module "key_pair_vpn" {
  source             = "saturnops/keypair/aws"
  environment        = "production"
  key_name           = format("%s-%s-vpn", "production", "skaf")
  ssm_parameter_path = format("%s-%s-vpn", "production", "skaf")
}


module "vpc" {
  source = "saturnops/vpc/aws"
  name                                            = "skaf"
  vpc_cidr                                        = "10.0.0.0/16"
  environment                                     = "production"
  ipv6_enabled                                    = true
  create_ipam_pool                                = false
  ipam_enabled                                    = false
  flow_log_enabled                                = true
  vpn_key_pair_name                               = module.key_pair_vpn.key_pair_name
  availability_zones                              = ["us-east-1a", "us-east-1b"]
  vpn_server_enabled                              = false
  intra_subnet_enabled                            = true
  auto_assign_public_ip                           = true
  public_subnet_enabled                           = true
  private_subnet_enabled                          = true
  one_nat_gateway_per_az                          = true
  database_subnet_enabled                         = true
  vpn_server_instance_type                        = "t3a.small"
  vpc_s3_endpoint_enabled                         = true
  vpc_ecr_endpoint_enabled                        = true
  flow_log_max_aggregation_interval               = 60
  flow_log_cloudwatch_log_group_skip_destroy      = true
  flow_log_cloudwatch_log_group_retention_in_days = 90
  flow_log_cloudwatch_log_group_kms_key_arn       = "arn:aws:kms:us-east-2:222222222222:key/kms_key_arn" #Enter your kms key arn
}

Refer this for more examples.

To avoid interruptions during the destruction process, ensure that any resources created outside of Terraform, which are connected to Terraform-managed resources, are deleted before destroying the module.

The private key generated by Keypair module will be stored in AWS Systems Manager Parameter Store. For more details refer this

To encrypt the VPC flow log CloudWatch log group, please use the following KMS key policy. Make sure to replace the account ID and region with your specific details.

{
    "Version": "2012-10-17",
    "Id": "allow-cloudwatch-logs-encryption",
    "Statement": [
        {
            "Sid": "AllowRootFullPermissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::12345678:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "AllowCloudWatchLogsEncryption",
            "Effect": "Allow",
            "Principal": {
                "Service": "logs.us-east-2.amazonaws.com"
            },
            "Action": [
                "kms:Encrypt*",
                "kms:Decrypt*",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:Describe*"
            ],
            "Resource": "*"
        }
    ]
}

Users need to declare vpc_cidr and subnets are calculated with the help of in-built functions.

This module supports three scenarios to create Network resource on AWS. Each will be explained in brief in the corresponding sections.

• simple-vpc (default behavior): To create a VPC with public subnets and IGW.

  • vpc_cidr = ""
  • public_subnet_enabled = true
  • auto_assign_public_ip = true

• vpc-with-private-sub: To create a VPC with public subnets, private subnets, IGW gateway and NAT gateway.

  • vpc_cidr = ""
  • public_subnet_enabled = true
  • private_subnet_enabled = true
  • auto_assign_public_ip = true

• complete-vpc-with-vpn: To create a VPC with public, private, database and intra subnets along with an IGW and NAT gateway. Jump server/Bastion Host is also configured.

  • vpc_cidr = ""
  • public_subnet_enabled = true
  • private_subnet_enabled = true
  • database_subnet_enabled = true
  • intra_subnet_enabled = true
  • auto_assign_public_ip = true
  • one_nat_gateway_per_az = true
  • vpn_server_enabled = true
  • vpn_server_instance_type = "t3a.small"
  • vpn_key_pair_name = ""
  • availability_zones = 2
  • flow_log_enabled = true
  • flow_log_max_aggregation_interval = 60
  • flow_log_cloudwatch_log_group_retention_in_days = 90
  • flow_log_cloudwatch_log_group_kms_key_arn = "arn:aws:kms:us-east-2:222222222222:key/kms_key_arn"

• vpc-peering: VPC peering support is available using submodule vpc_peering. Refer Peering Docs for more information

  • accepter_name = ""
  • accepter_vpc_id = ""
  • accepter_vpc_region = ""
  • requester_name = ""
  • requester_vpc_id = ""
  • requester_vpc_region = ""
  • auto_assign_public_ip = true
  • one_nat_gateway_per_az = true

• vpc-with-ipv6: To create VPC with IPv6 support, you only need to enable the parameter ipv6_enabled. Rest all the configurations will be taken care by module. Refer for example vpc-with-ipv6 for more information.

  • vpc_cidr = ""
  • public_subnet_enabled = true
  • private_subnet_enabled = true
  • database_subnet_enabled = true
  • intra_subnet_enabled = true
  • auto_assign_public_ip = true
  • ipv6_enabled = true
  • public_subnet_assign_ipv6_address_on_creation = true
  • private_subnet_assign_ipv6_address_on_creation = true
  • database_subnet_assign_ipv6_address_on_creation = true
  • intra_subnet_assign_ipv6_address_on_creation = true

The required IAM permissions to create resources from this module can be found here

We are using Pritunl as VPN. It is using Ubuntu 22.04 image as underlying OS. To configure Pritunl VPN:

  1. Access the Pritunl UI over HTTPS using the public IP of EC2 instance in browser
  2. Retrieve the initial key, user and password for setting up Pritunl from AWS Secrets Manager and log in to Pritunl.
  3. Create a DNS record mapping to the EC2 instance's public IP
  4. After login, in the Initial setup window, add the record created in the 'Lets Encrypt Domain' field.
  5. Pritunl will automatically configure a signed SSL certificate from Lets Encrypt.
  6. Add organization and user to pritunl.
  7. Add server and set port as 10150 which is already allowed from security group while creating instance for VPN server.
  8. Attach organization to the server and Start the server.
  9. Copy or download user profile link or file.
 10. Import the profile in Pritunl client.

[
  {
    "action": "deny",
    "cidr_block": "0.0.0.0/0",
    "from_port": 22,
    "protocol": "tcp",
    "rule_no": 98,
    "to_port": 22
  },
  {
    "action": "deny",
    "cidr_block": "0.0.0.0/0",
    "from_port": 3389,
    "protocol": "tcp",
    "rule_no": 99,
    "to_port": 3389
  },
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]

• Please give our GitHub repository a ⭐️ to show your support and increase its visibility.