aws-network-hub-for-terraform
所属分类：DevOps
开发工具：HCL
文件大小：0KB
下载次数：0
上传日期：2023-05-06 18:05:33
上 传 者：
sh-1993
说明： 该存储库为使用Terraform的多客户组织演示了一个可扩展、隔离、安全的AWS网络中心。
(This repository demonstrates a scalable, segregated, secured AWS network hub for multi-account organizations using Terraform.)
文件列表:
.terraform-docs.yml (255, 2022-06-15)
.terraform.lock.hcl (1237, 2022-06-15)
CODE_OF_CONDUCT.md (309, 2022-06-15)
CONTRIBUTING.md (3160, 2022-06-15)
LICENSE (926, 2022-06-15)
backend.tf (584, 2022-06-15)
config.auto.tfvars (970, 2022-06-15)
data.tf (265, 2022-06-15)
example-spoke-vpc/ (0, 2022-06-15)
example-spoke-vpc/.terraform-docs.yml (255, 2022-06-15)
example-spoke-vpc/backend.tf (584, 2022-06-15)
example-spoke-vpc/config.auto.tfvars (1073, 2022-06-15)
example-spoke-vpc/data.tf (708, 2022-06-15)
example-spoke-vpc/images/ (0, 2022-06-15)
example-spoke-vpc/images/IPAM_Delegated.png (47215, 2022-06-15)
example-spoke-vpc/images/RAM_Enabled.png (13559, 2022-06-15)
example-spoke-vpc/images/backend.png (63831, 2022-06-15)
example-spoke-vpc/images/diagram.png (219805, 2022-06-15)
example-spoke-vpc/images/dns.png (178874, 2022-06-15)
example-spoke-vpc/images/http_backend.png (85174, 2022-06-15)
example-spoke-vpc/images/iam_tag.png (47769, 2022-06-15)
example-spoke-vpc/images/nfw.png (161096, 2022-06-15)
example-spoke-vpc/images/provider.png (30721, 2022-06-15)
example-spoke-vpc/images/tgw.png (169916, 2022-06-15)
example-spoke-vpc/images/vpce.png (187751, 2022-06-15)
example-spoke-vpc/locals.tf (835, 2022-06-15)
example-spoke-vpc/main.tf (1220, 2022-06-15)
example-spoke-vpc/modules/ (0, 2022-06-15)
example-spoke-vpc/modules/dns/ (0, 2022-06-15)
example-spoke-vpc/modules/dns/.terraform-docs.yml (225, 2022-06-15)
example-spoke-vpc/modules/dns/data.tf (799, 2022-06-15)
example-spoke-vpc/modules/dns/dns.tf (1557, 2022-06-15)
example-spoke-vpc/modules/dns/provider.tf (305, 2022-06-15)
example-spoke-vpc/modules/dns/variables.tf (803, 2022-06-15)
example-spoke-vpc/modules/network/ (0, 2022-06-15)
example-spoke-vpc/modules/network/.terraform-docs.yml (233, 2022-06-15)
example-spoke-vpc/modules/network/data.tf (247, 2022-06-15)
... ...
# Network Hub Account with Terraform
This repository demonstrates a **scalable, segregated, secured** AWS network for **multi-account organizations**.
Using Transit Gateway to separate production, non-production and shared services traffic,
it deploys an advanced AWS networking pattern using centralized ingress and egress behind Network Firewall,
centralizes private VPC endpoints to share across all VPCs, and manages IP address allocation using Amazon VPC IPAM.
- Perfect for a central networking hub account, potentially alongside Account Factory for Terraform
- Solution itself can be deployed into nonprod, test and production deployments for safe iteration and testing.
- Written using clean, composable modules: the solution is easily extended and customised.
[Spoke VPCs for organization members can be created using the provided sister example in this repo.](https://github.com/example-spoke-vpc/README.md)
The following resources will be deployed by this example:
- VPC Transit Gateway
- VPC Endpoints
- AWS Network Firewall
- Route 53 Resolver
- Amazon VPC IP Address Manager
The resources deployed and the architectural pattern they follow are provided for demonstration and
testing purposes but are based on and inspired by AWS best practice and articles.
