Skip to content

Commit cacc2b0

Browse files
aiell0aiell0
authored
feat: Lambda VPC Endpoint (#534)
1 parent e320ada commit cacc2b0

File tree

7 files changed

+90
-1
lines changed

7 files changed

+90
-1
lines changed

‎README.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -450,6 +450,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
450450
| enable\_kinesis\_firehose\_endpoint | Should be true if you want to provision a Kinesis Firehose endpoint to the VPC | `bool` | `false` | no |
451451
| enable\_kinesis\_streams\_endpoint | Should be true if you want to provision a Kinesis Streams endpoint to the VPC | `bool` | `false` | no |
452452
| enable\_kms\_endpoint | Should be true if you want to provision a KMS endpoint to the VPC | `bool` | `false` | no |
453+
| enable\_lambda\_endpoint | Should be true if you want to provision a Lambda endpoint to the VPC | `bool` | `false` | no |
453454
| enable\_logs\_endpoint | Should be true if you want to provision a CloudWatch Logs endpoint to the VPC | `bool` | `false` | no |
454455
| enable\_monitoring\_endpoint | Should be true if you want to provision a CloudWatch Monitoring endpoint to the VPC | `bool` | `false` | no |
455456
| enable\_nat\_gateway | Should be true if you want to provision NAT Gateways for each of your private networks | `bool` | `false` | no |
@@ -519,6 +520,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
519520
| kms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for KMS endpoint | `bool` | `false` | no |
520521
| kms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for KMS endpoint | `list(string)` | `[]` | no |
521522
| kms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for KMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
523+
| lambda\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Lambda endpoint | `bool` | `false` | no |
524+
| lambda\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Lambda endpoint | `list(string)` | `[]` | no |
525+
| lambda\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Lambda endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
522526
| logs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for CloudWatch Logs endpoint | `bool` | `false` | no |
523527
| logs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for CloudWatch Logs endpoint | `list(string)` | `[]` | no |
524528
| logs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for CloudWatch Logs endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -855,6 +859,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
855859
| vpc\_endpoint\_kms\_dns\_entry | The DNS entries for the VPC Endpoint for KMS. |
856860
| vpc\_endpoint\_kms\_id | The ID of VPC endpoint for KMS |
857861
| vpc\_endpoint\_kms\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for KMS. |
862+
| vpc\_endpoint\_lambda\_dns\_entry | The DNS entries for the VPC Endpoint for Lambda. |
863+
| vpc\_endpoint\_lambda\_id | The ID of VPC endpoint for Lambda |
864+
| vpc\_endpoint\_lambda\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Lambda. |
858865
| vpc\_endpoint\_logs\_dns\_entry | The DNS entries for the VPC Endpoint for CloudWatch Logs. |
859866
| vpc\_endpoint\_logs\_id | The ID of VPC endpoint for CloudWatch Logs |
860867
| vpc\_endpoint\_logs\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for CloudWatch Logs. |

‎examples/complete-vpc/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@ No input.
4747
| public\_subnets | List of IDs of public subnets |
4848
| redshift\_subnets | List of IDs of redshift subnets |
4949
| this\_customer\_gateway | Map of Customer Gateway attributes |
50+
| vpc\_endpoint\_lambda\_dns\_entry | The DNS entries for the VPC Endpoint for Lambda. |
51+
| vpc\_endpoint\_lambda\_id | The ID of VPC endpoint for Lambda |
52+
| vpc\_endpoint\_lambda\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Lambda. |
5053
| vpc\_endpoint\_ssm\_dns\_entry | The DNS entries for the VPC Endpoint for SSM. |
5154
| vpc\_endpoint\_ssm\_id | The ID of VPC endpoint for SSM |
5255
| vpc\_endpoint\_ssm\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for SSM. |

‎examples/complete-vpc/main.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,11 @@ module "vpc" {
6161
ssm_endpoint_private_dns_enabled = true
6262
ssm_endpoint_security_group_ids = [data.aws_security_group.default.id]
6363

64+
# VPC endpoint for Lambda
65+
enable_lambda_endpoint = true
66+
lambda_endpoint_private_dns_enabled = true
67+
lambda_endpoint_security_group_ids = [data.aws_security_group.default.id]
68+
6469
# VPC endpoint for SSMMESSAGES
6570
enable_ssmmessages_endpoint = true
6671
ssmmessages_endpoint_private_dns_enabled = true
@@ -133,4 +138,3 @@ module "vpc" {
133138
Endpoint = "true"
134139
}
135140
}
136-

