Added Customer Gateway resource (#360)

Author: antonbabenko

README.md

@@ -256,6 +256,8 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
 | create\_redshift\_subnet\_group | Controls if redshift subnet group should be created | bool | `"true"` | no |
 | create\_redshift\_subnet\_route\_table | Controls if separate route table for redshift should be created | bool | `"false"` | no |
 | create\_vpc | Controls if VPC should be created (it affects almost all resources) | bool | `"true"` | no |
+| customer\_gateway\_tags | Additional tags for the Customer Gateway | map(string) | `{}` | no |
+| customer\_gateways | Maps of Customer Gateway's attributes (BGP ASN and Gateway's Internet-routable external IP address) | map(map(any)) | `{}` | no |
 | database\_acl\_tags | Additional tags for the database subnets network ACL | map(string) | `{}` | no |
 | database\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for database subnets | bool | `"false"` | no |
 | database\_inbound\_acl\_rules | Database subnets inbound network ACL rules | list(map(string)) | `[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ]` | no |
@@ -506,6 +508,7 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
 | Name | Description |
 |------|-------------|
 | azs | A list of availability zones specified as argument to this module |
+| cgw\_ids | List of IDs of Customer Gateway |
 | database\_network\_acl\_id | ID of the database network ACL |
 | database\_route\_table\_ids | List of IDs of database route tables |
 | database\_subnet\_arns | List of ARNs of database subnets |
@@ -564,6 +567,7 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
 | redshift\_subnets | List of IDs of redshift subnets |
 | redshift\_subnets\_cidr\_blocks | List of cidr_blocks of redshift subnets |
 | redshift\_subnets\_ipv6\_cidr\_blocks | List of IPv6 cidr_blocks of redshift subnets in an IPv6 enabled VPC |
+| this\_customer\_gateway | Map of Customer Gateway attributes |
 | vgw\_id | The ID of the VPN Gateway |
 | vpc\_arn | The ARN of the VPC |
 | vpc\_cidr\_block | The CIDR block of the VPC |

examples/complete-vpc/README.md

@@ -21,13 +21,15 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 
 | Name | Description |
 |------|-------------|
+| cgw\_ids | List of IDs of Customer Gateway |
 | database\_subnets | List of IDs of database subnets |
 | elasticache\_subnets | List of IDs of elasticache subnets |
 | intra\_subnets | List of IDs of intra subnets |
 | nat\_public\_ips | List of public Elastic IPs created for AWS NAT Gateway |
 | private\_subnets | List of IDs of private subnets |
 | public\_subnets | List of IDs of public subnets |
 | redshift\_subnets | List of IDs of redshift subnets |
+| this\_customer\_gateway | Map of Customer Gateway attributes |
 | vpc\_endpoint\_ssm\_dns\_entry | The DNS entries for the VPC Endpoint for SSM. |
 | vpc\_endpoint\_ssm\_id | The ID of VPC endpoint for SSM |
 | vpc\_endpoint\_ssm\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SSM. |

examples/complete-vpc/main.tf

@@ -33,6 +33,17 @@ module "vpc" {
   enable_nat_gateway = true
   single_nat_gateway = true
 
+  customer_gateways = {
+    IP1 = {
+      bgp_asn    = 65112
+      ip_address = "1.2.3.4"
+    },
+    IP2 = {
+      bgp_asn    = 65112
+      ip_address = "5.6.7.8"
+    }
+  }
+
   enable_vpn_gateway = true
 
   enable_dhcp_options              = true

examples/complete-vpc/outputs.tf

@@ -57,6 +57,17 @@ output "vpc_endpoint_ssm_dns_entry" {
   value       = module.vpc.vpc_endpoint_ssm_dns_entry
 }
 
+# Customer Gateway
+output "cgw_ids" {
+  description = "List of IDs of Customer Gateway"
+  value       = module.vpc.cgw_ids
+}
+
+output "this_customer_gateway" {
+  description = "Map of Customer Gateway attributes"
+  value       = module.vpc.this_customer_gateway
+}
+
 //
 //# VPC endpoints
 //output "vpc_endpoint_ec2_id" {

main.tf

@@ -989,6 +989,25 @@ resource "aws_route_table_association" "public" {
   route_table_id = aws_route_table.public[0].id
 }
 
+####################
+# Customer Gateways
+####################
+resource "aws_customer_gateway" "this" {
+  for_each = var.customer_gateways
+
+  bgp_asn    = each.value["bgp_asn"]
+  ip_address = each.value["ip_address"]
+  type       = "ipsec.1"
+
+  tags = merge(
+    {
+      Name = format("%s-%s", var.name, each.key)
+    },
+    var.tags,
+    var.customer_gateway_tags,
+  )
+}
+
 ##############
 # VPN Gateway
 ##############

outputs.tf

@@ -263,6 +263,16 @@ output "egress_only_internet_gateway_id" {
   value       = concat(aws_egress_only_internet_gateway.this.*.id, [""])[0]
 }
 
+output "cgw_ids" {
+  description = "List of IDs of Customer Gateway"
+  value       = [for k, v in aws_customer_gateway.this : v.id]
+}
+
+output "this_customer_gateway" {
+  description = "Map of Customer Gateway attributes"
+  value       = aws_customer_gateway.this
+}
+
 output "vgw_id" {
   description = "The ID of the VPN Gateway"
   value = concat(

variables.tf

@@ -1305,6 +1305,12 @@ variable "map_public_ip_on_launch" {
   default     = true
 }
 
+variable "customer_gateways" {
+  description = "Maps of Customer Gateway's attributes (BGP ASN and Gateway's Internet-routable external IP address)"
+  type        = map(map(any))
+  default     = {}
+}
+
 variable "enable_vpn_gateway" {
   description = "Should be true if you want to create a new VPN Gateway resource and attach it to the VPC"
   type        = bool
@@ -1489,6 +1495,12 @@ variable "nat_eip_tags" {
   default     = {}
 }
 
+variable "customer_gateway_tags" {
+  description = "Additional tags for the Customer Gateway"
+  type        = map(string)
+  default     = {}
+}
+
 variable "vpn_gateway_tags" {
   description = "Additional tags for the VPN gateway"
   type        = map(string)

vpc-endpoints.tf

@@ -971,7 +971,7 @@ resource "aws_vpc_endpoint" "efs" {
   count = var.create_vpc && var.enable_efs_endpoint ? 1 : 0
 
   vpc_id            = local.vpc_id
-  service_name      = data.aws_vpc_endpoint_service.efs.service_name
+  service_name      = data.aws_vpc_endpoint_service.efs[0].service_name
   vpc_endpoint_type = "Interface"
 
   security_group_ids  = var.efs_endpoint_security_group_ids
@@ -994,7 +994,7 @@ resource "aws_vpc_endpoint" "cloud_directory" {
   count = var.create_vpc && var.enable_cloud_directory_endpoint ? 1 : 0
 
   vpc_id            = local.vpc_id
-  service_name      = data.aws_vpc_endpoint_service.cloud_directory.service_name
+  service_name      = data.aws_vpc_endpoint_service.cloud_directory[0].service_name
   vpc_endpoint_type = "Interface"
 
   security_group_ids  = var.cloud_directory_endpoint_security_group_ids