terraform-aws-secure-vpc

Terraform Module Registry

A terraform module to create a VPC with secure default configurations. Most configurations are based on CIS Amazon web Services Foundations and CIS Amazon Web Services Three-tier Web Architecture Benchmark.

The primary goal of this module is to create a VPC itself in a secure manner without any boilerplate code hence it does not create any subnets except ones for NAT Gateways.

Features

• Disable insecure default configurations, e.g. denying all traffic in the default security group etc.
• Enable VPC Flow Logs to monitor all traffic type.
• Create NAT Gateways in each availability zones with the dedicated subnets and Network ACL rules.
• Create route tables for public/private subnets and set the private settings as default.

Usage

data "aws_caller_identity" "current" {}

module "secure_vpc" {
  source = "nozaq/secure-vpc/aws"

  aws_account_id          = data.aws_caller_identity.current.account_id
  cidr_block              = "10.0.0.0/8"
  availability_zones      = ["ap-northeast-1a", "ap-northeast-1c"]
  nat_subnet_cidr_blocks  = ["10.0.253.0/24", "10.0.254.0/24"]
  flow_logs_iam_role_name = "FlowLogsPublisher"
  flow_logs_group_name    = "SimpleVPCFlowLogs"

  tags = {
    Environment = "SimpleVPC"
  }
}

Inputs

Outputs