Skip to content

Commit a4b5a7a

Browse files
author
Rene Barbosa
committed
add: resolver-endpoints submodule
1 parent 385af6e commit a4b5a7a

File tree

8 files changed

+243
-0
lines changed

8 files changed

+243
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ There are independent submodules:
99
- [zones](https://github.com/terraform-aws-modules/terraform-aws-route53/tree/master/modules/zones) - to manage Route53 zones
1010
- [records](https://github.com/terraform-aws-modules/terraform-aws-route53/tree/master/modules/records) - to manage Route53 records
1111
- [delegation-sets](https://github.com/terraform-aws-modules/terraform-aws-route53/tree/master/modules/delegation-sets) - to manage Route53 delegation sets
12+
- [resolver-endpoints](https://github.com/terraform-aws-modules/terraform-aws-route53/tree/master/modules/resolver-endpoints) - to manage Route53 resolver endpoints
1213
- [resolver-rule-associations](https://github.com/terraform-aws-modules/terraform-aws-route53/tree/master/modules/resolver-rule-associations) - to manage Route53 resolver rule associations
1314

1415
## Usage

‎examples/complete/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ Note that this example may create resources which cost money. Run `terraform des
3939
| <a name="module_disabled_records"></a> [disabled\_records](#module\_disabled\_records) | ../../modules/records | n/a |
4040
| <a name="module_records"></a> [records](#module\_records) | ../../modules/records | n/a |
4141
| <a name="module_records_with_full_names"></a> [records\_with\_full\_names](#module\_records\_with\_full\_names) | ../../modules/records | n/a |
42+
| <a name="module_resolver_endpoints"></a> [resolver\_endpoints](#module\_resolver\_endpoints) | ../../modules/resolver-endpoints | n/a |
4243
| <a name="module_resolver_rule_associations"></a> [resolver\_rule\_associations](#module\_resolver\_rule\_associations) | ../../modules/resolver-rule-associations | n/a |
4344
| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | n/a |
4445
| <a name="module_terragrunt"></a> [terragrunt](#module\_terragrunt) | ../../modules/records | n/a |

‎examples/complete/main.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,23 @@ module "resolver_rule_associations" {
258258
}
259259
}
260260

261+
module "resolver_endpoints" {
262+
source = "../../modules/resolver-endpoints"
263+
264+
name = "example1"
265+
direction = "INBOUND"
266+
protocols = ["Do53", "DoH"]
267+
268+
subnet_ids = [
269+
slice(module.vpc1.private_subnets, 0, 2)
270+
]
271+
272+
vpc_id = module.vpc1.vpc_id
273+
security_group_ingress_cidr_blocks = [
274+
module.vpc2.vpc_cidr_block
275+
]
276+
}
277+
261278
module "disabled_records" {
262279
source = "../../modules/records"
263280

