Module: transit-gateway
Terraform module to provision:
- AWS Transit Gateway
- AWS Resource Access Manager (AWS RAM) Resource Share to share the Transit Gateway with
the Organization or another AWS Account (configurable via the variables
ram_resource_share_enabled
andram_principals
) - Transit Gateway route table
- Transit Gateway VPC attachments to connect multiple VPCs via the Transit Gateway
- Transit Gateway route table propagations to create propagated routes and allow traffic from the Transit Gateway to the VPC attachments
- Transit Gateway route table associations to allow traffic from the VPC attachments to the Transit Gateway
- Transit Gateway static routes (static routes have a higher precedence than propagated routes)
- Subnet routes to route traffic from the subnets in each VPC to the other Transit Gateway VPC attachments
Introduction
This module is configurable via the variable transit_gateway_config
- see usage and examples below.
The variable transit_gateway_config
is a map of environment names (e.g. prod
, staging
, dev
) to the environment configurations.
Each environment configuration contains the following fields:
vpc_id
- The ID of the VPC for which to create a VPC attachment and route table associations and propagations.vpc_cidr
- VPC CIDR block.subnet_ids
- The IDs of the subnets in the VPC.static_routes
- A list of Transit Gateway static route configurations. Note that static routes have a higher precedence than propagated routes.subnet_route_table_ids
- The IDs of the subnet route tables. The route tables are used to add routes to allow traffix from the subnets in one VPC to the other VPC attachments.route_to
- A set of environment names to route traffic from the current environment to the specified environments. In the example below, in theprod
environment we create subnet routes to route traffic from theprod
subnets to the VPC attachments in thestaging
anddev
environments. Specify eitherroute_to
orroute_to_cidr_blocks
.route_to_cidr_blocks
supersedesroute_to
.route_to_cidr_blocks
- A set of VPC CIDR blocks to route traffic from the current environment to the specified VPC CIDR blocks. In the example below, in thestaging
environment we create subnet routes to route traffic from thestaging
subnets to thedev
VPC CIDR. Specify eitherroute_to
orroute_to_cidr_blocks
.route_to_cidr_blocks
supersedesroute_to
.transit_gateway_vpc_attachment_id
- An existing Transit Gateway Attachment ID. If provided, the module will use it instead of creating a new one.
You now have the option to have Terraform manage route table entries by key, whereas previously they were only managed by index. The advantage
of managing them by key is that if a route table ID or destination CIDR changes, only that entry is affected, whereas when managed by index,
all the entries after the first affected index may be destroyed and re-created at a different index. The reason this is left as an option,
with the default being to manage the entries by index, is that if you are creating the VPC or subnets at the same time you are creating
the Transit Gateway, then Terraform will not be able to generate the keys during the plan phase and the plan will fail with the error
The "for_each" value depends on resource attributes that cannot be determined until apply...
. We recommend setting route_keys_enabled
to
true
unless you get this error, in which case you must leave it set to its default value of false
.
NOTE: This module requires Terraform 0.13 and newer since it uses module expansion with for_each
.
