vpc

Virtual Private Cloud (VPC)

This module creates a pre-configured VPC with a pair of subnets split over one or many availability zones (AZ). Each of the AZs created has a public and private subnet. The public subnet has a public IP address attached and has a route to the internet. The private subnet has a route to the internet through a nat gateway.

Architecture

This module allows you to deploy two types of architecture high availability and single zone mode.

High Availability Mode

Please Note: This might not work outside of ca-central-1

High Availability mode deploys in each AZ in a region. This is what you should chose if you want to target Protected B, Medium Integrity, Medium Availability (PBMM).

Single Zone mode

Please Note: This should not be used in a PBMM Production environment.

Single Zone mode deployes in the first AZ in a region that is found by the availability lookup. This will work for if you want to save money in dev.

Breaking change with v9.0.0

If you upgrade to v9.0.0 or above from a lower version, the high_availability flag is deprecated and no longer available. You will need to do the following in order to upgrade to a higher version:

1. Remove the high_availability flag
2. Instead add the following to your code:

  availability_zones = 3
  cidrsubnet_newbits = 8

3. Run terraform/terragrunt plan. You should have no changes in your infrastucture.

Requirements

Name	Version
aws	>= 5

Providers

Name	Version
aws	>= 5

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_log_group.flow_logs	resource
aws_default_network_acl.default	resource
aws_default_route_table.default	resource
aws_default_security_group.default	resource
aws_eip.nat	resource
aws_flow_log.flow_logs	resource
aws_iam_policy.vpc_metrics_flow_logs_write_policy	resource
aws_iam_role.flow_logs	resource
aws_iam_role_policy_attachment.vpc_metrics_flow_logs_write_policy_attach	resource
aws_internet_gateway.gw	resource
aws_nat_gateway.nat_gw	resource
aws_network_acl.main	resource
aws_network_acl_rule.block_rdp	resource
aws_network_acl_rule.block_ssh	resource
aws_network_acl_rule.https_request_egress_443	resource
aws_network_acl_rule.https_request_in_ingress_443	resource
aws_network_acl_rule.https_request_in_ingress_ephemeral	resource
aws_network_acl_rule.https_request_in_response_egress_443	resource
aws_network_acl_rule.https_request_in_response_egress_ephemeral	resource
aws_network_acl_rule.https_request_out_egress_ephemeral	resource
aws_network_acl_rule.https_request_out_response_ingress_443	resource
aws_network_acl_rule.https_request_out_response_ingress_ephemeral	resource
aws_route.private_nat_gateway	resource
aws_route.public_internet_gateway	resource
aws_route_table.private	resource
aws_route_table.public	resource
aws_route_table_association.private	resource
aws_route_table_association.public	resource
aws_subnet.private	resource
aws_subnet.public	resource
aws_vpc.main	resource
aws_availability_zones.available	data source
aws_iam_policy_document.vpc_flow_logs_service_principal	data source
aws_iam_policy_document.vpc_metrics_flow_logs_write	data source

Inputs

Name	Description	Type	Default	Required
allow_https_request_in	(Optional, default 'false') Allow HTTPS connections on port 443 in from the internet	bool	false	no
allow_https_request_in_response	(Optional, default 'false') Allow a response back to the internet in reply to a request	bool	false	no
allow_https_request_out	(Optional, default 'false') Allow HTTPS connections on port 443 out to the internet	bool	false	no
allow_https_request_out_response	(Optional, default 'false') Allow a response back from the internet in reply to a request	bool	false	no
availability_zones	(Optional, default '1') The number of availability zones to use	number	1	no
billing_tag_key	(Optional, default 'CostCentre') The name of the billing tag	string	"CostCentre"	no
billing_tag_value	(Required) The value of the billing tag	string	n/a	yes
block_rdp	(Optional, default 'true') Whether or not to block Port 3389	bool	true	no
block_ssh	(Optional, default 'true') Whether or not to block Port 22	bool	true	no
cidr	(Optional, default '10.0.0.0/16') The CIDR block for the VPC	string	"10.0.0.0/16"	no
cidrsubnet_newbits	(Optional, default '10') The number of additional bits with which to extend the cidr subnet prefix	number	10	no
enable_eip	(Optional, default 'true') Enables Elastic IPs, disabling is mainly used for testing purposes	bool	true	no
enable_flow_log	(Optional, default 'false') Whether or not to enable VPC Flow Logs	bool	false	no
name	(Required) The name of the vpc	string	n/a	yes
private_subnets	(Optional, default []) A list of private subnets inside the VPC	list(string)	[]	no
public_subnets	(Optional, default []) A list of public subnets inside the VPC	list(string)	[]	no
single_nat_gateway	Should be true if you want to provision a single shared NAT Gateway across all of your private networks	bool	false	no

Outputs

Name	Description
cidr_block	n/a
main_nacl_id	n/a
main_route_table_id	n/a
private_route_table_ids	n/a
private_subnet_cidr_blocks	n/a
private_subnet_ids	n/a
public_ips	n/a
public_subnet_cidr_blocks	n/a
public_subnet_ids	n/a
vpc_id	n/a