{"id":19107167,"url":"https://github.com/govtechsg/terraform-aws-vpc-ace","last_synced_at":"2025-09-07T00:41:40.315Z","repository":{"id":40773170,"uuid":"385595310","full_name":"GovTechSG/terraform-aws-vpc-ace","owner":"GovTechSG","description":"Another opnionated AWS VPC module, designed with GCC usage in mind","archived":false,"fork":false,"pushed_at":"2025-08-27T06:07:31.000Z","size":128,"stargazers_count":2,"open_issues_count":3,"forks_count":1,"subscribers_count":53,"default_branch":"master","last_synced_at":"2025-08-27T13:58:53.298Z","etag":null,"topics":["ace","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GovTechSG.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-07-13T12:25:33.000Z","updated_at":"2025-08-27T06:07:15.000Z","dependencies_parsed_at":"2023-01-31T20:31:20.243Z","dependency_job_id":"e50e0591-8d06-4a17-8143-ceb5faa4d591","html_url":"https://github.com/GovTechSG/terraform-aws-vpc-ace","commit_stats":null,"previous_names":[],"tags_count":71,"template":false,"template_full_name":null,"purl":"pkg:github/GovTechSG/terraform-aws-vpc-ace","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-aws-vpc-ace","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-aws-vpc-ace/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-aws-vpc-ace/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-aws-vpc-ace/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GovTechSG","download_url":"https://codeload.github.com/GovTechSG/terraform-aws-vpc-ace/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-aws-vpc-ace/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273983073,"owners_count":25202092,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-06T02:00:13.247Z","response_time":2576,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ace","terraform"],"created_at":"2024-11-09T04:11:30.448Z","updated_at":"2025-09-07T00:41:40.286Z","avatar_url":"https://github.com/GovTechSG.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# VPC\n\nOpinionated module to create/provision a vpc, from [GovTechSG/terraform-aws-vpc-forked](https://github.com/GovTechSG/terraform-aws-vpc-forked)\n\nAs this module is intended to use with a EKS cluster, additional tags to be included in subnets are required, this is to prevent situations where this module is reapplied after EKS has been created, which will remove the tags that are automatically added by EKS.\n\nAlso, it is modified to work with GCC VPC resources, where there are multiple permission boundaries applied and our terraform permissions are restricted from modifying and creating certain objects.\n\n## Gotchas with GCC\n\n1. you cannot modify anything that has tag `Owner: GCCI`\n\nSolution: Do not ever tag any of your resources with this value\nYou will notice that a number of resources in VPC dashboard that you cannot modify, not even adding additional tags. If you require additional tags, in the case of setting up EKS, where you need to tag the VPC [https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html) you will have to raise an SR to have someone from the technical desk to add it for you.\n\n2. you cannot create NAT Gateways\n\nThis module will fail as it tries to create NAT Gateway for you, which GCC does not. Therefore you will have to either, raise a SR to create them, or raise a SR to request for a temporary lift of the permission boundaries for you to apply this module (Recommended)\n## Upgrade\n\n### from v1 to v2\n\nIn v2.0 onwards, this module will no longer try to compute subnet cidrs using `cidrsubnet` functions and rely on user input to enter the cidr ranges for each subnet by themselves, see usage for example\n### Upgrade from v2 to v3\n\n#### Splitting of VPC endpoints to submodule\n\nThe original VPC module has since moved away from creating individual VPC endpoints within the module and decoupled it from the main module. See [PR](https://github.com/terraform-aws-modules/terraform-aws-vpc/pull/635)\n\nYou will have to implement the submodule separately(import and apply), before updating to v3 on this module.\n\nSetup your code as shown in the below example, after which, run `terraform import 'aws_vpc_endpoint.this[\"kms\"]'  vpce-xxxx` etc until you have imported all your endpoint services. You may now apply the vpc endpoint submodule, and you should not see any changes to your endpoints that will impact your existing applications, e.g changes to tags are okay, but changes to route table are not.\n\n##### Examples\n\n###### Terraform\n\n```hcl\nmodule \"endpoints\" {\n  source = \"terraform-aws-modules/vpc/aws//modules/vpc-endpoints\"\n\n  vpc_id             = \"vpc-12345678\"\n  security_group_ids = [\"sg-12345678\"]\n\n  endpoints = {\n    s3 = {\n      # interface endpoint\n      service             = \"s3\"\n      tags                = { Name = \"s3-vpc-endpoint\" }\n    },\n    dynamodb = {\n      # gateway endpoint\n      service         = \"dynamodb\"\n      route_table_ids = [\"rt-12322456\", \"rt-43433343\", \"rt-11223344\"]\n      tags            = { Name = \"dynamodb-vpc-endpoint\" }\n    },\n    sns = {\n      service    = \"sns\"\n      subnet_ids = [\"subnet-12345678\", \"subnet-87654321\"]\n      tags       = { Name = \"sns-vpc-endpoint\" }\n    },\n    sqs = {\n      service             = \"sqs\"\n      private_dns_enabled = true\n      security_group_ids  = [\"sg-987654321\"]\n      subnet_ids          = [\"subnet-12345678\", \"subnet-87654321\"]\n      tags                = { Name = \"sqs-vpc-endpoint\" }\n    },\n  }\n\n  tags = {\n    Owner       = \"user\"\n    Environment = \"dev\"\n  }\n}\n```\n\n###### Terragrunt\n\n```hcl\ndependency \"vpc\" {\n  config_path = \"../vpc\"\n}\n\ninputs = {\n\n  