Skip to content

Commit 158b7d7

Browse files
DrFaust92antonbabenko
DrFaust92
authored and
antonbabenko
committed
Added VPC Endpoints for SNS, Cloudtrail, ELB, Cloudwatch (#269)
1 parent 7192ee6 commit 158b7d7

File tree

5 files changed

+407
-2
lines changed

5 files changed

+407
-2
lines changed

‎README.md

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@ These types of resources are supported:
1616
* [VPN Gateway](https://www.terraform.io/docs/providers/aws/r/vpn_gateway.html)
1717
* [VPC Endpoint](https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html):
1818
* Gateway: S3, DynamoDB
19-
* Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS, ECS, ECS Agent, ECS Telemetry
19+
* Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
20+
ECS, ECS Agent, ECS Telemetry, SNS, CloudWatch(Monitoring, Logs, Events), Elastic Load Balancing,
21+
CloudTrail
2022
* [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html)
2123
* [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html)
2224
* [Redshift Subnet Group](https://www.terraform.io/docs/providers/aws/r/redshift_subnet_group.html)
@@ -263,6 +265,24 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
263265
| ecs\_telemetry\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECS Telemetry endpoint | string | `"false"` | no |
264266
| ecs\_telemetry\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECS Telemetry endpoint | list | `[]` | no |
265267
| ecs\_telemetry\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECS Telemetry endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
268+
| sns\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SNS endpoint | string | `"false"` | no |
269+
| sns\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SNS endpoint | list | `[]` | no |
270+
| sns\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SNS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
271+
| cloudtrail\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for CloudTrail endpoint | string | `"false"` | no |
272+
| cloudtrail\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for CloudTrail endpoint | list | `[]` | no |
273+
| cloudtrail\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for CloudTrail endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
274+
| elasticloadbalancing\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Elastic Load Balancing endpoint | string | `"false"` | no |
275+
| elasticloadbalancing\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Elastic Load Balancing endpoint | list | `[]` | no |
276+
| elasticloadbalancing\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Elastic Load Balancing endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
277+
| logs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for CloudWatch Logs endpoint | string | `"false"` | no |
278+
| logs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for CloudWatch Logs endpoint | list | `[]` | no |
279+
| logs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for CloudWatch Logs endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
280+
| events\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for CloudWatch Events endpoint | string | `"false"` | no |
281+
| events\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for CloudWatch Events endpoint | list | `[]` | no |
282+
| events\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for CloudWatch Events endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
283+
| monitoring\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for CloudWatch Monitoring endpoint | string | `"false"` | no |
284+
| monitoring\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for CloudWatch Monitoring endpoint | list | `[]` | no |
285+
| monitoring\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for CloudWatch Monitoring endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
266286
| elasticache\_acl\_tags | Additional tags for the elasticache subnets network ACL | map | `{}` | no |
267287
| elasticache\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for elasticache subnets | string | `"false"` | no |
268288
| elasticache\_inbound\_acl\_rules | Elasticache subnets inbound network ACL rules | list | `[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ]` | no |
@@ -456,6 +476,24 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
456476
| vpc\_endpoint\_ssmmessages\_dns\_entry | The DNS entries for the VPC Endpoint for SSMMESSAGES. |
457477
| vpc\_endpoint\_ssmmessages\_id | The ID of VPC endpoint for SSMMESSAGES |
458478
| vpc\_endpoint\_ssmmessages\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SSMMESSAGES. |
479+
| vpc\_endpoint\_sns\_dns\_entry | The DNS entries for the VPC Endpoint for SNS. |
480+
| vpc\_endpoint\_sns\_id | The ID of VPC endpoint for SNS |
481+
| vpc\_endpoint\_sns\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SNS. |
482+
| vpc\_endpoint\_cloudtrail\_dns\_entry | The DNS entries for the VPC Endpoint for CloudTrail. |
483+
| vpc\_endpoint\_cloudtrail\_id | The ID of VPC endpoint for CloudTrail |
484+
| vpc\_endpoint\_cloudtrail\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for CloudTrail. |
485+
| vpc\_endpoint\_elasticloadbalancing\_dns\_entry | The DNS entries for the VPC Endpoint for Elastic Load Balancing. |
486+
| vpc\_endpoint\_elasticloadbalancing\_id | The ID of VPC endpoint for Elastic Load Balancing |
487+
| vpc\_endpoint\_elasticloadbalancing\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Elastic Load Balancing. |
488+
| vpc\_endpoint\_monitoring\_dns\_entry | The DNS entries for the VPC Endpoint for CloudWatch Monitoring. |
489+
| vpc\_endpoint\_monitoring\_id | The ID of VPC endpoint for CloudWatch Monitoring |
490+
| vpc\_endpoint\_monitoring\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for CloudWatch Monitoring. |
491+
| vpc\_endpoint\_logs\_dns\_entry | The DNS entries for the VPC Endpoint for CloudWatch Logs. |
492+
| vpc\_endpoint\_logs\_id | The ID of VPC endpoint for CloudWatch Logs |
493+
| vpc\_endpoint\_logs\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for CloudWatch Logs. |
494+
| vpc\_endpoint\_events\_dns\_entry | The DNS entries for the VPC Endpoint for CloudWatch Events. |
495+
| vpc\_endpoint\_events\_id | The ID of VPC endpoint for CloudWatch Events |
496+
| vpc\_endpoint\_events\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for CloudWatch Events. |
459497
| vpc\_id | The ID of the VPC |
460498
| vpc\_instance\_tenancy | Tenancy of instances spin up within VPC |
461499
| vpc\_main\_route\_table\_id | The ID of the main route table associated with this VPC |

