Skip to content

Instantly share code, notes, and snippets.

@bobbrez
Created March 27, 2022 23:37
Show Gist options
  • Save bobbrez/0e1bcb4ef376c2b7ebfed9061a74ff19 to your computer and use it in GitHub Desktop.
Save bobbrez/0e1bcb4ef376c2b7ebfed9061a74ff19 to your computer and use it in GitHub Desktop.
Terraform / AWS VPN Creation
resource "aws_acm_certificate" "vpn_server" {
domain_name = "vpn.${var.zone_domain}"
validation_method = "DNS"
lifecycle {
create_before_destroy = true
}
}
resource "aws_acm_certificate_validation" "vpn_server" {
certificate_arn = aws_acm_certificate.vpn_server.arn
timeouts {
create = "1m"
}
}
resource "aws_acm_certificate" "vpn_client_root" {
private_key = file("../certs/client1.domain.tld.key")
certificate_body = file("../certs/client1.domain.tld.crt")
certificate_chain = file("../certs/ca.crt")
}
resource "aws_ec2_client_vpn_endpoint" "main" {
description = "main"
server_certificate_arn = aws_acm_certificate_validation.vpn_server.certificate_arn
client_cidr_block = var.cidr
split_tunnel = true
authentication_options {
type = "certificate-authentication"
root_certificate_chain_arn = aws_acm_certificate.vpn_client_root.arn
}
connection_log_options {
enabled = false
}
}
resource "aws_security_group" "vpn_access" {
vpc_id = data.aws_vpc.main.id
name = "vpn-access-sg"
ingress {
from_port = 443
protocol = "UDP"
to_port = 443
cidr_blocks = ["0.0.0.0/0"]
description = "Incoming VPN connection"
}
egress {
from_port = 0
protocol = "-1"
to_port = 0
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_ec2_client_vpn_network_association" "main" {
for_each = data.aws_subnet_ids.private.ids
client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.main.id
subnet_id = each.key
security_groups = [aws_security_group.vpn_access.id]
}
resource "aws_ec2_client_vpn_authorization_rule" "main" {
client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.main.id
target_network_cidr = data.aws_vpc.main.cidr_block
authorize_all_groups = true
}
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
data "aws_vpc" "main" {
tags = {
Environment = var.env
Name = "main"
}
}
data "aws_route53_zone" "public" {
name = "${var.zone_domain}."
private_zone = false
}
data "aws_vpn_gateway" "main" {
attached_vpc_id = data.aws_vpc.main.id
tags = {
Environment = var.env
Name = "main"
}
}
data "aws_security_groups" "default" {
filter {
name = "tag:Environment"
values = [var.env]
}
filter {
name = "tag:Name"
values = ["default"]
}
filter {
name = "vpc-id"
values = [data.aws_vpc.main.id]
}
}
data "aws_subnet_ids" "private" {
vpc_id = data.aws_vpc.main.id
tags = {
Environment = var.env
Visibility = "private"
}
}
variable "env" {
default = "stg"
}
variable "zone_domain" {
default = "test.com"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment