Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.
https://github.com/aws-samples/aws-network-hub-for-terraform

This repository demonstrates a scalable, segregated, secured AWS network hub for multi-account organizations using Terraform.
https://github.com/aws-samples/aws-network-hub-for-terraform
amazon-web-services automation aws aws-orga centralised-networking example hashicorp iac iam infrastructure-as-code network network-firewall network-hub ram route53 route53-resolver terraform transit-gateway vpc-endpoints vpc-flowlogs
Last synced: 24 days ago
JSON representation
This repository demonstrates a scalable, segregated, secured AWS network hub for multi-account organizations using Terraform.
Host: GitHub
URL: https://github.com/aws-samples/aws-network-hub-for-terraform
Owner: aws-samples
License: mit-0
Created: 2022-01-21T10:15:47.000Z (over 2 years ago)
Default Branch: main
Last Pushed: 2024-06-11T14:55:42.000Z (25 days ago)
Last Synced: 2024-06-11T21:42:02.355Z (25 days ago)
Topics: amazon-web-services, automation, aws, aws-orga, centralised-networking, example, hashicorp, iac, iam, infrastructure-as-code, network, network-firewall, network-hub, ram, route53, route53-resolver, terraform, transit-gateway, vpc-endpoints, vpc-flowlogs
Language: HCL
Homepage:
Size: 1.16 MB
Stars: 92
Watchers: 6
Forks: 23
Open Issues: 7
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
Lists

awesome-stars - aws-network-hub-for-terraform - account organizations using Terraform. | aws-samples | 93 | (HCL)
README

        

# Network Hub Account with Terraform

This repository demonstrates a **scalable, segregated, secured** AWS network for **multi-account organizations**.

Using Transit Gateway to separate production, non-production and shared services traffic,

it deploys an advanced AWS networking pattern using centralized ingress and egress behind Network Firewall,

centralizes private VPC endpoints to share across all VPCs, and manages IP address allocation using Amazon VPC IPAM.

- Perfect for a central networking hub account, potentially alongside Account Factory for Terraform

- Solution itself can be deployed into nonprod, test and production deployments for safe iteration and testing.

- Written using clean, composable modules: the solution is easily extended and customised.

[Spoke VPCs for organization members can be created using the provided sister example in this repo.](/example-spoke-vpc/README.md)

The following resources will be deployed by this example:

- VPC Transit Gateway

- VPC Endpoints

- AWS Network Firewall

- Route 53 Resolver

- Amazon VPC IP Address Manager

The resources deployed and the architectural pattern they follow are provided for demonstration and

testing purposes but are based on and inspired by AWS best practice and articles.

## Table of Contents

- [Overview](#overview)

  - [Diagrams](#diagrams)

  - [References](#references)

- [Prerequisites](#prerequisites)

  - [Variables](#variables)

- [Quick Start](#quick-start)

  - [Deploy from client machine](#deploy-from-client-machine)

  - [Validate Deployment](#validate-deployment)

  - [Tagging](#tagging)

  - [clean Up](#clean-up)

- [Terraform Docs](#terraform-docs)

- [Security](#security)

- [License](#license)

## Overview

### Diagrams

Solution Diagram

![diagram](images/diagram.png)

Transit Gateway

![tgw](images/tgw.png)

VPC Endpoints

![vpc_endpoints](images/vpce.png)

Network Firewall

![nfw](images/nfw.png)

Route 53 Resolver

![dns](images/dns.png)

### References

- 

- 

- 

- 

- 

- 

---

## Prerequisites

Minimal tooling is required for this solution. However, there are hard requirements around

AWS configuration.

### Tooling

- Terraform ~> 1.1

  - AWS provider >= 4.4.0

- AWS CLI

- Git CLI

### AWS account configuration

- AWS Organization

- Centralised network account

- IAM role with required permissions

- RAM sharing enabled for the Organisation

```bash

aws ram enable-sharing-with-aws-organization

```

![ram](images/RAM_Enabled.png)

**Troubleshooting tip**

If you experience any issue with the RAM share disable and re-enable RAM.

```bash

aws organizations disable-aws-service-access --service-principal ram.amazonaws.com

```

- IPAM delegated from the master account to the Centralised network account

```bash

aws ec2 enable-ipam-organization-admin-account \

    --delegated-admin-account-id 

```

![ipam](images/IPAM_Delegated.png)

### Customisation

If you do not define a remote backend Terraform will use the local directory to store the backend files

including tfstate. Examples of how to customise the Terraform backend are included but commented out.

