Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Enhancement] Add ability to provide a list of Availability Zones for subnet placement #124

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -372,9 +372,10 @@ Please see our [developer documentation](https://github.com/aws-ia/terraform-aws

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_az_count"></a> [az\_count](#input\_az\_count) | Searches region for # of AZs to use and takes a slice based on count. Assume slice is sorted a-z. | `number` | n/a | yes |
| <a name="input_name"></a> [name](#input\_name) | Name to give VPC. Note: does not effect subnet names, which get assigned name based on name\_prefix. | `string` | n/a | yes |
| <a name="input_subnets"></a> [subnets](#input\_subnets) | Configuration of subnets to build in VPC. 1 Subnet per AZ is created. Subnet types are defined as maps with the available keys: "private", "public", "transit\_gateway", "core\_network". Each Subnet type offers its own set of available arguments detailed below.<br><br>**Attributes shared across subnet types:**<br>- `cidrs` = (Optional\|list(string)) **Cannot set if `netmask` is set.** List of IPv4 CIDRs to set to subnets. Count of CIDRs defined must match quantity of azs in `az_count`.<br>- `netmask` = (Optional\|Int) **Cannot set if `cidrs` is set.** Netmask of the `var.cidr_block` to calculate for each subnet.<br>- `assign_ipv6_cidr` = (Optional\|bool) **Cannot set if `ipv6_cidrs` is set.** If true, it will calculate a /64 block from the IPv6 VPC CIDR to set in the subnets.<br>- `ipv6_cidrs` = (Optional\|list(string)) **Cannot set if `assign_ipv6_cidr` is set.** List of IPv6 CIDRs to set to subnets. The subnet size must use a /64 prefix length. Count of CIDRs defined must match quantity of azs in `az_count`.<br>- `name_prefix` = (Optional\|String) A string prefix to use for the name of your subnet and associated resources. Subnet type key name is used if omitted (aka private, public, transit\_gateway). Example `name_prefix = "private"` for `var.subnets.private` is redundant.<br>- `tags` = (Optional\|map(string)) Tags to set on the subnet and associated resources.<br><br>**Any private subnet type options:**<br>- All shared keys above<br>- `connect_to_public_natgw` = (Optional\|bool) Determines if routes to NAT Gateways should be created. Must also set `var.subnets.public.nat_gateway_configuration` in public subnets.<br>- `ipv6_native` = (Optional\|bool) Indicates whether to create an IPv6-ony subnet. Either `var.assign_ipv6_cidr` or `var.ipv6_cidrs` should be defined to allocate an IPv6 CIDR block.<br>- `connect_to_eigw` = (Optional\|bool) Determines if routes to the Egress-only Internet gateway should be created. Must also set `var.vpc_egress_only_internet_gateway`.<br><br>**public subnet type options:**<br>- All shared keys above<br>- `nat_gateway_configuration` = (Optional\|string) Determines if NAT Gateways should be created and in how many AZs. Valid values = `"none"`, `"single_az"`, `"all_azs"`. Default = "none". Must also set `var.subnets.private.connect_to_public_natgw = true`.<br>- `connect_to_igw` = (Optional\|bool) Determines if the default route (0.0.0.0/0 or ::/0) is created in the public subnets with destination the Internet gateway. Defaults to `true`.<br>- `ipv6_native` = (Optional\|bool) Indicates whether to create an IPv6-ony subnet. Either `var.assign_ipv6_cidr` or `var.ipv6_cidrs` should be defined to allocate an IPv6 CIDR block.<br><br>**transit\_gateway subnet type options:**<br>- All shared keys above<br>- `connect_to_public_natgw` = (Optional\|string) Determines if routes to NAT Gateways should be created. Specify the CIDR range or a prefix-list-id that you want routed to nat gateway. Usually `0.0.0.0/0`. Must also set `var.subnets.public.nat_gateway_configuration`.<br>- `transit_gateway_default_route_table_association` = (Optional\|bool) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways.<br>- `transit_gateway_default_route_table_propagation` = (Optional\|bool) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways.