amazon_side_asn |
The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. |
string |
"64512" |
no |
apigw_endpoint_private_dns_enabled |
Whether or not to associate a private hosted zone with the specified VPC for API GW endpoint |
bool |
false |
no |
apigw_endpoint_security_group_ids |
The ID of one or more security groups to associate with the network interface for API GW endpoint |
list(string) |
[] |
no |
apigw_endpoint_subnet_ids |
The ID of one or more subnets in which to create a network interface for API GW endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. |
list(string) |
[] |
no |
assign_generated_ipv6_cidr_block |
Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block |
bool |
false |
no |
azs |
A list of availability zones in the region |
list(string) |
[] |
no |
cidr |
The CIDR block for the VPC. Default value is a valid CIDR, but not acceptable by AWS and should be overridden |
string |
"0.0.0.0/0" |
no |
create_database_internet_gateway_route |
Controls if an internet gateway route for public database access should be created |
bool |
false |
no |
create_database_nat_gateway_route |
Controls if a nat gateway route should be created to give internet access to the database subnets |
bool |
false |
no |
create_database_subnet_group |
Controls if database subnet group should be created |
bool |
true |
no |
create_database_subnet_route_table |
Controls if separate route table for database should be created |
bool |
false |
no |
create_elasticache_subnet_group |
Controls if elasticache subnet group should be created |
bool |
true |
no |
create_elasticache_subnet_route_table |
Controls if separate route table for elasticache should be created |
bool |
false |
no |
create_redshift_subnet_group |
Controls if redshift subnet group should be created |
bool |
true |
no |
create_redshift_subnet_route_table |
Controls if separate route table for redshift should be created |
bool |
false |
no |
create_vpc |
Controls if VPC should be created (it affects almost all resources) |
bool |
true |
no |
database_acl_tags |
Additional tags for the database subnets network ACL |
map(string) |
{} |
no |
database_dedicated_network_acl |
Whether to use dedicated network ACL (not default) and custom rules for database subnets |
bool |
false |
no |
database_inbound_acl_rules |
Database subnets inbound network ACL rules |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
database_outbound_acl_rules |
Database subnets outbound network ACL rules |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
database_route_table_tags |
Additional tags for the database route tables |
map(string) |
{} |
no |
database_subnet_group_tags |
Additional tags for the database subnet group |
map(string) |
{} |
no |
database_subnet_suffix |
Suffix to append to database subnets name |
string |
"db" |
no |
database_subnet_tags |
Additional tags for the database subnets |
map(string) |
{} |
no |
database_subnets |
A list of database subnets |
list(string) |
[] |
no |
default_network_acl_egress |
List of maps of egress rules to set on the Default Network ACL |
list(map(string)) |
[ { "action": "allow", "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_no": 100, "to_port": 0 }, { "action": "allow", "from_port": 0, "ipv6_cidr_block": "::/0", "protocol": "-1", "rule_no": 101, "to_port": 0 } ] |
no |
default_network_acl_ingress |
List of maps of ingress rules to set on the Default Network ACL |
list(map(string)) |
[ { "action": "allow", "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_no": 100, "to_port": 0 }, { "action": "allow", "from_port": 0, "ipv6_cidr_block": "::/0", "protocol": "-1", "rule_no": 101, "to_port": 0 } ] |
no |
default_network_acl_name |
Name to be used on the Default Network ACL |
string |
"" |
no |
default_network_acl_tags |
Additional tags for the Default Network ACL |
map(string) |
{} |
no |
default_vpc_enable_classiclink |
Should be true to enable ClassicLink in the Default VPC |
bool |
false |
no |
default_vpc_enable_dns_hostnames |
Should be true to enable DNS hostnames in the Default VPC |
bool |
false |
no |
default_vpc_enable_dns_support |
Should be true to enable DNS support in the Default VPC |
bool |
true |
no |
default_vpc_name |