Usage
Here's how to invoke this module in your projects:
locals {
transit_gateway_config = {
prod = {
vpc_id = module.vpc_prod.vpc_id
vpc_cidr = module.vpc_prod.vpc_cidr_block
subnet_ids = module.subnets_prod.private_subnet_ids
subnet_route_table_ids = module.subnets_prod.private_route_table_ids
route_to = ["staging", "dev"]
route_to_cidr_blocks = null
transit_gateway_vpc_attachment_id = null
static_routes = [
{
blackhole = true
destination_cidr_block = "0.0.0.0/0"
},
{
blackhole = false
destination_cidr_block = "172.16.1.0/24"
}
]
},
staging = {
vpc_id = module.vpc_staging.vpc_id
vpc_cidr = module.vpc_staging.vpc_cidr_block
subnet_ids = module.subnets_staging.private_subnet_ids
subnet_route_table_ids = module.subnets_staging.private_route_table_ids
route_to = null
route_to_cidr_blocks = [module.vpc_dev.vpc_cidr_block]
transit_gateway_vpc_attachment_id = null
static_routes = [
{
blackhole = false
destination_cidr_block = "172.32.1.0/24"
}
]
},
dev = {
vpc_id = module.vpc_dev.vpc_id
vpc_cidr = module.vpc_dev.vpc_cidr_block
subnet_ids = module.subnets_dev.private_subnet_ids
subnet_route_table_ids = module.subnets_dev.private_route_table_ids
route_to = null
route_to_cidr_blocks = null
transit_gateway_vpc_attachment_id = null
static_routes = null
}
}
}
module "transit_gateway" {
source = "cloudposse/transit-gateway/aws"
# Cloud Posse recommends pinning every module to a specific version
# version = "x.x.x"
ram_resource_share_enabled = false
config = local.transit_gateway_config
context = module.this.context
}
Examples
Here is a working example of using this module:
Here are automated tests for the complete example using bats and Terratest (which tests and deploys the example on AWS):
Here is an example of using this module in a multi-account environment (with the Transit Gateway in one AWS account and all the VPC attachments and routes in different AWS accounts):
Variables
Required Variables
Optional Variables
allow_external_principals
(bool
) optionalIndicates whether principals outside your organization can be associated with a resource share
Default value:
false
Whether resource attachment requests are automatically accepted. Valid values:
disable
,enable
. Default value:disable
Default value:
"enable"
config
optionalConfiguration for VPC attachments, Transit Gateway routes, and subnet routes
Type:
map(object({
vpc_id = string
vpc_cidr = string
subnet_ids = set(string)
subnet_route_table_ids = set(string)
route_to = set(string)
route_to_cidr_blocks = set(string)
transit_gateway_vpc_attachment_id = string
static_routes = set(object({
blackhole = bool
destination_cidr_block = string
}))
}))Default value:
null
create_transit_gateway
(bool
) optionalWhether to create a Transit Gateway. If set to
false
, an existing Transit Gateway ID must be provided in the variableexisting_transit_gateway_id
Default value:
true
create_transit_gateway_route_table
(bool
) optionalWhether to create a Transit Gateway Route Table. If set to
false
, an existing Transit Gateway Route Table ID must be provided in the variableexisting_transit_gateway_route_table_id
Default value:
true
create_transit_gateway_route_table_association_and_propagation
(bool
) optionalWhether to create Transit Gateway Route Table associations and propagations
Default value:
true
create_transit_gateway_vpc_attachment
(bool
) optionalWhether to create Transit Gateway VPC Attachments
Default value:
true
default_route_table_association
(string
) optionalWhether resource attachments are automatically associated with the default association route table. Valid values:
disable
,enable
. Default value:disable
Default value:
"disable"
default_route_table_propagation
(string
) optionalWhether resource attachments automatically propagate routes to the default propagation route table. Valid values:
disable
,enable
. Default value:disable
Default value:
"disable"
dns_support
(string
) optionalWhether resource attachments automatically propagate routes to the default propagation route table. Valid values:
disable
,enable
. Default value:enable
Default value:
"enable"
existing_transit_gateway_id
(string
) optionalExisting Transit Gateway ID. If provided, the module will not create a Transit Gateway but instead will use the existing one
Default value:
null
existing_transit_gateway_route_table_id
(string
) optionalExisting Transit Gateway Route Table ID. If provided, the module will not create a Transit Gateway Route Table but instead will use the existing one
Default value:
null
ram_principal
(string
) optionalDEPRECATED, please use ram_principals instead.
The principal to associate with the resource share. Possible values are an
AWS account ID, an Organization ARN, or an Organization Unit ARN.Default value:
null
ram_principals
(list(string)
) optionalA list of principals to associate with the resource share. Possible values
are:- AWS account ID
- Organization ARN
- Organization Unit ARN
If this (and var.ram_principal) is not provided and
ram_resource_share_enabled
istrue
, the Organization ARN will be used.Default value:
[ ]
- AWS account ID
Whether to enable sharing the Transit Gateway with the Organization using Resource Access Manager (RAM)
Default value:
false
route_keys_enabled
(bool
) optionalIf true, Terraform will use keys to label routes, preventing unnecessary changes,
but this requires that the VPCs and subnets already exist before using this module.