## Table of Contents
- [Overview](https://github.com#overview)
- [Diagrams](https://github.com#diagrams)
- [References](https://github.com#references)
- [Prerequisites](https://github.com#prerequisites)
- [Variables](https://github.com#variables)
- [Quick Start](https://github.com#quick-start)
- [Deploy from client machine](https://github.com#deploy-from-client-machine)
- [Validate Deployment](https://github.com#validate-deployment)
- [Tagging](https://github.com#tagging)
- [clean Up](https://github.com#clean-up)
- [Terraform Docs](https://github.com#terraform-docs)
- [Security](https://github.com#security)
- [License](https://github.com#license)
## Overview
### Diagrams
Solution Diagram
Transit Gateway
VPC Endpoints
Network Firewall
Route 53 Resolver
### References
-
-
-
-
-
-
---
## Prerequisites
Minimal tooling is required for this solution. However, there are hard requirements around
AWS configuration.
### Tooling
- Terraform ~> 1.1
- AWS provider >= 4.4.0
- AWS CLI
- Git CLI
### AWS account configuration
- AWS Organization
- Centralised network account
- IAM role with required permissions
- RAM sharing enabled for the Organisation
```bash
aws ram enable-sharing-with-aws-organization
```
**Troubleshooting tip**
If you experience any issue with the RAM share disable and re-enable RAM.
```bash
aws organizations disable-aws-service-access --service-principal ram.amazonaws.com
```
- IPAM delegated from the master account to the Centralised network account
```bash
aws ec2 enable-ipam-organization-admin-account \
--delegated-admin-account-id
```
### Customisation
If you do not define a remote backend Terraform will use the local directory to store the backend files
including tfstate. Examples of how to customise the Terraform backend are included but commented out.
Usual caveats around safe storage of Terraform state must be considered.
Example GitLab HTTP backend for use with GitLab CI.
### Variables
| Type | Variable Name | Description | Notes |
| ------------------------------ | ---------------- | ---------------------------------------------------------------- | ------------------------------------------- |
| Global variables | environment | Environment to deploy into. | Accepted values \* dev, test, preprod, prod |
| | aws_region | Region to deploy in. | |
| | vpc_endpoints | List of centralised VPC endpoints to be deployed | |
| Environment specific variables | ipam_cidr | CIDR to be allocated to the IP Address Manager | |
| | tgw_route_tables | Transit Gateway Router Tables to create | |
| | root_domain | Root DNS domain to create private hosted zone and resolver rules | |
**Input Variable -** _config.auto.tfvars_
```terraform
aws_region = "eu-west-2"
vpc_endpoints = ["ec2", "rds", "sqs", "sns", "ssm", "logs", "ssmmessages", "ec2messages", "autoscaling", "ecs", "athena"]
env_config = {
dev = {
ipam_cidr = "10.0.0.0/10"
tgw_route_tables = ["prod", "dev", "shared"]
root_domain = "network-dev.internal"
}
test = {
ipam_cidr = "10.64.0.0/10"
tgw_route_tables = ["prod", "dev", "shared"]
root_domain = "network-test.internal"
}
preprod = {
ipam_cidr = "10.128.0.0/10"
tgw_route_tables = ["prod", "dev", "shared"]
root_domain = "network-preprod.internal"
}
prod = {
ipam_cidr = "10.192.0.0/10"
tgw_route_tables = ["prod", "dev", "shared"]
root_domain = "network-prod.internal"
}
}
```
---
## Quick Start
### Deploy from client machine
When deploying from your local machine having configured the **TF Backend** in the code you need to ensure you have access to read and write to the backend - possible backends include HTTP, Consul, Postgres, Artifactory, S3 or S3 + DynamoDB. We initialise the Terraform, complete the validate and format. Review the plan and then apply.
