You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Add new sub-module for AWS flow log ([#1241](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1241)) ([33aabec](https://github.com/terraform-aws-modules/terraform-aws-vpc/commit/33aabec82036e00240b0fcfb04f1e29297a48b1b))
* Add support for IAM role path to VPC flow log IAM role ([#1232](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1232)) ([6594a41](https://github.com/terraform-aws-modules/terraform-aws-vpc/commit/6594a41db42e26db84882ba10c3be30fcb291cc4))
* Add enhanced region support ([#1225](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1225)) ([fd357b9](https://github.com/terraform-aws-modules/terraform-aws-vpc/commit/fd357b932ec2d7719779e4fcd586f4538a62d495))
Copy file name to clipboardExpand all lines: README.md
+13-27Lines changed: 13 additions & 27 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,6 +27,9 @@ module "vpc" {
27
27
}
28
28
```
29
29
30
+
> [!WARNING]
31
+
> v6.x of the module still supports creating a VPC Flow Log within the root (VPC) module. However, this is deprecated behavior and will be removed in v7.0.0. Please use the [standalone flow log](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/modules/flow-log) module instead.
32
+
30
33
## External NAT Gateway IPs
31
34
32
35
By default this module will provision new Elastic IPs for the VPC's NAT Gateways.
@@ -116,24 +119,6 @@ If you need private subnets that should have no Internet routing (in the sense o
116
119
117
120
Since AWS Lambda functions allocate Elastic Network Interfaces in proportion to the traffic received ([read more](https://docs.aws.amazon.com/lambda/latest/dg/vpc.html)), it can be useful to allocate a large private subnet for such allocations, while keeping the traffic they generate entirely internal to the VPC.
118
121
119
-
You can add additional tags with `intra_subnet_tags` as with other subnet types.
120
-
121
-
## VPC Flow Log
122
-
123
-
VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).
124
-
125
-
### VPC Flow Log Examples
126
-
127
-
By default `file_format` is `plain-text`. You can also specify `parquet` to have logs written in Apache Parquet format.
128
-
129
-
```
130
-
flow_log_file_format = "parquet"
131
-
```
132
-
133
-
### Permissions Boundary
134
-
135
-
If your organization requires a permissions boundary to be attached to the VPC Flow Log role, make sure that you specify an ARN of the permissions boundary policy as `vpc_flow_log_permissions_boundary` argument. Read more about required [IAM policy for publishing flow logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html#flow-logs-iam).
136
-
137
122
## Conditional creation
138
123
139
124
Prior to Terraform 0.13, you were unable to specify `count` in a module block. If you wish to toggle the creation of the module's resources in an older (pre 0.13) version of Terraform, you can use the `create_vpc` argument.
@@ -243,19 +228,18 @@ You disable the creation by setting the var.public_enable_default_route variable
243
228
244
229
## Examples
245
230
246
-
-[Complete VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) with VPC Endpoints.
231
+
-[Block Public Access](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/block-public-access)
-[VPC Block Public Access](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/block-public-access)
258
-
-[Few tests and edge case examples](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issues)
259
243
260
244
## Contributing
261
245
@@ -592,6 +576,7 @@ No modules.
592
576
| <aname="input_redshift_subnet_suffix"></a> [redshift\_subnet\_suffix](#input\_redshift\_subnet\_suffix)| Suffix to append to redshift subnets name |`string`|`"redshift"`| no |
593
577
| <aname="input_redshift_subnet_tags"></a> [redshift\_subnet\_tags](#input\_redshift\_subnet\_tags)| Additional tags for the redshift subnets |`map(string)`|`{}`| no |
594
578
| <aname="input_redshift_subnets"></a> [redshift\_subnets](#input\_redshift\_subnets)| A list of redshift subnets inside the VPC |`list(string)`|`[]`| no |
579
+
| <aname="input_region"></a> [region](#input\_region)| Region where the resource(s) will be managed. Defaults to the region set in the provider configuration |`string`|`null`| no |
595
580
| <aname="input_reuse_nat_ips"></a> [reuse\_nat\_ips](#input\_reuse\_nat\_ips)| Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external\_nat\_ip\_ids' variable |`bool`|`false`| no |
596
581
| <aname="input_secondary_cidr_blocks"></a> [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks)| List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool |`list(string)`|`[]`| no |
597
582
| <aname="input_single_nat_gateway"></a> [single\_nat\_gateway](#input\_single\_nat\_gateway)| Should be true if you want to provision a single shared NAT Gateway across all of your private networks |`bool`|`false`| no |
@@ -602,6 +587,7 @@ No modules.
