diff --git a/README.md b/README.md index ecd8464a7..2465afc5c 100644 --- a/README.md +++ b/README.md @@ -218,13 +218,6 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway * Few tests and edge cases examples: [#46](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-46-no-private-subnets), [#44](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-44-asymmetric-private-subnets), [#108](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-108-route-already-exists) -## Requirements - -| Name | Version | -|------|---------| -| terraform | ~> 0.12.6 | -| aws | ~> 2.53 | - ## Providers | Name | Version | @@ -234,7 +227,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +|------|-------------|------|---------|:-----:| | amazon\_side\_asn | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no | | apigw\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for API GW endpoint | `bool` | `false` | no | | apigw\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for API GW endpoint | `list(string)` | `[]` | no | @@ -290,7 +283,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | database\_inbound\_acl\_rules | Database subnets inbound network ACL rules | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | database\_outbound\_acl\_rules | Database subnets outbound network ACL rules | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | database\_route\_table\_tags | Additional tags for the database route tables | `map(string)` | `{}` | no | -| database\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on database subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no | +| database\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on database subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | n/a | yes | | database\_subnet\_group\_tags | Additional tags for the database subnet group | `map(string)` | `{}` | no | | database\_subnet\_ipv6\_prefixes | Assigns IPv6 database subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list` | `[]` | no | | database\_subnet\_suffix | Suffix to append to database subnets name | `string` | `"db"` | no | @@ -343,7 +336,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | elasticache\_inbound\_acl\_rules | Elasticache subnets inbound network ACL rules | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | elasticache\_outbound\_acl\_rules | Elasticache subnets outbound network ACL rules | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | elasticache\_route\_table\_tags | Additional tags for the elasticache route tables | `map(string)` | `{}` | no | -| elasticache\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on elasticache subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no | +| elasticache\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on elasticache subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | n/a | yes | | elasticache\_subnet\_ipv6\_prefixes | Assigns IPv6 elasticache subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list` | `[]` | no | | elasticache\_subnet\_suffix | Suffix to append to elasticache subnets name | `string` | `"elasticache"` | no | | elasticache\_subnet\_tags | Additional tags for the elasticache subnets | `map(string)` | `{}` | no | @@ -355,8 +348,8 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | enable\_appmesh\_envoy\_management\_endpoint | Should be true if you want to provision a AppMesh endpoint to the VPC | `bool` | `false` | no | | enable\_appstream\_endpoint | Should be true if you want to provision a AppStream endpoint to the VPC | `bool` | `false` | no | | enable\_athena\_endpoint | Should be true if you want to provision a Athena endpoint to the VPC | `bool` | `false` | no | -| enable\_classiclink | Should be true to enable ClassicLink for the VPC. Only valid in regions and accounts that support EC2 Classic. | `bool` | `null` | no | -| enable\_classiclink\_dns\_support | Should be true to enable ClassicLink DNS Support for the VPC. Only valid in regions and accounts that support EC2 Classic. | `bool` | `null` | no | +| enable\_classiclink | Should be true to enable ClassicLink for the VPC. Only valid in regions and accounts that support EC2 Classic. | `bool` | n/a | yes | +| enable\_classiclink\_dns\_support | Should be true to enable ClassicLink DNS Support for the VPC. Only valid in regions and accounts that support EC2 Classic. | `bool` | n/a | yes | | enable\_cloud\_directory\_endpoint | Should be true if you want to provision an Cloud Directory endpoint to the VPC | `bool` | `false` | no | | enable\_cloudformation\_endpoint | Should be true if you want to provision a Cloudformation endpoint to the VPC | `bool` | `false` | no | | enable\_cloudtrail\_endpoint | Should be true if you want to provision a CloudTrail endpoint to the VPC | `bool` | `false` | no | @@ -410,13 +403,14 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | events\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for CloudWatch Events endpoint | `list(string)` | `[]` | no | | events\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for CloudWatch Events endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no | | external\_nat\_ip\_ids | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no | +| external\_nat\_ips | List of EIPs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no | | flow\_log\_cloudwatch\_iam\_role\_arn | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided. | `string` | `""` | no | -| flow\_log\_cloudwatch\_log\_group\_kms\_key\_id | The ARN of the KMS Key to use when encrypting log data for VPC flow logs. | `string` | `null` | no | +| flow\_log\_cloudwatch\_log\_group\_kms\_key\_id | The ARN of the KMS Key to use when encrypting log data for VPC flow logs. | `string` | n/a | yes | | flow\_log\_cloudwatch\_log\_group\_name\_prefix | Specifies the name prefix of CloudWatch Log Group for VPC flow logs. | `string` | `"/aws/vpc-flow-log/"` | no | -| flow\_log\_cloudwatch\_log\_group\_retention\_in\_days | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | `null` | no | +| flow\_log\_cloudwatch\_log\_group\_retention\_in\_days | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | n/a | yes | | flow\_log\_destination\_arn | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided. | `string` | `""` | no | | flow\_log\_destination\_type | Type of flow log destination. Can be s3 or cloud-watch-logs. | `string` | `"cloud-watch-logs"` | no | -| flow\_log\_log\_format | The fields to include in the flow log record, in the order in which they should appear. | `string` | `null` | no | +| flow\_log\_log\_format | The fields to include in the flow log record, in the order in which they should appear. | `string` | n/a | yes | | flow\_log\_traffic\_type | The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL. | `string` | `"ALL"` | no | | git\_codecommit\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for Git Codecommit endpoint | `bool` | `false` | no | | git\_codecommit\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Git Codecommit endpoint | `list` | `[]` | no | @@ -431,7 +425,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | intra\_inbound\_acl\_rules | Intra subnets inbound network ACLs | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | intra\_outbound\_acl\_rules | Intra subnets outbound network ACLs | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | intra\_route\_table\_tags | Additional tags for the intra route tables | `map(string)` | `{}` | no | -| intra\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on intra subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no | +| intra\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on intra subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | n/a | yes | | intra\_subnet\_ipv6\_prefixes | Assigns IPv6 intra subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list` | `[]` | no | | intra\_subnet\_suffix | Suffix to append to intra subnets name | `string` | `"intra"` | no | | intra\_subnet\_tags | Additional tags for the intra subnets | `map(string)` | `{}` | no | @@ -463,7 +457,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | private\_inbound\_acl\_rules | Private subnets inbound network ACLs | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | private\_outbound\_acl\_rules | Private subnets outbound network ACLs | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | private\_route\_table\_tags | Additional tags for the private route tables | `map(string)` | `{}` | no | -| private\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on private subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no | +| private\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on private subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | n/a | yes | | private\_subnet\_ipv6\_prefixes | Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list` | `[]` | no | | private\_subnet\_suffix | Suffix to append to private subnets name | `string` | `"private"` | no | | private\_subnet\_tags | Additional tags for the private subnets | `map(string)` | `{}` | no | @@ -476,7 +470,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | public\_inbound\_acl\_rules | Public subnets inbound network ACLs | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | public\_outbound\_acl\_rules | Public subnets outbound network ACLs | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | public\_route\_table\_tags | Additional tags for the public route tables | `map(string)` | `{}` | no | -| public\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on public subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no | +| public\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on public subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | n/a | yes | | public\_subnet\_ipv6\_prefixes | Assigns IPv6 public subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list` | `[]` | no | | public\_subnet\_suffix | Suffix to append to public subnets name | `string` | `"public"` | no | | public\_subnet\_tags | Additional tags for the public subnets | `map(string)` | `{}` | no | @@ -486,7 +480,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | redshift\_inbound\_acl\_rules | Redshift subnets inbound network ACL rules | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | redshift\_outbound\_acl\_rules | Redshift subnets outbound network ACL rules | `list(map(string))` | 
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
