first public release

Author: tedivm

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Robert Hafner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,43 @@
+# Teraform AWS NAT Module
+
+This module enables NAT in a specific VPC. It supports either a NAT Gateway or NAT Instance depending on preference, and can be launched in one or more Availability Zones.
+
+This module should normally be called directly from the VPC module, but exists as a standalone module mostly for cleaner code.
+
+## Usage
+
+### Example
+
+```terraform
+module "nat" {
+  source  = "tedivm/nat/aws"
+  version = "~> 1.0"
+
+  vpc                    = aws_vpc.main
+  max_availability_zones = var.max_availability_zones
+  route_tables           = aws_route_table.private
+  subnets                = aws_subnet.public
+  high_availability      = var.high_availability_nat
+  tags = local.common_tags
+}
+```
+
+### Outputs
+
+* aws_instances
+* aws_security_group
+* aws_iam_role
+* aws_eip
+
+## High Availability Mode
+
+In High Availability Mode this module runs one NAT in each availability zone. This ensures that issues in one zone do not affect the services in others. High Availability Mode also assigns each NAT Instance an Elastic IP address speed up the transfer of network connections to replacement instances.
+
+
+## Resources Affected
+
+* EC2 Instance
+* EIP (if high availability mode is set)
+* IAM Role (through the ec2_iam_profile module)
+* Routes
+* Security Group

eip.tf

@@ -0,0 +1,7 @@
+
+resource "aws_eip" "main" {
+  count    = var.high_availability ? local.nat_count : 0
+  instance = aws_instance.main[count.index].id
+  vpc      = true
+  tags     = local.common_tags
+}

iam.tf

@@ -0,0 +1,6 @@
+
+module "instance_profile" {
+  source = "../ec2_iam_profile"
+  name   = "${var.vpc.id}_NAT_Instance_Profile"
+  tags   = local.common_tags
+}

instance.tf

@@ -0,0 +1,37 @@
+
+locals {
+  nat_count = var.high_availability ? var.max_availability_zones : 1
+}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+
+  owners = ["099720109477"] # Canonical
+}
+
+resource "aws_instance" "main" {
+  count         = local.nat_count
+  ami           = data.aws_ami.ubuntu.id
+  instance_type = var.instance_type
+
+  monitoring        = true
+  source_dest_check = false
+  subnet_id         = var.subnets[count.index].id
+
+  iam_instance_profile   = module.instance_profile.aws_iam_instance_profile.name
+  vpc_security_group_ids = [aws_security_group.nat_traffic.id]
+
+  user_data = templatefile("${path.module}/templates/userdata.tmpl", { "VPC_CIDR" : var.vpc.cidr_block })
+
+  tags = local.common_tags
+}

outputs.tf

@@ -0,0 +1,16 @@
+
+output "aws_instances" {
+  value = aws_instance.main
+}
+
+output "aws_security_group" {
+  value = aws_security_group.nat_traffic
+}
+
+output "aws_iam_role" {
+  value = module.instance_profile.aws_iam_role
+}
+
+output "aws_eip" {
+  value = aws_eip.main
+}

routes.tf

@@ -0,0 +1,7 @@
+
+resource "aws_route" "route_to_nat" {
+  count                  = var.max_availability_zones
+  route_table_id         = var.route_tables[count.index].id
+  destination_cidr_block = "0.0.0.0/0"
+  instance_id            = var.high_availability ? aws_instance.main[count.index].id : aws_instance.main[0].id
+}

sg.tf

@@ -0,0 +1,23 @@
+
+resource "aws_security_group" "nat_traffic" {
+  name        = "${var.vpc.id} NAT Traffic"
+  description = "Allow internal VPC traffic and all outbound traffic"
+  vpc_id      = var.vpc.id
+
+  ingress {
+    description = "All traffic from inside VPC"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = [var.vpc.cidr_block]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = local.common_tags
+}

templates/userdata.tmpl

@@ -0,0 +1,27 @@
+Content-Type: multipart/mixed; boundary="//"
+MIME-Version: 1.0
+
+--//
+Content-Type: text/cloud-config; charset="us-ascii"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Content-Disposition: attachment; filename="cloud-config.txt"
+
+#cloud-config
+cloud_final_modules:
+- [scripts-user, always]
+
+--//
+Content-Type: text/x-shellscript; charset="us-ascii"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Content-Disposition: attachment; filename="userdata.txt"
+
+#!/bin/bash
+
+PRIMARY_INTERFACE=$(ip link | awk -F: '$0 !~ "lo|vir|wl|^[^0-9]"{print $2;getline}')
+
+echo 1 > /proc/sys/net/ipv4/ip_forward
+iptables -t nat -A POSTROUTING -o $PRIMARY_INTERFACE -s ${VPC_CIDR} -j MASQUERADE
+
+--//--

variables.tf

@@ -0,0 +1,35 @@
+
+variable "vpc" {
+  description = "The AWS_VPC that the NAT instance will be in."
+}
+
+variable "subnets" {
+  description = "A list of AWS Subnets from the Public Networks that NAT Instances can be launched into."
+}
+
+variable "instance_type" {
+  default = "t3.micro"
+}
+
+variable "route_tables" {
+  description = "A list of AWS Route Tables from the Private Networks that should route to NAT."
+}
+
+variable "max_availability_zones" {
+  description = "The number of availablity zones to launch in. This should match the route_tables and subnets count."
+}
+
+variable "high_availability" {
+  description = "When enabled servers will be launched in each subnet."
+  type        = bool
+  default     = false
+}
+
+variable "tags" {
+  description = "Tags to apply to all resources."
+  default     = {}
+}
+
+locals {
+  common_tags = merge(var.tags, { "Name" : try("${var.tags["Name"]}-NAT", "${var.vpc.id}-NAT") })
+}