-
Notifications
You must be signed in to change notification settings - Fork 8
/
network.tf
134 lines (112 loc) · 3.09 KB
/
network.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
resource "aws_vpc" "vpc" {
cidr_block = "${var.vpc_cidr}"
enable_dns_support = true
enable_dns_hostnames = true
}
resource "aws_internet_gateway" "igw" {
vpc_id = "${aws_vpc.vpc.id}"
}
resource "aws_subnet" "frontend_subnet" {
count = 2
vpc_id = "${aws_vpc.vpc.id}"
cidr_block = "${cidrsubnet(var.vpc_cidr, 8, count.index+1)}"
availability_zone = "${var.azs[count.index]}"
map_public_ip_on_launch = true
tags {
Name = "${var.name}-frontend-subnet"
}
}
resource "aws_route_table" "frontend_subnet" {
vpc_id = "${aws_vpc.vpc.id}"
route {
cidr_block = "0.0.0.0/0"
gateway_id = "${aws_internet_gateway.igw.id}"
}
tags {
Name = "${var.name}-frontend-subnet"
}
}
resource "aws_route_table_association" "frontend_subnet" {
count = 2
subnet_id = "${element(aws_subnet.frontend_subnet.*.id, count.index)}"
route_table_id = "${aws_route_table.frontend_subnet.id}"
}
resource "aws_eip" "nat" {
vpc = true
}
resource "aws_nat_gateway" "nat" {
allocation_id = "${aws_eip.nat.id}"
subnet_id = "${element(aws_subnet.frontend_subnet.*.id, 0)}"
depends_on = ["aws_internet_gateway.igw"]
}
resource "aws_subnet" "application_subnet" {
count = 2
vpc_id = "${aws_vpc.vpc.id}"
cidr_block = "${cidrsubnet(var.vpc_cidr, 8, count.index+101)}"
availability_zone = "${var.azs[count.index]}"
map_public_ip_on_launch = false
tags {
Name = "${var.name}-application-subnet"
}
}
resource "aws_route_table" "application_subnet" {
vpc_id = "${aws_vpc.vpc.id}"
route {
cidr_block = "0.0.0.0/0"
nat_gateway_id = "${aws_nat_gateway.nat.id}"
}
tags {
Name = "${var.name}-application-subnet"
}
}
resource "aws_vpc_endpoint" "vpc_endpoint" {
vpc_id = "${aws_vpc.vpc.id}"
service_name = "com.amazonaws.ap-northeast-1.s3"
route_table_ids = ["${aws_route_table.application_subnet.*.id}"]
policy = <<EOT
{
"Statement": [
{
"Action": "*",
"Effect": "Allow",
"Resource": "*",
"Principal": "*"
}
]
}
EOT
}
resource "aws_route_table_association" "application_subnet" {
count = 2
subnet_id = "${element(aws_subnet.application_subnet.*.id, count.index)}"
route_table_id = "${aws_route_table.application_subnet.id}"
}
resource "aws_subnet" "datastore_subnet" {
count = 2
vpc_id = "${aws_vpc.vpc.id}"
cidr_block = "${cidrsubnet(var.vpc_cidr, 8, count.index+201)}"
availability_zone = "${var.azs[count.index]}"
tags {
Name = "${var.name}-datastore-subnet"
}
}
resource "aws_network_acl" "acl" {
vpc_id = "${aws_vpc.vpc.id}"
subnet_ids = ["${aws_subnet.frontend_subnet.*.id}", "${aws_subnet.application_subnet.*.id}"]
ingress {
protocol = "-1"
rule_no = 100
action = "allow"
cidr_block = "0.0.0.0/0"
from_port = 0
to_port = 0
}
egress {
protocol = "-1"
rule_no = 100
action = "allow"
cidr_block = "0.0.0.0/0"
from_port = 0
to_port = 0
}
}