1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143

# Variables ====================================================================

variable "name_prefix" {
  description = "Prefix prepended to resource names created by this module"
  type        = string

  validation {
    condition     = length(trimspace(var.name_prefix)) > 0
    error_message = "name_prefix must not be empty."
  }
}

variable "cidr_block" {
  description = "Primary IPv4 CIDR block for the VPC"
  type        = string
}

variable "secondary_cidr_blocks" {
  description = "List of secondary IPv4 CIDR blocks to associate with the VPC"
  type        = list(string)
  default     = []
}

variable "enable_dns_hostnames" {
  description = "Enable DNS hostnames in the VPC"
  type        = bool
  default     = true
}

variable "enable_dns_support" {
  description = "Enable DNS resolution in the VPC"
  type        = bool
  default     = true
}

variable "public_subnets" {
  description = "Map of public subnet logical key to configuration"
  type = map(object({
    cidr_block        = string
    availability_zone = string
    map_public_ip     = optional(bool, false)
  }))
  default = {}
}

variable "private_subnets" {
  description = "Map of private subnet logical key to configuration"
  type = map(object({
    cidr_block        = string
    availability_zone = string
  }))
  default = {}
}

variable "isolated_subnets" {
  description = "Map of isolated (no NAT/IGW) subnet logical key to configuration"
  type = map(object({
    cidr_block        = string
    availability_zone = string
  }))
  default = {}
}

variable "enable_nat_gateway" {
  description = "Create NAT gateways for private subnet internet access"
  type        = bool
  default     = false
}

variable "single_nat_gateway" {
  description = "Use a single NAT gateway instead of one per AZ"
  type        = bool
  default     = false
}

variable "transit_gateway_id" {
  description = "TGW ID to use as next hop for isolated subnet routes. Routes only created when set."
  type        = string
  default     = null
}

variable "transit_gateway_route_table_id" {
  description = "TGW route table ID to associate and propagate. Uses TGW default route table when null."
  type        = string
  default     = null
}

variable "tgw_subnet_keys" {
  description = "Isolated subnet keys used as TGW attachment subnets, excluded from the default TGW route to avoid routing loops"
  type        = list(string)
  default     = []
}

variable "tgw_default_route_table_association" {
  description = "Whether the VPC attachment should be associated with the TGW default route table"
  type        = bool
  default     = true
}

variable "tgw_default_route_table_propagation" {
  description = "Whether the VPC attachment should propagate routes to the TGW default route table"
  type        = bool
  default     = true
}

variable "enable_flow_logs" {
  description = "Enable VPC flow logs. Requires flow_log_destination_arn to be set."
  type        = bool
  default     = false
}

variable "flow_log_role_permissions_boundary_arn" {
  description = <<-EOT
    Optional permissions boundary ARN for the flow log IAM role.
    Leave it 'null' if this role is exempted from boundary
    requirements by organizational governance standards.
  EOT
  type        = string
  default     = null
}

variable "flow_log_destination_arn" {
  description = "CloudWatch log group ARN or S3 bucket ARN for VPC flow logs"
  type        = string
  default     = null
}

variable "flow_log_traffic_type" {
  description = "VPC flow log traffic type. ALL, ACCEPT, or REJECT"
  type        = string
  default     = "ALL"

  validation {
    condition     = contains(["ALL", "ACCEPT", "REJECT"], var.flow_log_traffic_type)
    error_message = "Valid values for flow_log_traffic_type are ALL, ACCEPT, or REJECT."
  }
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}