‎examples/complete-vpc/outputs.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,21 @@ output "vpc_endpoint_ssm_dns_entry" {
5757
value = module.vpc.vpc_endpoint_ssm_dns_entry
5858
}
5959

60+
output "vpc_endpoint_lambda_id" {
61+
description = "The ID of VPC endpoint for Lambda"
62+
value = module.vpc.vpc_endpoint_lambda_id
63+
}
64+
65+
output "vpc_endpoint_lambda_network_interface_ids" {
66+
description = "One or more network interfaces for the VPC Endpoint for Lambda."
67+
value = module.vpc.vpc_endpoint_lambda_network_interface_ids
68+
}
69+
70+
output "vpc_endpoint_lambda_dns_entry" {
71+
description = "The DNS entries for the VPC Endpoint for Lambda."
72+
value = module.vpc.vpc_endpoint_lambda_dns_entry
73+
}
74+
6075
# Customer Gateway
6176
output "cgw_ids" {
6277
description = "List of IDs of Customer Gateway"

‎outputs.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -513,6 +513,21 @@ output "vpc_endpoint_sqs_dns_entry" {
513513
value = flatten(aws_vpc_endpoint.sqs.*.dns_entry)
514514
}
515515

516+
output "vpc_endpoint_lambda_id" {
517+
description = "The ID of VPC endpoint for Lambda"
518+
value = concat(aws_vpc_endpoint.lambda.*.id, [""])[0]
519+
}
520+
521+
output "vpc_endpoint_lambda_network_interface_ids" {
522+
description = "One or more network interfaces for the VPC Endpoint for Lambda."
523+
value = flatten(aws_vpc_endpoint.lambda.*.network_interface_ids)
524+
}
525+
526+
output "vpc_endpoint_lambda_dns_entry" {
527+
description = "The DNS entries for the VPC Endpoint for Lambda."
528+
value = flatten(aws_vpc_endpoint.lambda.*.dns_entry)
529+
}
530+
516531
output "vpc_endpoint_codebuild_id" {
517532
description = "The ID of VPC endpoint for codebuild"
518533
value = concat(aws_vpc_endpoint.codebuild.*.id, [""])[0]

‎variables.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -490,6 +490,30 @@ variable "sqs_endpoint_private_dns_enabled" {
490490
default = false
491491
}
492492

493+
variable "enable_lambda_endpoint" {
494+
description = "Should be true if you want to provision a Lambda endpoint to the VPC"
495+
type = bool
496+
default = false
497+
}
498+
499+
variable "lambda_endpoint_security_group_ids" {
500+
description = "The ID of one or more security groups to associate with the network interface for Lambda endpoint"
501+
type = list(string)
502+
default = []
503+
}
504+
505+
variable "lambda_endpoint_subnet_ids" {
506+
description = "The ID of one or more subnets in which to create a network interface for Lambda endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
507+
type = list(string)
508+
default = []
509+
}
510+
511+
variable "lambda_endpoint_private_dns_enabled" {
512+
description = "Whether or not to associate a private hosted zone with the specified VPC for Lambda endpoint"
513+
type = bool
514+
default = false
515+
}
516+
493517
variable "enable_ssm_endpoint" {
494518
description = "Should be true if you want to provision an SSM endpoint to the VPC"
495519
type = bool

‎vpc-endpoints.tf

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,27 @@ resource "aws_vpc_endpoint" "sqs" {
185185
tags = local.vpce_tags
186186
}
187187

188+
#########################
189+
# VPC Endpoint for Lambda
190+
#########################
191+
data "aws_vpc_endpoint_service" "lambda" {
192+
count = var.create_vpc && var.enable_lambda_endpoint ? 1 : 0
193+
194+
service = "lambda"
195+
}
196+
resource "aws_vpc_endpoint" "lambda" {
197+
count = var.create_vpc && var.enable_lambda_endpoint ? 1 : 0
198+
199+
vpc_id = local.vpc_id
200+
service_name = data.aws_vpc_endpoint_service.lambda[0].service_name
201+
vpc_endpoint_type = "Interface"
202+
203+
security_group_ids = var.lambda_endpoint_security_group_ids
204+
subnet_ids = coalescelist(var.lambda_endpoint_subnet_ids, aws_subnet.private.*.id)
205+
private_dns_enabled = var.lambda_endpoint_private_dns_enabled
206+
tags = local.vpce_tags
207+
}
208+
188209
###################################
189210
# VPC Endpoint for Secrets Manager
190211
###################################

0 commit comments

Comments
 (0)