feat: Add EC2 Instance Connect Endpoint support

Author: alvinjaison

README.md

@@ -264,6 +264,7 @@ No modules.
 | [aws_default_route_table.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table) | resource |
 | [aws_default_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | resource |
 | [aws_default_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc) | resource |
+| [aws_ec2_instance_connect_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_instance_connect_endpoint) | resource |
 | [aws_egress_only_internet_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/egress_only_internet_gateway) | resource |
 | [aws_eip.nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
 | [aws_elasticache_subnet_group.elasticache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | resource |
@@ -359,6 +360,7 @@ No modules.
 | <a name="input_create_flow_log_cloudwatch_iam_role"></a> [create\_flow\_log\_cloudwatch\_iam\_role](#input\_create\_flow\_log\_cloudwatch\_iam\_role) | Whether to create IAM role for VPC Flow Logs | `bool` | `false` | no |
 | <a name="input_create_flow_log_cloudwatch_log_group"></a> [create\_flow\_log\_cloudwatch\_log\_group](#input\_create\_flow\_log\_cloudwatch\_log\_group) | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |
 | <a name="input_create_igw"></a> [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
+| <a name="input_create_instance_connect_endpoint"></a> [create\_instance\_connect\_endpoint](#input\_create\_instance\_connect\_endpoint) | Whether to create EC2 Instance Connect Endpoint(s) | `bool` | `false` | no |
 | <a name="input_create_multiple_intra_route_tables"></a> [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 | <a name="input_create_multiple_public_route_tables"></a> [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
 | <a name="input_create_private_nat_gateway_route"></a> [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the private subnets | `bool` | `true` | no |
@@ -456,6 +458,10 @@ No modules.
 | <a name="input_flow_log_per_hour_partition"></a> [flow\_log\_per\_hour\_partition](#input\_flow\_log\_per\_hour\_partition) | (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries | `bool` | `false` | no |
 | <a name="input_flow_log_traffic_type"></a> [flow\_log\_traffic\_type](#input\_flow\_log\_traffic\_type) | The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL | `string` | `"ALL"` | no |
 | <a name="input_igw_tags"></a> [igw\_tags](#input\_igw\_tags) | Additional tags for the internet gateway | `map(string)` | `{}` | no |
+| <a name="input_instance_connect_endpoint_create_in_private_subnets"></a> [instance\_connect\_endpoint\_create\_in\_private\_subnets](#input\_instance\_connect\_endpoint\_create\_in\_private\_subnets) | Create EC2 Instance Connect Endpoint(s) in all private subnets if no subnet IDs are provided | `bool` | `true` | no |
+| <a name="input_instance_connect_endpoint_subnets"></a> [instance\_connect\_endpoint\_subnets](#input\_instance\_connect\_endpoint\_subnets) | List of subnet IDs where EC2 Instance Connect Endpoint(s) should be created. If null and create\_in\_private\_subnets is true, defaults to private subnets | `list(string)` | `null` | no |
+| <a name="input_instance_connect_security_group_ids"></a> [instance\_connect\_security\_group\_ids](#input\_instance\_connect\_security\_group\_ids) | List of security group IDs to associate with EC2 Instance Connect Endpoint(s). If null, defaults to no security groups | `list(string)` | `null` | no |
+| <a name="input_instance_connect_tags"></a> [instance\_connect\_tags](#input\_instance\_connect\_tags) | Additional tags for EC2 Instance Connect Endpoint resources | `map(string)` | `{}` | no |
 | <a name="input_instance_tenancy"></a> [instance\_tenancy](#input\_instance\_tenancy) | A tenancy option for instances launched into the VPC | `string` | `"default"` | no |
 | <a name="input_intra_acl_tags"></a> [intra\_acl\_tags](#input\_intra\_acl\_tags) | Additional tags for the intra subnets network ACL | `map(string)` | `{}` | no |
 | <a name="input_intra_dedicated_network_acl"></a> [intra\_dedicated\_network\_acl](#input\_intra\_dedicated\_network\_acl) | Whether to use dedicated network ACL (not default) and custom rules for intra subnets | `bool` | `false` | no |
@@ -632,6 +638,10 @@ No modules.
 | <a name="output_elasticache_subnets_ipv6_cidr_blocks"></a> [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
 | <a name="output_igw_arn"></a> [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 | <a name="output_igw_id"></a> [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
+| <a name="output_instance_connect_endpoint_arns"></a> [instance\_connect\_endpoint\_arns](#output\_instance\_connect\_endpoint\_arns) | ARNs of the EC2 Instance Connect Endpoint(s) |
+| <a name="output_instance_connect_endpoint_ids"></a> [instance\_connect\_endpoint\_ids](#output\_instance\_connect\_endpoint\_ids) | IDs of the EC2 Instance Connect Endpoint(s) created |
+| <a name="output_instance_connect_endpoint_security_group_ids"></a> [instance\_connect\_endpoint\_security\_group\_ids](#output\_instance\_connect\_endpoint\_security\_group\_ids) | Security group IDs associated with the EC2 Instance Connect Endpoint(s) |
+| <a name="output_instance_connect_endpoint_subnet_ids"></a> [instance\_connect\_endpoint\_subnet\_ids](#output\_instance\_connect\_endpoint\_subnet\_ids) | Subnet IDs where EC2 Instance Connect Endpoint(s) were created |
 | <a name="output_intra_network_acl_arn"></a> [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
 | <a name="output_intra_network_acl_id"></a> [intra\_network\_acl\_id](#output\_intra\_network\_acl\_id) | ID of the intra network ACL |
 | <a name="output_intra_route_table_association_ids"></a> [intra\_route\_table\_association\_ids](#output\_intra\_route\_table\_association\_ids) | List of IDs of the intra route table association |

