Add "bug-test" VPC for testing bug 8874

cidr-allocation.md

@@ -108,7 +108,7 @@
 | :---------- | :--- | :------------------------ |
 | 10.231.0.0  | /21  | LAB ONLY garden - general |
 | 10.231.8.0  | /21  | LAB ONLY house - general  |
-| 10.231.16.0 | /21  | -                         |
+| 10.231.16.0 | /21  | LAB ONLY bug - general    |
 | 10.231.24.0 | /21  | -                         |
 | 10.231.32.0 | /21  | -                         |
 |             |      |                           |

environments-networks/bug-sandbox.json

@@ -0,0 +1,18 @@
+{
+    "cidr": {
+      "subnet_sets": {
+        "general": {
+          "cidr": "10.231.16.0/21",
+          "accounts": []
+        }
+      }
+    },
+    "options": {
+      "bastion_linux": true,
+      "additional_cidrs": [],
+      "additional_endpoints": [],
+      "additional_private_zones": [],
+      "additional_vpcs": [],
+      "dns_zone_extend": []
+    }
+  }

policies/networking/expected.rego

@@ -456,6 +456,13 @@ expected :=
         "accounts": [
         ]
       }
+    },
+    "bug-sandbox": {
+      "general": {
+        "cidr": "10.231.16.0/21",
+        "accounts": [
+        ]
     }
   }
 }
+}

terraform/environments/core-vpc/transit-gateway-attachment.tf

@@ -30,7 +30,8 @@ resource "aws_ram_principal_association" "transit_gateway_association" {
 # Attach the VPC to the central Transit Gateway
 module "vpc_attachment" {
   depends_on = [
-    aws_ram_principal_association.transit_gateway_association
+    aws_ram_principal_association.transit_gateway_association,
+    module.vpc
   ]
   for_each = toset(keys(local.vpcs[terraform.workspace]))
   source   = "../../modules/ec2-tgw-attachment"

terraform/environments/core-vpc/vpc.tf

@@ -80,14 +80,20 @@ locals {
 
   modernisation-platform-domain          = "modernisation-platform.service.justice.gov.uk"
   modernisation-platform-internal-domain = "modernisation-platform.internal"
+
+  private_route_tables = merge([
+    for vpc_key, vpc_value in local.vpcs[terraform.workspace] : {
+      for route_table_key, route_table_id in module.vpc[vpc_key].private_route_tables :
+      "${vpc_key}-${route_table_key}" => route_table_id
+    }
+  ]...)
 }
 
 module "vpc" {
   for_each             = local.vpcs[terraform.workspace]
-  source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=1366ebe0812d4c129c0b31cfc5bf2a4b0540672c" # v3.1.0
+  source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
   additional_endpoints = each.value.options.additional_endpoints
   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
-  transit_gateway_id   = data.aws_ec2_transit_gateway.transit-gateway.id
 
   # VPC Flow Logs
   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
@@ -99,13 +105,20 @@ module "vpc" {
 }
 
 module "vpc_nacls" {
-  source           = "../../modules/vpc-nacls"
-  for_each         = local.vpcs[terraform.workspace]
-  additional_cidrs = each.value.options.additional_cidrs
-  additional_vpcs  = each.value.options.additional_vpcs
-  tags             = local.tags
-  tags_prefix      = each.key
-  vpc_name         = each.key
+  depends_on           = [module.vpc]
+  source               = "../../modules/vpc-nacls"
+  for_each             = local.vpcs[terraform.workspace]
+  additional_cidrs     = each.value.options.additional_cidrs
+  additional_vpcs      = each.value.options.additional_vpcs
+  tags                 = local.tags
+  tags_prefix          = each.key
+  vpc_name             = each.key
+  vpc_id               = module.vpc[each.key].vpc_id
+  vpc_cidr             = module.vpc[each.key].vpc_cidr
+  data_subnet_ids      = module.vpc[each.key].data_subnet_ids
+  private_subnet_ids   = module.vpc[each.key].private_subnet_ids
+  protected_subnet_ids = module.vpc[each.key].protected_subnet_ids
+  public_subnet_ids    = module.vpc[each.key].public_subnet_ids
 }
 
 locals {
@@ -121,13 +134,12 @@ locals {
 }
 
 module "resource-share" {
-  source = "../../modules/ram-resource-share"
-  for_each = {
-    for vpc in local.non-tgw-vpc-subnet : "${vpc.key}-${vpc.set}" => vpc
-  }
+  source   = "../../modules/ram-resource-share"
+  for_each = local.vpcs[terraform.workspace]
 
