Issue #16: ipv6 support - add ipv6 support

main.tf

@@ -2,10 +2,11 @@
 # VPC
 ######
 resource "aws_vpc" "this" {
-  cidr_block           = "${var.cidr}"
-  instance_tenancy     = "${var.instance_tenancy}"
-  enable_dns_hostnames = "${var.enable_dns_hostnames}"
-  enable_dns_support   = "${var.enable_dns_support}"
+  cidr_block                       = "${var.cidr}"
+  instance_tenancy                 = "${var.instance_tenancy}"
+  enable_dns_hostnames             = "${var.enable_dns_hostnames}"
+  enable_dns_support               = "${var.enable_dns_support}"
+  assign_generated_ipv6_cidr_block = "${var.enable_ipv6}"
 
   tags = "${merge(var.tags, map("Name", format("%s", var.name)))}"
 }
@@ -41,6 +42,14 @@ resource "aws_route" "public_internet_gateway" {
   gateway_id             = "${aws_internet_gateway.this.id}"
 }
 
+resource "aws_route" "public_internet_gateway_ipv6" {
+  count = "${var.enable_ipv6 && length(var.public_subnets) > 0 ? 1 : 0}"
+
+  route_table_id              = "${aws_route_table.public.id}"
+  destination_ipv6_cidr_block = "::/0"
+  gateway_id                  = "${aws_internet_gateway.this.id}"
+}
+
 #################
 # Private routes
 #################
@@ -57,7 +66,7 @@ resource "aws_route_table" "private" {
 # Public subnet
 ################
 resource "aws_subnet" "public" {
-  count = "${length(var.public_subnets)}"
+  count = "${!var.enable_ipv6 ? length(var.public_subnets) : 0}"
 
   vpc_id                  = "${aws_vpc.this.id}"
   cidr_block              = "${var.public_subnets[count.index]}"
@@ -67,11 +76,24 @@ resource "aws_subnet" "public" {
   tags = "${merge(var.tags, var.public_subnet_tags, map("Name", format("%s-public-%s", var.name, element(var.azs, count.index))))}"
 }
 
+resource "aws_subnet" "public_ipv6" {
+  count = "${var.enable_ipv6 ? length(var.public_subnets) : 0}"
+
+  vpc_id                          = "${aws_vpc.this.id}"
+  cidr_block                      = "${var.public_subnets[count.index]}"
+  ipv6_cidr_block                 = "${cidrsubnet(aws_vpc.this.ipv6_cidr_block,8,count.index)}"
+  availability_zone               = "${element(var.azs, count.index)}"
+  map_public_ip_on_launch         = "${var.map_public_ip_on_launch}"
+  assign_ipv6_address_on_creation = "${var.assign_ipv6_address_on_creation}"
+
+  tags = "${merge(var.tags, var.public_subnet_tags, map("Name", format("%s-public-%s", var.name, element(var.azs, count.index))))}"
+}
+
 #################
 # Private subnet
 #################
 resource "aws_subnet" "private" {
-  count = "${length(var.private_subnets)}"
+  count = "${!var.enable_ipv6 ? length(var.private_subnets) : 0}"
 
   vpc_id            = "${aws_vpc.this.id}"
   cidr_block        = "${var.private_subnets[count.index]}"
@@ -80,6 +102,18 @@ resource "aws_subnet" "private" {
   tags = "${merge(var.tags, var.private_subnet_tags, map("Name", format("%s-private-%s", var.name, element(var.azs, count.index))))}"
 }
 
+resource "aws_subnet" "private_ipv6" {
+  count = "${var.enable_ipv6 ? length(var.private_subnets) : 0}"
+
+  vpc_id                          = "${aws_vpc.this.id}"
+  cidr_block                      = "${var.private_subnets[count.index]}"
+  ipv6_cidr_block                 = "${cidrsubnet(aws_vpc.this.ipv6_cidr_block,8,count.index+32)}"
+  availability_zone               = "${element(var.azs, count.index)}"
+  assign_ipv6_address_on_creation = "${var.assign_ipv6_address_on_creation}"
+
+  tags = "${merge(var.tags, var.private_subnet_tags, map("Name", format("%s-private-%s", var.name, element(var.azs, count.index))))}"
+}
+
 ##################
 # Database subnet
 ##################
@@ -144,6 +178,12 @@ resource "aws_nat_gateway" "this" {
   depends_on = ["aws_internet_gateway.this"]
 }
 
+resource "aws_egress_only_internet_gateway" "this" {
+  count = "${var.enable_ipv6 ? 1 : 0}"
+
+  vpc_id = "${aws_vpc.this.id}"
+}
+
 resource "aws_route" "private_nat_gateway" {
   count = "${var.enable_nat_gateway ? length(var.azs) : 0}"
 
@@ -152,6 +192,14 @@ resource "aws_route" "private_nat_gateway" {
   nat_gateway_id         = "${element(aws_nat_gateway.this.*.id, count.index)}"
 }
 
