mirror of
https://github.com/Sea-Haven-Industries/file-share.git
synced 2026-09-30 19:23:18 +00:00
9f27827dcb
* fix(infra): look up the live office VPN gateway (PLAT-77) The gateway tagged syslog-server-office is deleted, so the plan cannot find a route target for the office LANs. * fix(infra): select the office VPN gateway by id (PLAT-77) A state-and-VPC lookup is not unique once syslog recreates its deleted gateway. The workspace variable pins the gateway that is carrying office traffic.
95 lines
2.2 KiB
HCL
95 lines
2.2 KiB
HCL
data "aws_vpc" "syslog" {
|
|
filter {
|
|
name = "tag:Name"
|
|
values = ["syslog-server-vpc"]
|
|
}
|
|
}
|
|
|
|
data "aws_internet_gateway" "syslog" {
|
|
filter {
|
|
name = "tag:Name"
|
|
values = ["syslog-server-igw"]
|
|
}
|
|
}
|
|
|
|
# syslog state still names a deleted gateway syslog-server-office.
|
|
# vpn_gateway_id selects the gateway that is actually carrying office traffic.
|
|
data "aws_vpn_gateway" "syslog" {
|
|
id = var.vpn_gateway_id
|
|
}
|
|
|
|
data "aws_subnet" "syslog_public" {
|
|
vpc_id = data.aws_vpc.syslog.id
|
|
|
|
filter {
|
|
name = "tag:Name"
|
|
values = ["syslog-server-public"]
|
|
}
|
|
}
|
|
|
|
resource "aws_eip" "nat" {
|
|
domain = "vpc"
|
|
|
|
tags = {
|
|
Name = "file-share-nat"
|
|
}
|
|
}
|
|
|
|
resource "aws_nat_gateway" "file_share" {
|
|
allocation_id = aws_eip.nat.id
|
|
subnet_id = data.aws_subnet.syslog_public.id
|
|
|
|
tags = {
|
|
Name = "file-share"
|
|
}
|
|
}
|
|
|
|
resource "aws_route_table" "file_share" {
|
|
vpc_id = data.aws_vpc.syslog.id
|
|
|
|
tags = {
|
|
Name = "file-share"
|
|
}
|
|
}
|
|
|
|
resource "aws_route" "office" {
|
|
for_each = toset(local.office_lan_cidrs)
|
|
|
|
route_table_id = aws_route_table.file_share.id
|
|
destination_cidr_block = each.value
|
|
gateway_id = data.aws_vpn_gateway.syslog.id
|
|
}
|
|
|
|
resource "aws_route" "nat" {
|
|
route_table_id = aws_route_table.file_share.id
|
|
destination_cidr_block = "0.0.0.0/0"
|
|
nat_gateway_id = aws_nat_gateway.file_share.id
|
|
}
|
|
|
|
resource "aws_subnet" "file_share" {
|
|
vpc_id = data.aws_vpc.syslog.id
|
|
cidr_block = local.subnet_cidr
|
|
availability_zone = local.subnet_az
|
|
map_public_ip_on_launch = false
|
|
|
|
tags = {
|
|
Name = "file-share"
|
|
}
|
|
|
|
lifecycle {
|
|
precondition {
|
|
condition = one(data.aws_internet_gateway.syslog.attachments[*].vpc_id) == data.aws_vpc.syslog.id
|
|
error_message = "syslog IGW is not attached to the syslog VPC."
|
|
}
|
|
|
|
precondition {
|
|
condition = data.aws_vpn_gateway.syslog.state == "available" && data.aws_vpn_gateway.syslog.attached_vpc_id == data.aws_vpc.syslog.id
|
|
error_message = "vpn_gateway_id must be an available VPN gateway attached to the syslog VPC."
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_route_table_association" "file_share" {
|
|
subnet_id = aws_subnet.file_share.id
|
|
route_table_id = aws_route_table.file_share.id
|
|
}
|