+| <a name="input_name"></a> [name](#input\_name) | Name to be used on all the resources as identifier | `string` | n/a | yes |
+| <a name="input_private_subnets"></a> [private\_subnets](#input\_private\_subnets) | Private subnets to be created | `map(any)` | <pre>{<br>  "eu-west-3a": {<br>    "cidr": "10.1.0.0/24",<br>    "name": "priv-eu-west-3a"<br>  },<br>  "eu-west-3b": {<br>    "cidr": "10.1.2.0/24",<br>    "name": "priv-eu-west-3b"<br>  },<br>  "eu-west-3c": {<br>    "cidr": "10.1.3.0/24",<br>    "name": "priv-eu-west-3c"<br>  }<br>}</pre> | no |
+| <a name="input_public_subnets"></a> [public\_subnets](#input\_public\_subnets) | Public subnets to be created | `map(any)` | <pre>{<br>  "eu-west-3a": {<br>    "cidr": "10.1.4.0/24",<br>    "name": "pub-eu-west-3a"<br>  },<br>  "eu-west-3b": {<br>    "cidr": "10.1.5.0/24",<br>    "name": "pub-eu-west-3b"<br>  },<br>  "eu-west-3c": {<br>    "cidr": "10.1.6.0/24",<br>    "name": "pub-eu-west-3c"<br>  }<br>}</pre> | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | Default tags to add to resources | `map(any)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_nat_gateway_ids"></a> [nat\_gateway\_ids](#output\_nat\_gateway\_ids) | n/a |
+| <a name="output_private_route_table_ids"></a> [private\_route\_table\_ids](#output\_private\_route\_table\_ids) | n/a |
+| <a name="output_private_subnet_ids"></a> [private\_subnet\_ids](#output\_private\_subnet\_ids) | n/a |
+| <a name="output_public_route_table_id"></a> [public\_route\_table\_id](#output\_public\_route\_table\_id) | n/a |
+| <a name="output_public_subnet_ids"></a> [public\_subnet\_ids](#output\_public\_subnet\_ids) | n/a |
+| <a name="output_vpc_arn"></a> [vpc\_arn](#output\_vpc\_arn) | n/a |
+| <a name="output_vpc_default_security_group_id"></a> [vpc\_default\_security\_group\_id](#output\_vpc\_default\_security\_group\_id) | n/a |
+| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | n/a |
+| <a name="output_vpc_main_route_table_id"></a> [vpc\_main\_route\_table\_id](#output\_vpc\_main\_route\_table\_id) | n/a |
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

aws/vpc/main.tf

@@ -0,0 +1,14 @@
+locals {
+  interpolated_tags = merge({
+    "Name"           = var.name,
+    "Customer"       = var.customer,
+    "Environment"    = var.environment,
+    "ManagedBy"      = "Terraform",
+    "LastModifiedAt" = time_static.last_update.rfc3339,
+    },
+    var.tags
+  )
+}
+
+resource "time_static" "last_update" {
+}

aws/vpc/nat-gw.tf

@@ -0,0 +1,21 @@
+// eips for nat gateways
+resource "aws_eip" "nat_gw_eips" {
+  #checkov:skip=CKV2_AWS_19:invalid - ip will be attached to nat gw
+  count = length(var.availability_zones)
+  vpc   = true
+  tags = merge(
+    { Name = "${var.name}-${var.availability_zones[count.index]}-nat-gw" },
+    local.interpolated_tags
+  )
+}
+
+// nat gateways
+resource "aws_nat_gateway" "nat_gw" {
+  count         = length(aws_eip.nat_gw_eips)
+  allocation_id = aws_eip.nat_gw_eips[count.index].id
+  subnet_id     = aws_subnet.priv_subnet[count.index].id
+  tags = merge(
+    local.interpolated_tags,
+    { Name = "${var.availability_zones[count.index]}-nat-gw" },
+  )
+}

aws/vpc/outputs.tf

@@ -0,0 +1,35 @@
+output "vpc_id" {
+  value = aws_vpc.vpc.id
+}
+
+output "vpc_arn" {
+  value = aws_vpc.vpc.arn
+}
+
+output "vpc_default_security_group_id" {
+  value = aws_vpc.vpc.default_security_group_id
+}
+
+output "vpc_main_route_table_id" {
+  value = aws_vpc.vpc.main_route_table_id
+}
+
+output "public_subnet_ids" {
+  value = aws_subnet.pub_subnet[*].id
+}
+
+output "private_subnet_ids" {
+  value = aws_subnet.priv_subnet[*].id
+}
+
+output "nat_gateway_ids" {
+  value = aws_nat_gateway.nat_gw[*].id
+}
+
+output "public_route_table_id" {
+  value = aws_route_table.public_rt.id
+}
+
+output "private_route_table_ids" {
+  value = aws_route_table.private_rt[*].id
+}

aws/vpc/providers.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws",
+      version = ">= 4.30.0, < 5.0.0"
+    }
+    time = {
+      source  = "hashicorp/time",
+      version = "~> 0.9.1"
+    }
+  }
+  required_version = "~> 1.3"
+}

