feat!: (IAC-619) Support VPCs with private and control_plane subnets, NAT gateway is not required

docs/CONFIG-VARS.md

@@ -11,6 +11,8 @@ Supported configuration variables are listed in the tables below.  All variables
       - [Using Static Credentials](#using-static-credentials)
       - [Using AWS Profile](#using-aws-profile)
   - [Admin Access](#admin-access)
+    - [Public Access CIDRs](#public-access-cidrs)
+    - [Private Access CIDRs](#private-access-cidrs)
   - [Networking](#networking)
     - [Use Existing](#use-existing)
   - [IAM](#iam)
@@ -72,14 +74,27 @@ NOTE: When deploying infrastructure into a private network (e.g. a VPN), with no
 
 NOTE: The script will either create a new Security Group, or use an existing Security Group, if specified in the `security_group_id` variable.
 
+### Public Access CIDRS
+
 You can use `default_public_access_cidrs` to set a default range for all created resources. To set different ranges for other resources, define the appropriate variable. Use an empty list [] to disallow access explicitly.
 
 | <div style="width:50px">Name</div> | <div style="width:150px">Description</div> | <div style="width:50px">Type</div> | <div style="width:75px">Default</div> | <div style="width:150px">Notes</div> |
 | :--- | :--- | :--- | :--- | :--- |
 | default_public_access_cidrs | IP address ranges that are allowed to access all created cloud resources | list of strings | | Set a default for all resources. |
-| cluster_endpoint_public_access_cidrs | IP address ranges that are allowed to access the AKS cluster API | list of strings | | For client admin access to the cluster api (by kubectl, for example). Only used with `cluster_api_mode=public` |
+| cluster_endpoint_public_access_cidrs | IP address ranges that are allowed to access the EKS cluster API | list of strings | | For client admin access to the cluster api (by kubectl, for example). Only used with `cluster_api_mode=public` |
 | vm_public_access_cidrs | IP address ranges that are allowed to access the VMs | list of strings | | Opens port 22 for SSH access to the jump server and/or NFS VM by adding Ingress Rule on the Security Group. Only used with `create_jump_public_ip=true` or `create_nfs_public_ip=true`. |
-| postgres_access_cidrs | IP address ranges that are allowed to access the AWS PostgreSQL server | list of strings ||	Opens port 5432 by adding Ingress Rule on the Security Group. Only used when creating postgres instances.|
+| postgres_public_access_cidrs | IP address ranges that are allowed to access the AWS PostgreSQL server | list of strings ||	Opens port 5432 by adding Ingress Rule on the Security Group. Only used when creating postgres instances.|
+
+### Private Access CIDRS
+
+You can use `default_private_access_cidrs` to set a default range for all created private resources. To set different ranges for other resources, define the appropriate variable. Use an empty list [] to disallow access explicitly.
+
+| <div style="width:50px">Name</div> | <div style="width:150px">Description</div> | <div style="width:50px">Type</div> | <div style="width:75px">Default</div> | <div style="width:150px">Notes</div> |
+| :--- | :--- | :--- | :--- | :--- |
+| default_private_access_cidrs | IP address ranges that are allowed to access all created private cloud resources | list of strings | | Set a default for all private resources. |
+| cluster_endpoint_private_access_cidrs | IP address ranges that are allowed to access the EKS cluster API | list of strings | | For client admin access to the cluster api (by kubectl, for example). Only used with `cluster_api_mode=private` |
+| vpc_endpoint_private_access_cidrs | IP address ranges that are allowed to access all AWS Services targeted by the VPC endpoints  | list of strings | | |
+| vm_private_access_cidrs | IP address ranges that are allowed to access the private IP based VMs | list of strings | | Opens port 22 for SSH access to the jump server and/or NFS VM by adding Ingress Rule on the Workers Security Group. Only used with `create_jump_public_ip=false` or `create_nfs_public_ip=false`. |
 
 ## Networking
  | Name | Description | Type | Default | Notes |

locals.tf

@@ -20,11 +20,19 @@ locals {
   aws_shared_credentials = local.use_aws_shared_credentials_file ? [var.aws_shared_credentials_file] : var.aws_shared_credentials_files
 
