continue work

vpc-transit-gateway-association/README.md

@@ -32,14 +32,18 @@ module "vpc_tgw" {
 
 ## Modules
 
-No modules.
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_routing_attachment"></a> [routing\_attachment](#module\_routing\_attachment) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//routing | tf-upgrade |
 
 ## Resources
 
 | Name | Type |
 |------|------|
 | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
 | [aws_arn.network_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
+| [aws_availability_zone.zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zone) | data source |
+| [aws_availability_zones.zones](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_caller_identity.network_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_ec2_transit_gateway.gateway_peer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_transit_gateway) | data source |
@@ -57,12 +61,17 @@ No modules.
 |------|-------------|------|---------|:--------:|
 | <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias (default: will pull from current account\_alias) | `string` | `""` | no |
 | <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default: will pull from current user) | `string` | `""` | no |
+| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | AWS Availability Zones to use (by default will use all available) | `list(string)` | `[]` | no |
 | <a name="input_create"></a> [create](#input\_create) | Flag to indicate whether to create the resources or not (default: true) | `bool` | `true` | no |
 | <a name="input_network_account_profile"></a> [network\_account\_profile](#input\_network\_account\_profile) | AWS profile of the source account sharing the VPC resources | `string` | n/a | yes |
 | <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| <a name="input_route_table_label"></a> [route\_table\_label](#input\_route\_table\_label) | Route table lable for the attachment subnets | `string` | `"attachment"` | no |
+| <a name="input_subnet_ids"></a> [subnet\_ids](#input\_subnet\_ids) | List of subnet IDs for this VPC for the TGW attachment. This should be not public, and should be a separate attachment set of /28 subnets with no other use | `list(string)` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS).  Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no |
+| <a name="input_transit_gateway_environment"></a> [transit\_gateway\_environment](#input\_transit\_gateway\_environment) | Transit Gateway Environment (aka, VRF) to which to connnect this VPC | `string` | n/a | yes |
 | <a name="input_vpc_environment"></a> [vpc\_environment](#input\_vpc\_environment) | VPC environment purpose (infrastructure, common, shared, dev, stage, ite, prod) | `string` | `null` | no |
 | <a name="input_vpc_full_name"></a> [vpc\_full\_name](#input\_vpc\_full\_name) | VPC full name component (vpc{index}-{vpc\_name}) | `string` | `null` | no |
+| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC ID | `string` | n/a | yes |
 | <a name="input_vpc_index"></a> [vpc\_index](#input\_vpc\_index) | VPC index number (integer starting at 1) | `number` | `null` | no |
 | <a name="input_vpc_name"></a> [vpc\_name](#input\_vpc\_name) | VPC name component used through the VPC descrbing its purpose (ex: dice-dev) | `string` | `null` | no |
 | <a name="input_vpc_short_name"></a> [vpc\_short\_name](#input\_vpc\_short\_name) | VPC short name component (vpc{index}) | `string` | `null` | no |
@@ -71,6 +80,9 @@ No modules.
 
 | Name | Description |
 |------|-------------|
+| <a name="output_availability_zone_ids"></a> [availability\_zone\_ids](#output\_availability\_zone\_ids) | VPC Availability zone id list (3) |
+| <a name="output_availability_zone_names"></a> [availability\_zone\_names](#output\_availability\_zone\_names) | VPC Availability zone name list (3) |
+| <a name="output_availability_zone_suffixes"></a> [availability\_zone\_suffixes](#output\_availability\_zone\_suffixes) | VPC Availability zone suffix list (3) |
 | <a name="output_gateway_peer"></a> [gateway\_peer](#output\_gateway\_peer) | Transit Gateway peer (other region) |
 | <a name="output_gateway_self"></a> [gateway\_self](#output\_gateway\_self) | Transit Gateway self (this region) |
 | <a name="output_map_route_tables_peer"></a> [map\_route\_tables\_peer](#output\_map\_route\_tables\_peer) | Transit Gateway route tables map (VRF:id) peer (other region) |

