site-to-site-vpn
This component provisions a Site-To-Site VPN with a target AWS VPC on one side of the tunnel. The other (customer) side can be any VPN gateway endpoint, e.g. a hardware device, other cloud VPN, etc.
AWS Site-to-Site VPN is a fully-managed service that creates a secure connection between your data center or branch office and your AWS resources using IP Security (IPSec) tunnels. When using Site-to-Site VPN, you can connect to both your Amazon Virtual Private Clouds (VPC) and AWS Transit Gateway, and two tunnels per connection are used for increased redundancy.
The component provisions the following resources:
-
AWS Virtual Private Gateway (a representation of the AWS side of the tunnel)
-
AWS Customer Gateway (a representation of the other (remote) side of the tunnel). It requires:
- The gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN)
/32
IP of the VPN endpoint
-
AWS Site-To-Site VPN connection. It creates two VPN tunnels for redundancy and requires:
- The IP CIDR ranges on each side of the tunnel
- Pre-shared Keys for each tunnel (can be auto-generated if not provided and saved into SSM Parameter Store)
- (Optional) IP CIDR ranges to be used inside each VPN tunnel
-
Route table entries to direct the appropriate traffic from the local VPC to the other side of the tunnel
Post-tunnel creation requirements
Once the site-to-site VPN resources are deployed, you need to send the VPN configuration from AWS side to the administrator of the remote side of the VPN connection. To do this:
- Determine the infrastructure that will be used for the remote side, specifically:
- Vendor
- Platform
- Software Version
- IKE version
- Log into the target AWS account
- Go to the "VPC" console
- On the left navigation manu, go to
Virtual Private Network
>Site-to-Site VPN Connections
- Select the VPN connection that was created via this component
- On the top right, click the
Download Configuration
button - Enter the information you obtained and click
Download
- Send the configuration file to the administrator of the remote side of the tunnel
Usage
Stack Level: Regional
components:
terraform:
site-to-site-vpn:
metadata:
component: site-to-site-vpn
vars:
enabled: true
name: "site-to-site-vpn"
vpc_component_name: vpc
customer_gateway_bgp_asn: 65000
customer_gateway_ip_address: 20.200.30.0
vpn_gateway_amazon_side_asn: 64512
vpn_connection_static_routes_only: true
vpn_connection_tunnel1_inside_cidr: 169.254.20.0/30
vpn_connection_tunnel2_inside_cidr: 169.254.21.0/30
vpn_connection_local_ipv4_network_cidr: 10.100.128.0/24
vpn_connection_remote_ipv4_network_cidr: 10.10.80.0/24
vpn_connection_static_routes_destinations:
- 10.100.128.0/24
vpn_connection_tunnel1_startup_action: add
vpn_connection_tunnel2_startup_action: add
transit_gateway_enabled: false
vpn_connection_tunnel1_cloudwatch_log_enabled: false
vpn_connection_tunnel2_cloudwatch_log_enabled: false
preshared_key_enabled: true
ssm_enabled: true
ssm_path_prefix: "/site-to-site-vpn"
Amazon side Autonomous System Number (ASN)
The variable vpn_gateway_amazon_side_asn
(Amazon side Autonomous System Number) is not strictly required when creating
an AWS VPN Gateway. If you do not specify Amazon side ASN during the creation of the VPN Gateway, AWS will automatically
assign a default ASN (which is 7224 for the Amazon side of the VPN).
However, specifying Amazon side ASN can be important if you need to integrate the VPN with an on-premises network that uses Border Gateway Protocol (BGP) and you want to avoid ASN conflicts or require a specific ASN for routing policies.
If your use case involves BGP peering, and you need a specific ASN for the Amazon side, then you should explicitly set
the vpn_gateway_amazon_side_asn
. Otherwise, it can be omitted (set to null
), and AWS will handle it automatically.
