feat: adding s3 vpc endpoint to private and public subnets

Author: Benjamin Valiente (Contractor)

aws/network/main.tf

@@ -87,6 +87,23 @@ module "public_subnet_routes" {
   depends_on = [module.public_subnets, aws_internet_gateway.this]
 }
 
+module "s3_endpoint" {
+  count  = var.create_s3_endpoint ? 1 : 0
+  source = "./modules/vpc-endpoints/s3-vpc-endpoint"
+
+  name      = var.name
+  namespace = var.namespace
+  vpc       = local.vpc
+  tags      = var.tags
+
+  route_table_ids = concat(
+    module.private_subnet_routes.route_table_ids,
+    [module.public_subnet_routes.route_table.id],
+  )
+
+  depends_on = [module.private_subnet_routes, module.public_subnet_routes]
+}
+
 resource "aws_internet_gateway" "this" {
   count = var.create_internet_gateway ? 1 : 0
 

aws/network/modules/private-subnet-routes/outputs.tf

@@ -0,0 +1,9 @@
+output "route_tables" {
+  description = "Map of per-AZ NAT route tables for private subnets"
+  value       = aws_route_table.nat
+}
+
+output "route_table_ids" {
+  description = "List of route table IDs for private subnets"
+  value       = [for rt in aws_route_table.nat : rt.id]
+}

aws/network/modules/vpc-endpoints/README.md

@@ -0,0 +1,3 @@
+# AWS S3 VPC Endpoint
+
+Module for creating a S3 VPC Endpoint in AWS.

aws/network/modules/vpc-endpoints/s3-vpc-endpoint/README.md

@@ -0,0 +1,14 @@
+resource "aws_vpc_endpoint" "s3" {
+  vpc_id            = var.vpc_id
+  service_name      = "com.amazonaws.${var.region}.s3"
+  vpc_endpoint_type = "Gateway"
+
+  route_table_ids = var.route_table_ids
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.name}-s3-endpoint"
+    }
+  )
+}

aws/network/modules/vpc-endpoints/s3-vpc-endpoint/main.tf

@@ -0,0 +1,9 @@
+output "endpoint_id" {
+  description = "ID of the S3 Gateway VPC endpoint"
+  value       = aws_vpc_endpoint.s3.id
+}
+
+output "prefix_list_id" {
+  description = "Prefix list ID of the S3 endpoint (useful for security group egress rules)"
+  value       = aws_vpc_endpoint.s3.prefix_list_id
+}

aws/network/modules/vpc-endpoints/s3-vpc-endpoint/outputs.tf

@@ -0,0 +1,28 @@
+variable "name" {
+  type        = string
+  description = "Name for this network (used in the endpoint's Name tag)"
+}
+
+variable "namespace" {
+  type        = list(string)
+  description = "Prefix to be applied to created resources"
+  default     = []
+}
+
+variable "vpc" {
+  description = "The VPC object in which to create the S3 endpoint"
+  type = object({
+    id = string
+  })
+}
+
+variable "route_table_ids" {
+  type        = list(string)
+  description = "List of route table IDs to associate with the S3 Gateway endpoint"
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Tags to be applied to the endpoint"
+  default     = {}
+}

aws/network/modules/vpc-endpoints/s3-vpc-endpoint/variables.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.6.2"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}

aws/network/modules/vpc-endpoints/s3-vpc-endpoint/versions.tf

@@ -12,3 +12,8 @@ output "vpc_id" {
   description = "ID of the AWS VPC"
   value       = local.vpc.id
 }
+
+output "s3_endpoint_id" {
+  description = "ID of the S3 Gateway VPC endpoint (null if disabled)"
+  value       = try(module.s3_endpoint[0].endpoint_id, null)
+}

aws/network/outputs.tf

@@ -99,4 +99,10 @@ variable "flow_logs_retention_days" {
   description = "Number of days to retain VPC Flow Logs in CloudWatch." # Only applies when enable_flow_logs is true.
   type        = number
   default     = null # null = retain forever
+}
+
+variable "create_s3_endpoint" {
+  description = "Set to false to disable creation of the S3 Gateway VPC endpoint"
+  type        = bool
+  default     = true
 }