SR DO-686 Added ability to create SCP for IPAM Pools

.gitignore

@@ -34,3 +34,8 @@ terraform.rc
 .terraform.lock.hcl
 go.mod
 go.sum
+
+*.zip
+*.tar
+
+/.idea/

main.tf

@@ -41,7 +41,9 @@ resource "aws_vpc_ipam" "main" {
 
 module "level_zero" {
   source = "./modules/sub_pool"
-
+  providers = {
+    aws.root = aws.root
+  }
   address_family      = var.address_family
   ipam_scope_id       = local.scope_id
   source_ipam_pool_id = null
@@ -59,7 +61,9 @@ module "level_zero" {
 module "level_one" {
   source   = "./modules/sub_pool"
   for_each = var.pool_configurations
-
+  providers = {
+    aws.root = aws.root
+  }
   address_family      = var.address_family
   ipam_scope_id       = local.scope_id
   source_ipam_pool_id = module.level_zero.pool.id
@@ -76,7 +80,9 @@ module "level_one" {
 module "level_two" {
   source   = "./modules/sub_pool"
   for_each = toset(local.level_2_pool_names)
-
+  providers = {
+    aws.root = aws.root
+  }
   address_family      = var.address_family
   ipam_scope_id       = local.scope_id
   source_ipam_pool_id = module.level_one[split("/", each.key)[0]].pool.id
@@ -94,7 +100,9 @@ module "level_two" {
 module "level_three" {
   source   = "./modules/sub_pool"
   for_each = toset(local.level_3_pool_names)
-
+  providers = {
+    aws.root = aws.root
+  }
   address_family = var.address_family
   ipam_scope_id  = local.scope_id
 

modules/sub_pool/ipam-scp.tf

@@ -0,0 +1,41 @@
+# The following resources are added outside of
+# https://github.com/aws-ia/terraform-aws-ipam/tree/v1.1.4
+# https://registry.terraform.io/modules/aws-ia/ipam/aws/latest
+
+
+locals {
+  scp_enabled = try(length(var.pool_config.ram_share_principals), 0) > 0 && var.pool_config.create_scp
+}
+
+resource "aws_organizations_policy" "restrict_ipam_pools" {
+  #This should get deployed to root account
+  provider = aws.root
+
+  for_each    = local.scp_enabled ? toset(var.pool_config.ram_share_principals) : []
+  name        = "Restrict IPAM Pool Acc # ${each.key}"
+  description = "Restrict IPAM pool for Acc # ${each.key}"
+
+  content = jsonencode({
+    statement = {
+      sid       = "RestrictIpamPools"
+      effect    = "Deny"
+      actions   = ["ec2:CreateVpc", "ec2:AssociateVpcCidrBlock"]
+      resources = ["arn:aws:ec2:${var.implied_locale != "None" ? var.implied_locale : var.pool_config.locale}:*:vpc/*"]
+
+      condition = {
+        test     = "StringNotEquals"
+        variable = "ec2:Ipv4IpamPoolId"
+        values   = [aws_vpc_ipam_pool.sub.id]
+      }
+    }
+  })
+}
+
+resource "aws_organizations_policy_attachment" "restrict_ipam_pools_scp_target" {
+  #This should get deployed to root account
+  provider = aws.root
+
+  for_each  = local.scp_enabled ? toset(var.pool_config.ram_share_principals) : []
+  policy_id = aws_organizations_policy.restrict_ipam_pools[each.key].id
+  target_id = each.key
+}

modules/sub_pool/variables.tf

@@ -3,6 +3,7 @@ variable "pool_config" {
   type = object({
     cidr                 = list(string)
     ram_share_principals = optional(list(string))
+    create_scp           = optional(bool, false)
 
     locale                            = optional(string)
     allocation_default_netmask_length = optional(string)

modules/sub_pool/versions.tf

@@ -2,8 +2,9 @@ terraform {
   required_version = ">= 1.3.0"
   required_providers {
     aws = {
-      source  = "hashicorp/aws"
-      version = ">= 3.73.0"
+      source                = "hashicorp/aws"
+      version               = ">= 3.73.0"
+      configuration_aliases = [aws.root]
     }
   }
 }

versions.tf

@@ -2,8 +2,9 @@ terraform {
   required_version = ">= 1.3.0"
   required_providers {
     aws = {
-      source  = "hashicorp/aws"
-      version = ">= 3.73.0"
+      source                = "hashicorp/aws"
+      version               = ">= 3.73.0"
+      configuration_aliases = [aws.root]
     }
   }
 }