Pe 4375 add gwlb

.spacelift/config.yml

@@ -1,3 +1,3 @@
 version: 1
 
-module_version: 0.3.9
+module_version: 0.4.0

downstream_changes.md

@@ -16,6 +16,18 @@ There are two main changes from the upstream code that are worth discussing:
   - By having this code here, we ensure the TGW Attachment subnets are created with the same logic as the other subnets, and at the same time
 
 ## List of Changes
+- **v0.4.0 GWLB Subnet for non web traffic [PE-4374](https://axelspringer.atlassian.net/browse/PE-4374)**
+  - Add allowed principal to the GWLB Service Endpoint in the central VPC
+  - Allocate a /25 CIDR from IPAM for the GWLB subnet
+  - Create a GWLB subnet for the endpoints
+  - Create a route table for GWLB subnet
+    - 0.0.0.0/0 -> IGW
+    - VPC_CIDR -> local
+  - Create one GWLB endpoint in every GWLB subnet
+  - Create ingress route table 
+    - Public subnet -> 1 GWLB endpoint in the same AZ
+    - VPC_CIDR -> local
+
 
 - **Transit Gateway Attachment Subnet Creation** - [tgw.tf](./tgw.tf)
   - We now have a separate file that creates

examples/complete/main.tf

@@ -26,7 +26,7 @@ module "vpc" {
   source = "../../"
 
   name_prefix = local.name
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs                 = local.azs
   private_subnets     = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]

examples/ipv6-dualstack/main.tf

@@ -26,7 +26,7 @@ module "vpc" {
   source = "../.."
 
   name_prefix = local.name
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs              = local.azs
   private_subnets  = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]

examples/issues/main.tf

@@ -25,7 +25,7 @@ module "vpc_issue_44" {
   source = "../../"
 
   name_prefix = "asymmetrical"
-  cidr = "10.0.0.0/16"
+  cidr        = "10.0.0.0/16"
 
   azs              = local.azs
   private_subnets  = ["10.0.1.0/24"]
@@ -49,7 +49,7 @@ module "vpc_issue_46" {
   source = "../../"
 
   name_prefix = "no-private-subnets"
-  cidr = "10.0.0.0/16"
+  cidr        = "10.0.0.0/16"
 
   azs                 = local.azs
   public_subnets      = ["10.0.0.0/22", "10.0.4.0/22", "10.0.8.0/22"]
@@ -75,7 +75,7 @@ module "vpc_issue_108" {
   source = "../../"
 
   name_prefix = "route-already-exists"
-  cidr = "10.0.0.0/16"
+  cidr        = "10.0.0.0/16"
 
   azs             = local.azs
   private_subnets = ["10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24"]

examples/network-acls/main.tf

@@ -175,7 +175,7 @@ module "vpc" {
   source = "../../"
 
   name_prefix = local.name
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs                 = local.azs
   private_subnets     = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]

examples/outpost/main.tf

@@ -125,7 +125,7 @@ module "vpc" {
   source = "../../"
 
   name_prefix = local.name
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]

examples/secondary-cidr-blocks/main.tf

@@ -27,7 +27,7 @@ module "vpc" {
   source = "../../"
 
   name_prefix = local.name
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   secondary_cidr_blocks = local.secondary_cidr_blocks # can add up to 5 total CIDR blocks
 

examples/separate-route-tables/main.tf

@@ -26,7 +26,7 @@ module "vpc" {
   source = "../../"
 
   name_prefix = local.name
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs                 = local.azs
   private_subnets     = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]

examples/simple/main.tf

@@ -26,7 +26,7 @@ module "vpc" {
   source = "../../"
 
   name_prefix = local.name
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

examples/vpc-flow-logs/main.tf

@@ -28,7 +28,7 @@ module "vpc_with_flow_logs_s3_bucket" {
   source = "../../"
 
   name_prefix = local.name
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
@@ -45,7 +45,7 @@ module "vpc_with_flow_logs_s3_bucket_parquet" {
   source = "../../"
 
   name_prefix = "${local.name}-parquet"
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
@@ -64,7 +64,7 @@ module "vpc_with_flow_logs_cloudwatch_logs_default" {
   source = "../../"
 
   name_prefix = "${local.name}-cloudwatch-logs-default"
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
@@ -88,7 +88,7 @@ module "vpc_with_flow_logs_cloudwatch_logs_prefix" {
   source = "../../"
 
   name_prefix = "${local.name}-cloudwatch-logs-prefix"
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
@@ -117,7 +117,7 @@ module "vpc_with_flow_logs_cloudwatch_logs" {
   source = "../../"
 
   name_prefix = "${local.name}-cloudwatch-logs"
-  cidr = local.vpc_cidr
+  cidr        = local.vpc_cidr
 
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]

gwlb.tf

@@ -0,0 +1,25 @@
+################################################################################
+# GWLB
+################################################################################
+
+data "aws_vpc_endpoint_service" "gwlb_endpoint_service" {
+  provider = aws.ocp_inspection_network
+  filter {
+    name   = "tag:Name"
+    values = [local.inspection-gwlb-endpoint-service]
+  }
+}
+
+resource "aws_vpc_endpoint_service_allowed_principal" "allow_other_account" {
+  provider = aws.ocp_inspection_network
+
+  count                   = local.create_gwlb ? 1 : 0
+  vpc_endpoint_service_id = data.aws_vpc_endpoint_service.gwlb_endpoint_service.service_id
+  principal_arn           = "arn:aws:iam::${var.target_account_id}:root"
+}
+
+output "gwlb_endpoint_service" {
+  value       = data.aws_vpc_endpoint_service.gwlb_endpoint_service.id
+  description = "The ID of the GWLB endpoint service"
+
+}