Overhaul for IPv6 and flexiblity #159
Conversation
|
/test all |
|
/test all |
![bridgecrew[bot]](https://avatars.githubusercontent.com/in/52968?s=60&v=4){kind=small}
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_NETWORKING_53 Fixed /public.tf module.subnets.aws_subnet.public BC_AWS_GENERAL_68 Fixed /nat-instance.tf module.subnets.aws_instance.nat_instance BC_AWS_LOGGING_26 Fixed /nat-instance.tf module.subnets.aws_instance.nat_instance BC_AWS_NETWORKING_53 Fixed /public.tf aws_subnet.public BC_AWS_NETWORKING_48 Fixed /main.tf aws_eip.default
Nuru
added
the
no-release
|
/test all |
|
/test all |
|
/test all |
|
/test all |
|
|
||
| 5. Assign private subnets according to AZ number (we're using `count.index` for that). | ||
| 6. Assign public subnets according to AZ number but with a shift according to the number of AZs in the region (see step 2) | ||
| Note that this means that, for example, in a region with 4 availability zones, if you specify only 3 availability zones |
There was a problem hiding this comment.
nit: consider eliminating the second that:
Note that this means, for example, ...
There was a problem hiding this comment.
Eliminating optional/implied words in the fashion you suggest works for me, but it seems to be a problem for readers for whom English is not their native language.
|
|
||
| use_az_ids = local.e && length(var.availability_zone_ids) > 0 | ||
| use_az_var = local.e && length(var.availability_zones) > 0 | ||
| use_default_azs = local.e && !(local.use_az_ids || local.use_az_var) |
There was a problem hiding this comment.
I am not concerned about having unused local variables. They serve as documentation and maintain parallel equivalence (ipv4 vs ipv6) making the code easier to understand and modify in the future.
In this particular case use_default_azs is not used because it is the only remaining choice in the conditional testing for the other 2 conditions.
|
|
||
|
|
||
| subnet_az_count = local.e ? length(local.subnet_availability_zones) : 0 | ||
| subnet_count = ((local.public_enabled ? 1 : 0) + (local.private_enabled ? 1 : 0)) * local.subnet_az_count |
There was a problem hiding this comment.
I am not concerned about having unused local variables. They serve as documentation and maintain parallel equivalence (ipv4 vs ipv6) making the code easier to understand and modify in the future.
In this particular case, subnet_count is the total number of subnets created. The fact that it turns out we never need this number is not a concern to me.
| # an IPv6 Egress-only Internet Gateway, not if it *requires* its use. | ||
| ipv6_egress_only_configured = local.ipv6_enabled && length(var.ipv6_egress_only_igw_id) > 0 | ||
|
|
||
| public4_enabled = local.public_enabled && local.ipv4_enabled |
| github.com/gruntwork-io/go-commons v0.8.0 // indirect | ||
| github.com/hashicorp/errwrap v1.0.0 // indirect | ||
| github.com/hashicorp/go-cleanhttp v0.5.2 // indirect | ||
| github.com/hashicorp/go-getter v1.5.9 // indirect | ||
| github.com/hashicorp/go-getter v1.5.11 // indirect | ||
| github.com/hashicorp/go-multierror v1.1.0 // indirect | ||
| github.com/hashicorp/go-safetemp v1.0.0 // indirect | ||
| github.com/hashicorp/go-version v1.3.0 // indirect |
There was a problem hiding this comment.
it looks like go.sum is out of sync with go.mod. To fix you can run:
$ go mod tidy -go=1.16 && go mod tidy -go=1.17There was a problem hiding this comment.
What makes you say they are out of sync? They look in sync to me?
terraform-aws-dynamic-subnets/test/src/go.sum
Line 222 in e584396
mergify
bot
dismissed
mcalhoun’s stale review
This Pull Request has been updated, so we're dismissing all reviews.
|
/test all |
|
/test all |
examples/existing-ips/outputs.tf
Outdated
| @@ -1,7 +1,9 @@ | |||
| output "existing_ips" { | |||
| value = values(aws_eip.nat_ips).*.public_ip | |||
| description = "IP Addresses created by this module for use by NAT" | |||
There was a problem hiding this comment.
| description = "IP Addresses created by this module for use by NAT" | |
| description = "Elastic IP Addresses created by this module for use by NAT" |
outputs.tf
Outdated
| @@ -28,27 +53,37 @@ output "private_route_table_ids" { | |||
| value = aws_route_table.private.*.id | |||
| } | |||
|
|
|||
| output "public_network_acl" { | |||
There was a problem hiding this comment.
