Add possibility to use the transit gateway as default gateway (#902)

Co-authored-by: Martin Nettling <[email protected]>
Co-authored-by: Andriy Knysh <[email protected]>

modules/tgw/spoke/README.md

@@ -98,7 +98,10 @@ atmos terraform apply tgw/spoke -s <tenant>-<environment>-<stage>
 
 ## Providers
 
-No providers.
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.1 |
+| <a name="provider_aws.tgw-hub"></a> [aws.tgw-hub](#provider\_aws.tgw-hub) | >= 4.1 |
 
 ## Modules
 
@@ -111,10 +114,14 @@ No providers.
 | <a name="module_tgw_hub_routes"></a> [tgw\_hub\_routes](#module\_tgw\_hub\_routes) | cloudposse/transit-gateway/aws | 0.10.0 |
 | <a name="module_tgw_spoke_vpc_attachment"></a> [tgw\_spoke\_vpc\_attachment](#module\_tgw\_spoke\_vpc\_attachment) | ./modules/standard_vpc_attachment | n/a |
 | <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
+| <a name="module_vpc"></a> [vpc](#module\_vpc) | cloudposse/stack-config/yaml//modules/remote-state | 1.5.0 |
 
 ## Resources
 
-No resources.
+| Name | Type |
+|------|------|
+| [aws_route.back_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
+| [aws_route.default_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 
 ## Inputs
 
@@ -124,6 +131,8 @@ No resources.
 | <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br>in the order they appear in the list. New attributes are appended to the<br>end of the list. The elements of the list are joined by the `delimiter`<br>and treated as a single ID element. | `list(string)` | `[]` | no |
 | <a name="input_connections"></a> [connections](#input\_connections) | A list of objects to define each TGW connections.<br><br>By default, each connection will look for only the default `vpc` component. | <pre>list(object({<br>    account = object({<br>      stage       = string<br>      environment = optional(string, "")<br>      tenant      = optional(string, "")<br>    })<br>    vpc_component_names = optional(list(string), ["vpc"])<br>    eks_component_names = optional(list(string), [])<br>  }))</pre> | `[]` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "descriptor_formats": {},<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "labels_as_tags": [<br>    "unset"<br>  ],<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {},<br>  "tenant": null<br>}</pre> | no |
+| <a name="input_default_route_enabled"></a> [default\_route\_enabled](#input\_default\_route\_enabled) | Enable default routing via transit gateway, requires also nat gateway and instance to be disabled in vpc component. Default is disabled. | `bool` | `false` | no |
+| <a name="input_default_route_outgoing_account_name"></a> [default\_route\_outgoing\_account\_name](#input\_default\_route\_outgoing\_account\_name) | The account name which is used for outgoing traffic, when using the transit gateway as default route. | `string` | `null` | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
 | <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br>Map of maps. Keys are names of descriptors. Values are maps of the form<br>`{<br>   format = string<br>   labels = list(string)<br>}`<br>(Type is `any` so the map values can later be enhanced to provide additional options.)<br>`format` is a Terraform format string to be passed to the `format()` function.<br>`labels` is a list of labels, in order, to pass to `format()` function.<br>Label values will be normalized before being passed to `format()` so they will be<br>identical to how they appear in `id`.<br>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
@@ -142,6 +151,7 @@ No resources.
 | <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.<br>Characters matching the regex will be removed from the ID elements.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
 | <a name="input_region"></a> [region](#input\_region) | AWS Region | `string` | n/a | yes |
 | <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
+| <a name="input_static_routes"></a> [static\_routes](#input\_static\_routes) | A list of static routes. | <pre>set(object({<br>    blackhole              = bool<br>    destination_cidr_block = string<br>  }))</pre> | `[]` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
 | <a name="input_tenant"></a> [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
 | <a name="input_tgw_hub_component_name"></a> [tgw\_hub\_component\_name](#input\_tgw\_hub\_component\_name) | The name of the transit-gateway component | `string` | `"tgw/hub"` | no |

modules/tgw/spoke/main.tf

@@ -8,6 +8,8 @@
 
 locals {
   spoke_account = module.this.tenant != null ? format("%s-%s-%s", module.this.tenant, module.this.environment, module.this.stage) : format("%s-%s", module.this.environment, module.this.stage)
+  // "When default routing via transit gateway is enabled, both nat gateway and nat instance must be disabled"
+  default_route_enabled_and_nat_disabled = module.this.enabled && var.default_route_enabled && length(module.vpc.outputs.nat_gateway_ids) == 0 && length(module.vpc.outputs.nat_instance_ids) == 0
 }
 