vpc-transit-gateway-association/availabilty_zones.tf

@@ -0,0 +1 @@
+../common/availabilty_zones.tf

vpc-transit-gateway-association/data.transit-gateway.tf

@@ -58,3 +58,7 @@ data "aws_ec2_transit_gateway_route_table" "route_tables_peer" {
 locals {
   transit_gateway_route_table_ids_peer = { for k, v in data.aws_ec2_transit_gateway_route_table.route_tables_peer : v.tags["boc:network_vrf"] => k if contains(keys(v.tags), "boc:network_vrf") }
 }
+
+# These two hold a map of VRF => route table
+# * transit_gateway_route_table_ids_self
+# * transit_gateway_route_table_ids_peer

vpc-transit-gateway-association/main.tf

@@ -23,3 +23,10 @@ locals {
     "boc:created_by"        = "terraform"
   }
 }
+
+
+#  vpc_id = local.vpc_id
+#  vpc_full_name                = var.vpc_full_name
+#  availability_zones           = []
+#  subnet_ids          = [for sn in module.subnets.private_subnets_ids : sn if lookup(sn.tags, "boc:vpc:route-table", null) == "attachment"]
+#  route_table_label    = "attachment"

vpc-transit-gateway-association/routing.tf

@@ -0,0 +1,34 @@
+module "routing_attachment" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//routing?ref=tf-upgrade"
+  vpc_id = var.vpc_id
+
+  vpc_full_name                = var.vpc_full_name
+  availability_zones           = var.availability_zones
+  private_subnets_ids          = var.subnt_ids
+  create_public_route_table    = false
+  private_route_table_label    = var.route_table_label
+  enable_igw                   = false
+  enable_nat                   = false
+  enable_vpc_endpoint_s3       = false
+  enable_vpc_endpoint_dynamodb = false
+
+  vpc_name       = var.vpc_name
+  vpc_short_name = var.vpc_short_name
+  vpc_cidr_block = var.vpc_cidr_block
+  #  vpc_index      = var.vpc_index
+
+  tags = merge(
+    local.common_tags,
+    local.tags,
+  )
+}
+
+## # routes to tgw (for now, 10.128/16, should be each of the highest cidr blocks per account). It would be nice to use prefix lists, but not supported in gov
+## resource "aws_route" "gateway" {
+##   for_each               = module.routing.private_route_table_ids 
+##   route_table_id         = each.value
+## #  destination_cidr_block = "0.0.0.0/0"
+##   destination_cidr_block = "10.128.0.0/16"
+##   transit_gateway_id         = data.aws_ec2_transit_gateway.gateway_east.id
+##   depends_on = [ aws_ec2_transit_gateway_vpc_attachment.vpc_attachment ]
+## }

vpc-transit-gateway-association/variables.common.availability_zones.tf

@@ -0,0 +1 @@
+../common/variables.common.availability_zones.tf

vpc-transit-gateway-association/variables.common.vpc_id.tf

@@ -0,0 +1 @@
+../common//variables.common.vpc_id.tf

vpc-transit-gateway-association/variables.tf

@@ -3,3 +3,23 @@ variable "network_account_profile" {
   type        = string
 }
 
+variable "transit_gateway_environment" {
+  description = "Transit Gateway Environment (aka, VRF) to which to connnect this VPC"
+  type        = string
+
+  validation {
+    condition     = contains(local._defaults["transit-gateway-environments"], var.transit_gateway_environment)
+    error_message = "transit_gateway_environment value must be one of the valid VRF selections"
+  }
+}
+
+variable "subnet_ids" {
+  description = "List of subnet IDs for this VPC for the TGW attachment. This should be not public, and should be a separate attachment set of /28 subnets with no other use"
+  type        = list(string)
+}
+
+variable "route_table_label" {
+  description = "Route table lable for the attachment subnets"
+  type        = string
+  default     = "attachment"
+}