If false, Terraform will use numbers to label routes, and a single change may
cascade to a long list of changes because the index or order has changed, but
this will work when thetrue
setting generates the errorThe "for_each" value depends on resource attributes...
Default value:
false
route_timeouts
optionalaws_route resource timeouts
Type:
object({
create = optional(string),
delete = optional(string),
update = optional(string)
})Default value:
{ }
transit_gateway_cidr_blocks
(list(string)
) optionalThe list of associated CIDR blocks. It can contain up to 1 IPv4 CIDR block
of size up to /24 and up to one IPv6 CIDR block of size up to /64. The IPv4
block must not be from range 169.254.0.0/16.Default value:
null
transit_gateway_description
(string
) optionalTransit Gateway description. If not provided, one will be automatically generated.
Default value:
""
vpc_attachment_appliance_mode_support
(string
) optionalWhether Appliance Mode support is enabled. If enabled, a traffic flow between a source and destination uses the same Availability Zone for the VPC attachment for the lifetime of that flow. Valid values:
disable
,enable
Default value:
"disable"
vpc_attachment_dns_support
(string
) optionalWhether resource attachments automatically propagate routes to the default propagation route table. Valid values:
disable
,enable
. Default value:enable
Default value:
"enable"
vpc_attachment_ipv6_support
(string
) optionalWhether resource attachments automatically propagate routes to the default propagation route table. Valid values:
disable
,enable
. Default value:enable
Default value:
"disable"
vpn_ecmp_support
(string
) optionalWhether resource attachments automatically propagate routes to the default propagation route table. Valid values:
disable
,enable
. Default value:enable
Default value:
"enable"
Context Variables
The following variables are defined in the context.tf
file of this module and part of the terraform-null-label pattern.
context.tf
file of this module and part of the terraform-null-label pattern.Outputs
RAM resource share ID
subnet_route_ids
Subnet route identifiers combined with destinations
transit_gateway_arn
Transit Gateway ARN
transit_gateway_association_default_route_table_id
Transit Gateway association default route table ID
transit_gateway_id
Transit Gateway ID
transit_gateway_propagation_default_route_table_id
Transit Gateway propagation default route table ID
transit_gateway_route_ids
Transit Gateway route identifiers combined with destinations
transit_gateway_route_table_id
Transit Gateway route table ID
transit_gateway_vpc_attachment_ids
Transit Gateway VPC attachment IDs
Dependencies
Requirements
terraform
, version:>= 1.3
aws
, version:>= 4.4.0
Providers
aws
, version:>= 4.4.0
Modules
Name | Version | Source | Description |
---|---|---|---|
subnet_route | latest | ./modules/subnet_route | Create routes in the subnets' route tables to route traffic from subnets to the Transit Gateway VPC attachments Only route to VPCs of the environments defined in route_to attribute |
this | 0.25.0 | cloudposse/label/null | n/a |
transit_gateway_route | latest | ./modules/transit_gateway_route | Static Transit Gateway routes Static routes have a higher precedence than propagated routes https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html https://docs.aws.amazon.com/vpc/latest/tgw/tgw-route-tables.html |
Resources
The following resources are used by this module:
aws_ec2_transit_gateway.default
(resource)aws_ec2_transit_gateway_route_table.default
(resource)aws_ec2_transit_gateway_route_table_association.default
(resource)aws_ec2_transit_gateway_route_table_propagation.default
(resource)aws_ec2_transit_gateway_vpc_attachment.default
(resource)aws_ram_principal_association.default
(resource)aws_ram_resource_association.default
(resource)aws_ram_resource_share.default
(resource)
Data Sources
The following data sources are used by this module:
aws_ec2_transit_gateway.this
(data source)aws_organizations_organization.default
(data source)aws_vpc.default
(data source)