 module "tgw_hub_routes" {
@@ -47,7 +49,30 @@ module "tgw_spoke_vpc_attachment" {
   connections          = var.connections
   expose_eks_sg        = var.expose_eks_sg
   peered_region        = var.peered_region
-
+  static_routes        = var.static_routes
 
   context = module.this.context
 }
+
+resource "aws_route" "default_route" {
+  count = local.default_route_enabled_and_nat_disabled ? length(module.vpc.outputs.private_route_table_ids) : 0
+
+  route_table_id         = module.vpc.outputs.private_route_table_ids[count.index]
+  destination_cidr_block = "0.0.0.0/0"
+  transit_gateway_id     = module.tgw_hub.outputs.transit_gateway_id
+}
+
+locals {
+  outgoing_network_account_name            = local.default_route_enabled_and_nat_disabled ? format("%s-%s", var.default_route_outgoing_account_name, var.own_vpc_component_name) : ""
+  default_route_vpc_public_route_table_ids = local.default_route_enabled_and_nat_disabled ? module.tgw_hub.outputs.vpcs[local.outgoing_network_account_name].outputs.default_route_vpc_public_route_table_ids : []
+}
+
+resource "aws_route" "back_route" {
+  provider = aws.tgw-hub
+
+  count = local.default_route_enabled_and_nat_disabled ? length(local.default_route_vpc_public_route_table_ids) : 0
+
+  route_table_id         = local.default_route_vpc_public_route_table_ids[count.index]
+  destination_cidr_block = module.vpc.outputs.vpc_cidr
+  transit_gateway_id     = module.tgw_hub.outputs.transit_gateway_id
+}

modules/tgw/spoke/modules/standard_vpc_attachment/main.tf

@@ -136,7 +136,7 @@ module "standard_vpc_attachment" {
       subnet_ids                        = local.own_vpc.private_subnet_ids
       subnet_route_table_ids            = local.own_vpc.private_route_table_ids
       route_to                          = null
-      static_routes                     = null
+      static_routes                     = var.static_routes
       transit_gateway_vpc_attachment_id = null
       route_to_cidr_blocks              = [for vpc in local.allowed_vpcs : vpc.cidr if !vpc.cross_region]
     }

modules/tgw/spoke/modules/standard_vpc_attachment/outputs.tf

@@ -7,7 +7,7 @@ output "tg_config" {
     subnet_route_table_ids            = null
     route_to                          = null
     route_to_cidr_blocks              = null
-    static_routes                     = null
+    static_routes                     = var.static_routes
     transit_gateway_vpc_attachment_id = module.standard_vpc_attachment.transit_gateway_vpc_attachment_ids[var.owning_account]
   }
   description = "Transit Gateway configuration formatted for handling"

modules/tgw/spoke/modules/standard_vpc_attachment/variables.tf

@@ -50,6 +50,17 @@ variable "connections" {
   default     = []
 }
 
+variable "static_routes" {
+  type = set(object({
+    blackhole              = bool
+    destination_cidr_block = string
+  }))
+  description = <<-EOT
+  A list of static routes.
+  EOT
+  default     = []
+}
+
 variable "expose_eks_sg" {
   type        = bool
   description = "Set true to allow EKS clusters to accept traffic from source accounts"

modules/tgw/spoke/remote-state.tf

@@ -15,6 +15,15 @@ module "tgw_hub" {
   context = module.this.context
 }
 
+module "vpc" {
+  source  = "cloudposse/stack-config/yaml//modules/remote-state"
+  version = "1.5.0"
+
+  component = var.own_vpc_component_name
+
+  context = module.this.context
+}
+
 module "cross_region_hub_connector" {
   source  = "cloudposse/stack-config/yaml//modules/remote-state"
   version = "1.5.0"

modules/tgw/spoke/variables.tf

@@ -66,3 +66,26 @@ variable "peered_region" {
   description = "Set `true` if this region is not the primary region"
   default     = false
 }
+
+variable "static_routes" {
+  type = set(object({
+    blackhole              = bool
+    destination_cidr_block = string
+  }))
+  description = <<-EOT
+  A list of static routes.
+  EOT
+  default     = []
+}
+
+variable "default_route_enabled" {
+  type        = bool
+  description = "Enable default routing via transit gateway, requires also nat gateway and instance to be disabled in vpc component. Default is disabled."
+  default     = false
+}
+
+variable "default_route_outgoing_account_name" {
+  type        = string
+  description = "The account name which is used for outgoing traffic, when using the transit gateway as default route."
+  default     = null
+}