vpc-endpoints

Creates AWS PrivateLink Interface and Gateway endpoints for private connectivity to AWS services.

Provisions a configurable set of VPC endpoints — defaulting to S3 (Gateway), EC2, EC2Messages, SSM, SSMMessages, KMS, Secrets Manager, ECR API, ECR DKR, and CloudWatch Logs (all Interface). Private DNS is enabled by default for Interface endpoints, eliminating the need for internet egress to reach AWS service APIs.

Usage

module "vpc_endpoints" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/networking/vpc-endpoints/aws"
  version = "0.1.0"

  vpc_id             = module.vpc.id
  subnet_ids         = module.vpc.isolated_subnet_id_list
  security_group_ids = [module.security_groups.ids["endpoints"]]
  route_table_ids    = [module.vpc.public_route_table_id]
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_vpc_endpoint.this	resource

Inputs

Name	Description	Type	Default	Required
vpc_id	VPC ID in which to create endpoints	string	n/a	yes
endpoints	Map of endpoint definitions. service_name is the short name (e.g. s3, ec2).type is Gateway or Interface. policy is an optional JSON resource policy.	map(object({ service_name = string type = optional(string, "Interface") private_dns_enabled = optional(bool, true) policy = optional(string, null) }))	{ "ec2": { "service_name": "ec2" }, "ec2messages": { "service_name": "ec2messages" }, "ecr_api": { "service_name": "ecr.api" }, "ecr_dkr": { "service_name": "ecr.dkr" }, "kms": { "service_name": "kms" }, "logs": { "service_name": "logs" }, "s3": { "private_dns_enabled": false, "service_name": "s3", "type": "Gateway" }, "secretsmanager": { "service_name": "secretsmanager" }, "ssm": { "service_name": "ssm" }, "ssmmessages": { "service_name": "ssmmessages" }}	no
route_table_ids	Route table IDs for Gateway endpoints (S3, DynamoDB)	list(string)	[]	no
security_group_ids	Security group IDs for Interface endpoints	list(string)	[]	no
subnet_ids	Subnet IDs for Interface endpoints	list(string)	[]	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
dns_entries	Map of endpoint logical key to DNS entries (Interface endpoints)
endpoint_arns	Map of endpoint logical key to endpoint ARN
endpoint_ids	Map of endpoint logical key to endpoint ID