aws/vpc/routes.tf

@@ -0,0 +1,44 @@
+// route tables
+resource "aws_route_table" "public_rt" {
+  vpc_id = aws_vpc.vpc.id
+  tags = merge(
+    local.interpolated_tags,
+    { Name = "${var.name}-public-rt" },
+  )
+}
+
+resource "aws_route_table" "private_rt" {
+  count  = length(var.availability_zones)
+  vpc_id = aws_vpc.vpc.id
+  tags = merge(
+    local.interpolated_tags,
+    { Name = "${var.private_subnets[var.availability_zones[count.index]].name}-private-rt" },
+  )
+}
+
+// routes
+resource "aws_route" "public_default_route" {
+  route_table_id         = aws_route_table.public_rt.id
+  destination_cidr_block = "0.0.0.0/0"
+  gateway_id             = aws_internet_gateway.igw.id
+}
+
+resource "aws_route" "private_default_route" {
+  count                  = length(var.availability_zones)
+  route_table_id         = aws_route_table.private_rt[count.index].id
+  destination_cidr_block = "0.0.0.0/0"
+  nat_gateway_id         = aws_nat_gateway.nat_gw[count.index].id
+}
+
+// routes table associations
+resource "aws_route_table_association" "private_rta" {
+  count          = length(var.availability_zones)
+  subnet_id      = aws_subnet.priv_subnet[count.index].id
+  route_table_id = aws_route_table.private_rt[count.index].id
+}
+
+resource "aws_route_table_association" "public_rta" {
+  count          = length(var.availability_zones)
+  subnet_id      = aws_subnet.pub_subnet[count.index].id
+  route_table_id = aws_route_table.public_rt.id
+}

aws/vpc/subnets-private.tf

@@ -0,0 +1,13 @@
+resource "aws_subnet" "priv_subnet" {
+  count             = length(var.availability_zones)
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = var.private_subnets[var.availability_zones[count.index]].cidr
+  availability_zone = var.availability_zones[count.index]
+  tags = merge(
+    local.interpolated_tags,
+    {
+      Name       = var.private_subnets[var.availability_zones[count.index]].name
+      SubnetType = "Private"
+    }
+  )
+}

aws/vpc/subnets-public.tf

@@ -0,0 +1,14 @@
+resource "aws_subnet" "pub_subnet" {
+  count             = length(var.availability_zones)
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = var.public_subnets[var.availability_zones[count.index]].cidr
+  availability_zone = var.availability_zones[count.index]
+  tags = merge(
+    local.interpolated_tags,
+    {
+      Name                     = var.public_subnets[var.availability_zones[count.index]].name
+      SubnetType               = "Public"
+      "kubernetes.io/role/elb" = "1"
+    }
+  )
+}

aws/vpc/variables.tf

@@ -0,0 +1,73 @@
+variable "name" {
+  description = "Name to be used on all the resources as identifier"
+  type        = string
+}
+
+variable "customer" {
+  description = "Customer for the current deployment"
+  type        = string
+  default     = ""
+}
+
+variable "environment" {
+  description = "Environment for the current deployment"
+  type        = string
+  default     = ""
+}
+
+variable "tags" {
+  description = "Default tags to add to resources"
+  type        = map(any)
+  default     = {}
+}
+
+# module specific variables
+variable "cidr_block" {
+  description = "CIDR block to be userd by the VPC"
+  type        = string
+  default     = "10.1.0.0/16"
+}
+
+variable "availability_zones" {
+  description = "AWS AZs to be used in the current region"
+  type        = list(string)
+  default     = ["eu-west-3a", "eu-west-3b", "eu-west-3c"]
+}
+
+variable "private_subnets" {
+  description = "Private subnets to be created"
+  type        = map(any)
+  default = {
+    "eu-west-3a" = {
+      name = "priv-eu-west-3a"
+      cidr = "10.1.0.0/24"
+    }
+    "eu-west-3b" = {
+      name = "priv-eu-west-3b"
+      cidr = "10.1.2.0/24"
+    }
+    "eu-west-3c" = {
+      name = "priv-eu-west-3c"
+      cidr = "10.1.3.0/24"
+    }
+  }
+}
+
+variable "public_subnets" {
+  description = "Public subnets to be created"
+  type        = map(any)
+  default = {
+    "eu-west-3a" = {
+      name = "pub-eu-west-3a"
+      cidr = "10.1.4.0/24"
+    }
+    "eu-west-3b" = {
+      name = "pub-eu-west-3b"
+      cidr = "10.1.5.0/24"
+    }
+    "eu-west-3c" = {
+      name = "pub-eu-west-3c"
+      cidr = "10.1.6.0/24"
+    }
+  }
+}

aws/vpc/vpc.tf

@@ -0,0 +1,36 @@
+data "aws_region" "current" {}
+
+#trivy:ignore:avd-aws-0178 fixme: logging is up to the user (but we can provide a switch with good default)
+resource "aws_vpc" "vpc" {
+  #checkov:skip=CKV2_AWS_11:fixme: logging is up to the user (but we can provide a switch with good default)
+  #checkov:skip=CKV2_AWS_12:fixme: we must indeed block the traffic by design
+  cidr_block           = var.cidr_block
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+  tags = merge(
+    local.interpolated_tags,
+    { Name = var.name },
+  )
+}
+
+resource "aws_vpc_dhcp_options" "dhcp_opts" {
+  domain_name         = "${data.aws_region.current.name}.compute.internal"
+  domain_name_servers = ["AmazonProvidedDNS"]
+  tags = merge(
+    local.interpolated_tags,
+    { Name = var.name },
+  )
+}
+
+resource "aws_vpc_dhcp_options_association" "dhcp_opts" {
+  vpc_id          = aws_vpc.vpc.id
+  dhcp_options_id = aws_vpc_dhcp_options.dhcp_opts.id
+}
+
+resource "aws_internet_gateway" "igw" {
+  vpc_id = aws_vpc.vpc.id
+  tags = merge(
+    local.interpolated_tags,
+    { Name = "${var.name}-igw" },
+  )
+}