Skip to content

Commit 2bae731

Browse files
szpuniszpuni
authored
fix: Added support for multi-account deployments (terraform-aws-modules#20)
1 parent 8c8b8b4 commit 2bae731

File tree

8 files changed

+307
-5
lines changed

8 files changed

+307
-5
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ All notable changes to this project will be documented in this file.
55
<a name="unreleased"></a>
66
## [Unreleased]
77

8-
8+
- Added RAM share accepter
9+
- fixed error when **create_tgw = false**
910

1011
<a name="v1.2.0"></a>
1112
## [v1.2.0] - 2020-08-17

‎README.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,20 +78,21 @@ module "vpc" {
7878
## Examples
7979

8080
* [Complete example](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway/tree/master/examples/complete) shows TGW in combination with the [VPC module](https://github.com/terraform-aws-modules/terraform-aws-vpc) and [Resource Access Manager (RAM)](https://aws.amazon.com/ram/).
81+
* [Multi-account example](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway/tree/master/examples/multi-account) shows TGW resources shared with different AWS accounts (via [Resource Access Manager (RAM)](https://aws.amazon.com/ram/)).
8182

8283
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8384
## Requirements
8485

8586
| Name | Version |
8687
|------|---------|
8788
| terraform | >= 0.12.7, < 0.14 |
88-
| aws | >= 2.18, < 4.0 |
89+
| aws | >= 2.24, < 4.0 |
8990

9091
## Providers
9192

9293
| Name | Version |
9394
|------|---------|
94-
| aws | >= 2.18, < 4.0 |
95+
| aws | >= 2.24, < 4.0 |
9596

9697
## Inputs
9798

@@ -109,6 +110,7 @@ module "vpc" {
109110
| ram\_allow\_external\_principals | Indicates whether principals outside your organization can be associated with a resource share. | `bool` | `false` | no |
110111
| ram\_name | The name of the resource share of TGW | `string` | `""` | no |
111112
| ram\_principals | A list of principals to share TGW with. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN | `list(string)` | `[]` | no |
113+
| ram\_resource\_share\_arn | ARN of RAM resource share | `string` | `""` | no |
112114
| ram\_tags | Additional tags for the RAM | `map(string)` | `{}` | no |
113115
| share\_tgw | Whether to share your transit gateway with other accounts | `bool` | `true` | no |
114116
| tags | A map of tags to add to all resources | `map(string)` | `{}` | no |

