Skip to content

feat: Add enhanced region support #1225

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Sep 22, 2025
Merged

feat: Add enhanced region support #1225

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c78c640
chore: pre-commit autoupdate
nightspotlight Jul 16, 2025
ef24f75
feat: add support for region (Enhanced Region Support)
nightspotlight Jul 16, 2025
9fb0730
feat: add support for region in `vpc-endpoints` module
nightspotlight Jul 16, 2025
dc91032
Use `region` variable in `aws_vpc_endpoint_service` data source
nightspotlight Jul 21, 2025
a77de68
Workaround for service endpoint lookup in the wrong region
nightspotlight Jul 22, 2025
28d67e2
Add `simple-regions` example
nightspotlight Aug 20, 2025
103fa59
Explain region limitations in `vpc-endpoints` sub-module
nightspotlight Aug 20, 2025
b088ef2
fix: Remove example, fix logic for VPC endpoints regional usage
bryantbiggs Sep 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
repos:
- repo: https://github.com/antonbabenko/pre-commit-terraform
rev: v1.99.0
rev: v1.99.5
hooks:
- id: terraform_fmt
- id: terraform_docs
Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -579,6 +579,7 @@ No modules.
| <a name="input_redshift_subnet_suffix"></a> [redshift\_subnet\_suffix](#input\_redshift\_subnet\_suffix) | Suffix to append to redshift subnets name | `string` | `"redshift"` | no |
| <a name="input_redshift_subnet_tags"></a> [redshift\_subnet\_tags](#input\_redshift\_subnet\_tags) | Additional tags for the redshift subnets | `map(string)` | `{}` | no |
| <a name="input_redshift_subnets"></a> [redshift\_subnets](#input\_redshift\_subnets) | A list of redshift subnets inside the VPC | `list(string)` | `[]` | no |
| <a name="input_region"></a> [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the region set in the provider configuration | `string` | `null` | no |
| <a name="input_reuse_nat_ips"></a> [reuse\_nat\_ips](#input\_reuse\_nat\_ips) | Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external\_nat\_ip\_ids' variable | `bool` | `false` | no |
| <a name="input_secondary_cidr_blocks"></a> [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
| <a name="input_single_nat_gateway"></a> [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` | `false` | no |
Expand Down
148 changes: 148 additions & 0 deletions main.tf
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions modules/vpc-endpoints/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,7 @@ No modules.
| <a name="input_create"></a> [create](#input\_create) | Determines whether resources will be created | `bool` | `true` | no |
| <a name="input_create_security_group"></a> [create\_security\_group](#input\_create\_security\_group) | Determines if a security group is created | `bool` | `false` | no |
| <a name="input_endpoints"></a> [endpoints](#input\_endpoints) | A map of interface and/or gateway endpoints containing their properties and configurations | `any` | `{}` | no |
| <a name="input_region"></a> [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the region set in the provider configuration | `string` | `null` | no |
| <a name="input_security_group_description"></a> [security\_group\_description](#input\_security\_group\_description) | Description of the security group created | `string` | `null` | no |
| <a name="input_security_group_ids"></a> [security\_group\_ids](#input\_security\_group\_ids) | Default security group IDs to associate with the VPC endpoints | `list(string)` | `[]` | no |
| <a name="input_security_group_name"></a> [security\_group\_name](#input\_security\_group\_name) | Name to use on security group created. Conflicts with `security_group_name_prefix` | `string` | `null` | no |
Expand Down
8 changes: 7 additions & 1 deletion modules/vpc-endpoints/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ data "aws_vpc_endpoint_service" "this" {

service = try(each.value.service, null)
service_name = try(each.value.service_name, null)
service_regions = try(coalescelist(compact([each.value.service_region])), null)
service_regions = try(coalescelist(compact([each.value.service_region])), [var.region], null)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't work…

│ Error: reading EC2 VPC Endpoint Services: couldn't find resource
│ 
│   with module.endpoints["emea"].data.aws_vpc_endpoint_service.this["secretsmanager"],
│   on .terraform/modules/endpoints/modules/vpc-endpoints/main.tf line 11, in data "aws_vpc_endpoint_service" "this":
│   11: data "aws_vpc_endpoint_service" "this" {

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The vpc_endpoint_service data source doesn't support the region parameter in v6.4.0. So it seems like it's going to the provider-set region, and so it's unable to find the service endpoint from a different region.