main.tf

@@ -19,8 +19,20 @@ locals {
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")
 
   create_vpc = var.create_vpc && var.putin_khuylo
+
+  # EC2 Instance Connect Endpoint target subnets
+  instance_connect_target_subnets = (
+    var.instance_connect_endpoint_subnets != null && length(var.instance_connect_endpoint_subnets) > 0
+    ? var.instance_connect_endpoint_subnets
+    : (
+      var.instance_connect_endpoint_create_in_private_subnets && local.len_private_subnets > 0
+      ? aws_subnet.private[*].id
+      : []
+    )
+  )
 }
 
+
 ################################################################################
 # VPC
 ################################################################################
@@ -1541,3 +1553,30 @@ resource "aws_default_route_table" "default" {
     var.default_route_table_tags,
   )
 }
+
+################################################################################
+# EC2 Instance Connect Endpoint
+################################################################################
+
+resource "aws_ec2_instance_connect_endpoint" "this" {
+  for_each = var.create_instance_connect_endpoint ? {
+    for idx, subnet_id in local.instance_connect_target_subnets : idx => subnet_id
+  } : {}
+
+  subnet_id = each.value
+
+  security_group_ids = (
+    var.instance_connect_security_group_ids != null
+    ? var.instance_connect_security_group_ids
+    : []
+  )
+
+
+  tags = merge(
+    var.tags,
+    var.instance_connect_tags,
+    {
+      Name = "${var.name}-ec2-instance-connect-${each.key}"
+    }
+  )
+}

outputs.tf

@@ -667,3 +667,27 @@ output "name" {
   description = "The name of the VPC specified as argument to this module"
   value       = var.name
 }
+
+################################################################################
+# EC2 Instance Connect Endpoint
+################################################################################
+
+output "instance_connect_endpoint_ids" {
+  description = "IDs of the EC2 Instance Connect Endpoint(s) created"
+  value       = try([for v in aws_ec2_instance_connect_endpoint.this : v.id], [])
+}
+
+output "instance_connect_endpoint_subnet_ids" {
+  description = "Subnet IDs where EC2 Instance Connect Endpoint(s) were created"
+  value       = try([for v in aws_ec2_instance_connect_endpoint.this : v.subnet_id], [])
+}
+
+output "instance_connect_endpoint_security_group_ids" {
+  description = "Security group IDs associated with the EC2 Instance Connect Endpoint(s)"
+  value       = try(var.instance_connect_security_group_ids, [])
+}
+
+output "instance_connect_endpoint_arns" {
+  description = "ARNs of the EC2 Instance Connect Endpoint(s)"
+  value       = try([for v in aws_ec2_instance_connect_endpoint.this : v.arn], [])
+}