Provisioning
Provision the site-to-site-vpn
component by executing the following commands:
atmos terraform plan site-to-site-vpn -s <stack>
atmos terraform apply site-to-site-vpn -s <stack>
References
- https://aws.amazon.com/vpn/site-to-site-vpn
- https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_VpnTunnelOptionsSpecification.html
Variables
Required Variables
customer_gateway_bgp_asn
(number
) requiredThe Customer Gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN)
region
(string
) requiredAWS Region
Optional Variables
customer_gateway_ip_address
(string
) optionalThe IPv4 address for the Customer Gateway device's outside interface. Set to
null
to not create the Customer GatewayDefault value:
null
existing_transit_gateway_id
(string
) optionalExisting Transit Gateway ID. If provided, the module will not create a Virtual Private Gateway but instead will use the transit_gateway. For setting up transit gateway we can use the cloudposse/transit-gateway/aws module and pass the output transit_gateway_id to this variable
Default value:
""
preshared_key_enabled
(bool
) optionalFlag to enable adding the preshared keys to the VPN connection
Default value:
true
ssm_enabled
(bool
) optionalFlag to enable saving the
tunnel1_preshared_key
andtunnel2_preshared_key
in the SSM Parameter StoreDefault value:
false
ssm_path_prefix
(string
) optionalSSM Key path prefix for the associated SSM parameters
Default value:
""
transit_gateway_enabled
(bool
) optionalSet to true to enable VPN connection to transit gateway and then pass in the existing_transit_gateway_id
Default value:
false
transit_gateway_route_table_id
(string
) optionalThe ID of the route table for the transit gateway that you want to associate + propagate the VPN connection's TGW attachment
Default value:
null
transit_gateway_routes
optionalA map of transit gateway routes to create on the given TGW route table (via
transit_gateway_route_table_id
) for the created VPN Attachment. Use the key in the map to describe the routeType:
map(object({
blackhole = optional(bool, false)
destination_cidr_block = string
}))Default value:
{ }
vpc_component_name
(string
) optionalAtmos VPC component name
Default value:
"vpc"
vpn_connection_local_ipv4_network_cidr
(string
) optionalThe IPv4 CIDR on the Customer Gateway (on-premises) side of the VPN connection
Default value:
"0.0.0.0/0"
vpn_connection_log_retention_in_days
(number
) optionalSpecifies the number of days you want to retain log events
Default value:
30
vpn_connection_remote_ipv4_network_cidr
(string
) optionalThe IPv4 CIDR on the AWS side of the VPN connection
Default value:
"0.0.0.0/0"
vpn_connection_static_routes_destinations
(list(string)
) optionalList of CIDR blocks to be used as destination for static routes. Routes to destinations will be propagated to the VPC route tables
Default value:
[ ]
vpn_connection_static_routes_only
(bool
) optionalIf set to
true
, the VPN connection will use static routes exclusively. Static routes must be used for devices that don't support BGPDefault value:
false
vpn_connection_tunnel1_cloudwatch_log_enabled
(bool
) optionalEnable or disable VPN tunnel logging feature for the tunnel
Default value:
false
vpn_connection_tunnel1_cloudwatch_log_output_format
(string
) optionalSet log format for the tunnel. Default format is json. Possible values are
json
andtext
Default value:
"json"
vpn_connection_tunnel1_dpd_timeout_action
(string
) optionalThe action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify
clear
to end the IKE session. Valid values areclear
|none
|restart
Default value:
"clear"
vpn_connection_tunnel1_ike_versions
(list(string)
) optionalThe IKE versions that are permitted for the first VPN tunnel. Valid values are ikev1 | ikev2
Default value:
[ ]
vpn_connection_tunnel1_inside_cidr
(string
) optionalThe CIDR block of the inside IP addresses for the first VPN tunnel
Default value:
null
vpn_connection_tunnel1_phase1_dh_group_numbers
(list(string)
) optionalList of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are 2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24
Default value:
[ ]
vpn_connection_tunnel1_phase1_encryption_algorithms
(list(string)
) optionalList of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16
Default value:
[ ]
vpn_connection_tunnel1_phase1_integrity_algorithms
(list(string)
) optionalOne or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 | SHA2-256 | SHA2-384 | SHA2-512
Default value:
[ ]
vpn_connection_tunnel1_phase2_dh_group_numbers
(list(string)
) optionalList of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are 2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24
Default value:
[ ]
vpn_connection_tunnel1_phase2_encryption_algorithms
(list(string)
) optionalList of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16
Default value:
[ ]
vpn_connection_tunnel1_phase2_integrity_algorithms
(list(string)
) optionalOne or more integrity algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are SHA1 | SHA2-256 | SHA2-384 | SHA2-512
