Skip to content

Commit 3407dfd

Browse files
antonbabenkoantonbabenko
committed
Added VPC endpoints for SQS (closes terraform-aws-modules#248)
1 parent b79f313 commit 3407dfd

File tree

6 files changed

+116
-35
lines changed

6 files changed

+116
-35
lines changed

‎.pre-commit-config.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
repos:
22
- repo: git://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.8.1
3+
rev: v1.11.0
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_docs
77
- repo: git://github.com/pre-commit/pre-commit-hooks
8-
rev: v2.1.0
8+
rev: v2.2.3
99
hooks:
1010
- id: check-merge-conflict

‎README.md

Lines changed: 35 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ These types of resources are supported:
1616
* [VPN Gateway](https://www.terraform.io/docs/providers/aws/r/vpn_gateway.html)
1717
* [VPC Endpoint](https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html):
1818
* Gateway: S3, DynamoDB
19-
* Interface: EC2, SSM, EC2 Messages, SSM Messages, ECR API, ECR DKR, API Gateway, KMS, ECS, ECS Agent, ECS Telemetry
19+
* Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS, ECS, ECS Agent, ECS Telemetry
2020
* [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html)
2121
* [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html)
2222
* [Redshift Subnet Group](https://www.terraform.io/docs/providers/aws/r/redshift_subnet_group.html)
@@ -28,6 +28,12 @@ Sponsored by [Cloudcraft - the best way to draw AWS diagrams](https://cloudcraft
2828

2929
<a href="https://cloudcraft.co/?utm_source=terraform-aws-vpc" target="_blank"><img src="https://raw.githubusercontent.com/antonbabenko/modules.tf-lambda/master/misc/cloudcraft-logo.png" alt="Cloudcraft - the best way to draw AWS diagrams" width="211" height="56" /></a>
3030

31+
## Terraform versions
32+
33+
For Terraform 0.12 use version `v2.*` of this module.
34+
35+
If you are using Terraform 0.11 you can use versions `v1.*`.
36+
3137
## Usage
3238

3339
```hcl
@@ -183,10 +189,6 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
183189
enable_public_redshift = true # <= By default Redshift subnets will be associated with the private route table
184190
```
185191

186-
## Terraform version
187-
188-
Terraform version 0.10.3 or newer is required for this module to work.
189-
190192
## Examples
191193

