Network Stack - REVIEW

[kikobr82]

Objectives:

Network stack

• vpc (/16 cidr)
• 4 subnets (/24 cidr) public/private in 2 different AZ'stack
• 2 route table public/private
• 2 nacl public/private (ALLOW ALL is not permitted)
• internet gateway

Acceptance Criteria:

• I can run a instance on public subnet and another one on private subnet
• I can access the public one using ssh from my local machine through internet
• I can't directly access the private instance from internet
• I can ssh the private instance from the public one
• no security groups or nacls have ALLOW ALL

[deniseddi]

Looking at the terraform-vpc :

• we are using 3 AZ's , requirements ask for 2 . Should we create subnets in the first two available availability zones, for example, for “private-wp-a” : availability_zone = “${data.aws_availability_zones.iac-azs.names[0]}” for “private-wp-b”: availability_zone = “${data.aws_availability_zones.iac-azs.names[1]}” for “public-wp-a”: availability_zone = “${data.aws_availability_zones.iac-azs.names[0]}" for “public-wp-b”: availability_zone = “${data.aws_availability_zones.iac-azs.names[1]}” ? Does that make sense?

[deniseddi]

I can't find if 2 Networks ACLs (public/private) have been created. I am looking for code similar to:

resource "aws_network_acl" "main" {
  vpc_id = "${aws_vpc.main.id}"

Possibly with ingress and egress rules.

[deniseddi]

In terraform-vpc/variables.tf, variable "cidr_vpc" { type = string default = "10.0.0.0/16" } Meets the requirement of /16 cidr, however, variable "private_subnet-wp-a" { type = string default = "10.0.63.0/18" } Shouldn't each be ".../24" ?

[deniseddi]

Reviewed Network Stack.

Commited changes:

• /24 cidr for the subnets, in variables.tf
• Created two NACL's (private/public)

Need to do the checks of the "Acceptance Criteria".

[deniseddi]

• Created a PR with the updated version. It also includes all other unchanged .tf files.