Usual caveats around safe storage of Terraform state must be considered.

![backend](images/backend.png)

Example GitLab HTTP backend for use with GitLab CI.

![http_backend](images/http_backend.png)

### Variables

| Type                           | Variable Name    | Description                                                      | Notes                                       |

| ------------------------------ | ---------------- | ---------------------------------------------------------------- | ------------------------------------------- |

| Global variables               | environment      | Environment to deploy into.                                      | Accepted values \* dev, test, preprod, prod |

|                                | aws_region       | Region to deploy in.                                             |                                             |

|                                | vpc_endpoints    | List of centralised VPC endpoints to be deployed                 |                                             |

| Environment specific variables | ipam_cidr        | CIDR to be allocated to the IP Address Manager                   |                                             |

|                                | tgw_route_tables | Transit Gateway Router Tables to create                          |                                             |

|                                | root_domain      | Root DNS domain to create private hosted zone and resolver rules |                                             |

**Input Variable -** _config.auto.tfvars_

```terraform

aws_region    = "eu-west-2"

vpc_endpoints = ["ec2", "rds", "sqs", "sns", "ssm", "logs", "ssmmessages", "ec2messages", "autoscaling", "ecs", "athena"]

env_config = {

  dev = {

    ipam_cidr        = "10.0.0.0/10"

    tgw_route_tables = ["prod", "dev", "shared"]

    root_domain      = "network-dev.internal"

  }

  test = {

    ipam_cidr        = "10.64.0.0/10"

    tgw_route_tables = ["prod", "dev", "shared"]

    root_domain      = "network-test.internal"

  }

  preprod = {

    ipam_cidr        = "10.128.0.0/10"

    tgw_route_tables = ["prod", "dev", "shared"]

    root_domain      = "network-preprod.internal"

  }

  prod = {

    ipam_cidr        = "10.192.0.0/10"

    tgw_route_tables = ["prod", "dev", "shared"]

    root_domain      = "network-prod.internal"

  }

}

```

---

## Quick Start

### Deploy from client machine

When deploying from your local machine having configured the **TF Backend** in the code you need to ensure you have access to read and write to the backend - possible backends include HTTP, Consul, Postgres, Artifactory, S3 or S3 + DynamoDB. We initialise the Terraform, complete the validate and format. Review the plan and then apply.

- `terraform init`

- `terraform validate`

- set environment for deployment

  - `export TF_VAR_environment="$ENV"`

  - `Set-Item -Path env:TF_VAR_environment -Value "$ENV"`

    (Possible $ENV values - `dev`, `test`, `preprod`, `prod`)

- `terraform plan`

- `terraform apply` **or** `terraform apply --auto-approve`

---

### Tagging

Tags are added to all AWS resources through use of the tag configuration of the AWS Provider.

As not all AWS resources support default tags passed from the provider (EC2 Auto-Scaling Group + Launch Template)

We pass the tags as a variable (Map(string) - these are defined in the root locals.tf file.

![provider](images/provider.png)

**Example Tags -** _locals.tf_

```terraform

tags = {

  Product    = "Network_Automation"

  Owner      = "GitHub"

  Project_ID = "12345"

}

```

### Clean Up

Remember to clean up after your work is complete. You can do that by doing `terraform destroy`.

Note that this command will delete all the resources previously created by Terraform.