   # CIDRs
-  default_public_access_cidrs           = var.default_public_access_cidrs == null ? [] : var.default_public_access_cidrs
-  vm_public_access_cidrs                = var.vm_public_access_cidrs == null ? local.default_public_access_cidrs : var.vm_public_access_cidrs
-  cluster_endpoint_public_access_cidrs  = var.cluster_api_mode == "private" ? [] : (var.cluster_endpoint_public_access_cidrs == null ? local.default_public_access_cidrs : var.cluster_endpoint_public_access_cidrs)
-  cluster_endpoint_private_access_cidrs = var.cluster_endpoint_private_access_cidrs == null ? distinct(concat(module.vpc.public_subnet_cidrs, module.vpc.private_subnet_cidrs)) : var.cluster_endpoint_private_access_cidrs # tflint-ignore: terraform_unused_declarations
-  postgres_public_access_cidrs          = var.postgres_public_access_cidrs == null ? local.default_public_access_cidrs : var.postgres_public_access_cidrs
+  default_public_access_cidrs  = var.default_public_access_cidrs == null ? [] : var.default_public_access_cidrs
+  default_private_access_cidrs = var.default_private_access_cidrs == null ? [] : var.default_private_access_cidrs
+
+  vm_public_access_cidrs  = var.vm_public_access_cidrs == null ? local.default_public_access_cidrs : var.vm_public_access_cidrs
+  vm_private_access_cidrs = var.vm_private_access_cidrs == null ? local.default_private_access_cidrs : var.vm_private_access_cidrs
+
+  cluster_endpoint_public_access_cidrs = var.cluster_api_mode == "private" ? [] : (var.cluster_endpoint_public_access_cidrs == null ? local.default_public_access_cidrs : var.cluster_endpoint_public_access_cidrs)
+
+  cluster_endpoint_private_access_cidrs = var.cluster_api_mode == "public" ? [] : var.cluster_endpoint_private_access_cidrs == null ? distinct(concat(module.vpc.public_subnet_cidrs, module.vpc.private_subnet_cidrs, local.default_private_access_cidrs)) : distinct(concat(module.vpc.public_subnet_cidrs, module.vpc.private_subnet_cidrs, local.default_private_access_cidrs, var.cluster_endpoint_private_access_cidrs)) # tflint-ignore: terraform_unused_declarations
+
+  vpc_endpoint_private_access_cidrs = var.vpc_endpoint_private_access_cidrs == null ? distinct(concat(module.vpc.public_subnet_cidrs, module.vpc.private_subnet_cidrs, local.default_private_access_cidrs)) : distinct(concat(module.vpc.public_subnet_cidrs, module.vpc.private_subnet_cidrs, local.default_private_access_cidrs, var.vpc_endpoint_private_access_cidrs))
+
+  postgres_public_access_cidrs = var.postgres_public_access_cidrs == null ? local.default_public_access_cidrs : var.postgres_public_access_cidrs
 
   # Subnets
   jump_vm_subnet   = var.create_jump_public_ip ? module.vpc.public_subnets[0] : module.vpc.private_subnets[0]

security.tf

@@ -24,13 +24,13 @@ resource "aws_security_group" "sg" {
 }
 
 resource "aws_security_group_rule" "private_vpc" {
-  count             = var.vpc_private_endpoints_enabled ? length(local.cluster_endpoint_private_access_cidrs) > 0 ? 1 : 0 : 0
+  count             = var.vpc_private_endpoints_enabled ? length(local.vpc_endpoint_private_access_cidrs) > 0 ? 1 : 0 : 0
   type              = "ingress"
   description       = "Allow tcp port 443 ingress to all AWS Services targeted by the VPC endpoints"
   from_port         = 443
   to_port           = 443
   protocol          = "tcp"
-  cidr_blocks       = local.cluster_endpoint_private_access_cidrs
+  cidr_blocks       = local.vpc_endpoint_private_access_cidrs
   security_group_id = local.security_group_id
 }
 
@@ -121,6 +121,17 @@ resource "aws_security_group_rule" "cluster_ingress" {
   security_group_id        = local.cluster_security_group_id
 }
 
+resource "aws_security_group_rule" "private_cluster_ingress" {
+  count             = local.cluster_endpoint_private_access_cidrs != null ? length(local.cluster_endpoint_private_access_cidrs) > 0 ? 1 : 0 : 0
+  type              = "ingress"
+  description       = "Allow tcp port 443 ingress to EKS cluster API from cluster endpoint private access cidrs"
+  from_port         = 443
+  to_port           = 443
+  protocol          = "tcp"
+  cidr_blocks       = local.cluster_endpoint_private_access_cidrs
+  security_group_id = local.cluster_security_group_id
+}
+
 
 resource "aws_security_group" "workers_security_group" {
   name   = "${var.prefix}-eks_worker_sg"
@@ -189,3 +200,22 @@ resource "aws_security_group_rule" "worker_cluster_api_443" {
   to_port                  = 443
   security_group_id        = aws_security_group.workers_security_group[0].id
 }
+
+
+resource "aws_security_group_rule" "vm_private_access_22" {
+
+  count = (length(local.vm_private_access_cidrs) > 0
+    && var.workers_security_group_id == null
+    && ((var.create_jump_public_ip == false && var.create_jump_vm)
+      || (var.create_nfs_public_ip == false && var.storage_type == "standard")
+    )
+    ? 1 : 0
+  )
+  type              = "ingress"
+  description       = "Allow the client VMs to reach a private IP based Jump VM"
+  from_port         = 22
+  to_port           = 22
+  protocol          = "tcp"
+  cidr_blocks       = local.vm_private_access_cidrs
+  security_group_id = aws_security_group.workers_security_group[0].id
+}

variables.tf

@@ -61,9 +61,15 @@ variable "iac_tooling" {
   default     = "terraform"
 }
 
-## Public Access
+## Public & Private Access
 variable "default_public_access_cidrs" {
-  description = "List of CIDRs to access created resources."
+  description = "List of CIDRs to access created resources - Public."
+  type        = list(string)
+  default     = null
+}
+
+variable "default_private_access_cidrs" {
+  description = "List of CIDRs to access created resources - Private."
   type        = list(string)
   default     = null
 }
@@ -80,8 +86,20 @@ variable "cluster_endpoint_private_access_cidrs" {
   default     = null
 }
 
+variable "vpc_endpoint_private_access_cidrs" {
+  description = "List of CIDRs to access VPC endpoints - Private."
+  type        = list(string)
+  default     = null
+}
+
 variable "vm_public_access_cidrs" {
-  description = "List of CIDRs to access jump VM or NFS VM."
+  description = "List of CIDRs to access jump VM or NFS VM - Public."
+  type        = list(string)
+  default     = null
+}
+
+variable "vm_private_access_cidrs" {
+  description = "List of CIDRs to access jump VM or NFS VM - Private."
   type        = list(string)
   default     = null
 }