I just found the list of non-region-aware resources, and the aws_vpc_endpoint_service data source is one of them… 😟 https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/enhanced-region-support#non%E2%80%93region-aware-resources

Copy link
Contributor Author

@nightspotlight nightspotlight Jul 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I was able to get it to work but had to alter the endpoints map a little and had to add a new input variable in the module.

Before:

  endpoints = {
    s3 = {
      service = "s3"
      # …
    }
  }

After:

  enable_service_endpoint_lookup = false
  endpoints = {
    s3 = {
      service_endpoint = "com.amazonaws.${each.value.aws_region}.s3"
      service_region   = each.value.aws_region
      # …
    }
  }

The enable_service_endpoint_lookup switch effectively disables the aws_vpc_endpoint_service data source (default is enabled).

I need to work out and add some example scripts.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated examples and readmes


filter {
name = "service-type"
Expand All @@ -24,6 +24,8 @@ data "aws_vpc_endpoint_service" "this" {
resource "aws_vpc_endpoint" "this" {
for_each = local.endpoints

region = var.region

vpc_id = var.vpc_id
service_name = try(each.value.service_endpoint, data.aws_vpc_endpoint_service.this[each.key].service_name)
service_region = try(each.value.service_region, null)
Expand Down Expand Up @@ -76,6 +78,8 @@ resource "aws_vpc_endpoint" "this" {
resource "aws_security_group" "this" {
count = var.create && var.create_security_group ? 1 : 0

region = var.region

name = var.security_group_name
name_prefix = var.security_group_name_prefix
description = var.security_group_description
Expand All @@ -95,6 +99,8 @@ resource "aws_security_group" "this" {
resource "aws_security_group_rule" "this" {
for_each = { for k, v in var.security_group_rules : k => v if var.create && var.create_security_group }

region = var.region

# Required
security_group_id = aws_security_group.this[0].id
protocol = try(each.value.protocol, "tcp")
Expand Down
6 changes: 6 additions & 0 deletions modules/vpc-endpoints/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,12 @@ variable "create" {
default = true
}

variable "region" {
description = "Region where the resource(s) will be managed. Defaults to the region set in the provider configuration"
type = string
default = null
}

variable "vpc_id" {
description = "The ID of the VPC in which the endpoint will be used"
type = string
Expand Down
6 changes: 6 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,12 @@ variable "create_vpc" {
default = true
}

variable "region" {
description = "Region where the resource(s) will be managed. Defaults to the region set in the provider configuration"
type = string
default = null
}

variable "name" {
description = "Name to be used on all the resources as identifier"
type = string
Expand Down
6 changes: 6 additions & 0 deletions vpc-flow-logs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
data "aws_region" "current" {
# Call this API only if create_vpc and enable_flow_log are true
count = var.create_vpc && var.enable_flow_log ? 1 : 0

region = var.region
}

data "aws_caller_identity" "current" {
Expand Down Expand Up @@ -36,6 +38,8 @@ locals {
resource "aws_flow_log" "this" {
count = local.enable_flow_log ? 1 : 0

region = var.region

log_destination_type = var.flow_log_destination_type
log_destination = local.flow_log_destination_arn
log_format = var.flow_log_log_format
Expand Down Expand Up @@ -65,6 +69,8 @@ resource "aws_flow_log" "this" {
resource "aws_cloudwatch_log_group" "flow_log" {
count = local.create_flow_log_cloudwatch_log_group ? 1 : 0

region = var.region

name = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
kms_key_id = var.flow_log_cloudwatch_log_group_kms_key_id
Expand Down