‎examples/multi-account/README.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Complete AWS Transit Gateway example
2+
3+
Configuration in this directory creates AWS Transit Gateway, attach VPC to it and share it with other AWS principals using [Resource Access Manager (RAM)](https://aws.amazon.com/ram/).
4+
5+
## Notes
6+
7+
There is a famous limitation in Terraform which prevents us from using computed values in `count`. Fot this reason this example is using data-sources to discover already created default VPC and subnets.
8+
9+
In real-world scenario you will have to split creation of VPC (using [terraform-aws-vpc modules](https://github.com/terraform-aws-modules/terraform-aws-vpc)) and creation of TGW resources using this module.
10+
11+
## Usage
12+
13+
To run this example you need to execute:
14+
15+
```bash
16+
$ terraform init
17+
$ terraform plan
18+
$ terraform apply
19+
```
20+
21+
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
22+
23+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
24+
## Requirements
25+
26+
No requirements.
27+
28+
## Providers
29+
30+
| Name | Version |
31+
|------|---------|
32+
| aws | n/a |
33+
34+
## Inputs
35+
36+
No input.
37+
38+
## Outputs
39+
40+
| Name | Description |
41+
|------|-------------|
42+
| this\_ec2\_transit\_gateway\_arn | EC2 Transit Gateway Amazon Resource Name (ARN) |
43+
| this\_ec2\_transit\_gateway\_association\_default\_route\_table\_id | Identifier of the default association route table |
44+
| this\_ec2\_transit\_gateway\_id | EC2 Transit Gateway identifier |
45+
| this\_ec2\_transit\_gateway\_owner\_id | Identifier of the AWS account that owns the EC2 Transit Gateway |
46+
| this\_ec2\_transit\_gateway\_propagation\_default\_route\_table\_id | Identifier of the default propagation route table |
47+
| this\_ec2\_transit\_gateway\_route\_ids | List of EC2 Transit Gateway Route Table identifier combined with destination |
48+
| this\_ec2\_transit\_gateway\_route\_table\_association | Map of EC2 Transit Gateway Route Table Association attributes |
49+
| this\_ec2\_transit\_gateway\_route\_table\_association\_ids | List of EC2 Transit Gateway Route Table Association identifiers |
50+
| this\_ec2\_transit\_gateway\_route\_table\_default\_association\_route\_table | Boolean whether this is the default association route table for the EC2 Transit Gateway |
51+
| this\_ec2\_transit\_gateway\_route\_table\_default\_propagation\_route\_table | Boolean whether this is the default propagation route table for the EC2 Transit Gateway |
52+
| this\_ec2\_transit\_gateway\_route\_table\_id | EC2 Transit Gateway Route Table identifier |
53+
| this\_ec2\_transit\_gateway\_route\_table\_propagation | Map of EC2 Transit Gateway Route Table Propagation attributes |
54+
| this\_ec2\_transit\_gateway\_route\_table\_propagation\_ids | List of EC2 Transit Gateway Route Table Propagation identifiers |
55+
| this\_ec2\_transit\_gateway\_vpc\_attachment | Map of EC2 Transit Gateway VPC Attachment attributes |
56+
| this\_ec2\_transit\_gateway\_vpc\_attachment\_ids | List of EC2 Transit Gateway VPC Attachment identifiers |
57+
| this\_ram\_principal\_association\_id | The Amazon Resource Name (ARN) of the Resource Share and the principal, separated by a comma |
58+
| this\_ram\_resource\_share\_id | The Amazon Resource Name (ARN) of the resource share |
59+
60+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/multi-account/main.tf‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
}
4+
5+
# This provider is required for attachment only installation in another AWS Account.
6+
provider "aws" {
7+
region = "eu-west-1"
8+
alias = "peer"
9+
}
10+
11+
// See Notes in README.md for explanation regarding using data-sources and computed values
12+
data "aws_vpc" "default" {
13+
default = true
14+
}
15+
16+
data "aws_subnet_ids" "this" {
17+
vpc_id = data.aws_vpc.default.id
18+
}
19+
20+
module "tgw" {
21+
source = "../../"
22+
23+
name = "my-tgw"
24+
description = "My TGW shared with several other AWS accounts"
25+
amazon_side_asn = 64532
26+
27+
enable_auto_accept_shared_attachments = true // When "true" there is no need for RAM resources if using multiple AWS accounts
28+
29+
vpc_attachments = {
30+
vpc1 = {
31+
vpc_id = data.aws_vpc.default.id # module.vpc1.vpc_id
32+
subnet_ids = data.aws_subnet_ids.this.ids # module.vpc1.private_subnets
33+
dns_support = true
34+
ipv6_support = true
35+
transit_gateway_default_route_table_association = false
36+
transit_gateway_default_route_table_propagation = false
37+
// transit_gateway_route_table_id = "tgw-rtb-073a181ee589b360f"
38+
39+
tgw_routes = [
40+
{
41+
destination_cidr_block = "30.0.0.0/16"
42+
},
43+
{
44+
blackhole = true
45+
destination_cidr_block = "0.0.0.0/0"
46+
}
47+
]
48+
},
49+
vpc2 = {
50+
vpc_id = data.aws_vpc.default.id # module.vpc2.vpc_id
51+
subnet_ids = data.aws_subnet_ids.this.ids # module.vpc2.private_subnets
52+
53+
tgw_routes = [
54+
{
55+
destination_cidr_block = "50.0.0.0/16"
56+
},
57+
{
58+
blackhole = true
59+
destination_cidr_block = "10.10.10.10/32"
60+
}
61+
]
62+
},
63+
}
64+
65+
ram_allow_external_principals = true
66+
ram_principals = [307990089504]
67+
68+
tags = {
69+
Purpose = "tgw-complete-example"
70+
}
71+
}
72+
73+
module "tgw_peer" {
74+
# This is optional and connects to another account. Meaning you need to be authenticated with 2 separate AWS Accounts
75+
source = "../../"
76+
77+
providers = {
78+
aws = aws.peer
79+
}
80+
81+
name = "my-tgw-peer"
82+
description = "My TGW shared with several other AWS accounts"
83+
amazon_side_asn = 64532
84+
85+
share_tgw = true
86+
create_tgw = false
87+
ram_resource_share_arn = module.tgw.this_ram_resource_share_id
88+
enable_auto_accept_shared_attachments = true // When "true" there is no need for RAM resources if using multiple AWS accounts
89+
90+
vpc_attachments = {
91+
vpc1 = {
92+
tgw_id = module.tgw.this_ec2_transit_gateway_id
93+
vpc_id = data.aws_vpc.default.id # module.vpc1.vpc_id
94+
subnet_ids = data.aws_subnet_ids.this.ids # module.vpc1.private_subnets
95+
dns_support = true
96+
ipv6_support = true
97+
transit_gateway_default_route_table_association = false
98+
transit_gateway_default_route_table_propagation = false
99+
// transit_gateway_route_table_id = "tgw-rtb-073a181ee589b360f"
100+
101+
tgw_routes = [
102+
{
103+
destination_cidr_block = "30.0.0.0/16"
104+
},
105+
{
106+
blackhole = true
107+
destination_cidr_block = "0.0.0.0/0"
108+
}
109+
]
110+
},
111+
}
112+
113+
ram_allow_external_principals = true
114+
ram_principals = [307990089504]
115+
116+
tags = {
117+
Purpose = "tgw-complete-example"
118+
}
119+
}
120+
121+
module "vpc1" {
122+
source = "terraform-aws-modules/vpc/aws"
123+
version = "~> 2.0"
124+
125+
name = "vpc1"
126+
127+
cidr = "10.10.0.0/16"
128+
129+
azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
130+
private_subnets = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
131+
132+
enable_ipv6 = true
133+
private_subnet_assign_ipv6_address_on_creation = true
134+
private_subnet_ipv6_prefixes = [0, 1, 2]
135+
}

