1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

# Variables ====================================================================

variable "name" {
  description = "Name for the Transit Gateway."
  type        = string
}

variable "description" {
  description = "Description of the Transit Gateway."
  type        = string
  default     = ""
}

variable "amazon_side_asn" {
  description = "BGP ASN for the Amazon side. Valid ranges: 64512–65534 (16-bit private) or 4200000000–4294967294 (32-bit private)."
  type        = number
  default     = 64512

  validation {
    condition = (
      (var.amazon_side_asn >= 64512 && var.amazon_side_asn <= 65534) ||
      (var.amazon_side_asn >= 4200000000 && var.amazon_side_asn <= 4294967294)
    )
    error_message = "amazon_side_asn must be in 64512–65534 or 4200000000–4294967294."
  }
}

variable "auto_accept_shared_attachments" {
  description = "Auto-accept cross-account VPC attachments. Must be 'enable' or 'disable'."
  type        = string
  default     = "disable"

  validation {
    condition     = contains(["enable", "disable"], var.auto_accept_shared_attachments)
    error_message = "auto_accept_shared_attachments must be 'enable' or 'disable'."
  }
}

variable "default_route_table_association" {
  description = "Associate new attachments with the default TGW route table. Must be 'enable' or 'disable'."
  type        = string
  default     = "enable"

  validation {
    condition     = contains(["enable", "disable"], var.default_route_table_association)
    error_message = "default_route_table_association must be 'enable' or 'disable'."
  }
}

variable "default_route_table_propagation" {
  description = "Propagate attachment routes to the default TGW route table. Must be 'enable' or 'disable'."
  type        = string
  default     = "enable"

  validation {
    condition     = contains(["enable", "disable"], var.default_route_table_propagation)
    error_message = "default_route_table_propagation must be 'enable' or 'disable'."
  }
}

variable "dns_support" {
  description = "DNS resolution across VPC attachments. Must be 'enable' or 'disable'."
  type        = string
  default     = "enable"

  validation {
    condition     = contains(["enable", "disable"], var.dns_support)
    error_message = "dns_support must be 'enable' or 'disable'."
  }
}

variable "vpn_ecmp_support" {
  description = "ECMP routing for VPN attachments. Must be 'enable' or 'disable'."
  type        = string
  default     = "enable"

  validation {
    condition     = contains(["enable", "disable"], var.vpn_ecmp_support)
    error_message = "vpn_ecmp_support must be 'enable' or 'disable'."
  }
}

variable "multicast_support" {
  description = "Enable multicast support. Cannot be changed after TGW creation — set intentionally."
  type        = string
  default     = "disable"

  validation {
    condition     = contains(["enable", "disable"], var.multicast_support)
    error_message = "multicast_support must be 'enable' or 'disable'."
  }
}

variable "ram_share_name" {
  description = "Name for the RAM resource share. Set to null to skip RAM sharing entirely."
  type        = string
  default     = null
}

variable "ram_allow_external_principals" {
  description = "Allow external principals (outside the AWS Organization) in the RAM share."
  type        = bool
  default     = false
}

variable "ram_principals" {
  description = "List of AWS account IDs or AWS Organizations ARNs to share the TGW with via RAM. Requires ram_share_name to be set."
  type        = list(string)
  default     = []

  validation {
    condition = alltrue([
      for p in var.ram_principals :
      can(regex("^\\d{12}$", p)) || can(regex("^arn:aws:organizations::", p))
    ])
    error_message = "Each ram_principal must be a 12-digit AWS account ID or an AWS Organizations ARN (arn:aws:organizations::...)."
  }
}

variable "route_tables" {
  description = "Map of additional TGW route tables to create beyond the default. Key is a logical identifier, value contains the Name tag."
  type = map(object({
    name = string
  }))
  default = {}
}

variable "tags" {
  description = "Tags to apply to all resources in this module."
  type        = map(string)
  default     = {}
}