vpc-peering-nat-example/ec2.tf at main · ReversecLabs/vpc-peering-nat-example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
data "aws_ami" "ubuntu" {
    most_recent = true

    filter {
        name   = "name"
        values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
    }

    filter {
        name   = "virtualization-type"
        values = ["hvm"]
    }
    owners = ["099720109477"] # Canonical
}

resource "aws_key_pair" "vpc1_bastion_key" {
    key_name = "bastion-key"
    public_key = var.public_key
}

resource "aws_instance" "vpc1_bastion" {
    ami           = data.aws_ami.ubuntu.id
    instance_type = "t3.micro"

    associate_public_ip_address = true
    subnet_id = aws_subnet.vpc1_subnet[1].id
    vpc_security_group_ids = [aws_security_group.vpc1_bastion_sg.id]
    key_name = aws_key_pair.vpc1_bastion_key.id

    tags = {
        Name = "vpc1-bastion"
    }
}

resource "aws_instance" "vpc2_instances" {
    count         = 2
    ami           = data.aws_ami.ubuntu.id
    instance_type = "t3.micro"

    associate_public_ip_address = false
    subnet_id = aws_subnet.vpc2_subnet[count.index].id
    vpc_security_group_ids = [aws_security_group.vpc2_instance_sg.id]

    tags = {
        Name = "vpc2-instance-${count.index+1}"
    }
}

resource "aws_security_group" "vpc1_bastion_sg" {
    name = "bastion-host-sg"
    vpc_id = aws_vpc.peered_vpc[0].id
}

resource "aws_vpc_security_group_ingress_rule" "allow_ssh" {
    security_group_id = aws_security_group.vpc1_bastion_sg.id
    from_port = 22
    to_port = 22
    ip_protocol = "tcp"
    cidr_ipv4 = var.ssh_cidr
}

resource "aws_vpc_security_group_egress_rule" "allow_all" {
    security_group_id = aws_security_group.vpc1_bastion_sg.id
    ip_protocol = -1
    cidr_ipv4 = "0.0.0.0/0"
}

resource "aws_security_group" "vpc2_instance_sg" {
    name = "vpc2-instance-sg"
    vpc_id = aws_vpc.peered_vpc[1].id
}

resource "aws_vpc_security_group_ingress_rule" "allow_peered_vpc" {
    security_group_id = aws_security_group.vpc2_instance_sg.id
    ip_protocol = -1
    cidr_ipv4 = var.vpc_cidrs[0]
}