vpc_id             = dependency.vpc.outputs.vpc_id\n  security_group_ids = [\"sg-xxx\"]\n  subnet_ids         = dependency.vpc.outputs.private_subnets_ids\n\n  endpoints = {\n    s3 = {\n      # gateway endpoint\n      service      = \"s3\"\n      service_type = \"Gateway\"\n      tags         = { Name = \"s3-vpc-endpoint\" }\n    },\n    dynamodb = {\n      # gateway endpoint\n      service         = \"dynamodb\"\n      service_type    = \"Gateway\"\n      route_table_ids = concat(dependency.vpc.outputs.vpc_public_route_table_ids, dependency.vpc.outputs.vpc_private_route_table_ids, dependency.vpc.outputs.vpc_intra_route_table_ids)\n      tags            = { Name = \"dynamodb-vpc-endpoint\" }\n    },\n    ec2 = {\n      service             = \"ec2\"\n      private_dns_enabled = true\n      tags                = { Name = \"ec2-vpc-endpoint\" }\n    }\n    ecr = {\n      service             = \"ecr.api\"\n      private_dns_enabled = true\n      tags                = { Name = \"ecr-api-vpc-endpoint\" }\n    }\n    elasticfilesystem = {\n      service             = \"elasticfilesystem\"\n      private_dns_enabled = true\n      tags                = { Name = \"elasticfilesystem-vpc-endpoint\" }\n    }\n    kms = {\n      service             = \"kms\"\n      private_dns_enabled = true\n      tags                = { Name = \"kms-vpc-endpoint\" }\n    }\n    execute-api = {\n      service             = \"execute-api\"\n      private_dns_enabled = true\n      tags                = { Name = \"execute-api-vpc-endpoint\" }\n    }\n    sts = {\n      service             = \"sts\"\n      private_dns_enabled = true\n      tags                = { Name = \"sts-vpc-endpoint\" }\n    }\n    \"ecr.dkr\" = {\n      service             = \"ecr.dkr\"\n      private_dns_enabled = true\n      tags                = { Name = \"ecr-dkr-vpc-endpoint\" }\n    }\n    sqs = {\n      service             = \"sqs\"\n      private_dns_enabled = true\n      tags                = { Name = \"sqs-vpc-endpoint\" }\n    },\n  }\n}\n```\n### Removing VPC endpoint state from VPC module\n\nIf you apply the VPC module immediately, you will notice that terraform will destroy your existing endpoints, this is not what we want. Since we have moved the state to be managed by the VPC endpoint submodule, we will need to remove the endpoint state from the VPC module.\n\nFor each of your endpoints, run `terraform state rm \"aws_vpc_endpoint.kms[0]\"`\n\n## Usage\n\n\nThere are 2 ways to use this module, mainly\n\n1. Create the vpc\n2. Reuse a created VPC(that is empty) and provision it. This is in the case of GCC where VPC will be created for us, and we have no rights to create new vpcs. In this scenario, use the terraform `import` command to import the resource to the module for it to manage. e.g `terraform import 'module.vpc.aws_vpc.this[0]' vpc_xxxxxxx`\n\n### Create vpc\n\n```hcl\nmodule \"vpc\" {\n  vpc_cidr = \"172.1.1.0/25\"\n  secondary_cidr_blocks = [\"172.2.2.0/24\"]\n  manage_cidr_block = \"172.2.2.0/24\"\n  vpc_tags = {\n    \"DataClassification\" = \"Official Close\"\n    \"Type\" = \"Internet\"\n  }\n\n  public_subnets = [\n    \"172.2.2.0/27\",\n  ]\n  database_subnets = [\n    \"172.2.2.32/27,\n  ]\n\n  private_subnets = [\n    \"172.2.2.64/27\",\n\n  ]\n  number_of_azs = 2\n\n}\n```\n\nNote the usage of `secondary_cidr_blocks` and `manage_cidr_block`\nAs this module was originalyl intended to create 1 vpc with 1 cidr range for management, and it was only later discovered that GCC creates multiple cidr ranges in your VPC, you will have to use `manage_cidr_block` to tell the module to add create and manage resources for 1 cidr range at a time. Duplicate the module block for managing multiple cidrs as a workaround for now.\n\n### Reuse VPC\n\n#### Terraform\n\n\u003e terraform import 'module.vpc.aws_vpc.this[0]' vpc-xxxxxxxx\n\u003e terraform import 'module.vpc.aws_vpc_ipv4_cidr_block_association.this[0]' vpc-cidr-assoc-xxx\n\u003e terraform import 'module.vpc.aws_internet_gateway.this[0]' igw-xxx\n\n#### Terragrunt\n\n\u003e terragrunt import 'module.vpc.aws_vpc.this[0]' vpc-xxxxxxxx\n\u003e terragrunt import 'module.vpc.aws_vpc_ipv4_cidr_block_association.this[0]' vpc-cidr-assoc-xxx\n\u003e terragrunt import 'module.vpc.aws_internet_gateway.this[0]' igw-xxx\n\n### EKS Subnet-Specific Tags\n\nWith the introduction of subnet-specific EKS tag variables, you can now apply different tags to different subnet types. This is useful when you need specific tags for different subnet types for EKS cluster requirements or organizational purposes.\n\n```hcl\nmodule \"vpc\" {\n  vpc_cidr = \"172.1.1.0/25\"\n\n  # General EKS cluster tags applied to all subnets\n  eks_cluster_tags = {\n    \"kubernetes.io/cluster/my-cluster\" = \"shared\"\n  }\n\n  # Public subnet specific EKS tags\n  eks_public_subnet_tags = {\n    \"kubernetes.io/cluster/my-cluster\" = \"owned\"\n    \"Environment\" = \"production\"\n  }\n\n  # Private subnet specific EKS tags\n  eks_private_subnet_tags = {\n    \"kubernetes.io/cluster/my-cluster\" = \"owned\"\n    \"Tier\" = \"application\"\n  }\n\n  # Intra subnet specific EKS tags\n  eks_intra_subnet_tags = {\n    \"Tier\" = \"management\"\n  }\n\n  public_subnets = [\"172.1.1.0/27\"]\n  private_subnets = [\"172.1.1.32/27\"]\n  intranet_subnets = [\"172.1.1.64/27\"]\n  database_subnets = [\"172.1.1.96/27\"]\n  number_of_azs = 2\n}\n```\n\n**Note**: The subnet-specific tags are merged with the general `eks_cluster_tags`, so you don't need to repeat common tags across all subnet types.\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\nNo requirements.