| no | | redshift\_route\_table\_tags | Additional tags for the redshift route tables | `map(string)` | `{}` | no | -| redshift\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on redshift subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no | +| redshift\_subnet\_assign\_ipv6\_address\_on\_creation | Assign IPv6 address on redshift subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | n/a | yes | | redshift\_subnet\_group\_tags | Additional tags for the redshift subnet group | `map(string)` | `{}` | no | | redshift\_subnet\_ipv6\_prefixes | Assigns IPv6 redshift subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list` | `[]` | no | | redshift\_subnet\_suffix | Suffix to append to redshift subnets name | `string` | `"redshift"` | no | @@ -542,7 +536,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway | vpc\_endpoint\_tags | Additional tags for the VPC Endpoints | `map(string)` | `{}` | no | | vpc\_flow\_log\_tags | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no | | vpc\_tags | Additional tags for the VPC | `map(string)` | `{}` | no | -| vpn\_gateway\_az | The Availability Zone for the VPN Gateway | `string` | `null` | no | +| vpn\_gateway\_az | The Availability Zone for the VPN Gateway | `string` | n/a | yes | | vpn\_gateway\_id | ID of VPN Gateway to attach to the VPC | `string` | `""` | no | | vpn\_gateway\_tags | Additional tags for the VPN gateway | `map(string)` | `{}` | no | diff --git a/examples/complete-vpc/README.md b/examples/complete-vpc/README.md index 34b4b9e8e..b3834c2d9 100644 --- a/examples/complete-vpc/README.md +++ b/examples/complete-vpc/README.md @@ -17,10 +17,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers | Name | Version | diff --git a/examples/ipv6/README.md b/examples/ipv6/README.md index 4d92d6cdd..eaf3aa242 100644 --- a/examples/ipv6/README.md +++ b/examples/ipv6/README.md @@ -15,10 +15,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers | Name | Version | diff --git a/examples/issue-108-route-already-exists/README.md b/examples/issue-108-route-already-exists/README.md index fcff3a059..bf87248d7 100644 --- a/examples/issue-108-route-already-exists/README.md +++ b/examples/issue-108-route-already-exists/README.md @@ -19,10 +19,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers No provider. diff --git a/examples/issue-44-asymmetric-private-subnets/README.md b/examples/issue-44-asymmetric-private-subnets/README.md index 8d4ec8055..2c89cb58d 100644 --- a/examples/issue-44-asymmetric-private-subnets/README.md +++ b/examples/issue-44-asymmetric-private-subnets/README.md @@ -17,10 +17,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers No provider. diff --git a/examples/issue-46-no-private-subnets/README.md b/examples/issue-46-no-private-subnets/README.md index 07e8345fa..d31d3b559 100644 --- a/examples/issue-46-no-private-subnets/README.md +++ b/examples/issue-46-no-private-subnets/README.md @@ -17,10 +17,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers No provider. diff --git a/examples/manage-default-vpc/README.md b/examples/manage-default-vpc/README.md index 8a5536c4a..c371deba4 100644 --- a/examples/manage-default-vpc/README.md +++ b/examples/manage-default-vpc/README.md @@ -17,10 +17,6 @@ $ terraform apply Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers No provider. diff --git a/examples/network-acls/README.md b/examples/network-acls/README.md index eee08e771..a8902245d 100644 --- a/examples/network-acls/README.md +++ b/examples/network-acls/README.md @@ -19,10 +19,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers No provider. diff --git a/examples/secondary-cidr-blocks/README.md b/examples/secondary-cidr-blocks/README.md index 6a6ff1a67..9464baea3 100644 --- a/examples/secondary-cidr-blocks/README.md +++ b/examples/secondary-cidr-blocks/README.md @@ -17,10 +17,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers No provider. diff --git a/examples/simple-vpc/README.md b/examples/simple-vpc/README.md index 98670b9ef..e70f173b8 100644 --- a/examples/simple-vpc/README.md +++ b/examples/simple-vpc/README.md @@ -21,10 +21,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers | Name | Version | diff --git a/examples/test_fixture/README.md b/examples/test_fixture/README.md index 622b06ce8..a9e421a6b 100644 --- a/examples/test_fixture/README.md +++ b/examples/test_fixture/README.md @@ -21,10 +21,6 @@ Finished in 4.25 seconds (files took 2.75 seconds to load) This will destroy any existing test resources, create the resources afresh, run the tests, report back, and destroy the resources. -## Requirements - -No requirements. - ## Providers | Name | Version | @@ -34,7 +30,7 @@ No requirements. ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +|------|-------------|------|---------|:-----:| | region | n/a | `string` | `"eu-west-1"` | no | ## Outputs diff --git a/examples/vpc-flow-logs/README.md b/examples/vpc-flow-logs/README.md index 1b74fc296..c09064c97 100644 --- a/examples/vpc-flow-logs/README.md +++ b/examples/vpc-flow-logs/README.md @@ -19,10 +19,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers | Name | Version | diff --git a/examples/vpc-separate-private-route-tables/README.md b/examples/vpc-separate-private-route-tables/README.md index 6d8182325..66b11e5cd 100644 --- a/examples/vpc-separate-private-route-tables/README.md +++ b/examples/vpc-separate-private-route-tables/README.md @@ -17,10 +17,6 @@ $ terraform apply Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. -## Requirements - -No requirements. - ## Providers No provider. diff --git a/outputs.tf b/outputs.tf index c3b01a547..a25b67696 100644 --- a/outputs.tf +++ b/outputs.tf @@ -245,7 +245,7 @@ output "nat_ids" { output "nat_public_ips" { description = "List of public Elastic IPs created for AWS NAT Gateway" - value = aws_eip.nat.*.public_ip + value = var.reuse_nat_ips ? var.external_nat_ips : aws_eip.nat.*.public_ip } output "natgw_ids" { diff --git a/variables.tf b/variables.tf index 9381d8cef..687ac512b 100644 --- a/variables.tf +++ b/variables.tf @@ -298,6 +298,12 @@ variable "external_nat_ip_ids" { default = [] } +variable "external_nat_ips" { + description = "List of EIPs to be assigned to the NAT Gateways (used in combination with reuse_nat_ips)" + type = list(string) + default = [] +} + variable "enable_dynamodb_endpoint" { description = "Should be true if you want to provision a DynamoDB endpoint to the VPC" type = bool