## Terraform Docs

### Terraform Deployment

#### Requirements

| Name | Version |

|------|---------|

| terraform | ~> 1.1 |

| aws | >= 4.4.0 |

#### Providers

| Name | Version |

|------|---------|

| aws | 4.5.0 |

#### Modules

| Name | Source | Version |

|------|--------|---------|

| dns | ./modules/dns | n/a |

| ipam | ./modules/ipam | n/a |

| network_firewall_vpc | ./modules/network_firewall_vpc | n/a |

| tgw | ./modules/tgw | n/a |

| vpc_endpoints | ./modules/vpc_endpoints | n/a |

#### Resources

| Name | Type |

|------|------|

| [aws_iam_policy.central_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |

| [aws_iam_policy_attachment.central_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource |

| [aws_iam_role.central_network](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |

| [aws_iam_role.flow_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |

| [aws_iam_role_policy.flow_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |

| [aws_kms_key.log_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |

| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |

| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |

| [aws_iam_policy_document.policy_kms_logs_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_organizations_organization.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organization) | data source |

#### Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

| aws_region | AWS region being deployed to | `string` | n/a | yes |

| env_config | Map of objects for per environment configuration | 
map(object({
    ipam_cidr        = string
    tgw_route_tables = list(string)
    root_domain      = string
  })) | n/a | yes |

| environment | Deployment environment passed as argument or environment variable | `string` | n/a | yes |

| tags | Default tags to apply to all resources | `map(string)` | n/a | yes |

| vpc_endpoints | Which VPC endpoints to use | `list(string)` | n/a | yes |

#### Outputs

No outputs.

### TGW Module

#### Requirements

No requirements.

#### Providers

| Name | Version |

|------|---------|

| aws | n/a |

#### Modules

No modules.

#### Resources

| Name | Type |

|------|------|

| [aws_ec2_transit_gateway.org_tgw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway) | resource |

| [aws_ec2_transit_gateway_route.blackhole_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource |

| [aws_ec2_transit_gateway_route.default_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource |

| [aws_ec2_transit_gateway_route.default_route_ipv6](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route) | resource |

| [aws_ec2_transit_gateway_route_table.org_tgw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table) | resource |

| [aws_ram_principal_association.org](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_principal_association) | resource |

| [aws_ram_resource_association.tgw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_association) | resource |

| [aws_ram_resource_share.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share) | resource |

#### Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

| az_names | A list of the Availability Zone names available to the account | `list(string)` | n/a | yes |

| cidr | Corporate CIDR range for use with blackholing traffic between production and development environments | `string` | n/a | yes |

| environment | Deployment environment passed as argument or environment variable | `string` | n/a | yes |

| inspection_attachment | Inspection VPC attachment for default route | `string` | n/a | yes |

| org_arn | The ARN of the AWS Organization this account belongs to | `string` | n/a | yes |

| tgw_route_tables | List of route tables to create for the transit gateway | `list(string)` | n/a | yes |

#### Outputs

| Name | Description |

|------|-------------|

| tgw | TGW ID for VPC attachments |

| tgw_route_table | Map of route tables used for association and propagation |

### IPAM Module

#### Requirements

No requirements.

#### Providers

| Name | Version |

|------|---------|

| aws | n/a |

#### Modules

No modules.

#### Resources

| Name | Type |

|------|------|

| [aws_ram_principal_association.org](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_principal_association) | resource |

| [aws_ram_resource_association.ipam](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_association) | resource |

| [aws_ram_resource_share.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share) | resource |

| [aws_ssm_parameter.ipam_pool_id](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |

| [aws_vpc_ipam.org_ipam](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam) | resource |

| [aws_vpc_ipam_pool.private_org_ipam_pool](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_pool) | resource |

| [aws_vpc_ipam_pool_cidr.private_org_ipam_pool](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_pool_cidr) | resource |

| [aws_vpc_ipam_scope.private_org_ipam_scope](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_scope) | resource |

#### Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

| aws_region | AWS region being deployed to | `string` | n/a | yes |

| ipam_cidr | CIDR block assigned to IPAM pool | `string` | n/a | yes |

| org_arn | The ARN of the AWS Organization this account belongs to | `string` | n/a | yes |

#### Outputs

| Name | Description |

|------|-------------|

| org_ipam | Org IPAM ID |

| org_ipam_pool | Org IPAM pool ID |

### VPC Endpoint Module

#### Requirements

No requirements.

#### Providers

| Name | Version |

|------|---------|

| aws | n/a |

#### Modules

No modules.