\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | n/a |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_vpc\"\u003e\u003c/a\u003e [vpc](#module\\_vpc) | github.com/GovTechSG/terraform-aws-vpc-forked | v4.0.6 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_cloudwatch_log_subscription_filter.flow_log](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_subscription_filter) | resource |\n| [aws_eip.nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |\n| [aws_network_acl.database](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl) | resource |\n| [aws_network_acl.intra](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl) | resource |\n| [aws_network_acl.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl) | resource |\n| [aws_network_acl.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl) | resource |\n| [aws_network_acl_rule.database_inbound_allow_443_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_inbound_allow_443_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_inbound_allow_all_ephemeral_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_inbound_allow_all_ephemeral_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_inbound_rdp_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_inbound_ssh_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_outbound_allow_443_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_outbound_allow_443_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_outbound_allow_all_ephemeral_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_outbound_allow_all_ephemeral_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_outbound_rdp_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.database_outbound_ssh_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_inbound_allow_all_ephemeral_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_inbound_allow_all_udp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_inbound_allow_all_udp_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_inbound_allow_tcp_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_inbound_rdp_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_inbound_ssh_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_outbound_allow_all_ephemeral_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_outbound_allow_all_ephemeral_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_outbound_allow_all_ephemeral_rule_tgw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_outbound_allow_all_udp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_outbound_allow_all_udp_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_outbound_allow_tcp_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_outbound_rdp_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intra_outbound_ssh_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_inbound_allow_443_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_inbound_bgp_179_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_inbound_bgp_179_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_inbound_nfs_111_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_inbound_nfs_111_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_inbound_ssh_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_inbound_ssh_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_outbound_allow_443_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_outbound_bgp_179_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_outbound_bgp_179_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_outbound_nfs_111_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_outbound_nfs_111_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_outbound_ssh_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.intranet_outbound_ssh_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_443_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_80_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_all_ephemeral_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_all_udp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_all_udp_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_bgp_179_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_bgp_179_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_smtp_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_allow_tcp_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_ldap_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_ldap_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_nfs_111_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_nfs_111_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_openvpn_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_openvpn_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_rdp_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_rdp_rule_deny_udp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_ssh_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_ssh_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_inbound_ssh_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_443_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_80_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_all_ephemeral_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_all_udp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_all_udp_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_bgp_179_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_bgp_179_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_smtp_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_allow_tcp_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_ldap_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_ldap_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_nfs_111_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