Name to be used on the Default VPC |
string |
"" |
no |
default_vpc_tags |
Additional tags for the Default VPC |
map(string) |
{} |
no |
dhcp_options_domain_name |
Specifies DNS name for DHCP options set |
string |
"" |
no |
dhcp_options_domain_name_servers |
Specify a list of DNS server addresses for DHCP options set, default to AWS provided |
list(string) |
[ "AmazonProvidedDNS" ] |
no |
dhcp_options_netbios_name_servers |
Specify a list of netbios servers for DHCP options set |
list(string) |
[] |
no |
dhcp_options_netbios_node_type |
Specify netbios node_type for DHCP options set |
string |
"" |
no |
dhcp_options_ntp_servers |
Specify a list of NTP servers for DHCP options set |
list(string) |
[] |
no |
dhcp_options_tags |
Additional tags for the DHCP option set |
map(string) |
{} |
no |
ec2_endpoint_private_dns_enabled |
Whether or not to associate a private hosted zone with the specified VPC for EC2 endpoint |
bool |
false |
no |
ec2_endpoint_security_group_ids |
The ID of one or more security groups to associate with the network interface for EC2 endpoint |
list(string) |
[] |
no |
ec2_endpoint_subnet_ids |
The ID of one or more subnets in which to create a network interface for EC2 endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. |
list(string) |
[] |
no |
ec2messages_endpoint_private_dns_enabled |
Whether or not to associate a private hosted zone with the specified VPC for EC2MESSAGES endpoint |
bool |
false |
no |
ec2messages_endpoint_security_group_ids |
The ID of one or more security groups to associate with the network interface for EC2MESSAGES endpoint |
list(string) |
[] |
no |
ec2messages_endpoint_subnet_ids |
The ID of one or more subnets in which to create a network interface for EC2MESSAGES endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. |
list(string) |
[] |
no |
ecr_api_endpoint_private_dns_enabled |
Whether or not to associate a private hosted zone with the specified VPC for ECR API endpoint |
bool |
false |
no |
ecr_api_endpoint_security_group_ids |
The ID of one or more security groups to associate with the network interface for ECR API endpoint |
list(string) |
[] |
no |
ecr_api_endpoint_subnet_ids |
The ID of one or more subnets in which to create a network interface for ECR api endpoint. If omitted, private subnets will be used. |
list(string) |
[] |
no |
ecr_dkr_endpoint_private_dns_enabled |
Whether or not to associate a private hosted zone with the specified VPC for ECR DKR endpoint |
bool |
false |
no |
ecr_dkr_endpoint_security_group_ids |
The ID of one or more security groups to associate with the network interface for ECR DKR endpoint |
list(string) |
[] |
no |
ecr_dkr_endpoint_subnet_ids |
The ID of one or more subnets in which to create a network interface for ECR dkr endpoint. If omitted, private subnets will be used. |
list(string) |
[] |
no |
elasticache_acl_tags |
Additional tags for the elasticache subnets network ACL |
map(string) |
{} |
no |
elasticache_dedicated_network_acl |
Whether to use dedicated network ACL (not default) and custom rules for elasticache subnets |
bool |
false |
no |
elasticache_inbound_acl_rules |
Elasticache subnets inbound network ACL rules |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
elasticache_outbound_acl_rules |
Elasticache subnets outbound network ACL rules |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
elasticache_route_table_tags |
Additional tags for the elasticache route tables |
map(string) |
{} |
no |
elasticache_subnet_suffix |
Suffix to append to elasticache subnets name |
string |
"elasticache" |
no |
elasticache_subnet_tags |
Additional tags for the elasticache subnets |
map(string) |
{} |
no |
elasticache_subnets |
A list of elasticache subnets |
list(string) |
[] |
no |
enable_apigw_endpoint |
Should be true if you want to provision an api gateway endpoint to the VPC |
bool |
false |
no |
enable_dhcp_options |
Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type |
bool |
false |
no |
enable_dns_hostnames |
Should be true to enable DNS hostnames in the VPC |
bool |
false |
no |
enable_dns_support |
Should be true to enable DNS support in the VPC |
bool |
true |
no |
enable_dynamodb_endpoint |