‎examples/issue-108-route-already-exists/main.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,3 @@ module "vpc" {
1919
enable_s3_endpoint = true
2020
enable_dynamodb_endpoint = true
2121
}
22-

‎main.tf

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -898,6 +898,7 @@ resource "aws_vpc_endpoint_route_table_association" "public_dynamodb" {
898898
route_table_id = aws_route_table.public[0].id
899899
}
900900

901+
901902
#######################
902903
# VPC Endpoint for SQS
903904
#######################
@@ -1152,6 +1153,139 @@ resource "aws_vpc_endpoint" "ecs_telemetry" {
11521153
private_dns_enabled = var.ecs_telemetry_endpoint_private_dns_enabled
11531154
}
11541155

1156+
1157+
#######################
1158+
# VPC Endpoint for SNS
1159+
#######################
1160+
data "aws_vpc_endpoint_service" "sns" {
1161+
count = var.create_vpc && var.enable_sns_endpoint ? 1 : 0
1162+
1163+
service = "sns"
1164+
}
1165+
1166+
resource "aws_vpc_endpoint" "sns" {
1167+
count = var.create_vpc && var.enable_sns_endpoint ? 1 : 0
1168+
1169+
vpc_id = local.vpc_id
1170+
service_name = data.aws_vpc_endpoint_service.sns[0].service_name
1171+
vpc_endpoint_type = "Interface"
1172+
1173+
security_group_ids = var.sns_endpoint_security_group_ids
1174+
subnet_ids = coalescelist(var.sns_endpoint_subnet_ids, aws_subnet.private.*.id)
1175+
private_dns_enabled = var.sns_endpoint_private_dns_enabled
1176+
}
1177+
1178+
1179+
#######################
1180+
# VPC Endpoint for CloudWatch Monitoring
1181+
#######################
1182+
data "aws_vpc_endpoint_service" "monitoring" {
1183+
count = var.create_vpc && var.enable_monitoring_endpoint ? 1 : 0
1184+
1185+
service = "monitoring"
1186+
}
1187+
1188+
resource "aws_vpc_endpoint" "monitoring" {
1189+
count = var.create_vpc && var.enable_monitoring_endpoint ? 1 : 0
1190+
1191+
vpc_id = local.vpc_id
1192+
service_name = data.aws_vpc_endpoint_service.monitoring[0].service_name
1193+
vpc_endpoint_type = "Interface"
1194+
1195+
security_group_ids = var.monitoring_endpoint_security_group_ids
1196+
subnet_ids = coalescelist(var.monitoring_endpoint_subnet_ids, aws_subnet.private.*.id)
1197+
private_dns_enabled = var.monitoring_endpoint_private_dns_enabled
1198+
}
1199+
1200+
1201+
#######################
1202+
# VPC Endpoint for CloudWatch Logs
1203+
#######################
1204+
data "aws_vpc_endpoint_service" "logs" {
1205+
count = var.create_vpc && var.enable_logs_endpoint ? 1 : 0
1206+
1207+
service = "logs"
1208+
}
1209+
1210+
resource "aws_vpc_endpoint" "logs" {
1211+
count = var.create_vpc && var.enable_logs_endpoint ? 1 : 0
1212+
1213+
vpc_id = local.vpc_id
1214+
service_name = data.aws_vpc_endpoint_service.logs[0].service_name
1215+
vpc_endpoint_type = "Interface"
1216+
1217+
security_group_ids = var.logs_endpoint_security_group_ids
1218+
subnet_ids = coalescelist(var.logs_endpoint_subnet_ids, aws_subnet.private.*.id)
