Skip to content

Commit b99a234

Browse files
maxsxumaxsxu
authored
feat(aws): add private link module (#92)
### Motivation For support Customer setup private link to connect the private Pulsar Cluster endpoint. ### Modifications - Add module `aws/private-link` - Change the folder structure to keep consist with GPC/Azure, moved to module `aws/vendor-access` ### Verification Applied locally. ```hcl module "aws_private_link" { source = "github.com/streamnative/terraform-managed-cloud//modules/aws/private-link?ref=max/aws-private-link" region = "region" vpc_id = "vpc-id" subnet_ids = ["subnet-id"] service_name = "com.amazonaws.vpce.region.vpce-svc-name" } ``` ### ⚠️ Caveats After this PR, AWS user need change to use `github.com/streamnative/terraform-managed-cloud//modules/aws/vendor-access` for vendor access source.
1 parent 7514c41 commit b99a234

16 files changed

+402
-1561
lines changed

‎modules/aws/README.md

Lines changed: 0 additions & 1561 deletions
This file was deleted.

‎modules/aws/private-link/README.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# StreamNative Cloud - Managed AWS Private Link
2+
3+
This Terraform module configures your AWS network to access private StreamNative BYOC pulsar service.
4+
5+
# QuickStart
6+
Run the following terraform file with AWS Configuration:
7+
8+
```hcl
9+
module "aws_private_link" {
10+
source = "github.com/streamnative/terraform-managed-cloud//modules/aws/private-link?ref=main"
11+
12+
region = "region"
13+
vpc_id = "vpc-id"
14+
subnet_ids = ["subnet-id"]
15+
service_name = "com.amazonaws.vpce.region.vpce-svc-name"
16+
}
17+
```
18+
19+
1. Run `terraform init`
20+
2. Run `terraform plan`
21+
3. Run `terraform apply`
22+
23+
<!-- BEGIN_TF_DOCS -->
24+
## Requirements
25+
26+
| Name | Version |
27+
|------|---------|
28+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
29+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.30 |
30+
31+
## Providers
32+
33+
| Name | Version |
34+
|------|---------|
35+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.30 |
36+
37+
## Modules
38+
39+
No modules.
40+
41+
## Resources
42+
43+
| Name | Type |
44+
|------|------|
45+
| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
46+
| [aws_security_group_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
47+
| [aws_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
48+
| [aws_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
49+
50+
## Inputs
51+
52+
| Name | Description | Type | Default | Required |
53+
|------|-------------|------|---------|:--------:|
54+
| <a name="input_name"></a> [name](#input\_name) | The endpoint name | `string` | `""` | no |
55+
| <a name="input_region"></a> [region](#input\_region) | The region of vpc endpoint service. The VPC Endpoint must be the same region as Endpoint Service | `string` | n/a | yes |
56+
| <a name="input_security_group_ids"></a> [security\_group\_ids](#input\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface. If unspecified, will auto-create one | `list(string)` | `null` | no |
57+
| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | The vpc endpoint service name | `string` | n/a | yes |
58+
| <a name="input_subnet_ids"></a> [subnet\_ids](#input\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for the endpoint. Must be the same AZ as Endpoint Service. | `list(string)` | n/a | yes |
59+
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | The ID of the VPC in which the endpoint will be used | `string` | n/a | yes |
60+
61+
## Outputs
62+
63+
| Name | Description |
64+
|------|-------------|
65+
| <a name="output_vpc_endpoint_arn"></a> [vpc\_endpoint\_arn](#output\_vpc\_endpoint\_arn) | n/a |
66+
| <a name="output_vpc_endpoint_state"></a> [vpc\_endpoint\_state](#output\_vpc\_endpoint\_state) | n/a |
67+
<!-- END_TF_DOCS -->