<br>- `transit_gateway_appliance_mode_support` = (Optional\|string) Whether Appliance Mode is enabled. If enabled, a traffic flow between a source and a destination uses the same Availability Zone for the VPC attachment for the lifetime of that flow. Valid values: `disable` (default) and `enable`.<br>- `transit_gateway_dns_support` = (Optional\|string) DNS Support is used if you need the VPC to resolve public IPv4 DNS host names to private IPv4 addresses when queried from instances in another VPC attached to the transit gateway. Valid values: `enable` (default) and `disable`.<br><br>**core\_network subnet type options:**<br>- All shared keys abovce<br>- `connect_to_public_natgw` = (Optional\|string) Determines if routes to NAT Gateways should be created. Specify the CIDR range or a prefix-list-id that you want routed to nat gateway. Usually `0.0.0.0/0`. Must also set `var.subnets.public.nat_gateway_configuration`.<br>- `appliance_mode_support` = (Optional\|bool) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow. Defaults to `false`.<br>- `require_acceptance` = (Optional\|bool) Boolean whether the core network VPC attachment to create requires acceptance or not. Defaults to `false`.<br>- `accept_attachment` = (Optional\|bool) Boolean whether the core network VPC attachment is accepted or not in the segment. Only valid if `require_acceptance` is set to `true`. Defaults to `true`.<br><br>Example:<pre>subnets = {<br> # Dual-stack subnet<br> public = {<br> netmask = 24<br> assign_ipv6_cidr = true<br> nat_gateway_configuration = "single_az"<br> }<br> # IPv4 only subnet<br> private = {<br> netmask = 24<br> connect_to_public_natgw = true<br> }<br> # IPv6 only subnet<br> ipv6 = {<br> ipv6_native = true<br> assign_ipv6_cidr = true<br> connect_to_eigw = true<br> }<br> # Transit gateway subnets (dual-stack)<br> transit_gateway = {<br> netmask = 24<br> assign_ipv6_cidr = true<br> connect_to_public_natgw = true<br> transit_gateway_default_route_table_association = true<br> transit_gateway_default_route_table_propagation = true<br> }<br> # Core Network subnets (dual-stack)<br> core_network = {<br> netmask = 24<br> assign_ipv6_cidr = true<br> connect_to_public_natgw = true<br> appliance_mode_support = true<br> require_acceptance = true<br> accept_attachment = true<br> }<br>}</pre> | `any` | n/a | yes |
| <a name="input_az_count"></a> [az\_count](#input\_az\_count) | Searches region for # of AZs to use and takes a slice based on count. Assume slice is sorted a-z. Required if `azs` is not provided. | `number` | `null` | no |
| <a name="input_azs"></a> [azs](#input\_azs) | (Optional) A list of AZs to use. e.g. `azs = ["us-east-1a","us-east-1c"]` Incompatible with `az_count` | `list(string)` | `null` | no |
| <a name="input_cidr_block"></a> [cidr\_block](#input\_cidr\_block) | IPv4 CIDR range to assign to VPC if creating VPC or to associate as a secondary IPv6 CIDR. Overridden by var.vpc\_id output from data.aws\_vpc. | `string` | `null` | no |
| <a name="input_core_network"></a> [core\_network](#input\_core\_network) | AWS Cloud WAN's core network information - to create a VPC attachment. Required when `cloud_wan` subnet is defined. Two attributes are required: the `id` and `arn` of the resource. | <pre>object({<br> id = string<br> arn = string<br> })</pre> | <pre>{<br> "arn": null,<br> "id": null<br>}</pre> | no |
| <a name="input_core_network_ipv6_routes"></a> [core\_network\_ipv6\_routes](#input\_core\_network\_ipv6\_routes) | Configuration of IPv6 route(s) to AWS Cloud WAN's core network.<br>For each `public` and/or `private` subnets named in the `subnets` variable, optionally create routes from the subnet to the core network.<br>You can specify either a CIDR range or a prefix-list-id that you want routed to the core network.<br>Example:<pre>core_network_ivp6_routes = {<br> public = "::/0"<br> private = "pl-123"<br>}</pre> | `any` | `{}` | no |
Expand Down
31 changes: 30 additions & 1 deletion data.tf
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
locals {
azs = slice(data.aws_availability_zones.current.names, 0, var.az_count)
# az_count has been provided slice based on az_count otherwise return those provided
azs = var.az_count != null ? slice(data.aws_availability_zones.current.names, 0, var.az_count) : data.aws_availability_zones.current.names