- `terraform init`
- `terraform validate`
- set environment for deployment
- `export TF_VAR_environment="$ENV"`
- `Set-Item -Path env:TF_VAR_environment -Value "$ENV"`
(Possible $ENV values - `dev`, `test`, `preprod`, `prod`)
- `terraform plan`
- `terraform apply` **or** `terraform apply --auto-approve`
---
### Tagging
Tags are added to all AWS resources through use of the tag configuration of the AWS Provider.
As not all AWS resources support default tags passed from the provider (EC2 Auto-Scaling Group + Launch Template)
We pass the tags as a variable (Map(string) - these are defined in the root locals.tf file.
**Example Tags -** _locals.tf_
```terraform
tags = {
Product = "Network_Automation"
Owner = "GitHub"
Project_ID = "12345"
}
```
### Clean Up
Remember to clean up after your work is complete. You can do that by doing `terraform destroy`.
Note that this command will delete all the resources previously created by Terraform.
## Terraform Docs
### Terraform Deployment
#### Requirements
| Name | Version |
|------|---------|
| terraform | ~> 1.1 |
| aws | >= 4.4.0 |
#### Providers
| Name | Version |
|------|---------|
| aws | 4.5.0 |
#### Modules
| Name | Source | Version |
|------|--------|---------|
| dns | ./modules/dns | n/a |
| ipam | ./modules/ipam | n/a |
| network_firewall_vpc | ./modules/network_firewall_vpc | n/a |
| tgw | ./modules/tgw | n/a |
| vpc_endpoints | ./modules/vpc_endpoints | n/a |
#### Resources
| Name | Type |
|------|------|
| [aws_iam_policy.central_network](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy_attachment.central_network](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource |
| [aws_iam_role.central_network](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role.flow_logs](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role_policy.flow_logs](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_kms_key.log_key](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
| [aws_availability_zones.available](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
| [aws_caller_identity.current](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_policy_document.policy_kms_logs_document](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_organizations_organization.main](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organization) | data source |
#### Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| aws_region | AWS region being deployed to | `string` | n/a | yes |
| env_config | Map of objects for per environment configuration | map(object({
ipam_cidr = string
tgw_route_tables = list(string)
root_domain = string
})) | n/a | yes |
| environment | Deployment environment passed as argument or environment variable | `string` | n/a | yes |
| tags | Default tags to apply to all resources | `map(string)` | n/a | yes |
| vpc_endpoints | Which VPC endpoints to use | `list(string)` | n/a | yes |
#### Outputs
No outputs.
### TGW Module
#### Requirements
No requirements.
#### Providers
| Name | Version |
|------|---------|
| aws | n/a |
#### Modules
No modules.
#### Resources
| Name | Type |
|------|------|
| [aws_ec2_transit_gateway.org_tgw](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway) | resource |
| [aws_ec2_transit_gateway_route.blackhole_route](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource |
| [aws_ec2_transit_gateway_route.default_route](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource |
| [aws_ec2_transit_gateway_route.default_route_ipv6](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource |
| [aws_ec2_transit_gateway_route_table.org_tgw](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table) | resource |
| [aws_ram_principal_association.org](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_principal_association) | resource |
| [aws_ram_resource_association.tgw](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_association) | resource |
| [aws_ram_resource_share.main](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share) | resource |
#### Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| az_names | A list of the Availability Zone names available to the account | `list(string)` | n/a | yes |
| cidr | Corporate CIDR range for use with blackholing traffic between production and development environments | `string` | n/a | yes |
| environment | Deployment environment passed as argument or environment variable | `string` | n/a | yes |
| inspection_attachment | Inspection VPC attachment for default route | `string` | n/a | yes |
| org_arn | The ARN of the AWS Organization this account belongs to | `string` | n/a | yes |
| tgw_route_tables | List of route tables to create for the transit gateway | `list(string)` | n/a | yes |
#### Outputs
| Name | Description |
|------|-------------|
| tgw | TGW ID for VPC attachments |
| tgw_route_table | Map of route tables used for association and propagation |
### IPAM Module
#### Requirements
No requirements.