Should be true if you want to provision a DynamoDB endpoint to the VPC |
bool |
false |
no |
enable_ec2_endpoint |
Should be true if you want to provision an EC2 endpoint to the VPC |
bool |
false |
no |
enable_ec2messages_endpoint |
Should be true if you want to provision an EC2MESSAGES endpoint to the VPC |
bool |
false |
no |
enable_ecr_api_endpoint |
Should be true if you want to provision an ecr api endpoint to the VPC |
bool |
false |
no |
enable_ecr_dkr_endpoint |
Should be true if you want to provision an ecr dkr endpoint to the VPC |
bool |
false |
no |
enable_nat_gateway |
Should be true if you want to provision NAT Gateways for each of your private networks |
bool |
false |
no |
enable_public_redshift |
Controls if redshift should have public routing table |
bool |
false |
no |
enable_s3_endpoint |
Should be true if you want to provision an S3 endpoint to the VPC |
bool |
false |
no |
enable_ssm_endpoint |
Should be true if you want to provision an SSM endpoint to the VPC |
bool |
false |
no |
enable_ssmmessages_endpoint |
Should be true if you want to provision a SSMMESSAGES endpoint to the VPC |
bool |
false |
no |
enable_vpn_gateway |
Should be true if you want to create a new VPN Gateway resource and attach it to the VPC |
bool |
false |
no |
external_nat_ip_ids |
List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse_nat_ips) |
list(string) |
[] |
no |
igw_tags |
Additional tags for the internet gateway |
map(string) |
{} |
no |
instance_tenancy |
A tenancy option for instances launched into the VPC |
string |
"default" |
no |
intra_acl_tags |
Additional tags for the intra subnets network ACL |
map(string) |
{} |
no |
intra_dedicated_network_acl |
Whether to use dedicated network ACL (not default) and custom rules for intra subnets |
bool |
false |
no |
intra_inbound_acl_rules |
Intra subnets inbound network ACLs |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
intra_outbound_acl_rules |
Intra subnets outbound network ACLs |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
intra_route_table_tags |
Additional tags for the intra route tables |
map(string) |
{} |
no |
intra_subnet_suffix |
Suffix to append to intra subnets name |
string |
"intra" |
no |
intra_subnet_tags |
Additional tags for the intra subnets |
map(string) |
{} |
no |
intra_subnets |
A list of intra subnets |
list(string) |
[] |
no |
manage_default_network_acl |
Should be true to adopt and manage Default Network ACL |
bool |
false |
no |
manage_default_vpc |
Should be true to adopt and manage Default VPC |
bool |
false |
no |
map_public_ip_on_launch |
Should be false if you do not want to auto-assign public IP on launch |
bool |
true |
no |
name |
Name to be used on all the resources as identifier |
string |
"" |
no |
nat_eip_tags |
Additional tags for the NAT EIP |
map(string) |
{} |
no |
nat_gateway_tags |
Additional tags for the NAT gateways |
map(string) |
{} |
no |
one_nat_gateway_per_az |
Should be true if you want only one NAT Gateway per availability zone. Requires var.azs to be set, and the number of public_subnets created to be greater than or equal to the number of availability zones specified in var.azs . |
bool |
false |
no |
private_acl_tags |
Additional tags for the private subnets network ACL |
map(string) |
{} |
no |
private_dedicated_network_acl |
Whether to use dedicated network ACL (not default) and custom rules for private subnets |
bool |
false |
no |
private_inbound_acl_rules |
Private subnets inbound network ACLs |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
private_outbound_acl_rules |
Private subnets outbound network ACLs |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
private_route_table_tags |
Additional tags for the private route tables |
map(string) |
{} |
no |
private_subnet_suffix |
Suffix to append to private subnets name |
string |
"private" |
no |
private_subnet_tags |
Additional tags for the private subnets |
map(string) |
{} |
no |
private_subnets |
A list of private subnets inside the VPC |
list(string) |
[] |
no |
propagate_private_route_tables_vgw |
Should be true if you want route table propagation |
bool |
false |
no |
propagate_public_route_tables_vgw |
Should be true if you want route table propagation |
