Skip to content

feat: add support for disabling IGW for public subnets #457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jun 20, 2020
Merged

feat: add support for disabling IGW for public subnets #457

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d6c641e
add support for disabling IGW for public subnets
DrFaust92 Jun 20, 2020
bb17f98
fix doc
DrFaust92 Jun 20, 2020
19219e7
remove double negative
DrFaust92 Jun 20, 2020
da46fe7
add egress only igw flag
DrFaust92 Jun 20, 2020
2ef5676
Merge branch 'master' into conditional-igw
antonbabenko Jun 20, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
| create\_elasticache\_subnet\_route\_table | Controls if separate route table for elasticache should be created | `bool` | `false` | no |
| create\_flow\_log\_cloudwatch\_iam\_role | Whether to create IAM role for VPC Flow Logs | `bool` | `false` | no |
| create\_flow\_log\_cloudwatch\_log\_group | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |
| create\_igw | Controls if an Internet Gateway is created for public subnets and the related routes that connect them. | `bool` | `true` | no |
| create\_redshift\_subnet\_group | Controls if redshift subnet group should be created | `bool` | `true` | no |
| create\_redshift\_subnet\_route\_table | Controls if separate route table for redshift should be created | `bool` | `false` | no |
| create\_vpc | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
Expand Down
8 changes: 4 additions & 4 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ resource "aws_vpc_dhcp_options_association" "this" {
# Internet Gateway
###################
resource "aws_internet_gateway" "this" {
count = var.create_vpc && length(var.public_subnets) > 0 ? 1 : 0
count = var.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0

vpc_id = local.vpc_id

Expand Down Expand Up @@ -134,7 +134,7 @@ resource "aws_route_table" "public" {
}

resource "aws_route" "public_internet_gateway" {
count = var.create_vpc && length(var.public_subnets) > 0 ? 1 : 0
count = var.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0

route_table_id = aws_route_table.public[0].id
destination_cidr_block = "0.0.0.0/0"
Expand All @@ -146,7 +146,7 @@ resource "aws_route" "public_internet_gateway" {
}

resource "aws_route" "public_internet_gateway_ipv6" {
count = var.create_vpc && var.enable_ipv6 && length(var.public_subnets) > 0 ? 1 : 0
count = var.create_vpc && var.create_igw && var.enable_ipv6 && length(var.public_subnets) > 0 ? 1 : 0

route_table_id = aws_route_table.public[0].id
destination_ipv6_cidr_block = "::/0"
Expand Down Expand Up @@ -199,7 +199,7 @@ resource "aws_route_table" "database" {
}

resource "aws_route" "database_internet_gateway" {
count = var.create_vpc && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.create_database_internet_gateway_route && false == var.create_database_nat_gateway_route ? 1 : 0
count = var.create_vpc && var.create_igw && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.create_database_internet_gateway_route && false == var.create_database_nat_gateway_route ? 1 : 0

route_table_id = aws_route_table.database[0].id
destination_cidr_block = "0.0.0.0/0"
Expand Down
6 changes: 6 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2330,3 +2330,9 @@ variable "flow_log_max_aggregation_interval" {
type = number
default = 600
}

variable "create_igw" {
description = "Controls if an Internet Gateway is created for public subnets and the related routes that connect them."
type = bool
default = true
}