variables.tf

@@ -1678,3 +1678,37 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+################################################################################
+# EC2 Instance Connect Endpoint
+################################################################################
+
+variable "create_instance_connect_endpoint" {
+  type        = bool
+  default     = false
+  description = "Whether to create EC2 Instance Connect Endpoint(s)"
+}
+
+variable "instance_connect_endpoint_create_in_private_subnets" {
+  type        = bool
+  default     = true
+  description = "Create EC2 Instance Connect Endpoint(s) in all private subnets if no subnet IDs are provided"
+}
+
+variable "instance_connect_endpoint_subnets" {
+  type        = list(string)
+  default     = null
+  description = "List of subnet IDs where EC2 Instance Connect Endpoint(s) should be created. If null and create_in_private_subnets is true, defaults to private subnets"
+}
+
+variable "instance_connect_security_group_ids" {
+  type        = list(string)
+  default     = null
+  description = "List of security group IDs to associate with EC2 Instance Connect Endpoint(s). If null, defaults to no security groups"
+}
+
+variable "instance_connect_tags" {
+  type        = map(string)
+  default     = {}
+  description = "Additional tags for EC2 Instance Connect Endpoint resources"
+}

wrappers/main.tf

@@ -16,6 +16,7 @@ module "wrapper" {
   create_flow_log_cloudwatch_iam_role    = try(each.value.create_flow_log_cloudwatch_iam_role, var.defaults.create_flow_log_cloudwatch_iam_role, false)
   create_flow_log_cloudwatch_log_group   = try(each.value.create_flow_log_cloudwatch_log_group, var.defaults.create_flow_log_cloudwatch_log_group, false)
   create_igw                             = try(each.value.create_igw, var.defaults.create_igw, true)
+  create_instance_connect_endpoint       = try(each.value.create_instance_connect_endpoint, var.defaults.create_instance_connect_endpoint, false)
   create_multiple_intra_route_tables     = try(each.value.create_multiple_intra_route_tables, var.defaults.create_multiple_intra_route_tables, false)
   create_multiple_public_route_tables    = try(each.value.create_multiple_public_route_tables, var.defaults.create_multiple_public_route_tables, false)
   create_private_nat_gateway_route       = try(each.value.create_private_nat_gateway_route, var.defaults.create_private_nat_gateway_route, true)
@@ -183,6 +184,10 @@ module "wrapper" {
   flow_log_per_hour_partition                                       = try(each.value.flow_log_per_hour_partition, var.defaults.flow_log_per_hour_partition, false)
   flow_log_traffic_type                                             = try(each.value.flow_log_traffic_type, var.defaults.flow_log_traffic_type, "ALL")
   igw_tags                                                          = try(each.value.igw_tags, var.defaults.igw_tags, {})
+  instance_connect_endpoint_create_in_private_subnets               = try(each.value.instance_connect_endpoint_create_in_private_subnets, var.defaults.instance_connect_endpoint_create_in_private_subnets, true)
+  instance_connect_endpoint_subnets                                 = try(each.value.instance_connect_endpoint_subnets, var.defaults.instance_connect_endpoint_subnets, null)
+  instance_connect_security_group_ids                               = try(each.value.instance_connect_security_group_ids, var.defaults.instance_connect_security_group_ids, null)
+  instance_connect_tags                                             = try(each.value.instance_connect_tags, var.defaults.instance_connect_tags, {})
   instance_tenancy                                                  = try(each.value.instance_tenancy, var.defaults.instance_tenancy, "default")
   intra_acl_tags                                                    = try(each.value.intra_acl_tags, var.defaults.intra_acl_tags, {})
   intra_dedicated_network_acl                                       = try(each.value.intra_dedicated_network_acl, var.defaults.intra_dedicated_network_acl, false)