| output "public_network_acl" { | |
| output "public_network_acl_id" { |
outputs.tf
Outdated
| value = local.public_open_network_acl_enabled ? aws_network_acl.public[0].id : null | ||
| } | ||
|
|
||
| output "private_network_acl" { |
There was a problem hiding this comment.
| output "private_network_acl" { | |
| output "private_network_acl_id" { |
outputs.tf
Outdated
| } | ||
|
|
||
| output "nat_ips" { | ||
| description = "IP Addresses in use for NAT" | ||
| value = coalescelist(aws_eip.default.*.public_ip, aws_eip.nat_instance.*.public_ip, data.aws_eip.nat_ips.*.public_ip, tolist([""])) | ||
| description = "IP Addresses in use by NAT" |
There was a problem hiding this comment.
| description = "IP Addresses in use by NAT" | |
| description = "Elastic IP Addresses in use by NAT" |
variables.tf
Outdated
| variable "max_nats" { | ||
| type = number | ||
| description = "Maximum number of NAT Gateways or NAT instances to create" | ||
| default = 999 |
There was a problem hiding this comment.
why 999? should it be equal to the number of subnets or AZs?
There was a problem hiding this comment.
Really the default should be MAX_INT but Terraform doesn't provide such a value, so I used 999 as a "big enough" number that it will never take effect. It needs to be a value known at plan time, so it cannot be dependent on how many AZs are available.
variables.tf
Outdated
| type = string | ||
| description = "Base CIDR block which will be divided into subnet CIDR blocks (e.g. `10.0.0.0/16`)" | ||
| description = "The string to use in IDs and elsewhere to distinguish resources for the private subnets from resources for the public subnets" |
There was a problem hiding this comment.
| description = "The string to use in IDs and elsewhere to distinguish resources for the private subnets from resources for the public subnets" | |
| description = "The string to use in IDs and elsewhere to distinguish resources for the public subnets from resources for the private subnets" |
variables.tf
Outdated
| variable "availability_zones" { | ||
| variable "ipv4_enabled" { | ||
| type = bool | ||
| description = "Set true to enable IPv4 addresses in the subnets" |
There was a problem hiding this comment.
| description = "Set true to enable IPv4 addresses in the subnets" | |
| description = "Set `true` to enable IPv4 addresses in the subnets" |
variables.tf
Outdated
|
|
||
| variable "ipv6_enabled" { | ||
| type = bool | ||
| description = "Set true to enable IPv6 addresses in the subnets" |
There was a problem hiding this comment.
| description = "Set true to enable IPv6 addresses in the subnets" | |
| description = "Set `true` to enable IPv6 addresses in the subnets" |
variables.tf
Outdated
| If `true`, a single network ACL be created and it will be associated with every private subnet, and a rule (number 100) | ||
| will be created allowing all ingress and all egress. You can add additional rules to this network ACL | ||
| using the `aws_network_acl_rule` resource. | ||
| If `false`, you will will need to manage the network ACL external to this module. |
There was a problem hiding this comment.
| If `false`, you will will need to manage the network ACL external to this module. | |
| If `false`, you will need to manage the network ACL external to this module. |
variables.tf
Outdated
| If `true`, a single network ACL be created and it will be associated with every public subnet, and a rule | ||
| will be created allowing all ingress and all egress. You can add additional rules to this network ACL | ||
| using the `aws_network_acl_rule` resource. | ||
| If `false`, you will will need to manage the network ACL external to this module. |
There was a problem hiding this comment.
| If `false`, you will will need to manage the network ACL external to this module. | |
| If `false`, you will need to manage the network ACL external to this module. |
variables.tf
Outdated
| variable "private_route_table_enabled" { | ||
| type = bool | ||
| description = <<-EOT | ||
| If true, a network route table and default route to the NAT gateway, NAT instance, or egress-only gateway |
There was a problem hiding this comment.
| If true, a network route table and default route to the NAT gateway, NAT instance, or egress-only gateway | |
| If `true`, a network route table and default route to the NAT gateway, NAT instance, or egress-only gateway |
variables.tf
Outdated
| condition = length(var.nat_instance_ami_id) < 2 | ||
| error_message = "Only 1 NAT Instance AMI ID can be provided." | ||
| } | ||
|
|
There was a problem hiding this comment.
can remove this empty line
|
/test all |
what
why
references
notes