602
587
| <aname="input_vpc_flow_log_iam_policy_name"></a> [vpc\_flow\_log\_iam\_policy\_name](#input\_vpc\_flow\_log\_iam\_policy\_name)| Name of the IAM policy |`string`|`"vpc-flow-log-to-cloudwatch"`| no |
603
588
| <aname="input_vpc_flow_log_iam_policy_use_name_prefix"></a> [vpc\_flow\_log\_iam\_policy\_use\_name\_prefix](#input\_vpc\_flow\_log\_iam\_policy\_use\_name\_prefix)| Determines whether the name of the IAM policy (`vpc_flow_log_iam_policy_name`) is used as a prefix |`bool`|`true`| no |
604
589
| <aname="input_vpc_flow_log_iam_role_name"></a> [vpc\_flow\_log\_iam\_role\_name](#input\_vpc\_flow\_log\_iam\_role\_name)| Name to use on the VPC Flow Log IAM role created |`string`|`"vpc-flow-log-role"`| no |
590
+
| <aname="input_vpc_flow_log_iam_role_path"></a> [vpc\_flow\_log\_iam\_role\_path](#input\_vpc\_flow\_log\_iam\_role\_path)| The path for the VPC Flow Log IAM Role |`string`|`null`| no |
605
591
| <aname="input_vpc_flow_log_iam_role_use_name_prefix"></a> [vpc\_flow\_log\_iam\_role\_use\_name\_prefix](#input\_vpc\_flow\_log\_iam\_role\_use\_name\_prefix)| Determines whether the IAM role name (`vpc_flow_log_iam_role_name_name`) is used as a prefix |`bool`|`true`| no |
606
592
| <aname="input_vpc_flow_log_permissions_boundary"></a> [vpc\_flow\_log\_permissions\_boundary](#input\_vpc\_flow\_log\_permissions\_boundary)| The ARN of the Permissions Boundary for the VPC Flow Log IAM Role |`string`|`null`| no |
607
593
| <aname="input_vpc_flow_log_tags"></a> [vpc\_flow\_log\_tags](#input\_vpc\_flow\_log\_tags)| Additional tags for the VPC Flow Logs |`map(string)`|`{}`| no |
The examples provided demonstrate different cluster configurations that users can create with the modules provided.
4
+
5
+
Please do not mistake the examples provided as "best practices". It is up to users to consult the AWS service documentation for best practices, usage recommendations, etc.
Copy file name to clipboardExpand all lines: examples/complete/README.md
-4Lines changed: 0 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -154,10 +154,6 @@ No inputs.
154
154
| <aname="output_vpc_endpoints"></a> [vpc\_endpoints](#output\_vpc\_endpoints)| Array containing the full resource object and attributes for all endpoints created |
155
155
| <aname="output_vpc_endpoints_security_group_arn"></a> [vpc\_endpoints\_security\_group\_arn](#output\_vpc\_endpoints\_security\_group\_arn)| Amazon Resource Name (ARN) of the security group |
156
156
| <aname="output_vpc_endpoints_security_group_id"></a> [vpc\_endpoints\_security\_group\_id](#output\_vpc\_endpoints\_security\_group\_id)| ID of the security group |
157
-
| <aname="output_vpc_flow_log_cloudwatch_iam_role_arn"></a> [vpc\_flow\_log\_cloudwatch\_iam\_role\_arn](#output\_vpc\_flow\_log\_cloudwatch\_iam\_role\_arn)| The ARN of the IAM role used when pushing logs to Cloudwatch log group |
158
-
| <aname="output_vpc_flow_log_destination_arn"></a> [vpc\_flow\_log\_destination\_arn](#output\_vpc\_flow\_log\_destination\_arn)| The ARN of the destination for VPC Flow Logs |
159
-
| <aname="output_vpc_flow_log_destination_type"></a> [vpc\_flow\_log\_destination\_type](#output\_vpc\_flow\_log\_destination\_type)| The type of the destination for VPC Flow Logs |
160
-
| <aname="output_vpc_flow_log_id"></a> [vpc\_flow\_log\_id](#output\_vpc\_flow\_log\_id)| The ID of the Flow Log resource |
161
157
| <aname="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id)| The ID of the VPC |
162
158
| <aname="output_vpc_instance_tenancy"></a> [vpc\_instance\_tenancy](#output\_vpc\_instance\_tenancy)| Tenancy of instances spin up within VPC |
163
159
| <aname="output_vpc_ipv6_association_id"></a> [vpc\_ipv6\_association\_id](#output\_vpc\_ipv6\_association\_id)| The association ID for the IPv6 CIDR block |
Configuration in this directory creates a set of VPC resources with VPC Flow Logs enabled in different configurations:
4
+
5
+
- Flow log to CloudWatch logs using module created CloudWatch log group and IAM role
6
+
- Flow log to CloudWatch logs using external CloudWatch log group and IAM role
7
+
- Flow log to S3 bucket in text format
8
+
- Flow log to S3 bucket in Parquet format
9
+
10
+
## Usage
11
+
12
+
To run this example you need to execute:
13
+
14
+
```bash
15
+
$ terraform init
16
+
$ terraform plan
17
+
$ terraform apply
18
+
```
19
+
20
+
Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources.
|[aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones)| data source |
56
+
57
+
## Inputs
58
+
59
+
No inputs.
60
+
61
+
## Outputs
62
+
63
+
| Name | Description |
64
+
|------|-------------|
65
+
| <aname="output_arn"></a> [arn](#output\_arn)| The ARN of the Flow Log |
66
+
| <aname="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn)| ARN of CloudWatch log group created |
67
+
| <aname="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name)| Name of CloudWatch log group created |
68
+
| <aname="output_iam_role_arn"></a> [iam\_role\_arn](#output\_iam\_role\_arn)| The Amazon Resource Name (ARN) specifying the IAM role |
69
+
| <aname="output_iam_role_name"></a> [iam\_role\_name](#output\_iam\_role\_name)| The name of the IAM role |
70
+
| <aname="output_iam_role_unique_id"></a> [iam\_role\_unique\_id](#output\_iam\_role\_unique\_id)| Stable and unique string identifying the IAM role |
71
+
| <aname="output_id"></a> [id](#output\_id)| The ID of the Flow Log |
0 commit comments