Skip to content

Commit

Permalink
add use_single_cgw option
Browse files Browse the repository at this point in the history
  • Loading branch information
@badra001
badra001 committed Oct 6, 2022
1 parent 7e72e8e commit bb20364
Show file tree
Hide file tree
Showing 6 changed files with 43 additions and 11 deletions.
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -187,3 +187,8 @@
* 2.2.1 -- 2022-09-28
- security-groups
- add variable: enable_manage_default_sg

* 2.3.0 -- 2022-10-06
- vpn-transit-gateway
- add variable use_single_cgw to use only one CGW per site instead of one per site per VPN

2 changes: 1 addition & 1 deletion common/version.tf
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
locals {
_module_version = "2.2.1"
_module_version = "2.3.1"
_module_names = {
"_main_" = "aws-vpc-setup"

Expand Down
2 changes: 2 additions & 0 deletions vpn-transit-gateway/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ No modules.
|------|------|
| [aws_cloudwatch_log_group.log](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
| [aws_customer_gateway.vpn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/customer_gateway) | resource |
| [aws_customer_gateway.vpn_single](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/customer_gateway) | resource |
| [aws_ec2_tag.vpn_tag_created_by](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_tag) | resource |
| [aws_ec2_tag.vpn_tag_environment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_tag) | resource |
| [aws_ec2_tag.vpn_tag_name](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_tag) | resource |
Expand All @@ -83,6 +84,7 @@ No modules.
| [null_resource.directory_setup](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
| [null_resource.generate_configs](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
| [random_string.tunnel_preshared_key](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
| [random_string.tunnel_preshared_key_single](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_account_alias.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_account_alias) | data source |
Expand Down
36 changes: 30 additions & 6 deletions vpn-transit-gateway/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ locals {
# customer gateway, one per vpc per site
#---
resource "aws_customer_gateway" "vpn" {
for_each = var.create ? local.vpn_settings : {}
for_each = var.create && ! var.use_single_cgw ? local.vpn_settings : {}
bgp_asn = each.value.bgp_asn_id
ip_address = each.value.ip_address
type = "ipsec.1"
Expand All @@ -110,11 +110,35 @@ resource "aws_customer_gateway" "vpn" {
)
}

# use a single CGW
resource "aws_customer_gateway" "vpn_single" {
for_each = var.create && var.use_single_cgw ? { for k, v in local.vpn_settings : v.site => v if v.sequence == 1 } : {}
bgp_asn = each.value.bgp_asn_id
ip_address = each.value.ip_address
type = "ipsec.1"

tags = merge(
local.base_tags,
var.tags,
{
Name = format("%v%v%v-%v", (var.use_tgw_prefixes ? local._prefixes["transit-gateway-vpn"] : ""), local._prefixes["customer-gateway"], each.key, lower(each.value.environment))
"boc:tgw_environment" = var.tgw_environment
},
)
}

#---
# vpn pre-shared key (same for each tunnel per site, one per site)
#---
resource "random_string" "tunnel_preshared_key" {
for_each = var.create ? local.vpn_settings : {}
for_each = var.create && ! var.use_single_cgw ? local.vpn_settings : {}
length = 32
special = true
override_special = "._"
}

resource "random_string" "tunnel_preshared_key_single" {
for_each = var.create && var.use_single_cgw ? { for k, v in local.vpn_settings : v.site => v if v.sequence == 1 } : {}
length = 32
special = true
override_special = "._"
Expand All @@ -125,14 +149,14 @@ resource "random_string" "tunnel_preshared_key" {
#---
resource "aws_vpn_connection" "vpn" {
for_each = var.create ? local.vpn_settings : {}
type = aws_customer_gateway.vpn[each.key].type
type = var.use_single_cgw ? aws_customer_gateway.vpn_single[each.value.site].type : aws_customer_gateway.vpn[each.key].type

transit_gateway_id = var.transit_gateway_id
customer_gateway_id = aws_customer_gateway.vpn[each.key].id
austomer_gateway_id = var.use_single_cgw ? aws_customer_gateway.vpn_single[each.value.site].id : aws_customer_gateway.vpn[each.key].id
enable_acceleration = false

tunnel1_preshared_key = length(each.value.preshared_keys) == 0 ? random_string.tunnel_preshared_key[each.key].result : element(each.value.preshared_keys, 0)
tunnel2_preshared_key = length(each.value.preshared_keys) == 0 ? random_string.tunnel_preshared_key[each.key].result : element(each.value.preshared_keys, 1)
tunnel1_preshared_key = length(each.value.preshared_keys) == 0 ? (var.use_single_cgw ? random_string.tunnel_preshared_key_single[each.value.site].result : random_string.tunnel_preshared_key[each.key].result) : element(each.value.preshared_keys, 0)
tunnel2_preshared_key = length(each.value.preshared_keys) == 0 ? (var.use_single_cgw ? random_string.tunnel_preshared_key_single[each.value.site].result : random_string.tunnel_preshared_key[each.key].result) : element(each.value.preshared_keys, 0)

tunnel1_inside_cidr = length(each.value.tunnel_ips) == 0 ? null : element(each.value.tunnel_ips, 0)
tunnel2_inside_cidr = length(each.value.tunnel_ips) == 0 ? null : element(each.value.tunnel_ips, 1)
Expand Down
4 changes: 2 additions & 2 deletions vpn-transit-gateway/outputs.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,10 +47,10 @@ output "vpn_labels" {

output "customer_gateway_arns" {
description = "AWS Customer Gateway ARNs"
value = var.create ? { for k, v in aws_customer_gateway.vpn : k => v.arn } : {}
value = var.create ? (var.use_single_cgw ? { for k, v in aws_customer_gateway.vpn_single : k => v.arn } : { for k, v in aws_customer_gateway.vpn : k => v.arn }) : {}
}

output "customer_gateway_ids" {
description = "AWS Customer Gateway IDs"
value = var.create ? { for k, v in aws_customer_gateway.vpn : k => v.id } : {}
value = var.create ? (var.use_single_cgw ? { for k, v in aws_customer_gateway.vpn_single : k => v.id } : { for k, v in aws_customer_gateway.vpn : k => v.id }) : {}
}
5 changes: 3 additions & 2 deletions vpn-transit-gateway/vpn-config.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,9 @@ locals {
sequence = v.sequence
label = v.label
full_label = format("aws:%v:%v:%v:%v", local.region, local.account_id, aws_vpn_connection.vpn[k].id, v.label)
customer_address = aws_customer_gateway.vpn[k].ip_address
bgp_asn = aws_customer_gateway.vpn[k].bgp_asn
customer_address = var.use_single_cgw ? aws_customer_gateway.vpn_single[v.site].ip_address : aws_customer_gateway.vpn[k].ip_address
bgp_asn = var.use_single_cgw ? aws_customer_gateway.vpn_single[v.site].bgp_asn : aws_customer_gateway.vpn[k].bgp_asn
use_single_cgw = var.use_single_cgw
vpn_connection_id = aws_vpn_connection.vpn[k].id
vpc_cidr_block = data.aws_vpc.vpc.cidr_block
vpc_name = var.vpc_name
Expand Down

0 comments on commit bb20364

Please sign in to comment.