‎examples/multi-account/outputs.tf‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
// aws_ec2_transit_gateway
2+
output "this_ec2_transit_gateway_arn" {
3+
description = "EC2 Transit Gateway Amazon Resource Name (ARN)"
4+
value = module.tgw.this_ec2_transit_gateway_arn
5+
}
6+
7+
output "this_ec2_transit_gateway_association_default_route_table_id" {
8+
description = "Identifier of the default association route table"
9+
value = module.tgw.this_ec2_transit_gateway_association_default_route_table_id
10+
}
11+
12+
output "this_ec2_transit_gateway_id" {
13+
description = "EC2 Transit Gateway identifier"
14+
value = module.tgw.this_ec2_transit_gateway_id
15+
}
16+
17+
output "this_ec2_transit_gateway_owner_id" {
18+
description = "Identifier of the AWS account that owns the EC2 Transit Gateway"
19+
value = module.tgw.this_ec2_transit_gateway_owner_id
20+
}
21+
22+
output "this_ec2_transit_gateway_propagation_default_route_table_id" {
23+
description = "Identifier of the default propagation route table"
24+
value = module.tgw.this_ec2_transit_gateway_propagation_default_route_table_id
25+
}
26+
27+
output "this_ec2_transit_gateway_route_table_default_association_route_table" {
28+
description = "Boolean whether this is the default association route table for the EC2 Transit Gateway"
29+
value = module.tgw.this_ec2_transit_gateway_route_table_default_association_route_table
30+
}
31+
32+
output "this_ec2_transit_gateway_route_table_default_propagation_route_table" {
33+
description = "Boolean whether this is the default propagation route table for the EC2 Transit Gateway"
34+
value = module.tgw.this_ec2_transit_gateway_route_table_default_propagation_route_table
35+
}
36+
37+
// aws_ec2_transit_gateway_route_table
38+
output "this_ec2_transit_gateway_route_table_id" {
39+
description = "EC2 Transit Gateway Route Table identifier"
40+
value = module.tgw.this_ec2_transit_gateway_route_table_id
41+
}
42+
43+
// aws_ec2_transit_gateway_route
44+
output "this_ec2_transit_gateway_route_ids" {
45+
description = "List of EC2 Transit Gateway Route Table identifier combined with destination"
46+
value = module.tgw.this_ec2_transit_gateway_route_ids
47+
}
48+
49+
// aws_ec2_transit_gateway_vpc_attachment
50+
output "this_ec2_transit_gateway_vpc_attachment_ids" {
51+
description = "List of EC2 Transit Gateway VPC Attachment identifiers"
52+
value = module.tgw.this_ec2_transit_gateway_vpc_attachment_ids
53+
}
54+
55+
output "this_ec2_transit_gateway_vpc_attachment" {
56+
description = "Map of EC2 Transit Gateway VPC Attachment attributes"
57+
value = module.tgw.this_ec2_transit_gateway_vpc_attachment
58+
}
59+
60+
// aws_ec2_transit_gateway_route_table_association
61+
output "this_ec2_transit_gateway_route_table_association_ids" {
62+
description = "List of EC2 Transit Gateway Route Table Association identifiers"
63+
value = module.tgw.this_ec2_transit_gateway_route_table_association_ids
64+
}
65+
66+
output "this_ec2_transit_gateway_route_table_association" {
67+
description = "Map of EC2 Transit Gateway Route Table Association attributes"
68+
value = module.tgw.this_ec2_transit_gateway_route_table_association
69+
}
70+
71+
// aws_ec2_transit_gateway_route_table_propagation
72+
output "this_ec2_transit_gateway_route_table_propagation_ids" {
73+
description = "List of EC2 Transit Gateway Route Table Propagation identifiers"
74+
value = module.tgw.this_ec2_transit_gateway_route_table_propagation_ids
75+
}
76+
77+
output "this_ec2_transit_gateway_route_table_propagation" {
78+
description = "Map of EC2 Transit Gateway Route Table Propagation attributes"
79+
value = module.tgw.this_ec2_transit_gateway_route_table_propagation
80+
}
81+
82+
// aws_ram_resource_share
83+
output "this_ram_resource_share_id" {
84+
description = "The Amazon Resource Name (ARN) of the resource share"
85+
value = module.tgw.this_ram_resource_share_id
86+
}
87+
88+
// aws_ram_principal_association
89+
output "this_ram_principal_association_id" {
90+
description = "The Amazon Resource Name (ARN) of the Resource Share and the principal, separated by a comma"
91+
value = module.tgw.this_ram_principal_association_id
92+
}