‎modules/aws/private-link/main.tf

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
provider "aws" {
2+
region = var.region
3+
}
4+
5+
data "aws_vpc" "this" {
6+
id = var.vpc_id
7+
}
8+
9+
locals {
10+
security_group_ids = coalescelist(var.security_group_ids, aws_security_group.this[*].id)
11+
12+
security_group_rules = {
13+
ingress_https = {
14+
type = "ingress"
15+
protocol = "tcp"
16+
from_port = 0
17+
to_port = 65535
18+
cidr_blocks = data.aws_vpc.this.cidr_block_associations.*.cidr_block
19+
description = "Allow access from VPC"
20+
}
21+
egress_http = {
22+
type = "egress"
23+
protocol = "tcp"
24+
from_port = 80
25+
to_port = 80
26+
cidr_blocks = data.aws_vpc.this.cidr_block_associations.*.cidr_block
27+
description = "HTTP to VPC"
28+
}
29+
egress_https = {
30+
type = "egress"
31+
protocol = "tcp"
32+
from_port = 443
33+
to_port = 443
34+
cidr_blocks = data.aws_vpc.this.cidr_block_associations.*.cidr_block
35+
description = "HTTPS to VPC"
36+
}
37+
egress_broker_tls = {
38+
type = "egress"
39+
protocol = "tcp"
40+
from_port = 6651
41+
to_port = 6651
42+
cidr_blocks = data.aws_vpc.this.cidr_block_associations.*.cidr_block
43+
description = "Broker TLS to VPC"
44+
}
45+
egress_kafka_tls = {
46+
type = "egress"
47+
protocol = "tcp"
48+
from_port = 9093
49+
to_port = 9093
50+
cidr_blocks = data.aws_vpc.this.cidr_block_associations.*.cidr_block
51+
description = "Kafka TLS to VPC"
52+
}
53+
egress_amqp_tls = {
54+
type = "egress"
55+
protocol = "tcp"
56+
from_port = 5671
57+
to_port = 5671
58+
cidr_blocks = data.aws_vpc.this.cidr_block_associations.*.cidr_block
59+
description = "AMQP TLS to VPC"
60+
}
61+
egress_mqtt_tls = {
62+
type = "egress"
63+
protocol = "tcp"
64+
from_port = 8883
65+
to_port = 8883
66+
cidr_blocks = data.aws_vpc.this.cidr_block_associations.*.cidr_block
67+
description = "MQTT TLS to VPC"
68+
}
69+
egress_status = {
70+
type = "egress"
71+
protocol = "tcp"
72+
from_port = 15021
73+
to_port = 15021
74+
cidr_blocks = data.aws_vpc.this.cidr_block_associations.*.cidr_block
75+
description = "Status to VPC"
76+
}
77+
}
78+
}
79+
80+
resource "aws_vpc_endpoint" "this" {
81+
vpc_id = var.vpc_id
82+
subnet_ids = var.subnet_ids
83+
service_name = var.service_name
84+
security_group_ids = local.security_group_ids
85+
86+
vpc_endpoint_type = "Interface"
87+
private_dns_enabled = true
88+
auto_accept = true
89+
90+
tags = {
91+
"Name" = coalesce(var.name, var.service_name)
92+
}
93+
}
94+
95+
resource "aws_security_group" "this" {
96+
count = var.security_group_ids == null ? 1 : 0
97+
98+
name_prefix = var.service_name
99+
vpc_id = var.vpc_id
100+
description = "For access vpc endpoint service ${var.service_name}"
101+
102+
tags = {
103+
"Name" = var.service_name
104+
}
105+
106+
lifecycle {
107+
create_before_destroy = true
108+
}
109+
}
110+
111+
resource "aws_security_group_rule" "this" {
112+
for_each = { for k, v in local.security_group_rules : k => v if var.security_group_ids == null }
113+
114+
security_group_id = aws_security_group.this[0].id
115+
type = each.value.type
116+
protocol = each.value.protocol
117+
from_port = each.value.from_port
118+
to_port = each.value.to_port
119+
cidr_blocks = each.value.cidr_blocks
120+
description = each.value.description
121+
}

‎modules/aws/private-link/outputs.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "vpc_endpoint_arn" {
2+
value = aws_vpc_endpoint.this.arn
3+
}
4+
5+
output "vpc_endpoint_state" {
6+
value = aws_vpc_endpoint.this.state
7+
}

‎modules/aws/private-link/variables.tf

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
variable "region" {
2+
type = string
3+
description = "The region of vpc endpoint service. The VPC Endpoint must be the same region as Endpoint Service"
4+
}
5+
6+
variable "vpc_id" {
7+
type = string
8+
description = "The ID of the VPC in which the endpoint will be used"
9+
}
10+
11+
variable "subnet_ids" {
12+
type = list(string)
13+
description = "The ID of one or more subnets in which to create a network interface for the endpoint. Must be the same AZ as Endpoint Service."
14+
}
15+
16+
variable "service_name" {
17+
type = string
18+
description = "The vpc endpoint service name"
19+
}
20+
21+
variable "security_group_ids" {
22+
type = list(string)
23+
default = null
24+
description = "The ID of one or more security groups to associate with the network interface. If unspecified, will auto-create one"
25+
}
26+
27+
variable "name" {
28+
type = string
29+
default = ""
30+
description = "The endpoint name"
31+
}

‎modules/aws/private-link/versions.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.30"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)