bool |
false |
no |
public_acl_tags |
Additional tags for the public subnets network ACL |
map(string) |
{} |
no |
public_dedicated_network_acl |
Whether to use dedicated network ACL (not default) and custom rules for public subnets |
bool |
false |
no |
public_inbound_acl_rules |
Public subnets inbound network ACLs |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
public_outbound_acl_rules |
Public subnets outbound network ACLs |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
public_route_table_tags |
Additional tags for the public route tables |
map(string) |
{} |
no |
public_subnet_suffix |
Suffix to append to public subnets name |
string |
"public" |
no |
public_subnet_tags |
Additional tags for the public subnets |
map(string) |
{} |
no |
public_subnets |
A list of public subnets inside the VPC |
list(string) |
[] |
no |
redshift_acl_tags |
Additional tags for the redshift subnets network ACL |
map(string) |
{} |
no |
redshift_dedicated_network_acl |
Whether to use dedicated network ACL (not default) and custom rules for redshift subnets |
bool |
false |
no |
redshift_inbound_acl_rules |
Redshift subnets inbound network ACL rules |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
redshift_outbound_acl_rules |
Redshift subnets outbound network ACL rules |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
redshift_route_table_tags |
Additional tags for the redshift route tables |
map(string) |
{} |
no |
redshift_subnet_group_tags |
Additional tags for the redshift subnet group |
map(string) |
{} |
no |
redshift_subnet_suffix |
Suffix to append to redshift subnets name |
string |
"redshift" |
no |
redshift_subnet_tags |
Additional tags for the redshift subnets |
map(string) |
{} |
no |
redshift_subnets |
A list of redshift subnets |
list(string) |
[] |
no |
restricted_acl_tags |
Additional tags for the restricted subnets network ACL |
map(string) |
{} |
no |
restricted_dedicated_network_acl |
n/a |
bool |
false |
no |
restricted_inbound_acl_rules |
Private subnets inbound network ACLs |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
restricted_outbound_acl_rules |
Private subnets outbound network ACLs |
list(map(string)) |
[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ] |
no |
restricted_subnet_suffix |
Suffix to append to restricted subnets name |
string |
"restricted" |
no |
restricted_subnet_tags |
Additional tags for the restricted subnets |
map(string) |
{} |
no |
restricted_subnets |
A list of restricted subnets inside the VPC |
list(string) |
[] |
no |
reuse_nat_ips |
Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable |
bool |
false |
no |
secondary_cidr_blocks |
List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool |
list(string) |
[] |
no |
single_nat_gateway |
Should be true if you want to provision a single shared NAT Gateway across all of your private networks |
bool |
false |
no |
ssm_endpoint_private_dns_enabled |
Whether or not to associate a private hosted zone with the specified VPC for SSM endpoint |
bool |
false |
no |
ssm_endpoint_security_group_ids |
The ID of one or more security groups to associate with the network interface for SSM endpoint |
list(string) |
[] |
no |
ssm_endpoint_subnet_ids |
The ID of one or more subnets in which to create a network interface for SSM endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. |
list(string) |
[] |
no |
ssmmessages_endpoint_private_dns_enabled |
Whether or not to associate a private hosted zone with the specified VPC for SSMMESSAGES endpoint |
bool |
false |
no |
ssmmessages_endpoint_security_group_ids |
The ID of one or more security groups to associate with the network interface for SSMMESSAGES endpoint |
list(string) |
[] |
no |
ssmmessages_endpoint_subnet_ids |
The ID of one or more subnets in which to create a network interface for SSMMESSAGES endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. |
list(string) |
[] |
no |
tags |
A map of tags to add to all resources |
map(string) |
{} |
no |
vpc_tags |
Additional tags for the VPC |
map(string) |
{} |
no |
vpn_gateway_id |
ID of VPN Gateway to attach to the VPC |
string |
"" |
no |
vpn_gateway_tags |
Additional tags for the VPN gateway |
map(string) |
{} |
no |