# vpc

Creates a VPC with public, private, and isolated subnet tiers, NAT gateways, route tables, and VPC flow logs.

Provisions a production-grade three-tier VPC with an internet gateway, Elastic IPs and NAT gateways per AZ (or a single shared NAT), separate route tables for each tier, and optional VPC flow logs to CloudWatch Logs or S3.

## Usage

```hcl
module "vpc" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__networking/vpc/aws"
  version = "0.1.0"

  name       = "prod"
  cidr_block = "10.0.0.0/16"

  public_subnets = {
    a = { cidr_block = "10.0.0.0/24", availability_zone = "us-east-1a" }
    b = { cidr_block = "10.0.1.0/24", availability_zone = "us-east-1b" }
  }

  private_subnets = {
    a = { cidr_block = "10.0.10.0/24", availability_zone = "us-east-1a" }
    b = { cidr_block = "10.0.11.0/24", availability_zone = "us-east-1b" }
  }

  isolated_subnets = {
    a = { cidr_block = "10.0.20.0/24", availability_zone = "us-east-1a" }
    b = { cidr_block = "10.0.21.0/24", availability_zone = "us-east-1b" }
  }

  flow_log_destination_arn = module.cloudwatch.log_group_arns["vpc"]
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->

## Requirements

| Name                                                                     | Version            |
| ------------------------------------------------------------------------ | ------------------ |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | >= 1.15.0, < 2.0.0 |
| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | >= 6.0, < 7.0      |

## Providers

| Name                                             | Version       |
| ------------------------------------------------ | ------------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | >= 6.0, < 7.0 |

## Resources

| Name                                                                                                                                                                            | Type     |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_ec2_transit_gateway_route_table_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_association) | resource |
| [aws_ec2_transit_gateway_route_table_propagation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_propagation) | resource |
| [aws_ec2_transit_gateway_vpc_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment)                   | resource |
| [aws_eip.nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip)                                                                                  | resource |
| [aws_flow_log.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log)                                                                       | resource |
| [aws_iam_role.flow_log](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role)                                                                   | resource |
| [aws_iam_role_policy.flow_log](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy)                                                     | resource |
| [aws_internet_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/internet_gateway)                                                       | resource |
| [aws_nat_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/nat_gateway)                                                                 | resource |
| [aws_route.isolated_tgw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route)                                                                     | resource |
| [aws_route.private_nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route)                                                                      | resource |
| [aws_route_table.isolated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table)                                                             | resource |
| [aws_route_table.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table)                                                              | resource |
| [aws_route_table.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table)                                                               | resource |
| [aws_route_table_association.isolated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association)                                     | resource |
| [aws_route_table_association.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association)                                      | resource |
| [aws_route_table_association.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table_association)                                       | resource |
| [aws_subnet.isolated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet)                                                                       | resource |
| [aws_subnet.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet)                                                                        | resource |
| [aws_subnet.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet)                                                                         | resource |
| [aws_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc)                                                                                 | resource |
| [aws_vpc_ipv4_cidr_block_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipv4_cidr_block_association)                         | resource |

## Inputs

| Name                                                                                                                                                | Description                                                                                                                                                                      | Type                                                                                                                                 | Default | Required |
| --------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------- | :------: |
| <a name="input_cidr_block"></a> [cidr_block](#input_cidr_block)                                                                                     | Primary IPv4 CIDR block for the VPC                                                                                                                                              | `string`                                                                                                                             | n/a     |   yes    |
| <a name="input_name_prefix"></a> [name_prefix](#input_name_prefix)                                                                                  | Prefix prepended to resource names created by this module                                                                                                                        | `string`                                                                                                                             | n/a     |   yes    |
| <a name="input_enable_dns_hostnames"></a> [enable_dns_hostnames](#input_enable_dns_hostnames)                                                       | Enable DNS hostnames in the VPC                                                                                                                                                  | `bool`                                                                                                                               | `true`  |    no    |
| <a name="input_enable_dns_support"></a> [enable_dns_support](#input_enable_dns_support)                                                             | Enable DNS resolution in the VPC                                                                                                                                                 | `bool`                                                                                                                               | `true`  |    no    |
| <a name="input_enable_flow_logs"></a> [enable_flow_logs](#input_enable_flow_logs)                                                                   | Enable VPC flow logs. Requires flow_log_destination_arn to be set.                                                                                                               | `bool`                                                                                                                               | `false` |    no    |
| <a name="input_enable_nat_gateway"></a> [enable_nat_gateway](#input_enable_nat_gateway)                                                             | Create NAT gateways for private subnet internet access                                                                                                                           | `bool`                                                                                                                               | `false` |    no    |
| <a name="input_flow_log_destination_arn"></a> [flow_log_destination_arn](#input_flow_log_destination_arn)                                           | CloudWatch log group ARN or S3 bucket ARN for VPC flow logs                                                                                                                      | `string`                                                                                                                             | `null`  |    no    |