‎main.tf‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ resource "aws_ec2_transit_gateway_route" "this" {
6767
resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
6868
for_each = var.vpc_attachments
6969

70-
transit_gateway_id = lookup(each.value, "tgw_id", aws_ec2_transit_gateway.this[0].id)
70+
transit_gateway_id = lookup(each.value, "tgw_id", var.create_tgw ? aws_ec2_transit_gateway.this[0].id : null)
7171
vpc_id = each.value["vpc_id"]
7272
subnet_ids = each.value["subnet_ids"]
7373

@@ -132,3 +132,9 @@ resource "aws_ram_principal_association" "this" {
132132
principal = var.ram_principals[count.index]
133133
resource_share_arn = aws_ram_resource_share.this[0].arn
134134
}
135+
136+
resource "aws_ram_resource_share_accepter" "this" {
137+
count = ! var.create_tgw && var.share_tgw ? 1 : 0
138+
139+
share_arn = var.ram_resource_share_arn
140+
}

‎variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,3 +121,9 @@ variable "ram_principals" {
121121
type = list(string)
122122
default = []
123123
}
124+
125+
variable "ram_resource_share_arn" {
126+
description = "ARN of RAM resource share"
127+
type = string
128+
default = ""
129+
}

‎versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@ terraform {
22
required_version = ">= 0.12.7, < 0.14"
33

44
required_providers {
5-
aws = ">= 2.18, < 4.0"
5+
aws = ">= 2.24, < 4.0"
66
}
77
}

0 commit comments

Comments
 (0)