diff --git a/vpc-transit-gateway-association/README.md b/vpc-transit-gateway-association/README.md index b244ecf..d6e155e 100644 --- a/vpc-transit-gateway-association/README.md +++ b/vpc-transit-gateway-association/README.md @@ -1,13 +1,15 @@ # About aws-vpc-setup :: vpc-transit-gateway-association -# Usage +This sets up the necessary transit gateway configuration for attaching a VPC with all of the components. It does the following: -```hcl -module "vpc_tgw" { - source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//vpc-transit-gateway-association?ref=tf-upgrade" - network_account_profile = "057445207498-ent-gov-network-sa" -} -``` +* gets transit gateway ID shared to this account and region +* gets transit gateway route tables +* creates routes for the attachment subnets to the transit gatewway +* creates routes to all other things on the transit gateway through a network prefix +* attaches the VPC to the transit gateway +* propagates the route to the associated route tables for the envirornment/VRF + * services is propagated to all +* creates static routes for transit gateway route tables in a peer region ## Requirements @@ -40,6 +42,13 @@ module "vpc_tgw" { | Name | Type | |------|------| +| [aws_ec2_transit_gateway_route.vpc_peer_all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource | +| [aws_ec2_transit_gateway_route.vpc_peer_common](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource | +| [aws_ec2_transit_gateway_route.vpc_peer_own_rt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource | +| [aws_ec2_transit_gateway_route_table_association.route_table_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_association) | resource | +| [aws_ec2_transit_gateway_route_table_propagation.vpc_self_common](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_propagation) | resource | +| [aws_ec2_transit_gateway_route_table_propagation.vpc_self_own_rt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_propagation) | resource | +| [aws_ec2_transit_gateway_vpc_attachment.vpc_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) | resource | | [aws_route.gateway_ipv4](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource | | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | | [aws_arn.network_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | @@ -51,6 +60,8 @@ module "vpc_tgw" { | [aws_ec2_managed_prefix_lists.tgw_ipv4](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_managed_prefix_lists) | data source | | [aws_ec2_transit_gateway.gateway_peer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_transit_gateway) | data source | | [aws_ec2_transit_gateway.gateway_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_transit_gateway) | data source | +| [aws_ec2_transit_gateway_peering_attachment.attachment_peer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_transit_gateway_peering_attachment) | data source | +| [aws_ec2_transit_gateway_peering_attachment.attachment_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_transit_gateway_peering_attachment) | data source | | [aws_ec2_transit_gateway_route_table.route_tables_peer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_transit_gateway_route_table) | data source | | [aws_ec2_transit_gateway_route_table.route_tables_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_transit_gateway_route_table) | data source | | [aws_ec2_transit_gateway_route_tables.route_tables_peer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_transit_gateway_route_tables) | data source | @@ -73,6 +84,7 @@ module "vpc_tgw" { | [route\_table\_label](#input\_route\_table\_label) | Route table lable for the attachment subnets | `string` | `"attachment"` | no | | [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no | | [transit\_gateway\_environment](#input\_transit\_gateway\_environment) | Transit Gateway Environment (aka, VRF) to which to connnect this VPC | `string` | n/a | yes | +| [transit\_gateway\_routing\_type](#input\_transit\_gateway\_routing\_type) | Transit Gateway routing type, to select either self or peer (where we may have many peers) | `string` | n/a | yes | | [vpc\_environment](#input\_vpc\_environment) | VPC environment purpose (infrastructure, common, shared, dev, stage, ite, prod) | `string` | `null` | no | | [vpc\_full\_name](#input\_vpc\_full\_name) | VPC full name component (vpc{index}-{vpc\_name}) | `string` | `null` | no | | [vpc\_id](#input\_vpc\_id) | VPC ID | `string` | n/a | yes | diff --git a/vpc-transit-gateway-association/data.transit-gateway.tf b/vpc-transit-gateway-association/data.transit-gateway.tf index ab2b12a..552a02d 100644 --- a/vpc-transit-gateway-association/data.transit-gateway.tf +++ b/vpc-transit-gateway-association/data.transit-gateway.tf @@ -62,3 +62,23 @@ locals { # These two hold a map of VRF => route table # * transit_gateway_route_table_ids_self # * transit_gateway_route_table_ids_peer + +#--- +# peering attachments +#--- +data "aws_ec2_transit_gateway_peering_attachment" "attachment_self" { + provider = aws.self + filter { + name = "transit-gateway-id" + values = [data.aws_ec2_transit_gateway.gateway_self.id] + } +} + +data "aws_ec2_transit_gateway_peering_attachment" "attachment_peer" { + provider = aws.peer + filter { + name = "transit-gateway-id" + values = [data.aws_ec2_transit_gateway.gateway_peer.id] + } +} + diff --git a/vpc-transit-gateway-association/main.tf b/vpc-transit-gateway-association/main.tf index 0891e3e..2585da5 100644 --- a/vpc-transit-gateway-association/main.tf +++ b/vpc-transit-gateway-association/main.tf @@ -1,6 +1,17 @@ /* * # About aws-vpc-setup :: vpc-transit-gateway-association * +* This sets up the necessary transit gateway configuration for attaching a VPC with all of the components. It does the following: +* +* * gets transit gateway ID shared to this account and region +* * gets transit gateway route tables +* * creates routes for the attachment subnets to the transit gatewway +* * creates routes to all other things on the transit gateway through a network prefix +* * attaches the VPC to the transit gateway +* * propagates the route to the associated route tables for the envirornment/VRF +* * services is propagated to all +* * creates static routes for transit gateway route tables in a peer region + * # Usage * * ```hcl diff --git a/vpc-transit-gateway-association/routing.tf b/vpc-transit-gateway-association/routing.tf index 88c21b5..ae58c60 100644 --- a/vpc-transit-gateway-association/routing.tf +++ b/vpc-transit-gateway-association/routing.tf @@ -2,8 +2,9 @@ module "routing_attachment_ipv4" { source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//routing?ref=tf-upgrade" vpc_id = var.vpc_id - vpc_full_name = var.vpc_full_name - availability_zones = var.availability_zones + vpc_full_name = var.vpc_full_name + availability_zones = var.availability_zones + # private_subnets_ids = [for sn in module.subnets.private_subnets_ids : sn.id if lookup(sn.tags, "boc:vpc:route-table", null) == "attachment"] private_subnets_ids = var.private_subnets_ids create_public_route_table = false private_route_table_label = var.route_table_label @@ -35,6 +36,7 @@ data "aws_ec2_managed_prefix_list" "tgw_ipv4" { id = each.key } +# pick the first prefix list found, either NAME or NAME.ipv4 resource "aws_route" "gateway_ipv4" { for_each = module.routing_ipv4.private_route_table_ids diff --git a/vpc-transit-gateway-association/variables.tf b/vpc-transit-gateway-association/variables.tf index a67a7e1..29ad7f0 100644 --- a/vpc-transit-gateway-association/variables.tf +++ b/vpc-transit-gateway-association/variables.tf @@ -13,6 +13,16 @@ variable "transit_gateway_environment" { } } +variable "transit_gateway_routing_type" { + description = "Transit Gateway routing type, to select either self or peer (where we may have many peers)" + type = string + + validation { + condition = contains(["self", "peer"], var.transit_gateway_routing_type) + error_message = "transit_gateway_routing_type must be either self or peer" + } +} + ## variable "subnet_ids" { ## description = "List of subnet IDs for this VPC for the TGW attachment. This should be not public, and should be a separate attachment set of /28 subnets with no other use" ## type = list(string)