Default value:
[ ]
vpn_connection_tunnel1_preshared_key
(string
) optionalThe preshared key of the first VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero. Allowed characters are alphanumeric characters, periods(.) and underscores(_)
Default value:
null
vpn_connection_tunnel1_startup_action
(string
) optionalThe action to take when the establishing the tunnel for the first VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify
start
for AWS to initiate the IKE negotiation. Valid values areadd
|start
Default value:
"add"
vpn_connection_tunnel2_cloudwatch_log_enabled
(bool
) optionalEnable or disable VPN tunnel logging feature for the tunnel
Default value:
false
vpn_connection_tunnel2_cloudwatch_log_output_format
(string
) optionalSet log format for the tunnel. Default format is json. Possible values are
json
andtext
Default value:
"json"
vpn_connection_tunnel2_dpd_timeout_action
(string
) optionalThe action to take after DPD timeout occurs for the second VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are
clear
|none
|restart
Default value:
"clear"
vpn_connection_tunnel2_ike_versions
(list(string)
) optionalThe IKE versions that are permitted for the second VPN tunnel. Valid values are ikev1 | ikev2
Default value:
[ ]
vpn_connection_tunnel2_inside_cidr
(string
) optionalThe CIDR block of the inside IP addresses for the second VPN tunnel
Default value:
null
vpn_connection_tunnel2_phase1_dh_group_numbers
(list(string)
) optionalList of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are 2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24
Default value:
[ ]
vpn_connection_tunnel2_phase1_encryption_algorithms
(list(string)
) optionalList of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16
Default value:
[ ]
vpn_connection_tunnel2_phase1_integrity_algorithms
(list(string)
) optionalOne or more integrity algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 | SHA2-256 | SHA2-384 | SHA2-512
Default value:
[ ]
vpn_connection_tunnel2_phase2_dh_group_numbers
(list(string)
) optionalList of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are 2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24
Default value:
[ ]
vpn_connection_tunnel2_phase2_encryption_algorithms
(list(string)
) optionalList of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16
Default value:
[ ]
vpn_connection_tunnel2_phase2_integrity_algorithms
(list(string)
) optionalOne or more integrity algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are SHA1 | SHA2-256 | SHA2-384 | SHA2-512
Default value:
[ ]
vpn_connection_tunnel2_preshared_key
(string
) optionalThe preshared key of the second VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero. Allowed characters are alphanumeric characters, periods(.) and underscores(_)
Default value:
null
vpn_connection_tunnel2_startup_action
(string
) optionalThe action to take when the establishing the tunnel for the second VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify
start
for AWS to initiate the IKE negotiation. Valid values areadd
|start
Default value:
"add"
vpn_gateway_amazon_side_asn
(number
) optionalThe Autonomous System Number (ASN) for the Amazon side of the VPN Gateway. If you don't specify an ASN, the Virtual Private Gateway is created with the default ASN
Default value:
null
Context Variables
The following variables are defined in the context.tf
file of this module and part of the terraform-null-label pattern.
context.tf
file of this module and part of the terraform-null-label pattern.additional_tag_map
(map(string)
) optionalAdditional key-value pairs to add to each map in
tags_as_list_of_maps
. Not added totags
orid
.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.Required: No
Default value:
{ }
attributes
(list(string)
) optionalID element. Additional attributes (e.g.
workers
orcluster
) to add toid
,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by thedelimiter
and treated as a single ID element.Required: No
Default value:
[ ]
context
(any
) optionalSingle object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables asnull
to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.Required: No
Default value:
{
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
}delimiter
(string
) optionalDelimiter to be used between ID elements.
Defaults to-
(hyphen). Set to""
to use no delimiter at all.Required: No
Default value:
null
descriptor_formats
(any
) optionalDescribe additional descriptors to be output in the
descriptors
output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
\{<br/> format = string<br/> labels = list(string)<br/> \}
(Type isany
so the map values can later be enhanced to provide additional options.)
format
is a Terraform format string to be passed to theformat()
function.
labels
is a list of labels, in order, to pass toformat()
function.
Label values will be normalized before being passed toformat()
so they will be
identical to how they appear inid
.
