Skip to content

Commit 34d17b3

Browse files
antonbabenkoantonbabenko
authored
Additional VPC Endpoints (terraform-aws-modules#302)
* adding secrets manager vpc end point support * adding config vpc end point support * adding codebuild, codecommit and git-codecommit vpc end point support * adding transfer server vpc end point support
2 parents 16d5f0e + 4e31800 commit 34d17b3

File tree

3 files changed

+276
-3
lines changed

3 files changed

+276
-3
lines changed

‎README.md

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ These types of resources are supported:
1818
* Gateway: S3, DynamoDB
1919
* Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
2020
ECS, ECS Agent, ECS Telemetry, SNS, CloudWatch(Monitoring, Logs, Events), Elastic Load Balancing,
21-
CloudTrail
21+
CloudTrail, Secrets Manager, Config, Codebuild, Codecommit, Git-Codecommit, Transfer Server
2222
* [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html)
2323
* [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html)
2424
* [Redshift Subnet Group](https://www.terraform.io/docs/providers/aws/r/redshift_subnet_group.html)
@@ -376,15 +376,33 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
376376
| sns\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SNS endpoint | bool | `"false"` | no |
377377
| sns\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SNS endpoint | list(string) | `[]` | no |
378378
| sns\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SNS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list(string) | `[]` | no |
379+
| codebuild\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Codebuild endpoint | string | `"false"` | no |
380+
| codebuild\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Codebuild endpoint | list | `[]` | no |
381+
| codebuild\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Codebuild endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
382+
| codecommit\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Codecommit endpoint | string | `"false"` | no |
383+
| codecommit\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Codecommit endpoint | list | `[]` | no |
384+
| codecommit\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Codecommit endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
385+
| git\_codecommit\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Git Codecommit endpoint | string | `"false"` | no |
386+
| git\_codecommit\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Git Codecommit endpoint | list | `[]` | no |
387+
| git\_codecommit\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Git Codecommit endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
388+
| config\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Config endpoint | string | `"false"` | no |
389+
| config\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Config endpoint | list | `[]` | no |
390+
| config\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Config endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
379391
| sqs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SQS endpoint | string | `"false"` | no |
380392
| sqs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SQS endpoint | list | `[]` | no |
381393
| sqs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SQS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list | `[]` | no |
382394
| ssm\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SSM endpoint | bool | `"false"` | no |
383395
| ssm\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SSM endpoint | list(string) | `[]` | no |
384396
| ssm\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SSM endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list(string) | `[]` | no |
397+
| secretsmanager\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Secrets Manager endpoint | bool | `"false"` | no |
398+
| secretsmanager\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Secrets Manager endpoint | list(string) | `[]` | no |
399+
| secretsmanager\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Secrets Manager endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list(string) | `[]` | no |
385400
| ssmmessages\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SSMMESSAGES endpoint | bool | `"false"` | no |
386401
| ssmmessages\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SSMMESSAGES endpoint | list(string) | `[]` | no |
387402
| ssmmessages\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SSMMESSAGES endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list(string) | `[]` | no |
403+
| transferserver\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Transfer Server endpoint | bool | `"false"` | no |
404+
| transferserver\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Transfer Server endpoint | list(string) | `[]` | no |
405+
| transferserver\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Transfer Server endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | list(string) | `[]` | no |
388406
| tags | A map of tags to add to all resources | map(string) | `{}` | no |
389407
| vpc\_tags | Additional tags for the VPC | map(string) | `{}` | no |
390408
| vpn\_gateway\_id | ID of VPN Gateway to attach to the VPC | string | `""` | no |

‎main.tf

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -899,6 +899,90 @@ resource "aws_vpc_endpoint_route_table_association" "public_dynamodb" {
899899
}
900900