#### Resources

| Name | Type |

|------|------|

| [aws_cloudwatch_log_group.flow_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |

| [aws_default_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | resource |

| [aws_ec2_transit_gateway_route_table_association.shared](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_association) | resource |

| [aws_ec2_transit_gateway_route_table_propagation.org](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_propagation) | resource |

| [aws_ec2_transit_gateway_vpc_attachment.vpc_endpoint](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) | resource |

| [aws_flow_log.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |

| [aws_route.default_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.default_route_ipv6](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route53_record.dev_ns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |

| [aws_route53_zone.interface_phz](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource |

| [aws_route_table.endpoint_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource |

| [aws_route_table_association.attachment_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |

| [aws_route_table_association.endpoint_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |

| [aws_security_group.allow_vpc_endpoint](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |

| [aws_security_group_rule.org_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |

| [aws_subnet.attachment_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |

| [aws_subnet.endpoint_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |

| [aws_vpc.endpoint_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc) | resource |

| [aws_vpc_dhcp_options.endpoint_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options) | resource |

| [aws_vpc_dhcp_options_association.endpoint_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options_association) | resource |

| [aws_vpc_endpoint.interface](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |

#### Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

| az_names | A list of the Availability Zone names available to the account | `list(string)` | n/a | yes |

| cidr | Corporate CIDR range for use with blackholing traffic between production and development environments | `string` | n/a | yes |

| environment | Deployment environment passed as argument or environment variable | `string` | n/a | yes |

| iam_role_arn | IAM role to allow VPC Flow Logs to write to CloudWatch | `string` | n/a | yes |

| interface_endpoints | Object representing the region and services to create interface endpoints for | `map(string)` | n/a | yes |

| kms_key_id | VPC Flow Logs KMS key to encrypt logs | `string` | n/a | yes |

| org_ipam_pool | IPAM pool ID to allocate CIDR space | `string` | n/a | yes |

| tgw | TGW ID for VPC attachments | `string` | n/a | yes |

| tgw_route_tables | TGW route tables for VPC association and propagation | `map(string)` | n/a | yes |

#### Outputs

No outputs.

### DNS Module

#### Requirements

No requirements.

#### Providers

| Name | Version |

|------|---------|

| aws | n/a |

#### Modules

No modules.

#### Resources

| Name | Type |

|------|------|

| [aws_cloudwatch_log_group.flow_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |

| [aws_default_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | resource |

| [aws_ec2_transit_gateway_route_table_association.shared](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_association) | resource |

| [aws_ec2_transit_gateway_route_table_propagation.org](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_propagation) | resource |

| [aws_ec2_transit_gateway_vpc_attachment.vpc_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) | resource |

| [aws_flow_log.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |

| [aws_ram_principal_association.org](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_principal_association) | resource |

| [aws_ram_resource_association.r53r](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_association) | resource |

| [aws_ram_resource_share.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share) | resource |

| [aws_route.default_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.default_route_ipv6](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route53_resolver_endpoint.inbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_endpoint) | resource |

| [aws_route53_resolver_endpoint.outbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_endpoint) | resource |

| [aws_route53_resolver_rule.fwd](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_rule) | resource |

| [aws_route53_resolver_rule_association.org_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_rule_association) | resource |

| [aws_route53_zone.root_private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource |

| [aws_route_table.dns_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource |

| [aws_route_table_association.attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |

| [aws_route_table_association.privatesubnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |

| [aws_security_group.allow_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |

| [aws_security_group_rule.dns_tcp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |

| [aws_subnet.attachment_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |

| [aws_subnet.endpoint_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |

| [aws_vpc.dns_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc) | resource |

| [aws_vpc_dhcp_options.dns_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options) | resource |

| [aws_vpc_dhcp_options_association.dns_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options_association) | resource |

#### Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

| az_names | A list of the Availability Zone names available to the account | `list(string)` | n/a | yes |

| cidr | Corporate CIDR range for use with blackholing traffic between production and development environments | `string` | n/a | yes |

| environment | Deployment environment passed as argument or environment variable | `string` | n/a | yes |

| iam_role_arn | IAM role to allow VPC Flow Logs to write to CloudWatch | `string` | n/a | yes |

| interface_endpoints | Object representing the region and services to create interface endpoints for | `map(string)` | n/a | yes |

| kms_key_id | VPC Flow Logs KMS key to encrypt logs | `string` | n/a | yes |

| org_arn | The ARN of the AWS Organization this account belongs to | `string` | n/a | yes |

| org_ipam_pool | IPAM pool ID to allocate CIDR space | `string` | n/a | yes |

| root_domain | Root domain for private hosted zone delegation | `string` | n/a | yes |

| tgw | TGW ID for VPC attachments | `string` | n/a | yes |

| tgw_route_tables | TGW route tables for VPC association and propagation | `map(string)` | n/a | yes |

#### Outputs

No outputs.

### Network Firewall Module

#### Requirements

No requirements.

#### Providers

| Name | Version |

|------|---------|

| aws | n/a |

#### Modules

No modules.

#### Resources

| Name | Type |

|------|------|

| [aws_cloudwatch_log_group.flow_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |

| [aws_cloudwatch_log_group.network_firewall_alert_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |

| [aws_cloudwatch_log_group.network_firewall_flow_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |

| [aws_default_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | resource |

| [aws_ec2_transit_gateway_route_table_association.shared](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_association) | resource |

| [aws_ec2_transit_gateway_route_table_propagation.org](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_propagation) | resource |

| [aws_ec2_transit_gateway_vpc_attachment.vpc_inspection](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) | resource |

| [aws_egress_only_internet_gateway.eigw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/egress_only_internet_gateway) | resource |

| [aws_eip.internet_vpc_nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |

| [aws_flow_log.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |

| [aws_internet_gateway.igw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/internet_gateway) | resource |

| [aws_nat_gateway.internet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/nat_gateway) | resource |

| [aws_networkfirewall_firewall.inspection_vpc_network_firewall](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall) | resource |

| [aws_networkfirewall_firewall_policy.anfw_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy) | resource |

| [aws_networkfirewall_logging_configuration.network_firewall_alert_logging_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_logging_configuration) | resource |

| [aws_networkfirewall_rule_group.block_domains](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_rule_group) | resource |

| [aws_route.default_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.default_route_ipv6](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.egress_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.egress_route_ipv6](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.ingress_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.inspection_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.inspection_route_ipv6](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.inspection_route_natgw_ipv6](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route.internal_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |

| [aws_route_table.attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource |

| [aws_route_table.inspection](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource |

| [aws_route_table.internet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table) | resource |

| [aws_route_table_association.attachment_subnet_rt_association](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |

| [aws_route_table_association.inspection_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |

| [aws_route_table_association.internet_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association) | resource |

| [aws_subnet.attachment_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |

| [aws_subnet.inspection_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |

| [aws_subnet.internet_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet) | resource |

| [aws_vpc.inspection_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc) | resource |

| [aws_vpc_dhcp_options.inspection_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options) | resource |

| [aws_vpc_dhcp_options_association.inspection_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_dhcp_options_association) | resource |

#### Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

| aws_region | AWS region being deployed to | `string` | n/a | yes |

| az_names | A list of the Availability Zone names available to the account | `list(string)` | n/a | yes |

| cidr | Corporate CIDR range for use with blackholing traffic between production and development environments | `string` | n/a | yes |

| environment | Deployment environment passed as argument or environment variable | `string` | n/a | yes |

| iam_role_arn | IAM role to allow VPC Flow Logs to write to CloudWatch | `string` | n/a | yes |

| kms_key_id | VPC Flow Logs KMS key to encrypt logs | `string` | n/a | yes |

| org_ipam_pool | IPAM pool ID to allocate CIDR space | `string` | n/a | yes |

| tgw | TGW ID for VPC attachments | `string` | n/a | yes |

| tgw_route_tables | TGW route tables for VPC association and propagation | `map(string)` | n/a | yes |

#### Outputs

| Name | Description |

|------|-------------|

| eni_map | Output ENI map |

| firewall_info | Info of network firewall for routing |

| inspection_attachment | Inspection TGW attachment ID for default route in TGW |

| route_table | Output route tables used for NFW |

| rt_map | Output RT map |

## Security

See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.

## License

This library is licensed under the MIT-0 License. See the LICENSE file.