   # Subnet ARNs to attach to a resource share
-  resource_arns = [for key, subnet in each.value.arns : subnet]
+  # resource_arns = [for key, subnet in each.value.arns : subnet]
+  resource_arns = { for idx, arn in module.vpc[each.key].non_tgw_subnet_arns : idx => arn }
 
   # Tags
   tags_common = local.tags
@@ -359,4 +371,17 @@ module "r53_dns_firewall" {
 
   tags_prefix = each.key
   tags_common = local.tags
+}
+
+resource "aws_route" "transit_gateway" {
+
+  depends_on = [
+    module.vpc_attachment,
+    module.vpc
+  ]
+
+  for_each               = local.private_route_tables
+  route_table_id         = each.value
+  destination_cidr_block = "0.0.0.0/0"
+  transit_gateway_id     = data.aws_ec2_transit_gateway.transit-gateway.id
 }

terraform/modules/ram-resource-share/main.tf

@@ -1,3 +1,6 @@
+locals {
+  resource_arns_map = { for idx, arn in var.resource_arns : idx => arn }
+}
 resource "aws_ram_resource_share" "default" {
   name                      = "${var.tags_prefix}-resource-share"
   allow_external_principals = false
@@ -10,7 +13,7 @@ resource "aws_ram_resource_share" "default" {
 }
 
 resource "aws_ram_resource_association" "default" {
-  for_each = toset(var.resource_arns)
+  for_each = var.resource_arns
 
   resource_arn       = each.value
   resource_share_arn = aws_ram_resource_share.default.arn

terraform/modules/ram-resource-share/variables.tf

@@ -10,5 +10,5 @@ variable "tags_prefix" {
 
 variable "resource_arns" {
   description = "Resource ARNs to attach to a resource share"
-  type        = list(string)
+  type        = map(string)
 }

terraform/modules/vpc-nacls/data.tf

@@ -1,9 +1,13 @@
-data "aws_vpc" "current" {
-  filter {
-    name   = "tag:Name"
-    values = [var.vpc_name]
-  }
-}
+# data "aws_vpc" "current" {
+#   filter {
+#     name   = "tag:Name"
+#     values = [var.vpc_name]
+#   }
+# }
+
+# locals {
+#   aws_vpc_current = var.vpc_id
+# }
 
 data "aws_vpc" "external" {
   for_each = toset(var.additional_vpcs)
@@ -13,23 +17,24 @@ data "aws_vpc" "external" {
   }
 }
 
-data "aws_subnets" "subnets_all" {
-  filter {
-    name   = "vpc-id"
-    values = [data.aws_vpc.current.id]
-  }
-}
+# data "aws_subnets" "subnets_all" {
+#   filter {
+#     name = "vpc-id"
+#     # values = [data.aws_vpc.current.id]
+#     values = [var.vpc_id]
+#   }
+# }
 
-data "aws_subnet" "subnets_all" {
-  for_each = toset(data.aws_subnets.subnets_all.ids)
-  id       = each.value
-}
+# data "aws_subnet" "subnets_all" {
+#   for_each = toset(data.aws_subnets.subnets_all.ids)
+#   id       = each.value
+# }
 
 locals {
-  data_subnet_ids      = [for v in data.aws_subnet.subnets_all : v.id if(length(regexall("(?:data)", v.tags.Name)) > 0)]
-  private_subnet_ids   = [for v in data.aws_subnet.subnets_all : v.id if(length(regexall("(?:private)", v.tags.Name)) > 0)]
-  protected_subnet_ids = [for v in data.aws_subnet.subnets_all : v.id if(length(regexall("(?:protected)", v.tags.Name)) > 0)]
-  public_subnet_ids    = [for v in data.aws_subnet.subnets_all : v.id if(length(regexall("(?:public)", v.tags.Name)) > 0)]
+  data_subnet_ids      = var.data_subnet_ids
+  private_subnet_ids   = var.private_subnet_ids
+  protected_subnet_ids = var.protected_subnet_ids
+  public_subnet_ids    = var.public_subnet_ids
 
   external_vpc_cidrs = length(var.additional_vpcs) > 0 ? flatten([
     for v in data.aws_vpc.external : {
@@ -51,7 +56,7 @@ locals {
 