901901

902+
#############################
903+
# VPC Endpoint for Codebuild
904+
#############################
905+
data "aws_vpc_endpoint_service" "codebuild" {
906+
count = var.create_vpc && var.enable_codebuild_endpoint ? 1 : 0
907+
908+
service = "codebuild"
909+
}
910+
911+
resource "aws_vpc_endpoint" "codebuild" {
912+
count = var.create_vpc && var.enable_codebuild_endpoint ? 1 : 0
913+
914+
vpc_id = local.vpc_id
915+
service_name = data.aws_vpc_endpoint_service.codebuild[0].service_name
916+
vpc_endpoint_type = "Interface"
917+
918+
security_group_ids = var.codebuild_endpoint_security_group_ids
919+
subnet_ids = coalescelist(var.codebuild_endpoint_subnet_ids, aws_subnet.private.*.id)
920+
private_dns_enabled = var.codebuild_endpoint_private_dns_enabled
921+
}
922+
923+
###############################
924+
# VPC Endpoint for Code Commit
925+
###############################
926+
data "aws_vpc_endpoint_service" "codecommit" {
927+
count = var.create_vpc && var.enable_codecommit_endpoint ? 1 : 0
928+
929+
service = "codecommit"
930+
}
931+
932+
resource "aws_vpc_endpoint" "codecommit" {
933+
count = var.create_vpc && var.enable_codecommit_endpoint ? 1 : 0
934+
935+
vpc_id = local.vpc_id
936+
service_name = data.aws_vpc_endpoint_service.codecommit[0].service_name
937+
vpc_endpoint_type = "Interface"
938+
939+
security_group_ids = var.codecommit_endpoint_security_group_ids
940+
subnet_ids = coalescelist(var.codecommit_endpoint_subnet_ids, aws_subnet.private.*.id)
941+
private_dns_enabled = var.codecommit_endpoint_private_dns_enabled
942+
}
943+
944+
###################################
945+
# VPC Endpoint for Git Code Commit
946+
###################################
947+
data "aws_vpc_endpoint_service" "git_codecommit" {
948+
count = var.create_vpc && var.enable_git_codecommit_endpoint ? 1 : 0
949+
950+
service = "git-codecommit"
951+
}
952+
953+
resource "aws_vpc_endpoint" "git_codecommit" {
954+
count = var.create_vpc && var.enable_git_codecommit_endpoint ? 1 : 0
955+
956+
vpc_id = local.vpc_id
957+
service_name = data.aws_vpc_endpoint_service.git_codecommit[0].service_name
958+
vpc_endpoint_type = "Interface"
959+
960+
security_group_ids = var.git_codecommit_endpoint_security_group_ids
961+
subnet_ids = coalescelist(var.git_codecommit_endpoint_subnet_ids, aws_subnet.private.*.id)
962+
private_dns_enabled = var.git_codecommit_endpoint_private_dns_enabled
963+
}
964+
965+
##########################
966+
# VPC Endpoint for Config
967+
##########################
968+
data "aws_vpc_endpoint_service" "config" {
969+
count = var.create_vpc && var.enable_config_endpoint ? 1 : 0
970+
971+
service = "config"
972+
}
973+
974+
resource "aws_vpc_endpoint" "config" {
975+
count = var.create_vpc && var.enable_config_endpoint ? 1 : 0
976+
977+
vpc_id = local.vpc_id
978+
service_name = data.aws_vpc_endpoint_service.config[0].service_name
979+
vpc_endpoint_type = "Interface"
980+
981+
security_group_ids = var.config_endpoint_security_group_ids
982+
subnet_ids = coalescelist(var.config_endpoint_subnet_ids, aws_subnet.private.*.id)
983+
private_dns_enabled = var.config_endpoint_private_dns_enabled
984+
}
985+
902986
#######################
903987
# VPC Endpoint for SQS
904988
#######################
@@ -920,6 +1004,27 @@ resource "aws_vpc_endpoint" "sqs" {
9201004
private_dns_enabled = var.sqs_endpoint_private_dns_enabled
9211005
}
9221006