1219+
private_dns_enabled = var.logs_endpoint_private_dns_enabled
1220+
}
1221+
1222+
1223+
#######################
1224+
# VPC Endpoint for CloudWatch Events
1225+
#######################
1226+
data "aws_vpc_endpoint_service" "events" {
1227+
count = var.create_vpc && var.enable_events_endpoint ? 1 : 0
1228+
1229+
service = "events"
1230+
}
1231+
1232+
resource "aws_vpc_endpoint" "events" {
1233+
count = var.create_vpc && var.enable_events_endpoint ? 1 : 0
1234+
1235+
vpc_id = local.vpc_id
1236+
service_name = data.aws_vpc_endpoint_service.events[0].service_name
1237+
vpc_endpoint_type = "Interface"
1238+
1239+
security_group_ids = var.events_endpoint_security_group_ids
1240+
subnet_ids = coalescelist(var.events_endpoint_subnet_ids, aws_subnet.private.*.id)
1241+
private_dns_enabled = var.events_endpoint_private_dns_enabled
1242+
}
1243+
1244+
1245+
#######################
1246+
# VPC Endpoint for Elastic Load Balancing
1247+
#######################
1248+
data "aws_vpc_endpoint_service" "elasticloadbalancing" {
1249+
count = var.create_vpc && var.enable_elasticloadbalancing_endpoint ? 1 : 0
1250+
1251+
service = "elasticloadbalancing"
1252+
}
1253+
1254+
resource "aws_vpc_endpoint" "elasticloadbalancing" {
1255+
count = var.create_vpc && var.enable_elasticloadbalancing_endpoint ? 1 : 0
1256+
1257+
vpc_id = local.vpc_id
1258+
service_name = data.aws_vpc_endpoint_service.elasticloadbalancing[0].service_name
1259+
vpc_endpoint_type = "Interface"
1260+
1261+
security_group_ids = var.elasticloadbalancing_endpoint_security_group_ids
1262+
subnet_ids = coalescelist(var.elasticloadbalancing_endpoint_subnet_ids, aws_subnet.private.*.id)
1263+
private_dns_enabled = var.elasticloadbalancing_endpoint_private_dns_enabled
1264+
}
1265+
1266+
1267+
#######################
1268+
# VPC Endpoint for CloudTrail
1269+
#######################
1270+
data "aws_vpc_endpoint_service" "cloudtrail" {
1271+
count = var.create_vpc && var.enable_cloudtrail_endpoint ? 1 : 0
1272+
1273+
service = "cloudtrail"
1274+
}
1275+
1276+
resource "aws_vpc_endpoint" "cloudtrail" {
1277+
count = var.create_vpc && var.enable_cloudtrail_endpoint ? 1 : 0
1278+
1279+
vpc_id = local.vpc_id
1280+
service_name = data.aws_vpc_endpoint_service.cloudtrail[0].service_name
1281+
vpc_endpoint_type = "Interface"
1282+
1283+
security_group_ids = var.cloudtrail_endpoint_security_group_ids
1284+
subnet_ids = coalescelist(var.cloudtrail_endpoint_subnet_ids, aws_subnet.private.*.id)
1285+
private_dns_enabled = var.cloudtrail_endpoint_private_dns_enabled
1286+
}
1287+
1288+
11551289
##########################
11561290
# Route table association
11571291
##########################

‎outputs.tf

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -528,6 +528,96 @@ output "vpc_endpoint_ecs_telemetry_dns_entry" {
528528
value = "${flatten(aws_vpc_endpoint.ecs_telemetry.*.dns_entry)}"
529529
}
530530