| <a name="input_flow_log_role_permissions_boundary_arn"></a> [flow_log_role_permissions_boundary_arn](#input_flow_log_role_permissions_boundary_arn) | Optional permissions boundary ARN for the flow log IAM role.<br/>Leave it 'null' if this role is exempted from boundary<br/>requirements by organizational governance standards. | `string`                                                                                                                             | `null`  |    no    |
| <a name="input_flow_log_traffic_type"></a> [flow_log_traffic_type](#input_flow_log_traffic_type)                                                    | VPC flow log traffic type. ALL, ACCEPT, or REJECT                                                                                                                                | `string`                                                                                                                             | `"ALL"` |    no    |
| <a name="input_isolated_subnets"></a> [isolated_subnets](#input_isolated_subnets)                                                                   | Map of isolated (no NAT/IGW) subnet logical key to configuration                                                                                                                 | <pre>map(object({<br/> cidr_block = string<br/> availability_zone = string<br/> }))</pre>                                            | `{}`    |    no    |
| <a name="input_private_subnets"></a> [private_subnets](#input_private_subnets)                                                                      | Map of private subnet logical key to configuration                                                                                                                               | <pre>map(object({<br/> cidr_block = string<br/> availability_zone = string<br/> }))</pre>                                            | `{}`    |    no    |
| <a name="input_public_subnets"></a> [public_subnets](#input_public_subnets)                                                                         | Map of public subnet logical key to configuration                                                                                                                                | <pre>map(object({<br/> cidr_block = string<br/> availability_zone = string<br/> map_public_ip = optional(bool, false)<br/> }))</pre> | `{}`    |    no    |
| <a name="input_secondary_cidr_blocks"></a> [secondary_cidr_blocks](#input_secondary_cidr_blocks)                                                    | List of secondary IPv4 CIDR blocks to associate with the VPC                                                                                                                     | `list(string)`                                                                                                                       | `[]`    |    no    |
| <a name="input_single_nat_gateway"></a> [single_nat_gateway](#input_single_nat_gateway)                                                             | Use a single NAT gateway instead of one per AZ                                                                                                                                   | `bool`                                                                                                                               | `false` |    no    |
| <a name="input_tags"></a> [tags](#input_tags)                                                                                                       | Resource tags to apply to all resources                                                                                                                                          | `map(string)`                                                                                                                        | `{}`    |    no    |
| <a name="input_tgw_default_route_table_association"></a> [tgw_default_route_table_association](#input_tgw_default_route_table_association)          | Whether the VPC attachment should be associated with the TGW default route table                                                                                                 | `bool`                                                                                                                               | `true`  |    no    |
| <a name="input_tgw_default_route_table_propagation"></a> [tgw_default_route_table_propagation](#input_tgw_default_route_table_propagation)          | Whether the VPC attachment should propagate routes to the TGW default route table                                                                                                | `bool`                                                                                                                               | `true`  |    no    |
| <a name="input_tgw_subnet_keys"></a> [tgw_subnet_keys](#input_tgw_subnet_keys)                                                                      | Isolated subnet keys used as TGW attachment subnets, excluded from the default TGW route to avoid routing loops                                                                  | `list(string)`                                                                                                                       | `[]`    |    no    |
| <a name="input_transit_gateway_id"></a> [transit_gateway_id](#input_transit_gateway_id)                                                             | TGW ID to use as next hop for isolated subnet routes. Routes only created when set.                                                                                              | `string`                                                                                                                             | `null`  |    no    |
| <a name="input_transit_gateway_route_table_id"></a> [transit_gateway_route_table_id](#input_transit_gateway_route_table_id)                         | TGW route table ID to associate and propagate. Uses TGW default route table when null.                                                                                           | `string`                                                                                                                             | `null`  |    no    |

## Outputs

| Name                                                                                                        | Description                                                    |
| ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| <a name="output_arn"></a> [arn](#output_arn)                                                                | VPC ARN                                                        |
| <a name="output_cidr_block"></a> [cidr_block](#output_cidr_block)                                           | Primary VPC CIDR block                                         |
| <a name="output_id"></a> [id](#output_id)                                                                   | VPC ID                                                         |
| <a name="output_internet_gateway_id"></a> [internet_gateway_id](#output_internet_gateway_id)                | Internet gateway ID (null when no public subnets)              |
| <a name="output_isolated_route_table_ids"></a> [isolated_route_table_ids](#output_isolated_route_table_ids) | Map of isolated subnet key to route table ID                   |
| <a name="output_isolated_subnet_id_list"></a> [isolated_subnet_id_list](#output_isolated_subnet_id_list)    | Flat list of isolated subnet IDs                               |
| <a name="output_isolated_subnet_ids"></a> [isolated_subnet_ids](#output_isolated_subnet_ids)                | Map of isolated subnet logical key to subnet ID                |
| <a name="output_nat_gateway_ids"></a> [nat_gateway_ids](#output_nat_gateway_ids)                            | Map of NAT gateway key to NAT gateway ID                       |
| <a name="output_private_route_table_ids"></a> [private_route_table_ids](#output_private_route_table_ids)    | Map of private subnet key to route table ID                    |
| <a name="output_private_subnet_id_list"></a> [private_subnet_id_list](#output_private_subnet_id_list)       | Flat list of private subnet IDs                                |
| <a name="output_private_subnet_ids"></a> [private_subnet_ids](#output_private_subnet_ids)                   | Map of private subnet logical key to subnet ID                 |
| <a name="output_public_route_table_id"></a> [public_route_table_id](#output_public_route_table_id)          | Public route table ID (null when no public subnets)            |
| <a name="output_public_subnet_id_list"></a> [public_subnet_id_list](#output_public_subnet_id_list)          | Flat list of public subnet IDs                                 |
| <a name="output_public_subnet_ids"></a> [public_subnet_ids](#output_public_subnet_ids)                      | Map of public subnet logical key to subnet ID                  |
| <a name="output_secondary_cidr_blocks"></a> [secondary_cidr_blocks](#output_secondary_cidr_blocks)          | List of secondary CIDR blocks associated with the VPC          |
| <a name="output_tgw_attachment_id"></a> [tgw_attachment_id](#output_tgw_attachment_id)                      | TGW VPC attachment ID, null when transit_gateway_id is not set |

<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->