192194
* [Simple VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/simple-vpc)
@@ -252,6 +254,15 @@ Terraform version 0.10.3 or newer is required for this module to work.
252254
| ecr\_dkr\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECR DKR endpoint | string | `"false"` | no |
253255
| ecr\_dkr\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECR DKR endpoint | list | `[]` | no |
254256
| ecr\_dkr\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECR dkr endpoint. If omitted, private subnets will be used. | list | `[]` | no |
257+
| ecs\_agent\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Agent endpoint | string | `"false"` | no |
258+
| ecs\_agent\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Agent endpoint | list | `[]` | no |
259+
| ecs\_agent\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Agent endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
260+
| ecs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS endpoint | string | `"false"` | no |
261+
| ecs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS endpoint | list | `[]` | no |
262+
| ecs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
263+
| ecs\_telemetry\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Telemetry endpoint | string | `"false"` | no |
264+
| ecs\_telemetry\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Telemetry endpoint | list | `[]` | no |
265+
| ecs\_telemetry\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Telemetry endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
255266
| elasticache\_acl\_tags | Additional tags for the elasticache subnets network ACL | map | `{}` | no |
256267
| elasticache\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for elasticache subnets | string | `"false"` | no |
257268
| elasticache\_inbound\_acl\_rules | Elasticache subnets inbound network ACL rules | list | `[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ]` | no |
@@ -269,10 +280,14 @@ Terraform version 0.10.3 or newer is required for this module to work.
269280
| enable\_ec2messages\_endpoint | Should be true if you want to provision an EC2MESSAGES endpoint to the VPC | string | `"false"` | no |
270281
| enable\_ecr\_api\_endpoint | Should be true if you want to provision an ecr api endpoint to the VPC | string | `"false"` | no |
271282
| enable\_ecr\_dkr\_endpoint | Should be true if you want to provision an ecr dkr endpoint to the VPC | string | `"false"` | no |
283+
| enable\_ecs\_agent\_endpoint | Should be true if you want to provision a ECS Agent endpoint to the VPC | string | `"false"` | no |
284+
| enable\_ecs\_endpoint | Should be true if you want to provision a ECS endpoint to the VPC | string | `"false"` | no |
285+
| enable\_ecs\_telemetry\_endpoint | Should be true if you want to provision a ECS Telemetry endpoint to the VPC | string | `"false"` | no |
272286
| enable\_kms\_endpoint | Should be true if you want to provision a KMS endpoint to the VPC | string | `"false"` | no |
273287
| enable\_nat\_gateway | Should be true if you want to provision NAT Gateways for each of your private networks | string | `"false"` | no |
274288
| enable\_public\_redshift | Controls if redshift should have public routing table | string | `"false"` | no |
275289
| enable\_s3\_endpoint | Should be true if you want to provision an S3 endpoint to the VPC | string | `"false"` | no |
290+
| enable\_sqs\_endpoint | Should be true if you want to provision an SQS endpoint to the VPC | string | `"false"` | no |
276291
| enable\_ssm\_endpoint | Should be true if you want to provision an SSM endpoint to the VPC | string | `"false"` | no |
277292
| enable\_ssmmessages\_endpoint | Should be true if you want to provision a SSMMESSAGES endpoint to the VPC | string | `"false"` | no |
278293
| enable\_vpn\_gateway | Should be true if you want to create a new VPN Gateway resource and attach it to the VPC | string | `"false"` | no |
@@ -327,21 +342,15 @@ Terraform version 0.10.3 or newer is required for this module to work.
327342
| reuse\_nat\_ips | Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable | string | `"false"` | no |
328343
| secondary\_cidr\_blocks | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | list | `[]` | no |
329344
| single\_nat\_gateway | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | string | `"false"` | no |
345+
| sqs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SQS endpoint | string | `"false"` | no |
346+
| sqs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SQS endpoint | list | `[]` | no |
347+
| sqs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SQS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
330348
| ssm\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SSM endpoint | string | `"false"` | no |
331349
| ssm\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SSM endpoint | list | `[]` | no |
332350
| ssm\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SSM endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
333351
| ssmmessages\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SSMMESSAGES endpoint | string | `"false"` | no |
334352
| ssmmessages\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SSMMESSAGES endpoint | list | `[]` | no |
335353
| ssmmessages\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SSMMESSAGES endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
336-
| ecs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS endpoint | string | `"false"` | no |
337-
| ecs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS endpoint | list | `[]` | no |
338-
| ecs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
339-
| ecs\_agent\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Agent endpoint | string | `"false"` | no |
340-
| ecs\_agent\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Agent endpoint | list | `[]` | no |
341-
| ecs\_agent\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Agent endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
342-
| ecs\_telemetry\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Telemetry endpoint | string | `"false"` | no |
343-
| ecs\_telemetry\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Telemetry endpoint | list | `[]` | no |
344-
| ecs\_telemetry\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Telemetry endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
345354
| tags | A map of tags to add to all resources | map | `{}` | no |
346355
| vpc\_tags | Additional tags for the VPC | map | `{}` | no |
347356
| vpn\_gateway\_id | ID of VPN Gateway to attach to the VPC | string | `""` | no |
@@ -424,26 +433,29 @@ Terraform version 0.10.3 or newer is required for this module to work.
424433
| vpc\_endpoint\_ecr\_dkr\_dns\_entry | The DNS entries for the VPC Endpoint for ECR DKR. |
425434
| vpc\_endpoint\_ecr\_dkr\_id | The ID of VPC endpoint for ECR DKR |
426435
| vpc\_endpoint\_ecr\_dkr\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECR DKR. |
436+
| vpc\_endpoint\_ecs\_agent\_dns\_entry | The DNS entries for the VPC Endpoint for ECS Agent. |
437+
| vpc\_endpoint\_ecs\_agent\_id | The ID of VPC endpoint for ECS Agent |
438+
| vpc\_endpoint\_ecs\_agent\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS Agent. |
439+
| vpc\_endpoint\_ecs\_dns\_entry | The DNS entries for the VPC Endpoint for ECS. |
440+
| vpc\_endpoint\_ecs\_id | The ID of VPC endpoint for ECS |
441+
| vpc\_endpoint\_ecs\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS. |
442+
| vpc\_endpoint\_ecs\_telemetry\_dns\_entry | The DNS entries for the VPC Endpoint for ECS Telemetry. |
443+
| vpc\_endpoint\_ecs\_telemetry\_id | The ID of VPC endpoint for ECS Telemetry |
444+
| vpc\_endpoint\_ecs\_telemetry\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS Telemetry. |
427445
| vpc\_endpoint\_kms\_dns\_entry | The DNS entries for the VPC Endpoint for KMS. |
428446
| vpc\_endpoint\_kms\_id | The ID of VPC endpoint for KMS |
429447
| vpc\_endpoint\_kms\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for KMS. |
430448
| vpc\_endpoint\_s3\_id | The ID of VPC endpoint for S3 |
431449
| vpc\_endpoint\_s3\_pl\_id | The prefix list for the S3 VPC endpoint. |
450+
| vpc\_endpoint\_sqs\_dns\_entry | The DNS entries for the VPC Endpoint for SQS. |
451+
| vpc\_endpoint\_sqs\_id | The ID of VPC endpoint for SQS |
452+
| vpc\_endpoint\_sqs\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SQS. |
432453
| vpc\_endpoint\_ssm\_dns\_entry | The DNS entries for the VPC Endpoint for SSM. |
433454
| vpc\_endpoint\_ssm\_id | The ID of VPC endpoint for SSM |
434455
| vpc\_endpoint\_ssm\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SSM. |
435456
| vpc\_endpoint\_ssmmessages\_dns\_entry | The DNS entries for the VPC Endpoint for SSMMESSAGES. |
436457
| vpc\_endpoint\_ssmmessages\_id | The ID of VPC endpoint for SSMMESSAGES |
437458
| vpc\_endpoint\_ssmmessages\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SSMMESSAGES. |
438-
| vpc\_endpoint\_ecs\_dns\_entry | The DNS entries for the VPC Endpoint for ECS. |
439-
| vpc\_endpoint\_ecs\_id | The ID of VPC endpoint for ECS |
440-
| vpc\_endpoint\_ecs\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS. |
441-
| vpc\_endpoint\_ecs\_agent\_dns\_entry | The DNS entries for the VPC Endpoint for ECS Agent. |
442-
| vpc\_endpoint\_ecs\_agent\_id | The ID of VPC endpoint for ECS Agent |
443-
| vpc\_endpoint\_ecs\_agent\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS Agent. |
444-
| vpc\_endpoint\_ecs\_telemetry\_dns\_entry | The DNS entries for the VPC Endpoint for ECS Telemetry. |
445-
| vpc\_endpoint\_ecs\_telemetry\_id | The ID of VPC endpoint for ECS Telemetry |
446-
| vpc\_endpoint\_ecs\_telemetry\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for ECS Telemetry. |
447459
| vpc\_id | The ID of the VPC |
448460
| vpc\_instance\_tenancy | Tenancy of instances spin up within VPC |
449461
| vpc\_main\_route\_table\_id | The ID of the main route table associated with this VPC |