   static_acl_rules = {
     allow_vpc_cidr_in = {
-      cidr_block  = data.aws_vpc.current.cidr_block
+      cidr_block  = var.vpc_cidr
       egress      = false
       from_port   = null
       protocol    = "-1"
@@ -60,7 +65,7 @@ locals {
       to_port     = null
     },
     allow_vpc_cidr_out = {
-      cidr_block  = data.aws_vpc.current.cidr_block
+      cidr_block  = var.vpc_cidr
       egress      = true
       from_port   = null
       protocol    = "-1"
@@ -264,7 +269,7 @@ locals {
 
   endpoint_access_rules = {
     allow_https_in = {
-      cidr_block  = data.aws_vpc.current.cidr_block
+      cidr_block  = var.vpc_cidr
       egress      = false
       from_port   = 443
       protocol    = "tcp"
@@ -273,7 +278,7 @@ locals {
       to_port     = 443
     },
     allow_smtp-tls_in = {
-      cidr_block  = data.aws_vpc.current.cidr_block
+      cidr_block  = var.vpc_cidr
       egress      = false
       from_port   = 587
       protocol    = "tcp"
@@ -282,7 +287,7 @@ locals {
       to_port     = 587
     },
     allow_redshift_in = {
-      cidr_block  = data.aws_vpc.current.cidr_block
+      cidr_block  = var.vpc_cidr
       egress      = false
       from_port   = 5439
       protocol    = "tcp"
@@ -291,7 +296,7 @@ locals {
       to_port     = 5439
     },
     allow_dynamic_tcp_out = {
-      cidr_block  = data.aws_vpc.current.cidr_block
+      cidr_block  = var.vpc_cidr
       egress      = true
       from_port   = 1024
       protocol    = "tcp"

terraform/modules/vpc-nacls/main.tf

@@ -1,6 +1,7 @@
 resource "aws_network_acl" "general-public" {
   #checkov:skip=CKV2_AWS_1:These are attached to a subnet and a vpc
-  vpc_id     = data.aws_vpc.current.id
+  # vpc_id     = data.aws_vpc.current.id
+  vpc_id     = var.vpc_id
   subnet_ids = local.public_subnet_ids
   tags = merge(
     { "Name" = format("%s-public-nacl", var.tags_prefix) },
@@ -9,7 +10,8 @@ resource "aws_network_acl" "general-public" {
 }
 resource "aws_network_acl" "general-private" {
   #checkov:skip=CKV2_AWS_1:These are attached to a subnet and a vpc
-  vpc_id     = data.aws_vpc.current.id
+  # vpc_id     = data.aws_vpc.current.id
+  vpc_id     = var.vpc_id
   subnet_ids = local.private_subnet_ids
   tags = merge(
     { "Name" = format("%s-private-nacl", var.tags_prefix) },
@@ -18,7 +20,8 @@ resource "aws_network_acl" "general-private" {
 }
 resource "aws_network_acl" "general-data" {
   #checkov:skip=CKV2_AWS_1:These are attached to a subnet and a vpc
-  vpc_id     = data.aws_vpc.current.id
+  # vpc_id     = data.aws_vpc.current.id
+  vpc_id     = var.vpc_id
   subnet_ids = local.data_subnet_ids
   tags = merge(
     { "Name" = format("%s-data-nacl", var.tags_prefix) },
@@ -27,7 +30,8 @@ resource "aws_network_acl" "general-data" {
 }
 resource "aws_network_acl" "protected" {
   #checkov:skip=CKV2_AWS_1:These are attached to a subnet and a vpc
-  vpc_id     = data.aws_vpc.current.id
+  # vpc_id     = data.aws_vpc.current.id
+  vpc_id     = var.vpc_id
   subnet_ids = local.protected_subnet_ids
   tags = merge(
     { "Name" = format("%s-protected-nacl", var.tags_prefix) },

terraform/modules/vpc-nacls/variables.tf

@@ -24,4 +24,35 @@ variable "tags_prefix" {
 variable "vpc_name" {
   description = "Selected VPC for NACL creation"
   type        = string
-}
+}
+
+variable "vpc_id" {
+  description = "VPC ID for NACL creation"
+  type        = string
+}
+
+variable "vpc_cidr" {
+  description = "VPC CIDR block"
+  type        = string
+
+}
+
+variable "data_subnet_ids" {
+  description = "List of data subnet IDs"
+  type        = list(string)
+}
+
+variable "private_subnet_ids" {
+  description = "List of private subnet IDs"
+  type        = list(string)
+}
+
+variable "protected_subnet_ids" {
+  description = "List of protected subnet IDs"
+  type        = list(string)
+}
+
+variable "public_subnet_ids" {
+  description = "List of public subnet IDs"
+  type        = list(string)
+}