This is a terraform module that creates a vpc and public and private subnets with optional nat instances or gateways.
This project is part of the Guardian Project Ops collection.
It's free and open source made available under the the APACHE2.
The VPC, nat-gateway, and nat-instance submodules are based off of Cloudposse's vpc and dynamic-subnets modules.
IMPORTANT: The master branch is used in source just as an example. In your code, do not pin to master because there may be breaking changes between releases.
Instead pin to the release tag (e.g. ?ref=tags/x.y.z) of one of our latest releases.
module "vpc" {
source = "git::https://gitlab.com/guardianproject-ops/terraform-aws-vpc?ref=master"
cidr_block = "10.55.0.0/16"
nat_instance_type = "t3.micro"
availability_zones = ["eu-central-1a", "eu-central-1b"]
nat_gateways = { "eu-central-1a" = "public_1" }
nat_instances = { "eu-central-1a" = "public_2" }
subnets = {
"eu-central-1a" = {
"public_1" = {
"cidr_block" = cidrsubnet(var.cidr_block, 8, 0)
"public_route_enabled" = true
}
"private_1" = {
"cidr_block" = cidrsubnet(var.cidr_block, 8, 1)
"public_route_enabled" = false
}
"rds_1" = {
"cidr_block" = cidrsubnet(var.cidr_block, 8, 2)
"public_route_enabled" = false
}
}
"eu-central-1b" = {
"public_2" = {
"cidr_block" = cidrsubnet(var.cidr_block, 8, 3)
"public_route_enabled" = true
}
"private_2" = {
"cidr_block" = cidrsubnet(var.cidr_block, 8, 4)
"public_route_enabled" = false
}
"rds_2" = {
"cidr_block" = cidrsubnet(var.cidr_block, 8, 5)
"public_route_enabled" = false
}
}
}
context = module.this.context
}
| Name | Version |
|---|---|
| terraform | >= 0.13 |
| Name | Version |
|---|---|
| aws | n/a |
| Name | Source | Version |
|---|---|---|
| nat_gateway | ./nat-gateway | |
| nat_instance | ./nat-instance | |
| private_label | cloudposse/label/null | 0.24.1 |
| public_label | cloudposse/label/null | 0.24.1 |
| subnets_private | ./subnet | |
| subnets_public | ./subnet | |
| this | cloudposse/label/null | 0.24.1 |
| vpc | ./vpc |
| Name | Type |
|---|---|
| aws_route_table.private | resource |
| aws_route_table.public | resource |
| aws_security_group.sg_allow_ssh | resource |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| additional_tag_map | Additional tags for appending to tags_as_list_of_maps. Not added to tags. |
map(string) |
{} |
no |
| attributes | Additional attributes (e.g. 1) |
list(string) |
[] |
no |
| availability_zones | The availability zones to create resources in | list(string) |
n/a | yes |
| aws_route_create_timeout | Time to wait for AWS route creation specifed as a Go Duration, e.g. 2m |
string |
"2m" |
no |
| aws_route_delete_timeout | Time to wait for AWS route deletion specifed as a Go Duration, e.g. 5m |
string |
"5m" |
no |
| cidr_block | Base CIDR block which will be divided into subnet CIDR blocks (e.g. 10.0.0.0/16) |
string |
n/a | yes |
| context | Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as null to use default value.Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged. |
any |
{ |
no |
| delimiter | Delimiter to be used between namespace, environment, stage, name and attributes.Defaults to - (hyphen). Set to "" to use no delimiter at all. |
string |
null |
no |
| enabled | Set to false to prevent the module from creating any resources | bool |
null |
no |
| environment | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' | string |
null |
no |
| id_length_limit | Limit id to this many characters (minimum 6).Set to 0 for unlimited length.Set to null for default, which is 0.Does not affect id_full. |
number |
null |
no |
| label_key_case | The letter case of label keys (tag names) (i.e. name, namespace, environment, stage, attributes) to use in tags.Possible values: lower, title, upper.Default value: title. |
string |
null |
no |
| label_order | The naming order of the id output and Name tag. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 5 elements, but at least one must be present. |
list(string) |
null |
no |
| label_value_case | The letter case of output label values (also used in tags and id).Possible values: lower, title, upper and none (no transformation).Default value: lower. |
string |
null |
no |
| name | Solution name, e.g. 'app' or 'jenkins' | string |
null |
no |
| namespace | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | string |
null |
no |
| nat_gateways | Map where key is the AZ and value is the name of the subnet in which to place a NAT Gateway in this AZ. | map(string) |
n/a | yes |
| nat_instance_type | NAT Instance type | string |
"t3.micro" |
no |
| nat_instances | Map where key is the AZ and value is the name of the subnet in which to place a NAT Instance in this AZ. | map(string) |
n/a | yes |
| regex_replace_chars | Regex to replace chars with empty string in namespace, environment, stage and name.If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits. |
string |
null |
no |
| stage | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | string |
null |
no |
| subnets | A list of maps describing the subnets to create. | map(map(object({ |
n/a | yes |
| tags | Additional tags (e.g. map('BusinessUnit','XYZ') |
map(string) |
{} |
no |
| Name | Description |
|---|---|
| availability_zones | n/a |
| nat_gateways | n/a |
| nat_instances | n/a |
| private_route_tables | n/a |
| private_subnets | n/a |
| public_subnets | n/a |
| ssh_security_group_id | n/a |
| vpc | n/a |
Like this project? Please give it a ★ on GitLab
Are you using this project or any of our other projects? Let us know at @guardianproject or email us directly
Check out these related projects.
File an issue, send us an email or join us in the Matrix 'verse at #guardianproject:matrix.org or IRC at #guardianproject on Freenode.
Please use the issue tracker to report any bugs or file feature requests.
If you are interested in becoming a contributor, want to get involved in developing this project, other projects, or want to join our team, we would love to hear from you! Shoot us an email.
In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.
- Fork the repo on GitLab
- Clone the project to your own machine
- Commit changes to your own branch
- Push your work back up to your fork
- Submit a Merge Request so that we can review your changes
NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!
Copyright © 2020-2021 The Guardian Project
Copyright © 2017-2021 Cloud Posse, LLC
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
See LICENSE.md for full details.
All other trademarks referenced herein are the property of their respective owners.
This project is maintained and funded by The Guardian Project.
We're a collective of designers and developers focused on useable privacy and security. Everything we do is 100% FOSS. Check out out other ops projects and non-ops projects, follow us on mastadon or twitter, apply for a job, or partner with us.
 Abel Luck |
|---|