‎examples/complete-vpc/main.tf

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ module "vpc" {
4545
# VPC endpoint for SSM
4646
enable_ssm_endpoint = true
4747
ssm_endpoint_private_dns_enabled = true
48-
ssm_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"] # ssm_endpoint_subnet_ids = ["..."]
48+
ssm_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"]
4949

5050
# VPC endpoint for SSMMESSAGES
5151
enable_ssmmessages_endpoint = true
@@ -77,7 +77,20 @@ module "vpc" {
7777
kms_endpoint_private_dns_enabled = true
7878
kms_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"]
7979

80-
# kms_endpoint_subnet_ids = ["..."]
80+
# VPC endpoint for ECS
81+
enable_ecs_endpoint = true
82+
ecs_endpoint_private_dns_enabled = true
83+
ecs_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"]
84+
85+
# VPC endpoint for ECS telemetry
86+
enable_ecs_telemetry_endpoint = true
87+
ecs_telemetry_endpoint_private_dns_enabled = true
88+
ecs_telemetry_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"]
89+
90+
# VPC endpoint for SQS
91+
enable_sqs_endpoint = true
92+
sqs_endpoint_private_dns_enabled = true
93+
sqs_endpoint_security_group_ids = ["${data.aws_security_group.default.id}"]
8194

8295
tags = {
8396
Owner = "user"

‎main.tf

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ resource "aws_route_table" "database" {
122122
}
123123

124124
resource "aws_route" "database_internet_gateway" {
125-
count = "${var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.create_database_internet_gateway_route && !var.create_database_nat_gateway_route ? 1 : 0}"
125+
count = "${var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.create_database_internet_gateway_route && ! var.create_database_nat_gateway_route ? 1 : 0}"
126126

