terraform: default to random cidr block for vpcs

clstokes · clstokes · commit 09b6c318311b · 2025-11-06T11:47:34.000-05:00
diff --git a/terraform/aws/aws-ec2-autoscaling-dual-subnet/main.tf b/terraform/aws/aws-ec2-autoscaling-dual-subnet/main.tf
@@ -36,11 +36,6 @@ module "vpc" {
 
   name = local.name
   tags = local.aws_tags
-
-  cidr = "10.0.80.0/22"
-
-  public_subnets  = ["10.0.80.0/24"]
-  private_subnets = ["10.0.81.0/24"]
 }
 
 resource "tailscale_tailnet_key" "main" {
diff --git a/terraform/aws/aws-ec2-autoscaling-dual-subnet/outputs.tf b/terraform/aws/aws-ec2-autoscaling-dual-subnet/outputs.tf
@@ -2,6 +2,10 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
+output "vpc_cidr" {
+  value = module.vpc.vpc_cidr_block
+}
+
 output "nat_public_ips" {
   value = module.vpc.nat_public_ips
 }
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf b/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf
@@ -31,11 +31,6 @@ module "vpc" {
 
   name = local.name
   tags = local.aws_tags
-
-  cidr = "10.0.80.0/22"
-
-  public_subnets  = ["10.0.80.0/24"]
-  private_subnets = ["10.0.81.0/24"]
 }
 
 resource "aws_vpc_endpoint" "recorder" {
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf b/terraform/aws/aws-ec2-autoscaling-session-recorder/outputs.tf
@@ -2,6 +2,10 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
+output "vpc_cidr" {
+  value = module.vpc.vpc_cidr_block
+}
+
 output "nat_public_ips" {
   value = module.vpc.nat_public_ips
 }
diff --git a/terraform/aws/aws-ec2-autoscaling/main.tf b/terraform/aws/aws-ec2-autoscaling/main.tf
@@ -35,11 +35,6 @@ module "vpc" {
 
   name = local.name
   tags = local.aws_tags
-
-  cidr = "10.0.80.0/22"
-
-  public_subnets  = ["10.0.80.0/24"]
-  private_subnets = ["10.0.81.0/24"]
 }
 
 resource "tailscale_tailnet_key" "main" {
diff --git a/terraform/aws/aws-ec2-autoscaling/outputs.tf b/terraform/aws/aws-ec2-autoscaling/outputs.tf
@@ -2,6 +2,10 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
+output "vpc_cidr" {
+  value = module.vpc.vpc_cidr_block
+}
+
 output "nat_public_ips" {
   value = module.vpc.nat_public_ips
 }
diff --git a/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/main.tf b/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/main.tf
@@ -36,11 +36,6 @@ module "vpc" {
   name = local.name
   tags = local.aws_tags
 
-  cidr = "10.0.80.0/22"
-
-  public_subnets  = ["10.0.80.0/24"]
-  private_subnets = ["10.0.81.0/24"]
-
   enable_ipv6 = true
 }
 
diff --git a/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/outputs.tf b/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/outputs.tf
@@ -2,6 +2,10 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
+output "vpc_cidr" {
+  value = module.vpc.vpc_cidr_block
+}
+
 output "nat_public_ips" {
   value = module.vpc.nat_public_ips
 }
diff --git a/terraform/aws/aws-ec2-instance/main.tf b/terraform/aws/aws-ec2-instance/main.tf
@@ -35,11 +35,6 @@ module "vpc" {
 
   name = local.name
   tags = local.aws_tags
-
-  cidr = "10.0.80.0/22"
-
-  public_subnets  = ["10.0.80.0/24"]
-  private_subnets = ["10.0.81.0/24"]
 }
 
 resource "tailscale_tailnet_key" "main" {
diff --git a/terraform/aws/aws-ec2-instance/outputs.tf b/terraform/aws/aws-ec2-instance/outputs.tf
@@ -2,6 +2,10 @@ output "vpc_id" {
   value = module.vpc.vpc_id
 }
 
+output "vpc_cidr" {
+  value = module.vpc.vpc_cidr_block
+}
+
 output "nat_public_ips" {
   value = module.vpc.nat_public_ips
 }
diff --git a/terraform/aws/internal-modules/aws-vpc/main.tf b/terraform/aws/internal-modules/aws-vpc/main.tf
@@ -1,5 +1,15 @@
-data "aws_availability_zones" "available" {
-  state = "available"
+locals {
+  vpc_cidr            = var.cidr == "" ? cidrsubnet("10.0.0.0/16", 6, random_integer.vpc_cidr[0].result) : var.cidr # /22
+  public_subnet_cidr  = length(var.public_subnets) == 0 ? [cidrsubnet(local.vpc_cidr, 2, 0)] : var.public_subnets   # /24 inside the /22
+  private_subnet_cidr = length(var.private_subnets) == 0 ? [cidrsubnet(local.vpc_cidr, 2, 1)] : var.private_subnets # next /24
+}
+
+# Pick a random /22 within 10.0.0.0/16
+resource "random_integer" "vpc_cidr" {
+  count = var.cidr == "" ? 1 : 0
+
+  min = 0
+  max = 63 # 2^(22-16)-1 = 64 slices in a /16
 }
 
 module "vpc" {
@@ -13,11 +23,11 @@ module "vpc" {
   public_subnet_tags  = merge(var.tags, { Name = "${var.name}-public" })
   private_subnet_tags = merge(var.tags, { Name = "${var.name}-private" })
 
-  cidr = var.cidr
+  azs = var.azs != null ? var.azs : data.aws_availability_zones.available.zone_ids
 
-  azs             = var.azs != null ? var.azs : data.aws_availability_zones.available.zone_ids
-  public_subnets  = var.public_subnets
-  private_subnets = var.private_subnets
+  cidr            = local.vpc_cidr
+  public_subnets  = local.public_subnet_cidr
+  private_subnets = local.private_subnet_cidr
 
   map_public_ip_on_launch = true
   enable_nat_gateway      = true
@@ -30,3 +40,7 @@ module "vpc" {
   public_subnet_ipv6_prefixes                   = range(0, length(var.public_subnets))
   private_subnet_ipv6_prefixes                  = range(10, 10 + length(var.private_subnets))
 }
+
+data "aws_availability_zones" "available" {
+  state = "available"
+}
diff --git a/terraform/aws/internal-modules/aws-vpc/variables.tf b/terraform/aws/internal-modules/aws-vpc/variables.tf
@@ -21,14 +21,17 @@ variable "azs" {
 variable "cidr" {
   description = "IPv4 CIDR block for the VPC"
   type        = string
+  default     = ""
 }
 variable "public_subnets" {
   description = "List of public subnet CIDR blocks"
   type        = list(string)
+  default     = []
 }
 variable "private_subnets" {
   description = "List of private subnet CIDR blocks"
   type        = list(string)
+  default     = []
 }
 variable "enable_ipv6" {
   description = "Conditional to provision IPV6 VPC resources too"

Original file line number	Diff line number	Diff line change
`@@ -2,6 +2,10 @@ output "vpc_id" {`
`2`	`2`	`value = module.vpc.vpc_id`
`3`	`3`	`}`
`4`	`4`
	`5`	`+output "vpc_cidr" {`
	`6`	`+ value = module.vpc.vpc_cidr_block`
	`7`	`+}`
	`8`	`+`
`5`	`9`	`output "nat_public_ips" {`
`6`	`10`	`value = module.vpc.nat_public_ips`
`7`	`11`	`}`