main.tf

/**
 * Copyright 2020 Quortex
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
*/

data "aws_region" "current" {}

locals {
  # Calculate newbits dynamically based on the number of availability zones
  # 1 or 2 AZs, newbits = 1 (2 subnets needed).
  # 3 or 4 AZs, newbits = 2 (4 subnets needed).
  # 5 to 8 AZs, newbits = 3 (8 subnets needed).
  # and so on...
  newbits = ceil(log(length(var.availability_zones), 2))
}

# VPC
resource "aws_vpc" "quortex" {
  cidr_block = var.vpc_cidr_block

  enable_dns_support   = true
  enable_dns_hostnames = true # required for using the cluster's private endpoint

  tags = merge(
    {
      "Name"                                      = var.vpc_name,
      "kubernetes.io/cluster/${var.cluster_name}" = "shared", # tagged so that Kubernetes can discover it
    },
    var.tags
  )
  # NOTE: The usage of the specific kubernetes.io/cluster/* resource tags below are required for EKS and Kubernetes to discover and manage networking resources.
}

# Remove all rules on default security group to be compliant with https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-ec2-2
resource "aws_default_security_group" "quortex" {
  vpc_id = aws_vpc.quortex.id
}

resource "aws_vpc_ipv4_cidr_block_association" "secondary" {
  for_each   = toset([for index, az in var.availability_zones : cidrsubnet(var.vpc_secondary_cidr, local.newbits, index)])
  vpc_id     = aws_vpc.quortex.id
  cidr_block = each.value
}

resource "aws_subnet" "quortex" {
  for_each = merge([
    for key, subnet in var.subnets : {
      for index, az in var.availability_zones : "${key}-${data.aws_region.current.name}${az}" => {
        "availability_zone" = "${data.aws_region.current.name}${az}",
        "cidr"              = cidrsubnet(subnet.cidr, local.newbits, index),
        "public"            = subnet.public,
        "tags"              = subnet.tags,
      }
    }
  ]...)

  vpc_id                  = aws_vpc.quortex.id
  availability_zone       = each.value.availability_zone
  cidr_block              = each.value.cidr
  map_public_ip_on_launch = each.value.public

  tags = merge(
    {
      "Name"                                      = "${var.subnet_name_prefix}${each.key}",
      "Public"                                    = tostring(each.value.public),
      "kubernetes.io/cluster/${var.cluster_name}" = "shared",
    },
    each.value.public ? {
      "kubernetes.io/role/elb" = "1" # tagged so that Kubernetes knows to use only those subnets for external load balancers
      } : {
      "kubernetes.io/role/internal-elb" = "1"
    },
    var.tags,
    each.value.tags
  )

  depends_on = [aws_vpc_ipv4_cidr_block_association.secondary]
}

# Internet Gateway
resource "aws_internet_gateway" "quortex" {
  vpc_id = aws_vpc.quortex.id

  tags = merge({
    Name = var.internet_gateway_name,
    },
    var.tags
  )
}

# Route table for public subnets
resource "aws_route_table" "quortex_public" {
  for_each = local.public_subnets

  vpc_id = aws_vpc.quortex.id

  # Public subnet: add route to Internet GW
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.quortex.id
  }

  # Additional route(s) to peered VPC
  dynamic "route" {
    for_each = var.vpc_peering_routes
    content {
      cidr_block                = route.value.cidr_block
      vpc_peering_connection_id = route.value.vpc_peering_connection_id
    }
  }

  # Additional route(s) to a VPC internet gateway or a virtual private gateway.
  dynamic "route" {
    for_each = var.gateway_routes
    content {
      cidr_block = route.value.cidr_block
      gateway_id = route.value.gateway_id
    }
  }

  tags = merge({ "Name" = "${var.route_table_prefix}${each.key}" }, var.tags)
}

# Route table for private subnets
resource "aws_route_table" "quortex_private" {
  for_each = local.private_subnets

  vpc_id = aws_vpc.quortex.id

  route {
    # Create default route depending on whether a NAT Gateway exists in
    # this availability zone. Only one of nat_gateway_id and gateway_id will be
    # non null
    cidr_block = "0.0.0.0/0"
    # Route to the NAT, if NAT gw exists in this az...
    nat_gateway_id = lookup(local.zoned_gateway_ids, each.value.availability_zone, null)
    # ...otherwise, route to the Internet Gateway
    gateway_id = lookup(local.zoned_gateway_ids, each.value.availability_zone, null) != null ? null : aws_internet_gateway.quortex.id
  }

  # Additional route(s) to peered VPC
  dynamic "route" {
    for_each = var.vpc_peering_routes
    content {
      cidr_block                = route.value.cidr_block
      vpc_peering_connection_id = route.value.vpc_peering_connection_id
    }
  }

  # Additional route(s) to a VPC internet gateway or a virtual private gateway.
  dynamic "route" {
    for_each = var.gateway_routes
    content {
      cidr_block = route.value.cidr_block
      gateway_id = route.value.gateway_id
    }
  }

  tags = merge({ "Name" = "${var.route_table_prefix}${each.key}" }, var.tags)
}


# Route table association

resource "aws_route_table_association" "quortex_public" {
  for_each = local.public_subnets

  subnet_id      = aws_subnet.quortex[each.key].id
  route_table_id = aws_route_table.quortex_public[each.key].id
}


resource "aws_route_table_association" "quortex_private" {
  for_each = local.private_subnets

  subnet_id      = aws_subnet.quortex[each.key].id
  route_table_id = aws_route_table.quortex_private[each.key].id
}