1007+
###################################
1008+
# VPC Endpoint for Secrets Manager
1009+
###################################
1010+
data "aws_vpc_endpoint_service" "secretsmanager" {
1011+
count = var.create_vpc && var.enable_secretsmanager_endpoint ? 1 : 0
1012+
1013+
service = "secretsmanager"
1014+
}
1015+
1016+
resource "aws_vpc_endpoint" "secretsmanager" {
1017+
count = var.create_vpc && var.enable_secretsmanager_endpoint ? 1 : 0
1018+
1019+
vpc_id = local.vpc_id
1020+
service_name = data.aws_vpc_endpoint_service.secretsmanager[0].service_name
1021+
vpc_endpoint_type = "Interface"
1022+
1023+
security_group_ids = var.secretsmanager_endpoint_security_group_ids
1024+
subnet_ids = coalescelist(var.secretsmanager_endpoint_subnet_ids, aws_subnet.private.*.id)
1025+
private_dns_enabled = var.secretsmanager_endpoint_private_dns_enabled
1026+
}
1027+
9231028
#######################
9241029
# VPC Endpoint for SSM
9251030
#######################
@@ -1004,6 +1109,27 @@ resource "aws_vpc_endpoint" "ec2messages" {
10041109
private_dns_enabled = var.ec2messages_endpoint_private_dns_enabled
10051110
}
10061111

1112+
###################################
1113+
# VPC Endpoint for Transfer Server
1114+
###################################
1115+
data "aws_vpc_endpoint_service" "transferserver" {
1116+
count = var.create_vpc && var.enable_transferserver_endpoint ? 1 : 0
1117+
1118+
service = "transfer.server"
1119+
}
1120+
1121+
resource "aws_vpc_endpoint" "transferserver" {
1122+
count = var.create_vpc && var.enable_transferserver_endpoint ? 1 : 0
1123+
1124+
vpc_id = local.vpc_id
1125+
service_name = data.aws_vpc_endpoint_service.transferserver[0].service_name
1126+
vpc_endpoint_type = "Interface"
1127+
1128+
security_group_ids = var.transferserver_endpoint_security_group_ids
1129+
subnet_ids = coalescelist(var.transferserver_endpoint_subnet_ids, aws_subnet.private.*.id)
1130+
private_dns_enabled = var.transferserver_endpoint_private_dns_enabled
1131+
}
1132+
10071133
###########################
10081134
# VPC Endpoint for ECR API
10091135
###########################

‎variables.tf

Lines changed: 131 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,86 @@ variable "enable_s3_endpoint" {
218218
default = false
219219
}
220220

221+
variable "enable_codebuild_endpoint" {
222+
description = "Should be true if you want to provision an Codebuild endpoint to the VPC"
223+
default = false
224+
}
225+
226+
variable "codebuild_endpoint_security_group_ids" {
227+
description = "The ID of one or more security groups to associate with the network interface for Codebuild endpoint"
228+
default = []
229+
}
230+
231+
variable "codebuild_endpoint_subnet_ids" {
232+
description = "The ID of one or more subnets in which to create a network interface for Codebuilt endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
233+
default = []
234+
}
235+
236+
variable "codebuild_endpoint_private_dns_enabled" {
237+
description = "Whether or not to associate a private hosted zone with the specified VPC for Codebuild endpoint"
238+
default = false
239+
}
240+
241+
variable "enable_codecommit_endpoint" {
242+
description = "Should be true if you want to provision an Codecommit endpoint to the VPC"
243+
default = false
244+
}
245+
246+
variable "codecommit_endpoint_security_group_ids" {
247+
description = "The ID of one or more security groups to associate with the network interface for Codecommit endpoint"
248+
default = []
249+
}
250+
251+
variable "codecommit_endpoint_subnet_ids" {
252+
description = "The ID of one or more subnets in which to create a network interface for Codecommit endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
253+
default = []
254+
}
255+
256+
variable "codecommit_endpoint_private_dns_enabled" {
257+
description = "Whether or not to associate a private hosted zone with the specified VPC for Codecommit endpoint"
258+
default = false
259+
}
260+
261+
variable "enable_git_codecommit_endpoint" {
262+
description = "Should be true if you want to provision an Git Codecommit endpoint to the VPC"
263+
default = false
264+
}
265+
266+
variable "git_codecommit_endpoint_security_group_ids" {
267+
description = "The ID of one or more security groups to associate with the network interface for Git Codecommit endpoint"
268+
default = []
269+
}
270+
271+
variable "git_codecommit_endpoint_subnet_ids" {
272+
description = "The ID of one or more subnets in which to create a network interface for Git Codecommit endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
273+
default = []
274+
}
275+
276+
variable "git_codecommit_endpoint_private_dns_enabled" {
277+
description = "Whether or not to associate a private hosted zone with the specified VPC for Git Codecommit endpoint"
278+
default = false
279+
}
280+
281+
variable "enable_config_endpoint" {
282+
description = "Should be true if you want to provision an config endpoint to the VPC"
283+
default = false
284+
}
285+
286+
variable "config_endpoint_security_group_ids" {
287+
description = "The ID of one or more security groups to associate with the network interface for config endpoint"
288+
default = []
289+
}
290+
291+
variable "config_endpoint_subnet_ids" {
292+
description = "The ID of one or more subnets in which to create a network interface for config endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
293+
default = []
294+
}
295+
296+
variable "config_endpoint_private_dns_enabled" {
297+
description = "Whether or not to associate a private hosted zone with the specified VPC for config endpoint"
298+
default = false
299+
}
300+
221301
variable "enable_sqs_endpoint" {
222302
description = "Should be true if you want to provision an SQS endpoint to the VPC"
223303
default = false
@@ -262,8 +342,26 @@ variable "ssm_endpoint_private_dns_enabled" {
262342
default = false
263343
}
264344