Default is{}
(descriptors
output will be empty).Required: No
Default value:
{ }
enabled
(bool
) optionalSet to false to prevent the module from creating any resources
Required: NoDefault value:
null
environment
(string
) optionalID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'
Required: NoDefault value:
null
id_length_limit
(number
) optionalLimit
id
to this many characters (minimum 6).
Set to0
for unlimited length.
Set tonull
for keep the existing setting, which defaults to0
.
Does not affectid_full
.Required: No
Default value:
null
label_key_case
(string
) optionalControls the letter case of the
tags
keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via thetags
input.
Possible values:lower
,title
,upper
.
Default value:title
.Required: No
Default value:
null
label_order
(list(string)
) optionalThe order in which the labels (ID elements) appear in the
id
.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.Required: No
Default value:
null
label_value_case
(string
) optionalControls the letter case of ID elements (labels) as included in
id
,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via thetags
input.
Possible values:lower
,title
,upper
andnone
(no transformation).
Set this totitle
and setdelimiter
to""
to yield Pascal Case IDs.
Default value:lower
.Required: No
Default value:
null
labels_as_tags
(set(string)
) optionalSet of labels (ID elements) to include as tags in the
tags
output.
Default is to include all labels.
Tags with empty values will not be included in thetags
output.
Set to[]
to suppress all generated tags.
Notes:
The value of thename
tag, if included, will be theid
, not thename
.
Unlike othernull-label
inputs, the initial setting oflabels_as_tags
cannot be
changed in later chained modules. Attempts to change it will be silently ignored.Required: No
Default value:
[
"default"
]name
(string
) optionalID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as atag
.
The "name" tag is set to the fullid
string. There is no tag with the value of thename
input.Required: No
Default value:
null
namespace
(string
) optionalID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique
Required: NoDefault value:
null
regex_replace_chars
(string
) optionalTerraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set,"/[^a-zA-Z0-9-]/"
is used to remove all characters other than hyphens, letters and digits.Required: No
Default value:
null
stage
(string
) optionalID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'
Required: NoDefault value:
null
tags
(map(string)
) optionalAdditional tags (e.g.
{'BusinessUnit': 'XYZ'}
).
Neither the tag keys nor the tag values will be modified by this module.Required: No
Default value:
{ }
tenant
(string
) optionalID element (Rarely used, not included by default). A customer identifier, indicating who this instance of a resource is for
Required: NoDefault value:
null
Outputs
customer_gateway_id
Customer Gateway ID
vpn_connection_customer_gateway_configuration
The configuration information for the VPN connection's Customer Gateway (in the native XML format)
vpn_connection_id
VPN Connection ID
vpn_connection_tunnel1_address
The public IP address of the first VPN tunnel
vpn_connection_tunnel1_cgw_inside_address
The RFC 6890 link-local address of the first VPN tunnel (Customer Gateway side)
vpn_connection_tunnel1_vgw_inside_address
The RFC 6890 link-local address of the first VPN tunnel (Virtual Private Gateway side)
vpn_connection_tunnel2_address
The public IP address of the second VPN tunnel
vpn_connection_tunnel2_cgw_inside_address
The RFC 6890 link-local address of the second VPN tunnel (Customer Gateway side)
vpn_connection_tunnel2_vgw_inside_address
The RFC 6890 link-local address of the second VPN tunnel (Virtual Private Gateway side)
vpn_gateway_id
Virtual Private Gateway ID
Dependencies
Requirements
terraform
, version:>= 1.3.0
aws
, version:>= 4.0
random
, version:>= 2.2
Providers
aws
, version:>= 4.0
random
, version:>= 2.2
Modules
Name | Version | Source | Description |
---|---|---|---|
iam_roles | latest | ../account-map/modules/iam-roles | n/a |
site_to_site_vpn | 1.3.0 | cloudposse/vpn-connection/aws | n/a |
this | 0.25.0 | cloudposse/label/null | n/a |
vpc | 1.5.0 | cloudposse/stack-config/yaml//modules/remote-state | n/a |
Resources
The following resources are used by this module:
aws_ssm_parameter.tunnel1_preshared_key
(resource)aws_ssm_parameter.tunnel2_preshared_key
(resource)random_password.tunnel1_preshared_key
(resource)random_password.tunnel2_preshared_key
(resource)
Data Sources
The following data sources are used by this module:
- cloudposse/terraform-aws-components - Cloud Posse's upstream component