# references to module.calculate_subnets output
calculated_subnets = module.calculate_subnets.subnets_by_type
Expand Down Expand Up @@ -123,6 +124,34 @@ data "aws_availability_zones" "current" {
name = "opt-in-status"
values = ["opt-in-not-required"]
}

dynamic "filter" {
for_each = var.azs != null ? [1] : []
content {
name = "zone-name"
values = var.azs
}
}

lifecycle {
# Check at least one variable `var.azs` or `var.az_count` has been provided
precondition {
condition = (var.azs != null && var.az_count != null) ? false : true
error_message = "Both `var.azs` and `var.az_count` provided. You must provide a value for `var.azs` or `var.az_count` but not both."
}

# Check that only `var.azs` or `var.az_count` was provided (and not both)
precondition {
condition = (var.azs == null && var.az_count == null) ? false : true
error_message = "You must provide a value for the variable `var.az_count` or `var.azs`."
}

# Check if `var.azs` was provided that the filter returns the correct number of AZs (i.e. all exist in the current partition/region)
postcondition {
condition = (var.azs == null) ? true : (length(self.names) == length(var.azs) ? true : false)
error_message = "One or more of the Availability Zones provided in `var.azs` does not exist. Please check the availability zones are available in the current region."
}
}
}

# search for existing vpc with var.vpc_id if not creating
Expand Down
6 changes: 6 additions & 0 deletions examples/provide_specific_azs/.header.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Deploy VPC subnets to a specific set of Availability Zones

This example shows how you can use this module to deploy a VPC defining a list of specific Availability Zones where subnets should be deployed. This example creates the following:

* VPC with IPv4 CIDR block named "specific-azs"
* Private subnets deployed in each of the Availability Zones defined in the input variable `azs` with the name prefix "vpc-specific-azs-private" and a /18 netmask
37 changes: 37 additions & 0 deletions examples/provide_specific_azs/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
<!-- BEGIN_TF_DOCS -->
# Deploy VPC subnets to a specific set of Availability Zones

This example shows how you can use this module to deploy a VPC defining a list of specific Availability Zones where subnets should be deployed. This example creates the following:

* VPC with IPv4 CIDR block named "specific-azs"
* Private subnets deployed in each of the Availability Zones defined in the input variable `azs` with the name prefix "vpc-specific-azs-private" and a /18 netmask

## Requirements

No requirements.

## Providers

No providers.

## Modules

| Name | Source | Version |
|------|--------|---------|
| <a name="module_vpc_specific_azs"></a> [vpc\_specific\_azs](#module\_vpc\_specific\_azs) | ../.. | n/a |

## Resources

No resources.

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_azs"></a> [azs](#input\_azs) | A list of AZs to use. e.g. `azs = ["us-east-1a","us-east-1c"]` Incompatible with `az_count` | `list(string)` | <pre>[<br> "us-east-1a",<br> "us-east-1c"<br>]</pre> | no |
| <a name="input_cidr_block"></a> [cidr\_block](#input\_cidr\_block) | IPv4 CIDR range to assign to VPC if creating VPC or to associate as a secondary IPv6 CIDR. Overridden by var.vpc\_id output from data.aws\_vpc. | `string` | `"10.0.0.0/16"` | no |

## Outputs

No outputs.
<!-- END_TF_DOCS -->
17 changes: 17 additions & 0 deletions examples/provide_specific_azs/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
module "vpc_specific_azs" {
# source = "aws-ia/vpc/aws"
# version = ">= 4.3.1"
source = "../.."

name = "specific-azs"
cidr_block = var.cidr_block
azs = var.azs


subnets = {
private = {
name_prefix = "vpc-specific-azs-private"
netmask = 18
}
}
}
Empty file.
15 changes: 15 additions & 0 deletions examples/provide_specific_azs/variables.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
variable "azs" {
type = list(string)
description = "A list of AZs to use. e.g. `azs = [\"us-east-1a\",\"us-east-1c\"]` Incompatible with `az_count`"
default = [
"us-east-1a",
"us-east-1c",
]
}

variable "cidr_block" {
type = string
description = "IPv4 CIDR range to assign to VPC if creating VPC or to associate as a secondary IPv6 CIDR. Overridden by var.vpc_id output from data.aws_vpc."
default = "10.0.0.0/16"
}

17 changes: 17 additions & 0 deletions test/examples_provide_specific_azs_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
package test

import (
"testing"

"github.com/gruntwork-io/terratest/modules/terraform"
)

func TestExamplesSpecificAzs(t *testing.T) {

terraformOptions := &terraform.Options{
TerraformDir: "../examples/provide_specific_azs",
}

defer terraform.Destroy(t, terraformOptions)
terraform.InitAndApply(t, terraformOptions)
}
9 changes: 8 additions & 1 deletion variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,14 @@ variable "vpc_id" {

variable "az_count" {
type = number
description = "Searches region for # of AZs to use and takes a slice based on count. Assume slice is sorted a-z."
description = "Searches region for # of AZs to use and takes a slice based on count. Assume slice is sorted a-z. Required if `azs` is not provided."
default = null
}

variable "azs" {
type = list(string)
description = "(Optional) A list of AZs to use. e.g. `azs = [\"us-east-1a\",\"us-east-1c\"]` Incompatible with `az_count`"
default = null
}

variable "vpc_enable_dns_hostnames" {
Expand Down