265-
variable "enable_ssmmessages_endpoint" {
266-
description = "Should be true if you want to provision a SSMMESSAGES endpoint to the VPC"
345+
variable "enable_secretsmanager_endpoint" {
346+
description = "Should be true if you want to provision an Secrets Manager endpoint to the VPC"
347+
type = bool
348+
default = false
349+
}
350+
351+
variable "secretsmanager_endpoint_security_group_ids" {
352+
description = "The ID of one or more security groups to associate with the network interface for Secrets Manager endpoint"
353+
type = list(string)
354+
default = []
355+
}
356+
357+
variable "secretsmanager_endpoint_subnet_ids" {
358+
description = "The ID of one or more subnets in which to create a network interface for Secrets Manager endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
359+
type = list(string)
360+
default = []
361+
}
362+
363+
variable "secretsmanager_endpoint_private_dns_enabled" {
364+
description = "Whether or not to associate a private hosted zone with the specified VPC for Secrets Manager endpoint"
267365
type = bool
268366
default = false
269367
}
@@ -292,6 +390,12 @@ variable "apigw_endpoint_subnet_ids" {
292390
default = []
293391
}
294392

393+
variable "enable_ssmmessages_endpoint" {
394+
description = "Should be true if you want to provision a SSMMESSAGES endpoint to the VPC"
395+
type = bool
396+
default = false
397+
}
398+
295399
variable "ssmmessages_endpoint_security_group_ids" {
296400
description = "The ID of one or more security groups to associate with the network interface for SSMMESSAGES endpoint"
297401
type = list(string)
@@ -310,6 +414,31 @@ variable "ssmmessages_endpoint_private_dns_enabled" {
310414
default = false
311415
}
312416

417+
variable "enable_transferserver_endpoint" {
418+
description = "Should be true if you want to provision a Transer Server endpoint to the VPC"
419+
type = bool
420+
default = false
421+
}
422+
423+
variable "transferserver_endpoint_security_group_ids" {
424+
description = "The ID of one or more security groups to associate with the network interface for Transfer Server endpoint"
425+
type = list(string)
426+
default = []
427+
}
428+
429+
variable "transferserver_endpoint_subnet_ids" {
430+
description = "The ID of one or more subnets in which to create a network interface for Transfer Server endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
431+
type = list(string)
432+
default = []
433+
}
434+
435+
variable "transferserver_endpoint_private_dns_enabled" {
436+
description = "Whether or not to associate a private hosted zone with the specified VPC for Transfer Server endpoint"
437+
type = bool
438+
default = false
439+
}
440+
441+
313442
variable "enable_ec2_endpoint" {
314443
description = "Should be true if you want to provision an EC2 endpoint to the VPC"
315444
type = bool

0 commit comments

Comments
 (0)