1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102

# Variables ====================================================================

variable "name_prefix" {
  description = "Prefix prepended to resource names created by this module"
  type        = string

  validation {
    condition     = length(trimspace(var.name_prefix)) > 0
    error_message = "name_prefix must not be empty."
  }
}

variable "endpoints" {
  description = "Map of resolver endpoint logical key to configuration"
  type = map(object({
    direction            = string
    endpoint_name_suffix = string
    endpoint_type        = optional(string, "IPV4")
    security_group_ids   = list(string)
    interfaces = list(object({
      subnet_id = string
      ip        = optional(string)
    }))
    tags = optional(map(string), {})
  }))
  default = {}

  validation {
    condition = alltrue([
      for k, v in var.endpoints : contains(["INBOUND", "OUTBOUND"], v.direction)
    ])
    error_message = "endpoints direction must be either INBOUND or OUTBOUND."
  }

  validation {
    condition = alltrue([
      for k, v in var.endpoints : contains(["IPV4", "IPV6", "DUALSTACK"], v.endpoint_type)
    ])
    error_message = "endpoints endpoint_type must be one of IPV4, IPV6, or DUALSTACK."
  }

  validation {
    condition = alltrue([
      for k, v in var.endpoints : can(regex("^[a-z0-9]+(-[a-z0-9]+)*$", v.endpoint_name_suffix))
    ])
    error_message = <<-EOT
      One or more endpoint_name_suffix values are not in kebab-case format.
      Use lowercase alphanumeric segments separated by single hyphens.
      No leading or trailing hyphens, no double hyphens, no underscores.
    EOT
  }
}

variable "rules" {
  description = <<-EOT
    Map of resolver rule logical key to configuration.
    endpoint_key must reference an OUTBOUND entry in var.endpoints.
  EOT
  type = map(object({
    domain_name      = string
    rule_type        = optional(string, "FORWARD")
    endpoint_key     = string
    rule_name_suffix = string
    target_ips = list(object({
      ip   = string
      port = optional(number, 53)
    }))
    vpc_ids = list(string)
    tags    = optional(map(string), {})
  }))
  default = {}

  validation {
    condition = alltrue([
      for k, v in var.rules : contains(["FORWARD", "RECURSIVE"], v.rule_type)
    ])
    error_message = <<-EOT
      One or more rule_type values are invalid.
      Valid values are FORWARD or RECURSIVE.

      SYSTEM rules are created automatically by AWS for a VPC's default
      domain and are not supported by this module.
    EOT
  }

  validation {
    condition = alltrue([
      for k, v in var.rules : can(regex("^[a-z0-9]+(-[a-z0-9]+)*$", v.rule_name_suffix))
    ])
    error_message = <<-EOT
      One or more rule_name_suffix values are not in kebab-case format.
      Use lowercase alphanumeric segments separated by single hyphens.
      No leading or trailing hyphens, no double hyphens, no underscores.
    EOT
  }
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}