‎modules/resolver-endpoints/README.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Route53 Resolver Endpoints
2+
3+
This module creates Route53 Resolver Endpoints.
4+
5+
## Requirements
6+
7+
| Name | Version |
8+
|------|---------|
9+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
10+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.56 |
11+
12+
## Providers
13+
14+
| Name | Version |
15+
|------|---------|
16+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.56 |
17+
18+
## Modules
19+
20+
No modules.
21+
22+
## Resources
23+
24+
| Name | Type |
25+
|------|------|
26+
| [aws_route53_resolver_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_endpoint) | resource |
27+
| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
28+
29+
## Inputs
30+
31+
| Name | Description | Type | Default | Required |
32+
|------|-------------|------|---------|:--------:|
33+
| <a name="input_create"></a> [create](#input\_create) | Whether to create Route53 resolver endpoints | `bool` | `true` | no |
34+
| <a name="input_create_security_group"></a> [create\_security\_group](#input\_create\_security\_group) | Whether to create Security Groups for Route53 Resolver Endpoints | `bool` | `true` | no |
35+
| <a name="input_direction"></a> [direction](#input\_direction) | The resolver endpoint flow direction | `string` | `"INBOUND"` | no |
36+
| <a name="input_name"></a> [name](#input\_name) | The resolver endpoint name | `string` | n/a | yes |
37+
| <a name="input_protocols"></a> [protocols](#input\_protocols) | The resolver endpoint protocols | `list(string)` | n/a | yes |
38+
| <a name="input_security_group_description"></a> [security\_group\_description](#input\_security\_group\_description) | The security group description | `string` | `"Managed by Terraform."` | no |
39+
| <a name="input_security_group_ids"></a> [security\_group\_ids](#input\_security\_group\_ids) | A list of security group IDs | `list(string)` | `[]` | no |
40+
| <a name="input_security_group_ingress_cidr_blocks"></a> [security\_group\_ingress\_cidr\_blocks](#input\_security\_group\_ingress\_cidr\_blocks) | A list of CIDR blocks to allow on security group | `list(string)` | `[]` | no |
41+
| <a name="input_security_group_name"></a> [security\_group\_name](#input\_security\_group\_name) | The security group name | `string` | `""` | no |
42+
| <a name="input_subnet_ids"></a> [subnet\_ids](#input\_subnet\_ids) | A list of subnets where Route53 resolver endpoints will be deployed | `list(string)` | n/a | yes |
43+
| <a name="input_type"></a> [type](#input\_type) | The resolver endpoint IP type | `string` | `"IPV4"` | no |
44+
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | The VPC ID for all the Route53 Resolver Endpoints | `string` | `""` | no |
45+
46+
## Outputs
47+
48+
| Name | Description |
49+
|------|-------------|
50+
| <a name="output_route53_resolver_endpoint_arn"></a> [route53\_resolver\_endpoint\_arn](#output\_route53\_resolver\_endpoint\_arn) | The ARN of the Resolver Endpoint |
51+
| <a name="output_route53_resolver_endpoint_id"></a> [route53\_resolver\_endpoint\_id](#output\_route53\_resolver\_endpoint\_id) | The ID of the Resolver Endpoint |
52+
| <a name="output_route53_resolver_endpoint_ip_addresses"></a> [route53\_resolver\_endpoint\_ip\_addresses](#output\_route53\_resolver\_endpoint\_ip\_addresses) | Resolver Endpoint IP Addresses |
53+
| <a name="output_route53_resolver_endpoint_security_groups"></a> [route53\_resolver\_endpoint\_security\_groups](#output\_route53\_resolver\_endpoint\_security\_groups) | Security Group IDs mapped to Resolver Endpoint |
54+
| <a name="output_route53_resolver_endpoint_vpc_id"></a> [route53\_resolver\_endpoint\_vpc\_id](#output\_route53\_resolver\_endpoint\_vpc\_id) | The VPC ID used by the Resolver Endpoint |

‎modules/resolver-endpoints/main.tf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
locals {
2+
security_group_ids = var.create_security_group ? [aws_security_group.this[0].id] : var.security_group_ids
3+
}
4+
5+
resource "aws_route53_resolver_endpoint" "this" {
6+
count = var.create ? 1 : 0
7+
8+
name = var.name
9+
direction = var.direction
10+
11+
resolver_endpoint_type = var.type
12+
security_group_ids = local.security_group_ids
13+
14+
dynamic "ip_address" {
15+
for_each = var.subnet_ids
16+
content {
17+
subnet_id = var.subnet_ids[ip_address.key]
18+
}
19+
}
20+
21+
protocols = var.protocols
22+
}
23+
24+
resource "aws_security_group" "this" {
25+
count = var.create && var.create_security_group ? 1 : 0
26+
27+
name = var.name
28+
description = var.security_group_description
29+
vpc_id = var.vpc_id
30+
31+
dynamic "ingress" {
32+
for_each = toset(["tcp", "udp"])
33+
content {
34+
description = "Allow DNS"
35+
protocol = ingress.value
36+
from_port = 53
37+
to_port = 53
38+
cidr_blocks = var.security_group_ingress_cidr_blocks
39+
}
40+
}
41+
42+
egress {
43+
description = "Allow All"
44+
protocol = "-1"
45+
from_port = 0
46+
to_port = 0
47+
cidr_blocks = ["0.0.0.0/0"]
48+
}
49+
50+
tags = {
51+
Name = "${var.name}-sg"
52+
}
53+
}