531+
output "vpc_endpoint_sns_id" {
532+
description = "The ID of VPC endpoint for SNS"
533+
value = concat(aws_vpc_endpoint.sns.*.id, [""])[0]
534+
}
535+
536+
output "vpc_endpoint_sns_network_interface_ids" {
537+
description = "One or more network interfaces for the VPC Endpoint for SNS."
538+
value = flatten(aws_vpc_endpoint.sns.*.network_interface_ids)
539+
}
540+
541+
output "vpc_endpoint_sns_dns_entry" {
542+
description = "The DNS entries for the VPC Endpoint for SNS."
543+
value = flatten(aws_vpc_endpoint.sns.*.dns_entry)
544+
}
545+
546+
output "vpc_endpoint_monitoring_id" {
547+
description = "The ID of VPC endpoint for CloudWatch Monitoring"
548+
value = concat(aws_vpc_endpoint.monitoring.*.id, [""])[0]
549+
}
550+
551+
output "vpc_endpoint_monitoring_network_interface_ids" {
552+
description = "One or more network interfaces for the VPC Endpoint for CloudWatch Monitoring."
553+
value = flatten(aws_vpc_endpoint.monitoring.*.network_interface_ids)
554+
}
555+
556+
output "vpc_endpoint_monitoring_dns_entry" {
557+
description = "The DNS entries for the VPC Endpoint for CloudWatch Monitoring."
558+
value = flatten(aws_vpc_endpoint.monitoring.*.dns_entry)
559+
}
560+
561+
output "vpc_endpoint_logs_id" {
562+
description = "The ID of VPC endpoint for CloudWatch Logs"
563+
value = concat(aws_vpc_endpoint.logs.*.id, [""])[0]
564+
}
565+
566+
output "vpc_endpoint_logs_network_interface_ids" {
567+
description = "One or more network interfaces for the VPC Endpoint for CloudWatch Logs."
568+
value = flatten(aws_vpc_endpoint.logs.*.network_interface_ids)
569+
}
570+
571+
output "vpc_endpoint_logs_dns_entry" {
572+
description = "The DNS entries for the VPC Endpoint for CloudWatch Logs."
573+
value = flatten(aws_vpc_endpoint.logs.*.dns_entry)
574+
}
575+
576+
output "vpc_endpoint_events_id" {
577+
description = "The ID of VPC endpoint for CloudWatch Events"
578+
value = concat(aws_vpc_endpoint.events.*.id, [""])[0]
579+
}
580+
581+
output "vpc_endpoint_events_network_interface_ids" {
582+
description = "One or more network interfaces for the VPC Endpoint for CloudWatch Events."
583+
value = flatten(aws_vpc_endpoint.events.*.network_interface_ids)
584+
}
585+
586+
output "vpc_endpoint_events_dns_entry" {
587+
description = "The DNS entries for the VPC Endpoint for CloudWatch Events."
588+
value = flatten(aws_vpc_endpoint.events.*.dns_entry)
589+
}
590+
591+
output "vpc_endpoint_elasticloadbalancing_id" {
592+
description = "The ID of VPC endpoint for Elastic Load Balancing"
593+
value = concat(aws_vpc_endpoint.elasticloadbalancing.*.id, [""])[0]
594+
}
595+
596+
output "vpc_endpoint_elasticloadbalancing_network_interface_ids" {
597+
description = "One or more network interfaces for the VPC Endpoint for Elastic Load Balancing."
598+
value = flatten(aws_vpc_endpoint.elasticloadbalancing.*.network_interface_ids)
599+
}
600+
601+
output "vpc_endpoint_elasticloadbalancing_dns_entry" {
602+
description = "The DNS entries for the VPC Endpoint for Elastic Load Balancing."
603+
value = flatten(aws_vpc_endpoint.elasticloadbalancing.*.dns_entry)
604+
}
605+
606+
output "vpc_endpoint_cloudtrail_id" {
607+
description = "The ID of VPC endpoint for CloudTrail"
608+
value = concat(aws_vpc_endpoint.cloudtrail.*.id, [""])[0]
609+
}
610+
611+
output "vpc_endpoint_cloudtrail_network_interface_ids" {
612+
description = "One or more network interfaces for the VPC Endpoint for CloudTrail."
613+
value = flatten(aws_vpc_endpoint.cloudtrail.*.network_interface_ids)
614+
}
615+
616+
output "vpc_endpoint_cloudtrail_dns_entry" {
617+
description = "The DNS entries for the VPC Endpoint for CloudTrail."
618+
value = flatten(aws_vpc_endpoint.cloudtrail.*.dns_entry)
619+
}
620+
531621
# Static values (arguments)
532622
output "azs" {
533623
description = "A list of availability zones specified as argument to this module"

0 commit comments

Comments
 (0)