feat: Added Textract vpc endpoint (#509)

Author: pserrano

README.md

@@ -22,7 +22,7 @@ These types of resources are supported:
   * Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
 ECS, ECS Agent, ECS Telemetry, SES, SNS, STS, Glue, CloudWatch(Monitoring, Logs, Events),
 Elastic Load Balancing, CloudTrail, Secrets Manager, Config, CodeBuild, CodeCommit,
-Git-Codecommit, Transfer Server, Kinesis Streams, Kinesis Firehose, SageMaker(Notebook, Runtime, API),
+Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, SageMaker(Notebook, Runtime, API),
 CloudFormation, CodePipeline, Storage Gateway, AppMesh, Transfer, Service Catalog, AppStream API, AppStream Streaming,
 Athena, Rekognition, Elastic File System (EFS), Cloud Directory, Elastic Beanstalk (+ Health), Elastic Map Reduce(EMR),
 DataSync, EBS, SMS, Elastic Inference Runtime, QLDB Session, Step Functions, Access Analyzer, Auto Scaling Plans,
@@ -465,6 +465,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_states\_endpoint | Should be true if you want to provision a Step Function endpoint to the VPC | `bool` | `false` | no |
 | enable\_storagegateway\_endpoint | Should be true if you want to provision a Storage Gateway endpoint to the VPC | `bool` | `false` | no |
 | enable\_sts\_endpoint | Should be true if you want to provision a STS endpoint to the VPC | `bool` | `false` | no |
+| enable\_textract\_endpoint | Should be true if you want to provision a Textract endpoint to the VPC | `bool` | `false` | no |
 | enable\_transfer\_endpoint | Should be true if you want to provision a Transfer endpoint to the VPC | `bool` | `false` | no |
 | enable\_transferserver\_endpoint | Should be true if you want to provision a Transfer Server endpoint to the VPC | `bool` | `false` | no |
 | enable\_vpn\_gateway | Should be true if you want to create a new VPN Gateway resource and attach it to the VPC | `bool` | `false` | no |
@@ -614,9 +615,12 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | sts\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for STS endpoint | `list(string)` | `[]` | no |
 | sts\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for STS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | tags | A map of tags to add to all resources | `map(string)` | `{}` | no |
+| textract\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Textract | `bool` | `false` | no |
+| textract\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Textract endpoint | `list(string)` | `[]` | no |
+| textract\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Textract endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | transfer\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Transfer endpoint | `bool` | `false` | no |
 | transfer\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Transfer endpoint | `list(string)` | `[]` | no |
-| transfer\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Transfer endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
+| transfer\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Transfer endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | transferserver\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Transfer Server endpoint | `bool` | `false` | no |
 | transferserver\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Transfer Server endpoint | `list(string)` | `[]` | no |
 | transferserver\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Transfer Server endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -890,6 +894,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_sts\_dns\_entry | The DNS entries for the VPC Endpoint for STS. |
 | vpc\_endpoint\_sts\_id | The ID of VPC endpoint for STS |
 | vpc\_endpoint\_sts\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for STS. |
+| vpc\_endpoint\_textract\_dns\_entry | The DNS entries for the VPC Endpoint for textract. |
+| vpc\_endpoint\_textract\_id | The ID of VPC endpoint for textract. |
+| vpc\_endpoint\_textract\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for textract. |
 | vpc\_endpoint\_transfer\_dns\_entry | The DNS entries for the VPC Endpoint for Transfer. |
 | vpc\_endpoint\_transfer\_id | The ID of VPC endpoint for Transfer |
 | vpc\_endpoint\_transfer\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Transfer. |

outputs.tf

@@ -1347,6 +1347,21 @@ output "vpc_endpoint_ses_dns_entry" {
   value       = flatten(aws_vpc_endpoint.ses.*.dns_entry)
 }
 
+output "vpc_endpoint_textract_id" {
+  description = "The ID of VPC endpoint for Textract"
+  value       = concat(aws_vpc_endpoint.textract.*.id, [""])[0]
+}
+
+output "vpc_endpoint_textract_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for Textract."
+  value       = flatten(aws_vpc_endpoint.textract.*.network_interface_ids)
+}
+
+output "vpc_endpoint_textract_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for Textract."
+  value       = flatten(aws_vpc_endpoint.textract.*.dns_entry)
+}
+
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"

variables.tf

@@ -538,6 +538,30 @@ variable "ssmmessages_endpoint_private_dns_enabled" {
   default     = false
 }
 
+variable "enable_textract_endpoint" {
+  description = "Should be true if you want to provision an Textract endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "textract_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for Textract endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "textract_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for Textract endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "textract_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for Textract endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_transferserver_endpoint" {
   description = "Should be true if you want to provision a Transfer Server endpoint to the VPC"
   type        = bool

vpc-endpoints.tf

@@ -1439,3 +1439,26 @@ resource "aws_vpc_endpoint" "codedeploy_commands_secure" {
 
   tags = local.vpce_tags
 }
+
+#############################################
+# VPC Endpoint for Textract
+#############################################
+data "aws_vpc_endpoint_service" "textract" {
+  count = var.create_vpc && var.enable_textract_endpoint ? 1 : 0
+
+  service = "textract"
+}
+
+resource "aws_vpc_endpoint" "textract" {
+  count = var.create_vpc && var.enable_textract_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.textract[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.textract_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.textract_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.textract_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}