+resource "aws_route" "private_nat_gateway_ipv6" {
+  count = "${var.enable_ipv6 ? length(var.azs) : 0}"
+
+  route_table_id              = "${element(aws_route_table.private.*.id, count.index)}"
+  destination_ipv6_cidr_block = "::/0"
+  egress_only_gateway_id      = "${aws_egress_only_internet_gateway.this.id}"
+}
+
 ######################
 # VPC Endpoint for S3
 ######################
@@ -216,12 +264,19 @@ resource "aws_vpc_endpoint_route_table_association" "public_dynamodb" {
 # Route table association
 ##########################
 resource "aws_route_table_association" "private" {
-  count = "${length(var.private_subnets)}"
+  count = "${!var.enable_ipv6 ? length(var.private_subnets) : 0}"
 
   subnet_id      = "${element(aws_subnet.private.*.id, count.index)}"
   route_table_id = "${element(aws_route_table.private.*.id, count.index)}"
 }
 
+resource "aws_route_table_association" "private_ipv6" {
+  count = "${var.enable_ipv6 ? length(var.private_subnets) : 0}"
+
+  subnet_id      = "${element(aws_subnet.private_ipv6.*.id, count.index)}"
+  route_table_id = "${element(aws_route_table.private.*.id, count.index)}"
+}
+
 resource "aws_route_table_association" "database" {
   count = "${length(var.database_subnets)}"
 
@@ -237,8 +292,15 @@ resource "aws_route_table_association" "elasticache" {
 }
 
 resource "aws_route_table_association" "public" {
-  count = "${length(var.public_subnets)}"
+  count = "${!var.enable_ipv6 ? length(var.public_subnets) : 0}"
 
   subnet_id      = "${element(aws_subnet.public.*.id, count.index)}"
   route_table_id = "${aws_route_table.public.id}"
 }
+
+resource "aws_route_table_association" "public_ipv6" {
+  count = "${var.enable_ipv6 ? length(var.public_subnets) : 0}"
+
+  subnet_id      = "${element(aws_subnet.public_ipv6.*.id, count.index)}"
+  route_table_id = "${aws_route_table.public.id}"
+}

outputs.tf

@@ -30,6 +30,21 @@ output "private_subnets_cidr_blocks" {
   value       = ["${aws_subnet.private.*.cidr_block}"]
 }
 
+output "ipv6_enabled_private_subnets" {
+  description = "List of IDs of private subnets in an ipv6 enabled VPC"
+  value       = ["${aws_subnet.private_ipv6.*.id}"]
+}
+
+output "ipv6_enabled_private_subnets_ipv4_cidr_blocks" {
+  description = "List of ipv4 cidr_blocks of private subnets in an ipv6 enabled VPC"
+  value       = ["${aws_subnet.private_ipv6.*.cidr_block}"]
+}
+
+output "ipv6_enabled_private_subnets_ipv6_cidr_blocks" {
+  description = "List of ipv6 cidr_blocks of private subnets in an ipv6 enabled VPC"
+  value       = ["${aws_subnet.private_ipv6.*.ipv6_cidr_block}"]
+}
+
 output "public_subnets" {
   description = "List of IDs of public subnets"
   value       = ["${aws_subnet.public.*.id}"]
@@ -40,6 +55,21 @@ output "public_subnets_cidr_blocks" {
   value       = ["${aws_subnet.public.*.cidr_block}"]
 }
 
+output "ipv6_enabled_public_subnets" {
+  description = "List of IDs of public subnets in an ipv6 enabled VPC"
+  value       = ["${aws_subnet.public_ipv6.*.id}"]
+}
+
+output "ipv6_enabled_public_subnets_ipv4_cidr_blocks" {
+  description = "List of ipv4 cidr_blocks of public subnets in an ipv6 enabled VPC"
+  value       = ["${aws_subnet.public_ipv6.*.cidr_block}"]
+}
+
+output "ipv6_enabled_public_subnets_ipv6_cidr_blocks" {
+  description = "List of ipv6 cidr_blocks of public subnets in an ipv6 enabled VPC"
+  value       = ["${aws_subnet.public_ipv6.*.ipv6_cidr_block}"]
+}
+
 output "database_subnets" {
   description = "List of IDs of database subnets"
   value       = ["${aws_subnet.database.*.id}"]
@@ -102,6 +132,11 @@ output "igw_id" {
   value       = "${aws_internet_gateway.this.id}"
 }
 
+output "ipv6_egress_only_igw_id" {
+  description = "The ID of the egress only Internet Gateway"
+  value       = "${aws_egress_only_internet_gateway.this.id}"
+}
+
 # VPC Endpoints
 output "vpc_endpoint_s3_id" {
   description = "The ID of VPC endpoint for S3"

variables.tf

@@ -124,3 +124,13 @@ variable "elasticache_subnet_tags" {
   description = "Additional tags for the elasticache subnets"
   default     = {}
 }
+
+variable "enable_ipv6" {
+  description = "Enable ipv6 in this VPC"
+  default     = false
+}
+
+variable "assign_ipv6_address_on_creation" {
+  description = "True to assign ipv6 dynamically, this is the ipv6 equivalent of map_public_ip_on_launch"
+  default     = true
+}