terraform-aws-modules/terraform-aws-vpc

The vpc-endpoints sub-module allows you to create both Interface and Gateway VPC endpoints on AWS. You define endpoints using an endpoints map where each key represents a service and the value contains the specific configuration for that service type.

To use this module, provide the vpc_id and a map of endpoints. You can configure different settings for Interface endpoints (using subnet_ids and subnet_configurations) and Gateway endpoints (using service_type = "Gateway" and route_table_ids).

module "endpoints" {
  source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"

  vpc_id             = "vpc-12345678"
  security_group_ids = ["sg-12345678"]

  endpoints = {
    s3 = {
      # interface endpoint
      service             = "s3"
      tags                = { Name = "s3-vpc-endpoint" }
    },
    dynamodb = {
      # gateway endpoint
      service         = "dynamodb"
      service_type    = "Gateway"
      route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
      tags            = { Name = "dynamodb-vpc-endpoint" }
    },
    sns = {
      service               = "sns"
      subnet_ids            = ["subnet-12345678", "subnet-87654321"]
      subnet_configurations = [
        {
          ipv4      = "10.8.34.10"
          subnet_id = "subnet-12345678"
        },
        {
          ipv4      = "10.8.35.10"
          subnet_id = "subnet-87654321"
        }
      ]
      tags = { Name = "sns-vpc-endpoint" }
    },
    sqs = {
      service             = "sqs"
      private_dns_enabled = true
      security_group_ids  = ["sg-987654321"]
      subnet_ids          = ["subnet-12345678", "subnet-87654321"]
      tags                = { Name = "sqs-vpc-endpoint" }
    },
  }

  tags = {
    Owner       = "user"
    Environment = "dev"
  }
}

To use an AWS IPAM Pool for CIDR assignment, you must 'preview' the CIDR using aws_vpc_ipam_preview_next_cidr because the module needs to know subnet CIDRs during the plan phase. You cannot use ipv4_netmask_length directly due to race conditions with terraform plan.

# Find the pool RAM shared to your account
data "aws_vpc_ipam_pool" "ipv4_example" {
  filter {
    name   = "description"
    values = ["*mypool*"]
  }

  filter {
    name   = "address-family"
    values = ["ipv4"]
  }
}

# Preview next CIDR from pool
data "aws_vpc_ipam_preview_next_cidr" "previewed_cidr" {
  ipam_pool_id   = data.aws_vpc_ipam_pool.ipv4_example.id
  netmask_length = 24
}

data "aws_region" "current" {}

# Calculate subnet cidrs from previewed IPAM CIDR
locals {
  partition       = cidrsubnets(data.aws_vpc_ipam_preview_next_cidr.previewed_cidr.cidr, 2, 2)
  private_subnets = cidrsubnets(local.partition[0], 2, 2)
  public_subnets  = cidrsubnets(local.partition[1], 2, 2)
  azs             = formatlist("${data.aws_region.current.name}%s", ["a", "b"])
}

module "vpc_cidr_from_ipam" {
  source            = "terraform-aws-modules/vpc/aws"
  name              = "vpc-cidr-from-ipam"
  ipv4_ipam_pool_id = data.aws_vpc_ipam_pool.ipv4_example.id
  azs               = local.azs
  cidr              = data.aws_vpc_ipam_preview_next_cidr.previewed_cidr.cidr
  private_subnets   = local.private_subnets
  public_subnets    = local.public_subnets
}

When upgrading from version 3.x to 4.x, note the following breaking changes and requirement updates:

Requirements

• Terraform Version: Minimum required version is now 1.0.
• AWS Provider Version: Minimum required version is now 4.x (specifically 4.35.0 or later).

Backwards Incompatible Variable Changes

• Removed: assign_ipv6_address_on_creation. Use the subnet-specific equivalent instead (e.g., public_subnet_assign_ipv6_address_on_creation).
• Removed: enable_classiclink (no longer supported by AWS).
• Removed: enable_classiclink_dns_support (no longer supported by AWS).

Default Value Changes

• map_public_ip_on_launch now defaults to false.
• enable_dns_hostnames now defaults to true.
• enable_dns_support now defaults to true.
• manage_default_security_group now defaults to true.
• manage_default_route_table now defaults to true.
• manage_default_network_acl now defaults to true.
• Outputs: The default fallback value for outputs has changed from an empty string ("") to null.

Naming Changes

• If a specific name is not provided, the default names for the default security group, route table, and network ACL now append -default to the VPC name.