‎modules/resolver-endpoints/outputs.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
2+
output "route53_resolver_endpoint_id" {
3+
description = "The ID of the Resolver Endpoint"
4+
value = aws_route53_resolver_endpoint.this[0].id
5+
}
6+
7+
output "route53_resolver_endpoint_arn" {
8+
description = "The ARN of the Resolver Endpoint"
9+
value = aws_route53_resolver_endpoint.this[0].arn
10+
}
11+
12+
output "route53_resolver_endpoint_vpc_id" {
13+
description = "The VPC ID used by the Resolver Endpoint"
14+
value = aws_route53_resolver_endpoint.this[0].host_vpc_id
15+
}
16+
17+
output "route53_resolver_endpoint_security_groups" {
18+
description = "Security Group IDs mapped to Resolver Endpoint"
19+
value = aws_route53_resolver_endpoint.this[0].security_group_ids
20+
}
21+
22+
output "route53_resolver_endpoint_ip_addresses" {
23+
description = "Resolver Endpoint IP Addresses"
24+
value = aws_route53_resolver_endpoint.this[0].ip_address
25+
}

‎modules/resolver-endpoints/variables.tf‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
variable "create" {
2+
description = "Whether to create Route53 resolver endpoints"
3+
type = bool
4+
default = true
5+
}
6+
7+
variable "name" {
8+
description = "The resolver endpoint name"
9+
type = string
10+
}
11+
12+
variable "protocols" {
13+
description = "The resolver endpoint protocols"
14+
validation {
15+
condition = alltrue([
16+
for value in var.protocols : contains(["DoH", "Do53", "DoH-FIPS"], value)
17+
])
18+
error_message = "Invalid value. Valid values are `DoH`, `Do53` and `DoH-FIPS`"
19+
}
20+
type = list(string)
21+
}
22+
23+
variable "direction" {
24+
description = "The resolver endpoint flow direction"
25+
type = string
26+
validation {
27+
condition = contains(["INBOUND", "OUTBOUND"], var.direction)
28+
error_message = "Invalid value. Valid values are `INBOUND` and `OUTBOUND`"
29+
}
30+
default = "INBOUND"
31+
}
32+
33+
variable "type" {
34+
description = "The resolver endpoint IP type"
35+
type = string
36+
validation {
37+
condition = contains(["IPV4", "IPV6"], var.type)
38+
error_message = "Invalid value. Valid values are `IPV4` or `IPV6`"
39+
}
40+
default = "IPV4"
41+
}
42+
43+
variable "subnet_ids" {
44+
description = "A list of subnets where Route53 resolver endpoints will be deployed"
45+
validation {
46+
condition = length(var.subnet_ids) >= 1
47+
error_message = "Invalid value. We should have at least 1 subnet."
48+
}
49+
type = list(string)
50+
}
51+
52+
variable "security_group_ids" {
53+
description = "A list of security group IDs"
54+
type = list(string)
55+
default = []
56+
}
57+
58+
# Security Group
59+
60+
variable "create_security_group" {
61+
description = "Whether to create Security Groups for Route53 Resolver Endpoints"
62+
type = bool
63+
default = true
64+
}
65+
66+
variable "vpc_id" {
67+
description = "The VPC ID for all the Route53 Resolver Endpoints"
68+
type = string
69+
default = ""
70+
}
71+
72+
variable "security_group_description" {
73+
description = "The security group description"
74+
type = string
75+
default = "Managed by Terraform."
76+
}
77+
78+
variable "security_group_ingress_cidr_blocks" {
79+
description = "A list of CIDR blocks to allow on security group"
80+
type = list(string)
81+
default = []
82+
}

‎modules/resolver-endpoints/versions.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 0.13.1"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 3.56"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)