Skip to content

Commit 7d4fa0d

Browse files
benjaminvalienteBenjamin Valiente (Contractor)github-actions[bot]
authored
Adding s3 vpc endpoint (#268)
* feat: adding s3 vpc endpoint to private and public subnets * terraform-docs: automated action * terraform-docs: automated action --------- Co-authored-by: Benjamin Valiente (Contractor) <benjamin.valiente@thoughtbot.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent c0effa9 commit 7d4fa0d

12 files changed

Lines changed: 150 additions & 0 deletions

File tree

‎aws/network/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ module "network" {
7171
| <a name="module_private_subnets"></a> [private\_subnets](#module\_private\_subnets) | ./modules/private-subnets | n/a |
7272
| <a name="module_public_subnet_routes"></a> [public\_subnet\_routes](#module\_public\_subnet\_routes) | ./modules/public-subnet-routes | n/a |
7373
| <a name="module_public_subnets"></a> [public\_subnets](#module\_public\_subnets) | ./modules/public-subnets | n/a |
74+
| <a name="module_s3_endpoint"></a> [s3\_endpoint](#module\_s3\_endpoint) | ./modules/vpc-endpoints/s3-vpc-endpoint | n/a |
7475
| <a name="module_vpc"></a> [vpc](#module\_vpc) | ./modules/vpc | n/a |
7576

7677
## Resources
@@ -87,6 +88,7 @@ module "network" {
8788
| <a name="input_cluster_names"></a> [cluster\_names](#input\_cluster\_names) | List of clusters which run in this network | `list(string)` | `[]` | no |
8889
| <a name="input_create_internet_gateway"></a> [create\_internet\_gateway](#input\_create\_internet\_gateway) | Set to false to disable creation of an internet gateway | `bool` | `true` | no |
8990
| <a name="input_create_nat_gateways"></a> [create\_nat\_gateways](#input\_create\_nat\_gateways) | Set to false to disable creation of NAT gateways | `bool` | `true` | no |
91+
| <a name="input_create_s3_endpoint"></a> [create\_s3\_endpoint](#input\_create\_s3\_endpoint) | Set to false to disable creation of the S3 Gateway VPC endpoint | `bool` | `true` | no |
9092
| <a name="input_create_vpc"></a> [create\_vpc](#input\_create\_vpc) | Set to false to disable creation of the VPC | `bool` | `true` | no |
9193
| <a name="input_enable_flow_logs"></a> [enable\_flow\_logs](#input\_enable\_flow\_logs) | Set to true to enable VPC flow logs | `bool` | `false` | no |
9294
| <a name="input_enable_ipv6"></a> [enable\_ipv6](#input\_enable\_ipv6) | Set to false to disable IPV6 | `bool` | `false` | no |
@@ -109,5 +111,6 @@ module "network" {
109111
|------|-------------|
110112
| <a name="output_cluster_names"></a> [cluster\_names](#output\_cluster\_names) | List of clusters which run in this network |
111113
| <a name="output_nat_ip_addresses"></a> [nat\_ip\_addresses](#output\_nat\_ip\_addresses) | List of IP addresses created for NAT gateways |
114+
| <a name="output_s3_endpoint_id"></a> [s3\_endpoint\_id](#output\_s3\_endpoint\_id) | ID of the S3 Gateway VPC endpoint (null if disabled) |
112115
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | ID of the AWS VPC |
113116
<!-- END_TF_DOCS -->

‎aws/network/main.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,23 @@ module "public_subnet_routes" {
8787
depends_on = [module.public_subnets, aws_internet_gateway.this]
8888
}
8989

90+
module "s3_endpoint" {
91+
count = var.create_s3_endpoint ? 1 : 0
92+
source = "./modules/vpc-endpoints/s3-vpc-endpoint"
93+
94+
name = var.name
95+
namespace = var.namespace
96+
vpc = local.vpc
97+
tags = var.tags
98+
99+
route_table_ids = concat(
100+
module.private_subnet_routes.route_table_ids,
101+
[module.public_subnet_routes.route_table.id],
102+
)
103+
104+
depends_on = [module.private_subnet_routes, module.public_subnet_routes]
105+
}
106+
90107
resource "aws_internet_gateway" "this" {
91108
count = var.create_internet_gateway ? 1 : 0
92109

‎aws/network/modules/private-subnet-routes/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,11 @@
3131
| <a name="input_private_subnets"></a> [private\_subnets](#input\_private\_subnets) | Private subnets for each availability\_zone | `map(object({ id = string, availability_zone = string }))` | n/a | yes |
3232
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to be applied to all created resources | `map(string)` | `{}` | no |
3333
| <a name="input_vpc"></a> [vpc](#input\_vpc) | AWS VPC for NAT gateways | `object({ id = string, cidr_block = string })` | n/a | yes |
34+
35+
## Outputs
36+
37+
| Name | Description |
38+
|------|-------------|
39+
| <a name="output_route_table_ids"></a> [route\_table\_ids](#output\_route\_table\_ids) | List of route table IDs for private subnets |
40+
| <a name="output_route_tables"></a> [route\_tables](#output\_route\_tables) | Map of per-AZ NAT route tables for private subnets |
3441
<!-- END_TF_DOCS -->

‎aws/network/modules/private-subnet-routes/outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "route_tables" {
2+
description = "Map of per-AZ NAT route tables for private subnets"
3+
value = aws_route_table.nat
4+
}
5+
6+
output "route_table_ids" {
7+
description = "List of route table IDs for private subnets"
8+
value = [for rt in aws_route_table.nat : rt.id]
9+
}

‎aws/network/modules/vpc-endpoints/README.md‎

Whitespace-only changes.

