vpc.tf

#tfsec:ignore:aws-ec2-require-vpc-flow-logs-for-all-vpcs
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"

  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "SOAT Tech Challenge VPC"
  }
}

resource "aws_subnet" "public_subnets" {
  count = length(var.private_subnet_cidrs)

  vpc_id            = aws_vpc.main.id
  cidr_block        = element(var.public_subnet_cidrs, count.index)
  availability_zone = element(local.azs, count.index)

  tags = {
    Name = "SOAT-TC VPC Public Subnet ${count.index + 1}"
  }
}

resource "aws_subnet" "private_subnets" {
  count = length(var.private_subnet_cidrs)

  vpc_id            = aws_vpc.main.id
  cidr_block        = element(var.private_subnet_cidrs, count.index)
  availability_zone = element(local.azs, count.index)

  tags = {
    Name = "SOAT-TC VPC Private Subnet ${count.index + 1}"
  }
}


resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "SOAT-TC VPC Internet Gateway"
  }
}

resource "aws_route_table" "public_rt" {
  vpc_id = aws_vpc.main.id


  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = "SOAT-TC VPC Public Route Table"
  }
}

resource "aws_route_table" "private_rt" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "SOAT-TC VPC Private Route Table"
  }
}

resource "aws_route_table_association" "public_rt_association" {
  count          = length(var.public_subnet_cidrs)
  subnet_id      = element(aws_subnet.public_subnets[*].id, count.index)
  route_table_id = aws_route_table.public_rt.id
}

resource "aws_route_table_association" "private_rt_association" {
  count          = length(var.private_subnet_cidrs)
  subnet_id      = element(aws_subnet.private_subnets[*].id, count.index)
  route_table_id = aws_route_table.private_rt.id
}

resource "aws_vpc_endpoint" "dynamodb" {
  service_name      = "com.amazonaws.${var.aws_region}.dynamodb"
  vpc_id            = aws_vpc.main.id
  vpc_endpoint_type = "Gateway"

  route_table_ids = [aws_route_table.public_rt.id]

  tags = {
    Name = "SOAT-TC DynamoDB VPC Gateway Endpoint"
  }
}


resource "aws_vpc_endpoint" "sqs" {
  service_name      = "com.amazonaws.${var.aws_region}.sqs"
  vpc_id            = aws_vpc.main.id
  vpc_endpoint_type = "Interface"

  subnet_ids         = aws_subnet.public_subnets[*].id
  security_group_ids = [aws_default_security_group.default.id]

  private_dns_enabled = true

  tags = {
    Name = "SOAT-TC SQS VPC Interface Endpoint"
  }
}

resource "aws_default_security_group" "default" {
  vpc_id = aws_vpc.main.id

  ingress {
    protocol  = -1
    self      = true
    from_port = 0
    to_port   = 0
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}