127127
route_table_id = "${aws_route_table.database.id}"
128128
destination_cidr_block = "0.0.0.0/0"
@@ -134,7 +134,7 @@ resource "aws_route" "database_internet_gateway" {
134134
}
135135

136136
resource "aws_route" "database_nat_gateway" {
137-
count = "${var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && !var.create_database_internet_gateway_route && var.create_database_nat_gateway_route && var.enable_nat_gateway ? local.nat_gateway_count : 0}"
137+
count = "${var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && ! var.create_database_internet_gateway_route && var.create_database_nat_gateway_route && var.enable_nat_gateway ? local.nat_gateway_count : 0}"
138138
route_table_id = "${element(aws_route_table.private.*.id, count.index)}"
139139
destination_cidr_block = "0.0.0.0/0"
140140
nat_gateway_id = "${element(aws_nat_gateway.this.*.id, count.index)}"
@@ -181,7 +181,7 @@ resource "aws_route_table" "intra" {
181181
# Public subnet
182182
################
183183
resource "aws_subnet" "public" {
184-
count = "${var.create_vpc && length(var.public_subnets) > 0 && (!var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0}"
184+
count = "${var.create_vpc && length(var.public_subnets) > 0 && (! var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0}"
185185

186186
vpc_id = "${local.vpc_id}"
187187
cidr_block = "${element(concat(var.public_subnets, list("")), count.index)}"
@@ -558,7 +558,7 @@ locals {
558558
}
559559

560560
resource "aws_eip" "nat" {
561-
count = "${var.create_vpc && (var.enable_nat_gateway && !var.reuse_nat_ips) ? local.nat_gateway_count : 0}"
561+
count = "${var.create_vpc && (var.enable_nat_gateway && ! var.reuse_nat_ips) ? local.nat_gateway_count : 0}"
562562

563563
vpc = true
564564

@@ -662,6 +662,27 @@ resource "aws_vpc_endpoint_route_table_association" "public_dynamodb" {
662662
route_table_id = "${aws_route_table.public.id}"
663663
}
664664

665+
#######################
666+
# VPC Endpoint for SQS
667+
#######################
668+
data "aws_vpc_endpoint_service" "sqs" {
669+
count = "${var.create_vpc && var.enable_sqs_endpoint ? 1 : 0}"
670+
671+
service = "sqs"
672+
}
673+
674+
resource "aws_vpc_endpoint" "sqs" {
675+
count = "${var.create_vpc && var.enable_sqs_endpoint ? 1 : 0}"
676+
677+
vpc_id = "${local.vpc_id}"
678+
service_name = "${data.aws_vpc_endpoint_service.sqs.service_name}"
679+
vpc_endpoint_type = "Interface"
680+
681+
security_group_ids = ["${var.sqs_endpoint_security_group_ids}"]
682+
subnet_ids = ["${coalescelist(var.sqs_endpoint_subnet_ids, aws_subnet.private.*.id)}"]
683+
private_dns_enabled = "${var.sqs_endpoint_private_dns_enabled}"
684+
}
685+
665686
#######################
666687
# VPC Endpoint for SSM
667688
#######################
@@ -888,7 +909,7 @@ resource "aws_vpc_endpoint" "ecs_telemetry" {
888909
count = "${var.create_vpc && var.enable_ecs_telemetry_endpoint ? 1 : 0}"
889910

890911
vpc_id = "${local.vpc_id}"
891-
service_name = "${data.aws_vpc_endpoint_service.ecs.service_name}"
912+
service_name = "${data.aws_vpc_endpoint_service.ecs_telemetry.service_name}"
892913
vpc_endpoint_type = "Interface"
893914

894915
security_group_ids = ["${var.ecs_telemetry_endpoint_security_group_ids}"]
@@ -914,7 +935,7 @@ resource "aws_route_table_association" "database" {
914935
}
915936

916937
resource "aws_route_table_association" "redshift" {
917-
count = "${var.create_vpc && length(var.redshift_subnets) > 0 && !var.enable_public_redshift ? length(var.redshift_subnets) : 0}"
938+
count = "${var.create_vpc && length(var.redshift_subnets) > 0 && ! var.enable_public_redshift ? length(var.redshift_subnets) : 0}"
918939

919940
subnet_id = "${element(aws_subnet.redshift.*.id, count.index)}"
920941
route_table_id = "${element(coalescelist(aws_route_table.redshift.*.id, aws_route_table.private.*.id), (var.single_nat_gateway || var.create_redshift_subnet_route_table ? 0 : count.index))}"

0 commit comments

Comments
 (0)