file-share/terraform/network.tf

data "aws_vpc" "syslog" {
  filter {
    name   = "tag:Name"
    values = ["syslog-server-vpc"]
  }
}

data "aws_internet_gateway" "syslog" {
  filter {
    name   = "tag:Name"
    values = ["syslog-server-igw"]
  }
}

# syslog state still names a deleted gateway syslog-server-office.
# vpn_gateway_id selects the gateway that is actually carrying office traffic.
data "aws_vpn_gateway" "syslog" {
  id = var.vpn_gateway_id
}

data "aws_subnet" "syslog_public" {
  vpc_id = data.aws_vpc.syslog.id

  filter {
    name   = "tag:Name"
    values = ["syslog-server-public"]
  }
}

resource "aws_eip" "nat" {
  domain = "vpc"

  tags = {
    Name = "file-share-nat"
  }
}

resource "aws_nat_gateway" "file_share" {
  allocation_id = aws_eip.nat.id
  subnet_id     = data.aws_subnet.syslog_public.id

  tags = {
    Name = "file-share"
  }
}

resource "aws_route_table" "file_share" {
  vpc_id = data.aws_vpc.syslog.id

  tags = {
    Name = "file-share"
  }
}

resource "aws_route" "office" {
  for_each = toset(local.office_lan_cidrs)

  route_table_id         = aws_route_table.file_share.id
  destination_cidr_block = each.value
  gateway_id             = data.aws_vpn_gateway.syslog.id
}

resource "aws_route" "nat" {
  route_table_id         = aws_route_table.file_share.id
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.file_share.id
}

resource "aws_subnet" "file_share" {
  vpc_id                  = data.aws_vpc.syslog.id
  cidr_block              = local.subnet_cidr
  availability_zone       = local.subnet_az
  map_public_ip_on_launch = false

  tags = {
    Name = "file-share"
  }

  lifecycle {
    precondition {
      condition     = one(data.aws_internet_gateway.syslog.attachments[*].vpc_id) == data.aws_vpc.syslog.id
      error_message = "syslog IGW is not attached to the syslog VPC."
    }

    precondition {
      condition     = data.aws_vpn_gateway.syslog.state == "available" && data.aws_vpn_gateway.syslog.attached_vpc_id == data.aws_vpc.syslog.id
      error_message = "vpn_gateway_id must be an available VPN gateway attached to the syslog VPC."
    }
  }
}

resource "aws_route_table_association" "file_share" {
  subnet_id      = aws_subnet.file_share.id
  route_table_id = aws_route_table.file_share.id
}