Terraform module to setup and manage a Transit Gateway, it supports the following features:
- Peering with another Transit Gateway
- Sharing the Transit Gateway with other accounts
- Creation and attachment of VPN connections
Please take note of the information below regarding the usage of the module. Complete code examples can be found in the examples directory.
Peering a Transit Gateway is done in two steps, first the peering invite is send to the specified account and transit gateway. Second when the peering invite has been accepted by the other party the peering attachment becomes ready and configuration like the route table association and routing can be done.
Example sending the invite in the first Terraform run:
transit_gateway_peering = {
peering-1 = {
peer_account_id = "111111111111",
peer_region = "eu-west-1",
peer_transit_gateway_id = "tgw-0123456789abcdefg"
route_table_association = ""
peer_routes = {}
}
}Example setting the route table assocation and static routes from in route tables in the second Terraform run after the remote party has accepted the peering request, excluding optional blackhole routes:
transit_gateway_peering = {
peering-1 = {
peer_account_id = "111111111111",
peer_region = "eu-west-1",
peer_transit_gateway_id = "tgw-0123456789abcdefg"
route_table_association = "vpc"
peer_routes = {
shared = ["10.1.1.0/24", "192.168.10.0/24"]
test = ["10.2.2.0/24", "192.168.10.0/24"]
}
}
}Example setting the route table assocation and static routes from in route tables in the second Terraform run after the remote party has accepted the peering request, including blackhole routes:
transit_gateway_peering = {
peering-1 = {
peer_account_id = "111111111111",
peer_region = "eu-west-1",
peer_transit_gateway_id = "tgw-0123456789abcdefg"
route_table_association = "vpc"
peer_routes = {
shared = ["10.1.1.0/24", "192.168.10.0/24"]
test = ["10.2.2.0/24", "192.168.10.0/24"]
}
blackhole_routes = {
shared = ["10.2.2.0/24", "192.168.9.0/24"]
test = ["10.1.1.0/24", "192.168.9.0/24"]
}
}
}Sharing a Transit Gateway is done in two steps, first is to share the Transit Gateway which makes it available in the specified account. Second, when the the other party has created the Transit Gateway attachment in the specified account, is accepting the attachment and configuring the route table association and propagation.
Example sharing the Transit gateway in the first Terraform run:
transit_gateway_sharing = {
sharing-1 = {
principal_account_id = "222222222222"
route_table_association = ""
route_table_propagation = []
transit_gateway_attachment_id = ""
}
}Example accepting the attachment, setting the route table assocation and propagation for the attached VPC in the remote account in the second Terraform run:
transit_gateway_sharing = {
sharing-1 = {
principal_account_id = "222222222222"
route_table_association = "vpc"
route_table_propagation = ["shared", "vpc"]
transit_gateway_attachment_id = "tgw-attach-062000946f17af583"
}
}The module supports using a KMS key to encrypt the logfiles created by the Transit Gateway or the VPNs. Please note that the example provided uses a KMS key policy that works out of the box but is not scoped down to least privilege.
| Name | Version |
|---|---|
| terraform | >= 1.3 |
| aws | >= 4.39.0 |
| time | >= 0.9.0 |
| Name | Version |
|---|---|
| aws | >= 4.39.0 |
| time | >= 0.9.0 |
No modules.
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| description | Description of the EC2 Transit Gateway | string |
n/a | yes |
| name | Name of the EC2 Transit Gateway | string |
n/a | yes |
| tags | Map of tags to set on Terraform created resources | map(string) |
n/a | yes |
| cloudwatch_flow_logs_configuration | Cloudwatch flow logs configuration | object({ |
{} |
no |
| enable_cloudwatch_flow_logs | Set to true to enable Transit Gateway flow logs to be stored in Cloudwatch | bool |
true |
no |
| enable_s3_flow_logs | Set to true to enable Transit Gateway flow logs to be stored in S3 | bool |
false |
no |
| route_tables | Route Tables to create on the Transit Gateway | list(any) |
[ |
no |
| s3_flow_logs_configuration | S3 flow logs configuration | object({ |
{} |
no |
| transit_gateway_asn | BGP ASN used on the Transit Gateway | number |
64512 |
no |
| transit_gateway_default_route_table_association | Whether resource attachments are automatically associated with the default association route table | bool |
false |
no |
| transit_gateway_default_route_table_propagation | Whether resource attachments automatically propagate routes to the default propagation route table | bool |
false |
no |
| transit_gateway_peering | Transit Gateway peering configuration | map(object({ |
{} |
no |
| transit_gateway_sharing | Transit Gateway sharing configuration | map(object({ |
{} |
no |
| vpn_connection | VPN connection configuration | map(object({ |
{} |
no |
| Name | Description |
|---|---|
| transit_gateway_id | Transit Gateway identifier |
| transit_gateway_route_table_id | Transit Gateway Route Table and route table ID |