#### Providers
| Name | Version |
|------|---------|
| aws | n/a |
#### Modules
No modules.
#### Resources
| Name | Type |
|------|------|
| [aws_ram_principal_association.org](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_principal_association) | resource |
| [aws_ram_resource_association.ipam](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_association) | resource |
| [aws_ram_resource_share.main](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share) | resource |
| [aws_ssm_parameter.ipam_pool_id](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
| [aws_vpc_ipam.org_ipam](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam) | resource |
| [aws_vpc_ipam_pool.private_org_ipam_pool](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_pool) | resource |
| [aws_vpc_ipam_pool_cidr.private_org_ipam_pool](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_pool_cidr) | resource |
| [aws_vpc_ipam_scope.private_org_ipam_scope](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_scope) | resource |
#### Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| aws_region | AWS region being deployed to | `string` | n/a | yes |
| ipam_cidr | CIDR block assigned to IPAM pool | `string` | n/a | yes |
| org_arn | The ARN of the AWS Organization this account belongs to | `string` | n/a | yes |
#### Outputs
| Name | Description |
|------|-------------|
| org_ipam | Org IPAM ID |
| org_ipam_pool | Org IPAM pool ID |
### VPC Endpoint Module
#### Requirements
No requirements.
#### Providers
| Name | Version |
|------|---------|
| aws | n/a |
#### Modules
No modules.
#### Resources
| Name | Type |
|------|------|
| [aws_cloudwatch_log_group.flow_logs](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
| [aws_default_security_group.default](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | resource |
| [aws_ec2_transit_gateway_route_table_association.shared](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_association) | resource |
| [aws_ec2_transit_gateway_route_table_propagation.org](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_propagation) | resource |
| [aws_ec2_transit_gateway_vpc_attachment.vpc_endpoint](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) | resource |
| [aws_flow_log.vpc](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |
| [aws_route.default_route](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
| [aws_route.default_route_ipv6](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
| [aws_route53_record.dev_ns](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
| [aws_route53_zone.interface_phz](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource |
| [aws_route_table.endpoint_vpc](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource |
| [aws_route_table_association.attachment_subnet](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |
| [aws_route_table_association.endpoint_subnet](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |
| [aws_security_group.allow_vpc_endpoint](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
| [aws_security_group_rule.org_cidr](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
| [aws_subnet.attachment_subnet](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
| [aws_subnet.endpoint_subnet](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |
| [aws_vpc.endpoint_vpc](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc) | resource |
| [aws_vpc_dhcp_options.endpoint_vpc](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options) | resource |
| [aws_vpc_dhcp_options_association.endpoint_vpc](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options_association) | resource |
| [aws_vpc_endpoint.interface](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
#### Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| az_names | A list of the Availability Zone names available to the account | `list(string)` | n/a | yes |
| cidr | Corporate CIDR range for use with blackholing traffic between production and development environments | `string` | n/a | yes |
| environment | Deployment environment passed as argument or environment variable | `string` | n/a | yes |
| iam_role_arn | IAM role to allow VPC Flow Logs to write to CloudWatch | `string` | n/a | yes |
| interface_endpoints | Object representing the region and services to create interface endpoints for | `map(string)` | n/a | yes |
| kms_key_id | VPC Flow Logs KMS key to encrypt logs | `string` | n/a | yes |
| org_ipam_pool | IPAM pool ID to allocate CIDR space | `string` | n/a | yes |
| tgw | TGW ID for VPC attachments | `string` | n/a | yes |
| tgw_route_tables | TGW route tables for VPC association and propagation | `map(string)` | n/a | yes |
#### Outputs
No outputs.
### DNS Module
#### Requirements
No requirements.
#### Providers
| Name | Version |
|------|---------|
| aws | n/a |
#### Modules
No modules.
#### Resources
| Name | Type |
|------|------|
| [aws_cloudwatch_log_group.flow_logs](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
| [aws_default_security_group.default](https://github.comhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | reso ... ...
近期下载者：
相关文件：
收藏者：