_nfs_111_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_openvpn_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_openvpn_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_rdp_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_rdp_rule_deny_udp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_ssh_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_ssh_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.private_outbound_ssh_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_inbound_allow_all_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_inbound_rdp_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_inbound_rdp_rule_deny_udp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_inbound_ssh_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_inbound_ssh_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_inbound_ssh_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_outbound_allow_all_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_outbound_rdp_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_outbound_rdp_rule_deny_udp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_outbound_ssh_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_outbound_ssh_rule_deny](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_network_acl_rule.public_outbound_ssh_rule_secondary_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |\n| [aws_security_group.allow_443](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |\n| [aws_security_group.allow_http_https_outgoing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |\n| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_aws_region\"\u003e\u003c/a\u003e [aws\\_region](#input\\_aws\\_region) | Region to deploy current terraform script | `string` | `\"ap-southeast-1\"` | no |\n| \u003ca name=\"input_cidr_name\"\u003e\u003c/a\u003e [cidr\\_name](#input\\_cidr\\_name) | Name of cidr managed | `string` | `\"\"` | no |\n| \u003ca name=\"input_create_allow_443_security_group\"\u003e\u003c/a\u003e [create\\_allow\\_443\\_security\\_group](#input\\_create\\_allow\\_443\\_security\\_group) | Controls if the allow\\_443 security group should be created | `bool` | `true` | no |\n| \u003ca name=\"input_create_allow_http_https_outgoing_security_group\"\u003e\u003c/a\u003e [create\\_allow\\_http\\_https\\_outgoing\\_security\\_group](#input\\_create\\_allow\\_http\\_https\\_outgoing\\_security\\_group) | Controls if the allow\\_http\\_https\\_outgoing security group should be created | `bool` | `true` | no |\n| \u003ca name=\"input_create_flow_log_cloudwatch_iam_role\"\u003e\u003c/a\u003e [create\\_flow\\_log\\_cloudwatch\\_iam\\_role](#input\\_create\\_flow\\_log\\_cloudwatch\\_iam\\_role) | Whether to create IAM role for VPC Flow Logs | `bool` | `false` | no |\n| \u003ca name=\"input_create_flow_log_cloudwatch_log_group\"\u003e\u003c/a\u003e [create\\_flow\\_log\\_cloudwatch\\_log\\_group](#input\\_create\\_flow\\_log\\_cloudwatch\\_log\\_group) | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |\n| \u003ca name=\"input_create_vpc\"\u003e\u003c/a\u003e [create\\_vpc](#input\\_create\\_vpc) | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |\n| \u003ca name=\"input_database_acl_tags\"\u003e\u003c/a\u003e [database\\_acl\\_tags](#input\\_database\\_acl\\_tags) | Additional tags for the database subnets network ACL | `map(string)` | `{}` | no |\n| \u003ca name=\"input_database_dedicated_network_acl\"\u003e\u003c/a\u003e [database\\_dedicated\\_network\\_acl](#input\\_database\\_dedicated\\_network\\_acl) | Whether to use dedicated network ACL (not default) and custom rules for database subnets | `bool` | `false` | no |\n| \u003ca name=\"input_database_inbound_acl_rules\"\u003e\u003c/a\u003e [database\\_inbound\\_acl\\_rules](#input\\_database\\_inbound\\_acl\\_rules) | Database subnets inbound network ACL rules | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_database_outbound_acl_rules\"\u003e\u003c/a\u003e [database\\_outbound\\_acl\\_rules](#input\\_database\\_outbound\\_acl\\_rules) | Database subnets outbound network ACL rules | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_database_subnets\"\u003e\u003c/a\u003e [database\\_subnets](#input\\_database\\_subnets) | cidr range of your database subnets | `list(string)` | `[]` | no |\n| \u003ca name=\"input_default_network_acl_egress\"\u003e\u003c/a\u003e [default\\_network\\_acl\\_egress](#input\\_default\\_network\\_acl\\_egress) | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"action\": \"allow\",\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_no\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  },\u003cbr\u003e  {\u003cbr\u003e    \"action\": \"allow\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"ipv6_cidr_block\": \"::/0\",\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_no\": 101,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_default_network_acl_ingress\"\u003e\u003c/a\u003e [default\\_network\\_acl\\_ingress](#input\\_default\\_network\\_acl\\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"action\": \"allow\",\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_no\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  },\u003cbr\u003e  {\u003cbr\u003e    \"action\": \"allow\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"ipv6_cidr_block\": \"::/0\",\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_no\": 101,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_default_network_acl_name\"\u003e\u003c/a\u003e [default\\_network\\_acl\\_name](#input\\_default\\_network\\_acl\\_name) | Name to be used on the Default Network ACL | `string` | `\"\"` | no |\n| \u003ca name=\"input_default_network_acl_tags\"\u003e\u003c/a\u003e [default\\_network\\_acl\\_tags](#input\\_default\\_network\\_acl\\_tags) | Additional tags for the Default Network ACL | `map(string)` | `{}` | no |\n| \u003ca name=\"input_default_route_table_name\"\u003e\u003c/a\u003e [default\\_route\\_table\\_name](#input\\_default\\_route\\_table\\_name) | Name to be used on the default route table | `string` | `null` | no |\n| \u003ca name=\"input_default_route_table_propagating_vgws\"\u003e\u003c/a\u003e [default\\_route\\_table\\_propagating\\_vgws](#input\\_default\\_route\\_table\\_propagating\\_vgws) | List of virtual gateways for propagation | `list(string)` | `[]` | no |\n| \u003ca name=\"input_default_route_table_routes\"\u003e\u003c/a\u003e [default\\_route\\_table\\_routes](#input\\_default\\_route\\_table\\_routes) | Configuration block of routes. