Terraform / AWS VPN Creation

main.tf

resource "aws_acm_certificate" "vpn_server" {
  domain_name       = "vpn.${var.zone_domain}"
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_acm_certificate_validation" "vpn_server" {
  certificate_arn = aws_acm_certificate.vpn_server.arn

  timeouts {
    create = "1m"
  }
}

resource "aws_acm_certificate" "vpn_client_root" {
  private_key       = file("../certs/client1.domain.tld.key")
  certificate_body  = file("../certs/client1.domain.tld.crt")
  certificate_chain = file("../certs/ca.crt")
}

resource "aws_ec2_client_vpn_endpoint" "main" {
  description            = "main"
  server_certificate_arn = aws_acm_certificate_validation.vpn_server.certificate_arn
  client_cidr_block      = var.cidr
  split_tunnel           = true

  authentication_options {
    type                       = "certificate-authentication"
    root_certificate_chain_arn = aws_acm_certificate.vpn_client_root.arn
  }

  connection_log_options {
    enabled = false
  }
}

resource "aws_security_group" "vpn_access" {
  vpc_id = data.aws_vpc.main.id
  name   = "vpn-access-sg"

  ingress {
    from_port   = 443
    protocol    = "UDP"
    to_port     = 443
    cidr_blocks = ["0.0.0.0/0"]
    description = "Incoming VPN connection"
  }

  egress {
    from_port   = 0
    protocol    = "-1"
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_ec2_client_vpn_network_association" "main" {
  for_each               = data.aws_subnet_ids.private.ids
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.main.id
  subnet_id              = each.key
  security_groups        = [aws_security_group.vpn_access.id]
}

resource "aws_ec2_client_vpn_authorization_rule" "main" {
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.main.id
  target_network_cidr    = data.aws_vpc.main.cidr_block
  authorize_all_groups   = true
}

sources.tf

data "aws_caller_identity" "current" {}

data "aws_region" "current" {}

data "aws_vpc" "main" {
  tags = {
    Environment = var.env
    Name        = "main"
  }
}

data "aws_route53_zone" "public" {
  name         = "${var.zone_domain}."
  private_zone = false
}

data "aws_vpn_gateway" "main" {
  attached_vpc_id = data.aws_vpc.main.id

  tags = {
    Environment = var.env
    Name        = "main"
  }
}


data "aws_security_groups" "default" {
  filter {
    name   = "tag:Environment"
    values = [var.env]
  }

  filter {
    name   = "tag:Name"
    values = ["default"]
  }

  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }
}

data "aws_subnet_ids" "private" {
  vpc_id = data.aws_vpc.main.id
  tags = {
    Environment = var.env
    Visibility  = "private"
  }
}

variables.tf

variable "env" {
  default = "stg"
}

variable "zone_domain" {
  default = "test.com"
}