Palo Alto Networks VPC Module for AWS

A Terraform module for deploying a VPC in AWS.

One advantage of this module over the terraform-aws-vpc module is that it does not create multiple resources based on Terraform count iterator. This allows for example easier removal of any single subnet, without the need to briefly destroy and re-create any other subnet.

Usage

module "vpc" {
  source = "../../modules/vpc"

  name                    = var.name
  cidr_block              = var.vpc_cidr_block
  secondary_cidr_blocks   = var.vpc_secondary_cidr_blocks
  create_internet_gateway = true
  global_tags             = var.global_tags
  vpc_tags                = var.vpc_tags
  security_groups         = var.security_groups
}

Reference

Requirements

Name	Version
terraform	>= 1.0.0, < 2.0.0
aws	~> 5.17

Providers

Name	Version
aws	~> 5.17

Modules

No modules.

Resources

Name	Type
aws_internet_gateway.this	resource
aws_network_acl.this	resource
aws_network_acl_rule.this	resource
aws_route_table.from_igw	resource
aws_route_table.from_vgw	resource
aws_route_table_association.from_igw	resource
aws_route_table_association.from_vgw	resource
aws_security_group.this	resource
aws_vpc.this	resource
aws_vpc_dhcp_options.this	resource
aws_vpc_dhcp_options_association.this	resource
aws_vpc_ipv4_cidr_block_association.this	resource
aws_vpn_gateway.this	resource
aws_internet_gateway.this	data source
aws_vpc.this	data source

Inputs

Name	Description	Type	Default	Required
assign_generated_ipv6_cidr_block	A boolean flag to assign AWS-provided /56 IPv6 CIDR block. Defaults false	bool	null	no
cidr_block	CIDR block to assign to a new VPC.	string	null	no
create_dhcp_options	Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers.	bool	false	no
create_internet_gateway	Set to true to create IG and attach it to the VPC.	bool	false	no
create_vpc	When set to true inputs are used to create a VPC, otherwise - to get data about an existing one (based on the name value).	bool	true	no
create_vpn_gateway	When set to true, create VPN gateway and a dedicated route table.	bool	false	no
domain_name	Specifies DNS name for DHCP options set. 'create_dhcp_options' needs to be enabled.	string	""	no
domain_name_servers	Specify a list of DNS server addresses for DHCP options set, default to AWS provided	list(string)	[]	no
enable_dns_hostnames	A boolean flag to enable/disable DNS hostnames in the VPC. Defaults false.	bool	null	no
enable_dns_support	A boolean flag to enable/disable DNS support in the VPC. Defaults true.	bool	null	no
global_tags	Optional map of arbitrary tags to apply to all the created resources.	map(string)	{}	no
instance_tenancy	VPC level instance tenancy.	string	null	no
nacls	The nacls variable is a map of maps, where each map represents an AWS NACL. Example:nacls = { trusted_path_monitoring = { name = "trusted-path-monitoring" rules = { block_outbound_icmp = { rule_number = 110 egress = true protocol = "icmp" rule_action = "deny" cidr_block = "10.100.1.0/24" from_port = null to_port = null } allow_inbound = { rule_number = 300 egress = false protocol = "-1" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = null to_port = null } } } }	any	{}	no
name	Name of the VPC to create or use.	string	n/a	yes
name_internet_gateway	Name of the IGW to create or use.	string	null	no
name_vpn_gateway	Name of the VPN gateway to create.	string	null	no
ntp_servers	Specify a list of NTP server addresses for DHCP options set, default to AWS provided	list(string)	[]	no
route_table_internet_gateway	Name of route table for the IGW.	string	null	no
route_table_vpn_gateway	Name of the route table for VPN gateway.	string	null	no
secondary_cidr_blocks	Secondary CIDR block to assign to a new VPC.	list(string)	[]	no
security_groups	The security_groups variable is a map of maps, where each map represents an AWS Security Group. The key of each entry acts as the Security Group name. List of available attributes of each Security Group entry: - rules: A list of objects representing a Security Group rule. The key of each entry acts as the name of the rule and needs to be unique across all rules in the Security Group. List of attributes available to define a Security Group rule: - description: Security Group description. - type: Specifies if rule will be evaluated on ingress (inbound) or egress (outbound) traffic. - cidr_blocks: List of CIDR blocks - for ingress, determines the traffic that can reach your instance. For egress Determines the traffic that can leave your instance, and where it can go. - prefix_list_ids: List of Prefix List IDs - self: security group itself will be added as a source to the rule. Cannot be specified with cidr_blocks, or security_groups. - source_security_groups: list of security group IDs to be used as a source to the rule. Cannot be specified with cidr_blocks, or self. Example:security_groups = { vmseries-mgmt = { name = "vmseries-mgmt" rules = { all-outbound = { description = "Permit All traffic outbound" type = "egress", from_port = "0", to_port = "0", protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } https-inbound-private = { description = "Permit HTTPS for VM-Series Management" type = "ingress", from_port = "443", to_port = "443", protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] } https-inbound-eip = { description = "Permit HTTPS for VM-Series Management from known public IPs" type = "ingress", from_port = "443", to_port = "443", protocol = "tcp" cidr_blocks = ["100.100.100.100/32"] } ssh-inbound-eip = { description = "Permit SSH for VM-Series Management from known public IPs" type = "ingress", from_port = "22", to_port = "22", protocol = "tcp" cidr_blocks = ["100.100.100.100/32"] } https-inbound-self = { description = "Permit HTTPS from instances with the same security group" type = "ingress", from_port = "443", to_port = "443", protocol = "tcp" self = true } https-inbound-security-groups = { description = "Permit HTTPS traffic for the resources associated with the specified security group" type = "ingress", from_port = "443", to_port = "443", protocol = "tcp" source_security_groups = ["sg-1a2b3c4d5e6f7g8h9i"] } https-inbound-prefix-list = { description = "Permit HTTPS for VM-Series Management for IPs in managed prefix list" type = "ingress", from_port = "443", to_port = "443", protocol = "tcp" prefix_list_ids = ["pl-1a2b3c4d5e6f7g8h9i"] } } } }	any	{}	no
use_internet_gateway	If an existing VPC is provided and has IG attached, set to true to reuse it.	bool	false	no
vpc_tags	Optional map of arbitrary tags to apply to VPC resource.	map	{}	no
vpn_gateway_amazon_side_asn	ASN for the Amazon side of the gateway.	string	null	no

Outputs

Name	Description
has_secondary_cidrs	n/a
id	The VPC identifier (either created or pre-existing).
igw_as_next_hop_set	The object is suitable for use as vpc_route module's input next_hop_set.
internet_gateway	The entire Internet Gateway object. It is null when create_internet_gateway is false.
internet_gateway_route_table	The Route Table object created to handle traffic from Internet Gateway (IGW). It is null when create_internet_gateway is false.
nacl_ids	Map of NACL -> ID (newly created).
name	The VPC Name Tag (either created or pre-existing).
security_group_ids	Map of Security Group Name -> ID (newly created).
vpc	The entire VPC object (either created or pre-existing).
vpn_gateway	The entire Virtual Private Gateway object. It is null when create_vpn_gateway is false.
vpn_gateway_route_table	The Route Table object created to handle traffic from Virtual Private Gateway (VGW). It is null when create_vpn_gateway is false.