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |\n| \u003ca name=\"input_default_route_table_tags\"\u003e\u003c/a\u003e [default\\_route\\_table\\_tags](#input\\_default\\_route\\_table\\_tags) | Additional tags for the default route table | `map(string)` | `{}` | no |\n| \u003ca name=\"input_default_security_group_egress\"\u003e\u003c/a\u003e [default\\_security\\_group\\_egress](#input\\_default\\_security\\_group\\_egress) | List of maps of egress rules to set on the default security group | `list(map(string))` | `[]` | no |\n| \u003ca name=\"input_default_security_group_ingress\"\u003e\u003c/a\u003e [default\\_security\\_group\\_ingress](#input\\_default\\_security\\_group\\_ingress) | List of maps of ingress rules to set on the default security group | `list(map(string))` | `[]` | no |\n| \u003ca name=\"input_default_security_group_name\"\u003e\u003c/a\u003e [default\\_security\\_group\\_name](#input\\_default\\_security\\_group\\_name) | Name to be used on the default security group | `string` | `null` | no |\n| \u003ca name=\"input_default_security_group_rules\"\u003e\u003c/a\u003e [default\\_security\\_group\\_rules](#input\\_default\\_security\\_group\\_rules) | Allowed inbound rules for default security group | `map(any)` | `{}` | no |\n| \u003ca name=\"input_default_security_group_tags\"\u003e\u003c/a\u003e [default\\_security\\_group\\_tags](#input\\_default\\_security\\_group\\_tags) | Additional tags for the default security group | `map(string)` | `{}` | no |\n| \u003ca name=\"input_default_vpc_enable_dns_hostnames\"\u003e\u003c/a\u003e [default\\_vpc\\_enable\\_dns\\_hostnames](#input\\_default\\_vpc\\_enable\\_dns\\_hostnames) | Should be true to enable DNS hostnames in the Default VPC | `bool` | `true` | no |\n| \u003ca name=\"input_default_vpc_enable_dns_support\"\u003e\u003c/a\u003e [default\\_vpc\\_enable\\_dns\\_support](#input\\_default\\_vpc\\_enable\\_dns\\_support) | Should be true to enable DNS support in the Default VPC | `bool` | `true` | no |\n| \u003ca name=\"input_default_vpc_name\"\u003e\u003c/a\u003e [default\\_vpc\\_name](#input\\_default\\_vpc\\_name) | Name to be used on the Default VPC | `string` | `null` | no |\n| \u003ca name=\"input_default_vpc_tags\"\u003e\u003c/a\u003e [default\\_vpc\\_tags](#input\\_default\\_vpc\\_tags) | Additional tags for the Default VPC | `map(string)` | `{}` | no |\n| \u003ca name=\"input_eks_cluster_tags\"\u003e\u003c/a\u003e [eks\\_cluster\\_tags](#input\\_eks\\_cluster\\_tags) | List of tags that EKS will create, but also added to VPC for persistency across terraform applies | `map(any)` | `{}` | no |\n| \u003ca name=\"input_eks_intra_subnet_tags\"\u003e\u003c/a\u003e [eks\\_intra\\_subnet\\_tags](#input\\_eks\\_intra\\_subnet\\_tags) | Additional EKS-specific tags to apply to intra subnets only | `map(any)` | `{}` | no |\n| \u003ca name=\"input_eks_private_subnet_tags\"\u003e\u003c/a\u003e [eks\\_private\\_subnet\\_tags](#input\\_eks\\_private\\_subnet\\_tags) | Additional EKS-specific tags to apply to private subnets only | `map(any)` | `{}` | no |\n| \u003ca name=\"input_eks_public_subnet_tags\"\u003e\u003c/a\u003e [eks\\_public\\_subnet\\_tags](#input\\_eks\\_public\\_subnet\\_tags) | Additional EKS-specific tags to apply to public subnets only | `map(any)` | `{}` | no |\n| \u003ca name=\"input_enable_flow_log\"\u003e\u003c/a\u003e [enable\\_flow\\_log](#input\\_enable\\_flow\\_log) | Whether or not to enable VPC Flow Logs | `bool` | `false` | no |\n| \u003ca name=\"input_enable_nat_gateway\"\u003e\u003c/a\u003e [enable\\_nat\\_gateway](#input\\_enable\\_nat\\_gateway) | Should be true if you want to provision NAT Gateways for each of your private networks | `bool` | `true` | no |\n| \u003ca name=\"input_firewall_dedicated_network_acl\"\u003e\u003c/a\u003e [firewall\\_dedicated\\_network\\_acl](#input\\_firewall\\_dedicated\\_network\\_acl) | Whether to use dedicated network ACL (not default) and custom rules for firewall subnets | `bool` | `false` | no |\n| \u003ca name=\"input_firewall_inbound_acl_rules\"\u003e\u003c/a\u003e [firewall\\_inbound\\_acl\\_rules](#input\\_firewall\\_inbound\\_acl\\_rules) | firewall subnets inbound network ACL rules | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_firewall_outbound_acl_rules\"\u003e\u003c/a\u003e [firewall\\_outbound\\_acl\\_rules](#input\\_firewall\\_outbound\\_acl\\_rules) | Firewall subnets outbound network ACL rules | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_firewall_subnets\"\u003e\u003c/a\u003e [firewall\\_subnets](#input\\_firewall\\_subnets) | cidr range of your firewall subnets | `list(string)` | `[]` | no |\n| \u003ca name=\"input_firewall_sync_states\"\u003e\u003c/a\u003e [firewall\\_sync\\_states](#input\\_firewall\\_sync\\_states) | Output of aws\\_networkfirewall\\_firewall.firewall\\_status[0].sync\\_states | \u003cpre\u003elist(object({\u003cbr\u003e    attachment = list(object({\u003cbr\u003e      endpoint_id = string\u003cbr\u003e      subnet_id   = string\u003cbr\u003e    }))\u003cbr\u003e    availability_zone = string\u003cbr\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_flow_log_cloudwatch_iam_role_arn\"\u003e\u003c/a\u003e [flow\\_log\\_cloudwatch\\_iam\\_role\\_arn](#input\\_flow\\_log\\_cloudwatch\\_iam\\_role\\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\\_log\\_destination\\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided | `string` | `\"\"` | no |\n| \u003ca name=\"input_flow_log_cloudwatch_log_group_kms_key_id\"\u003e\u003c/a\u003e [flow\\_log\\_cloudwatch\\_log\\_group\\_kms\\_key\\_id](#input\\_flow\\_log\\_cloudwatch\\_log\\_group\\_kms\\_key\\_id) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs | `string` | `null` | no |\n| \u003ca name=\"input_flow_log_cloudwatch_log_group_name_prefix\"\u003e\u003c/a\u003e [flow\\_log\\_cloudwatch\\_log\\_group\\_name\\_prefix](#input\\_flow\\_log\\_cloudwatch\\_log\\_group\\_name\\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `\"/aws/vpc-flow-log/\"` | no |\n| \u003ca name=\"input_flow_log_cloudwatch_log_group_name_suffix\"\u003e\u003c/a\u003e [flow\\_log\\_cloudwatch\\_log\\_group\\_name\\_suffix](#input\\_flow\\_log\\_cloudwatch\\_log\\_group\\_name\\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `\"\"` | no |\n| \u003ca name=\"input_flow_log_cloudwatch_log_group_retention_in_days\"\u003e\u003c/a\u003e [flow\\_log\\_cloudwatch\\_log\\_group\\_retention\\_in\\_days](#input\\_flow\\_log\\_cloudwatch\\_log\\_group\\_retention\\_in\\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |\n| \u003ca name=\"input_flow_log_destination_arn\"\u003e\u003c/a\u003e [flow\\_log\\_destination\\_arn](#input\\_flow\\_log\\_destination\\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\\_flow\\_log\\_cloudwatch\\_log\\_group is set to false this argument must be provided | `string` | `\"\"` | no |\n| \u003ca name=\"input_flow_log_destination_type\"\u003e\u003c/a\u003e [flow\\_log\\_destination\\_type](#input\\_flow\\_log\\_destination\\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `\"cloud-watch-logs\"` | no |\n| \u003ca name=\"input_flow_log_file_format\"\u003e\u003c/a\u003e [flow\\_log\\_file\\_format](#input\\_flow\\_log\\_file\\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |\n| \u003ca name=\"input_flow_log_hive_compatible_partitions\"\u003e\u003c/a\u003e [flow\\_log\\_hive\\_compatible\\_partitions](#input\\_flow\\_log\\_hive\\_compatible\\_partitions) | (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3 | `bool` | `false` | no |\n| \u003ca name=\"input_flow_log_log_format\"\u003e\u003c/a\u003e [flow\\_log\\_log\\_format](#input\\_flow\\_log\\_log\\_format) | The fields to include in the flow log record, in the order in which they should appear | `string` | `null` | no |\n| \u003ca name=\"input_flow_log_max_aggregation_interval\"\u003e\u003c/a\u003e [flow\\_log\\_max\\_aggregation\\_interval](#input\\_flow\\_log\\_max\\_aggregation\\_interval) | The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: `60` seconds or `600` seconds | `number` | `600` | no |\n| \u003ca name=\"input_flow_log_per_hour_partition\"\u003e\u003c/a\u003e [flow\\_log\\_per\\_hour\\_partition](#input\\_flow\\_log\\_per\\_hour\\_partition) | (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries | `bool` | `false` | no |\n| \u003ca name=\"input_flow_log_traffic_type\"\u003e\u003c/a\u003e [flow\\_log\\_traffic\\_type](#input\\_flow\\_log\\_traffic\\_type) | The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL | `string` | `\"ALL\"` | no |\n| \u003ca name=\"input_folder\"\u003e\u003c/a\u003e [folder](#input\\_folder) | Path relative to root of terraform directory where this module is used. This is for easier locating of where the individual resource is created with aws console | `map(any)` | n/a | yes |\n| \u003ca name=\"input_intra_acl_tags\"\u003e\u003c/a\u003e [intra\\_acl\\_tags](#input\\_intra\\_acl\\_tags) | Additional tags for the intra subnets network ACL | `map(string)` | `{}` | no |\n| \u003ca name=\"input_intra_dedicated_network_acl\"\u003e\u003c/a\u003e [intra\\_dedicated\\_network\\_acl](#input\\_intra\\_dedicated\\_network\\_acl) | Whether to use dedicated network ACL (not default) and custom rules for intra subnets | `bool` | `false` | no |\n| \u003ca name=\"input_intra_inbound_acl_rules\"\u003e\u003c/a\u003e [intra\\_inbound\\_acl\\_rules](#input\\_intra\\_inbound\\_acl\\_rules) | Intra subnets inbound network ACLs | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_intra_outbound_acl_rules\"\u003e\u003c/a\u003e [intra\\_outbound\\_acl\\_rules](#input\\_intra\\_outbound\\_acl\\_rules) | Intra subnets outbound network ACLs | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_intranet_subnets\"\u003e\u003c/a\u003e [intranet\\_subnets](#input\\_intranet\\_subnets) | cidr range of your intranet subnets | `list(string)` | `[]` | no |\n| \u003ca name=\"input_lg_filters\"\u003e\u003c/a\u003e [lg\\_filters](#input\\_lg\\_filters) | Log group filters for Network Firewall | \u003cpre\u003emap(object({\u003cbr\u003e    naming_suffix   = string\u003cbr\u003e    role_arn        = string\u003cbr\u003e    filter_pattern  = string\u003cbr\u003e    destination_arn = string\u003cbr\u003e    distribution    = string\u003cbr\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_manage_default_network_acl\"\u003e\u003c/a\u003e [manage\\_default\\_network\\_acl](#input\\_manage\\_default\\_network\\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `false` | no |\n| \u003ca name=\"input_manage_default_route_table\"\u003e\u003c/a\u003e [manage\\_default\\_route\\_table](#input\\_manage\\_default\\_route\\_table) | Should be true to manage default route table | `bool` | `true` | no |\n| \u003ca name=\"input_manage_default_security_group\"\u003e\u003c/a\u003e [manage\\_default\\_security\\_group](#input\\_manage\\_default\\_security\\_group) | Should be true to adopt and manage default security group | `bool` | `true` | no |\n| \u003ca name=\"input_manage_default_vpc\"\u003e\u003c/a\u003e [manage\\_default\\_vpc](#input\\_manage\\_default\\_vpc) | Should be true to adopt and manage Default VPC | `bool` | `false` | no |\n| \u003ca name=\"input_map_public_ip_on_launch\"\u003e\u003c/a\u003e [map\\_public\\_ip\\_on\\_launch](#input\\_map\\_public\\_ip\\_on\\_launch) | Should be false if you do not want to auto-assign public IP on launch | `bool` | `true` | no |\n| \u003ca name=\"input_number_of_azs\"\u003e\u003c/a\u003e [number\\_of\\_azs](#input\\_number\\_of\\_azs) | Determines number of availability zones to use in the region | `number` | `2` | no |\n| \u003ca name=\"input_private_acl_tags\"\u003e\u003c/a\u003e [private\\_acl\\_tags](#input\\_private\\_acl\\_tags) | Additional tags for the private subnets network ACL | `map(string)` | `{}` | no |\n| \u003ca name=\"input_private_dedicated_network_acl\"\u003e\u003c/a\u003e [private\\_dedicated\\_network\\_acl](#input\\_private\\_dedicated\\_network\\_acl) | Whether to use dedicated network ACL (not default) and custom rules for private subnets | `bool` | `false` | no |\n| \u003ca name=\"input_private_inbound_acl_rules\"\u003e\u003c/a\u003e [private\\_inbound\\_acl\\_rules](#input\\_private\\_inbound\\_acl\\_rules) | Private subnets inbound network ACLs | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_private_outbound_acl_rules\"\u003e\u003c/a\u003e [private\\_outbound\\_acl\\_rules](#input\\_private\\_outbound\\_acl\\_rules) | Private subnets outbound network ACLs | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_private_subnets\"\u003e\u003c/a\u003e [private\\_subnets](#input\\_private\\_subnets) | cidr range of your private subnets | `list(string)` | `[]` | no |\n| \u003ca name=\"input_public_acl_tags\"\u003e\u003c/a\u003e [public\\_acl\\_tags](#input\\_public\\_acl\\_tags) | Additional tags for the public subnets network ACL | `map(string)` | `{}` | no |\n| \u003ca name=\"input_public_dedicated_network_acl\"\u003e\u003c/a\u003e [public\\_dedicated\\_network\\_acl](#input\\_public\\_dedicated\\_network\\_acl) | Whether to use dedicated network ACL (not default) and custom rules for public subnets | `bool` | `false` | no |\n| \u003ca name=\"input_public_inbound_acl_rules\"\u003e\u003c/a\u003e [public\\_inbound\\_acl\\_rules](#input\\_public\\_inbound\\_acl\\_rules) | Public subnets inbound network ACLs | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_public_outbound_acl_rules\"\u003e\u003c/a\u003e [public\\_outbound\\_acl\\_rules](#input\\_public\\_outbound\\_acl\\_rules) | Public subnets outbound network ACLs | `list(map(string))` | \u003cpre\u003e[\u003cbr\u003e  {\u003cbr\u003e    \"cidr_block\": \"0.0.0.0/0\",\u003cbr\u003e    \"from_port\": 0,\u003cbr\u003e    \"protocol\": \"-1\",\u003cbr\u003e    \"rule_action\": \"allow\",\u003cbr\u003e    \"rule_number\": 100,\u003cbr\u003e    \"to_port\": 0\u003cbr\u003e  }\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_public_subnets\"\u003e\u003c/a\u003e [public\\_subnets](#input\\_public\\_subnets) | cidr range of your public subnets | `list(string)` | `[]` | no |\n| \u003ca name=\"input_secondary_cidr_blocks\"\u003e\u003c/a\u003e [secondary\\_cidr\\_blocks](#input\\_secondary\\_cidr\\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Tags to apply to resources | `map(any)` | `{}` | no |\n| \u003ca name=\"input_vpc_cidr\"\u003e\u003c/a\u003e [vpc\\_cidr](#input\\_vpc\\_cidr) | CIDR for the VPC, check that this doesn't collide with an existing one | `string` | n/a | yes |\n| \u003ca name=\"input_vpc_flow_log_permissions_boundary\"\u003e\u003c/a\u003e [vpc\\_flow\\_log\\_permissions\\_boundary](#input\\_vpc\\_flow\\_log\\_permissions\\_boundary) | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no |\n| \u003ca name=\"input_vpc_flow_log_tags\"\u003e\u003c/a\u003e [vpc\\_flow\\_log\\_tags](#input\\_vpc\\_flow\\_log\\_tags) | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |\n| \u003ca name=\"input_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#input\\_vpc\\_id) | VPC id for use in cases where VPC was already created and you would like to reuse it with this module. Not required if create\\_vpc = true | `string` | `\"\"` | no |\n| \u003ca name=\"input_vpc_name\"\u003e\u003c/a\u003e [vpc\\_name](#input\\_vpc\\_name) | Name of VPC | `string` | n/a | yes |\n| \u003ca name=\"input_vpc_tags\"\u003e\u003c/a\u003e [vpc\\_tags](#input\\_vpc\\_tags) | Tags to apply to VPC | `map(any)` | `{}` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_database_network_acl_id\"\u003e\u003c/a\u003e [database\\_network\\_acl\\_id](#output\\_database\\_network\\_acl\\_id) | The ID of the database network ACL |\n| \u003ca name=\"output_database_subnet_group\"\u003e\u003c/a\u003e [database\\_subnet\\_group](#output\\_database\\_subnet\\_group) | Group name of the database subnet |\n| \u003ca name=\"output_database_subnets_cidr_blocks\"\u003e\u003c/a\u003e [database\\_subnets\\_cidr\\_blocks](#output\\_database\\_subnets\\_cidr\\_blocks) | CIDR blocks for database subnets for the VPC |\n| \u003ca name=\"output_database_subnets_ids\"\u003e\u003c/a\u003e [database\\_subnets\\_ids](#output\\_database\\_subnets\\_ids) | Intranet subnets for the VPC |\n| \u003ca name=\"output_default_network_acl_id\"\u003e\u003c/a\u003e [default\\_network\\_acl\\_id](#output\\_default\\_network\\_acl\\_id) | The ID of the default network ACL |\n| \u003ca name=\"output_default_security_group_id\"\u003e\u003c/a\u003e [default\\_security\\_group\\_id](#output\\_default\\_security\\_group\\_id) | The ID of the security group created by default on VPC creation |\n| \u003ca name=\"output_firewall_network_acl_id\"\u003e\u003c/a\u003e [firewall\\_network\\_acl\\_id](#output\\_firewall\\_network\\_acl\\_id) | The ID of the database network ACL |\n| \u003ca name=\"output_firewall_route_table_ids\"\u003e\u003c/a\u003e [firewall\\_route\\_table\\_ids](#output\\_firewall\\_route\\_table\\_ids) | List of IDs of firewall route tables |\n| \u003ca name=\"output_firewall_subnet_arns\"\u003e\u003c/a\u003e [firewall\\_subnet\\_arns](#output\\_firewall\\_subnet\\_arns) | List of ARNs of firewall subnets |\n| \u003ca name=\"output_firewall_subnets_cidr_blocks\"\u003e\u003c/a\u003e [firewall\\_subnets\\_cidr\\_blocks](#output\\_firewall\\_subnets\\_cidr\\_blocks) | CIDR blocks for firewall subnets for the VPC |\n| \u003ca name=\"output_firewall_subnets_ids\"\u003e\u003c/a\u003e [firewall\\_subnets\\_ids](#output\\_firewall\\_subnets\\_ids) | firewall subnets for the VPC |\n| \u003ca name=\"output_http_https_outgoing_security_group_id\"\u003e\u003c/a\u003e [http\\_https\\_outgoing\\_security\\_group\\_id](#output\\_http\\_https\\_outgoing\\_security\\_group\\_id) | The ID of the security group to allow HTTP/HTTPS outgoing traffic |\n| \u003ca name=\"output_https_security_group_id\"\u003e\u003c/a\u003e [https\\_security\\_group\\_id](#output\\_https\\_security\\_group\\_id) | The ID of the security group to all traffic from 443 |\n| \u003ca name=\"output_intra_subnets_cidr_blocks\"\u003e\u003c/a\u003e [intra\\_subnets\\_cidr\\_blocks](#output\\_intra\\_subnets\\_cidr\\_blocks) | CIDR blocks for intranet subnets for the VPC |\n| \u003ca name=\"output_intra_subnets_ids\"\u003e\u003c/a\u003e [intra\\_subnets\\_ids](#output\\_intra\\_subnets\\_ids) | Intranet subnets for the VPC |\n| \u003ca name=\"output_intranet_network_acl_id\"\u003e\u003c/a\u003e [intranet\\_network\\_acl\\_id](#output\\_intranet\\_network\\_acl\\_id) | The ID of the intra network ACL |\n| \u003ca name=\"output_private_network_acl_id\"\u003e\u003c/a\u003e [private\\_network\\_acl\\_id](#output\\_private\\_network\\_acl\\_id) | The ID of the privatenetwork ACL |\n| \u003ca name=\"output_private_subnets_cidr_blocks\"\u003e\u003c/a\u003e [private\\_subnets\\_cidr\\_blocks](#output\\_private\\_subnets\\_cidr\\_blocks) | CIDR blocks fo private subnets for the VPC |\n| \u003ca name=\"output_private_subnets_ids\"\u003e\u003c/a\u003e [private\\_subnets\\_ids](#output\\_private\\_subnets\\_ids) | Private subnets for the VPC |\n| \u003ca name=\"output_public_network_acl_id\"\u003e\u003c/a\u003e [public\\_network\\_acl\\_id](#output\\_public\\_network\\_acl\\_id) | The ID of the public network ACL |\n| \u003ca name=\"output_public_subnets_cidr_blocks\"\u003e\u003c/a\u003e [public\\_subnets\\_cidr\\_blocks](#output\\_public\\_subnets\\_cidr\\_blocks) | CIDR blocks for public subnets for the VPC |\n| \u003ca name=\"output_public_subnets_ids\"\u003e\u003c/a\u003e [public\\_subnets\\_ids](#output\\_public\\_subnets\\_ids) | Public subnets for the VPC |\n| \u003ca name=\"output_vpc_azs\"\u003e\u003c/a\u003e [vpc\\_azs](#output\\_vpc\\_azs) | AZs at time of creation |\n| \u003ca name=\"output_vpc_cidr_block\"\u003e\u003c/a\u003e [vpc\\_cidr\\_block](#output\\_vpc\\_cidr\\_block) | The CIDR block of the VPC |\n| \u003ca name=\"output_vpc_database_route_table_ids\"\u003e\u003c/a\u003e [vpc\\_database\\_route\\_table\\_ids](#output\\_vpc\\_database\\_route\\_table\\_ids) | List of IDs of database route tables |\n| \u003ca name=\"output_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#output\\_vpc\\_id) | ID of the created VPC |\n| \u003ca name=\"output_vpc_igw_id\"\u003e\u003c/a\u003e [vpc\\_igw\\_id](#output\\_vpc\\_igw\\_id) | IGW ID |\n| \u003ca name=\"output_vpc_intra_route_table_ids\"\u003e\u003c/a\u003e [vpc\\_intra\\_route\\_table\\_ids](#output\\_vpc\\_intra\\_route\\_table\\_ids) | List of IDs of intra route tables |\n| \u003ca name=\"output_vpc_main_route_table_id\"\u003e\u003c/a\u003e [vpc\\_main\\_route\\_table\\_id](#output\\_vpc\\_main\\_route\\_table\\_id) | The ID of the main route table associated with this VPC |\n| \u003ca name=\"output_vpc_nat_eip_ids\"\u003e\u003c/a\u003e [vpc\\_nat\\_eip\\_ids](#output\\_vpc\\_nat\\_eip\\_ids) | EIP for the NAT gateway in the VPC |\n| \u003ca name=\"output_vpc_nat_eip_public\"\u003e\u003c/a\u003e [vpc\\_nat\\_eip\\_public](#output\\_vpc\\_nat\\_eip\\_public) | Public address for the EIP on the NAT Gateway |\n| \u003ca name=\"output_vpc_nat_ids\"\u003e\u003c/a\u003e [vpc\\_nat\\_ids](#output\\_vpc\\_nat\\_ids) | NAT gateway IDs |\n| \u003ca name=\"output_vpc_private_route_table_ids\"\u003e\u003c/a\u003e [vpc\\_private\\_route\\_table\\_ids](#output\\_vpc\\_private\\_route\\_table\\_ids) | List of IDs of private route tables |\n| \u003ca name=\"output_vpc_public_route_table_ids\"\u003e\u003c/a\u003e [vpc\\_public\\_route\\_table\\_ids](#output\\_vpc\\_public\\_route\\_table\\_ids) | The IDs of the public route tables |\n| \u003ca name=\"output_vpc_region\"\u003e\u003c/a\u003e [vpc\\_region](#output\\_vpc\\_region) | The region the VPC belongs to |\n\u003c!-- END_TF_DOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgovtechsg%2Fterraform-aws-vpc-ace","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgovtechsg%2Fterraform-aws-vpc-ace","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgovtechsg%2Fterraform-aws-vpc-ace/lists"}