‎aws/network/modules/vpc-endpoints/s3-vpc-endpoint/README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# AWS S3 VPC Endpoint
2+
3+
Module for creating a S3 VPC Endpoint in AWS.
4+
<!-- BEGIN_TF_DOCS -->
5+
## Requirements
6+
7+
| Name | Version |
8+
|------|---------|
9+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.6.2 |
10+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 6.0 |
11+
12+
## Providers
13+
14+
| Name | Version |
15+
|------|---------|
16+
| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 6.0 |
17+
18+
## Resources
19+
20+
| Name | Type |
21+
|------|------|
22+
| [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
23+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
24+
25+
## Inputs
26+
27+
| Name | Description | Type | Default | Required |
28+
|------|-------------|------|---------|:--------:|
29+
| <a name="input_name"></a> [name](#input\_name) | Name for this network (used in the endpoint's Name tag) | `string` | n/a | yes |
30+
| <a name="input_namespace"></a> [namespace](#input\_namespace) | Prefix to be applied to created resources | `list(string)` | `[]` | no |
31+
| <a name="input_route_table_ids"></a> [route\_table\_ids](#input\_route\_table\_ids) | List of route table IDs to associate with the S3 Gateway endpoint | `list(string)` | n/a | yes |
32+
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to be applied to the endpoint | `map(string)` | `{}` | no |
33+
| <a name="input_vpc"></a> [vpc](#input\_vpc) | The VPC object in which to create the S3 endpoint | <pre>object({<br> id = string<br> })</pre> | n/a | yes |
34+
35+
## Outputs
36+
37+
| Name | Description |
38+
|------|-------------|
39+
| <a name="output_endpoint_id"></a> [endpoint\_id](#output\_endpoint\_id) | ID of the S3 Gateway VPC endpoint |
40+
| <a name="output_prefix_list_id"></a> [prefix\_list\_id](#output\_prefix\_list\_id) | Prefix list ID of the S3 endpoint (useful for security group egress rules) |
41+
<!-- END_TF_DOCS -->

‎aws/network/modules/vpc-endpoints/s3-vpc-endpoint/main.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
data "aws_region" "current" {}
2+
3+
resource "aws_vpc_endpoint" "s3" {
4+
vpc_id = var.vpc.id
5+
service_name = "com.amazonaws.${data.aws_region.current.name}.s3"
6+
vpc_endpoint_type = "Gateway"
7+
8+
route_table_ids = var.route_table_ids
9+
10+
tags = merge(
11+
var.tags,
12+
{
13+
Name = join("-", concat(var.namespace, [var.name, "s3-endpoint"]))
14+
}
15+
)
16+
}

‎aws/network/modules/vpc-endpoints/s3-vpc-endpoint/outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "endpoint_id" {
2+
description = "ID of the S3 Gateway VPC endpoint"
3+
value = aws_vpc_endpoint.s3.id
4+
}
5+
6+
output "prefix_list_id" {
7+
description = "Prefix list ID of the S3 endpoint (useful for security group egress rules)"
8+
value = aws_vpc_endpoint.s3.prefix_list_id
9+
}

‎aws/network/modules/vpc-endpoints/s3-vpc-endpoint/variables.tf‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
variable "name" {
2+
type = string
3+
description = "Name for this network (used in the endpoint's Name tag)"
4+
}
5+
6+
variable "namespace" {
7+
type = list(string)
8+
description = "Prefix to be applied to created resources"
9+
default = []
10+
}
11+
12+
variable "vpc" {
13+
description = "The VPC object in which to create the S3 endpoint"
14+
type = object({
15+
id = string
16+
})
17+
}
18+
19+
variable "route_table_ids" {
20+
type = list(string)
21+
description = "List of route table IDs to associate with the S3 Gateway endpoint"
22+
}
23+
24+
variable "tags" {
25+
type = map(string)
26+
description = "Tags to be applied to the endpoint"
27+
default = {}
28+
}

‎aws/network/modules/vpc-endpoints/s3-vpc-endpoint/versions.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
required_version = ">= 1.6.2"
3+
required_providers {
4+
aws = {
5+
source = "hashicorp/aws"
6+
version = "~> 6.0"
7+
}
8+
}
9+
}

0 commit comments

Comments
 (0)