# vpc-endpoints

Creates AWS PrivateLink Interface and Gateway endpoints for private connectivity to AWS services.

Provisions a configurable set of VPC endpoints — defaulting to S3 (Gateway), EC2, EC2Messages, SSM, SSMMessages, KMS, Secrets Manager, ECR API, ECR DKR, and CloudWatch Logs (all Interface). Private DNS is enabled by default for Interface endpoints, eliminating the need for internet egress to reach AWS service APIs.

## Usage

```hcl
module "vpc_endpoints" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/networking/vpc-endpoints/aws"
  version = "0.1.0"

  vpc_id             = module.vpc.id
  subnet_ids         = module.vpc.isolated_subnet_id_list
  security_group_ids = [module.security_groups.ids["endpoints"]]
  route_table_ids    = [module.vpc.public_route_table_id]
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_vpc_id"></a> [vpc_id](#input_vpc_id) | VPC ID in which to create endpoints | `string` | n/a | yes |
| <a name="input_endpoints"></a> [endpoints](#input_endpoints) | Map of endpoint definitions. service_name is the short name (e.g. s3, ec2).<br/>type is Gateway or Interface. policy is an optional JSON resource policy. | <pre>map(object({<br/>    service_name        = string<br/>    type                = optional(string, "Interface")<br/>    private_dns_enabled = optional(bool, true)<br/>    policy              = optional(string, null)<br/>  }))</pre> | <pre>{<br/>  "ec2": {<br/>    "service_name": "ec2"<br/>  },<br/>  "ec2messages": {<br/>    "service_name": "ec2messages"<br/>  },<br/>  "ecr_api": {<br/>    "service_name": "ecr.api"<br/>  },<br/>  "ecr_dkr": {<br/>    "service_name": "ecr.dkr"<br/>  },<br/>  "kms": {<br/>    "service_name": "kms"<br/>  },<br/>  "logs": {<br/>    "service_name": "logs"<br/>  },<br/>  "s3": {<br/>    "private_dns_enabled": false,<br/>    "service_name": "s3",<br/>    "type": "Gateway"<br/>  },<br/>  "secretsmanager": {<br/>    "service_name": "secretsmanager"<br/>  },<br/>  "ssm": {<br/>    "service_name": "ssm"<br/>  },<br/>  "ssmmessages": {<br/>    "service_name": "ssmmessages"<br/>  }<br/>}</pre> | no |
| <a name="input_route_table_ids"></a> [route_table_ids](#input_route_table_ids) | Route table IDs for Gateway endpoints (S3, DynamoDB) | `list(string)` | `[]` | no |
| <a name="input_security_group_ids"></a> [security_group_ids](#input_security_group_ids) | Security group IDs for Interface endpoints | `list(string)` | `[]` | no |
| <a name="input_subnet_ids"></a> [subnet_ids](#input_subnet_ids) | Subnet IDs for Interface endpoints | `list(string)` | `[]` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_dns_entries"></a> [dns_entries](#output_dns_entries) | Map of endpoint logical key to DNS entries (Interface endpoints) |
| <a name="output_endpoint_arns"></a> [endpoint_arns](#output_endpoint_arns) | Map of endpoint logical key to endpoint ARN |
| <a name="output_endpoint_ids"></a> [endpoint_ids](#output_endpoint_ids) | Map of endpoint logical key to endpoint ID |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->