tf-module-aws-client-vpn/client_vpn.tf at main · itgix/tf-module-aws-client-vpn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
resource "aws_security_group" "client_vpn_sg" {
  name        = "${var.client_vpn_name}-sg"
  description = "Security group for the Client VPN endpoint"
  vpc_id      = var.vpc_id

  ingress {
    description = "Allow UDP 443 inbound from anywhere"
    from_port   = 443
    to_port     = 443
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_cloudwatch_log_group" "client_vpn_logs" {
  count             = var.enable_connection_logs ? 1 : 0
  name              = "${var.client_vpn_name}-logs"
  retention_in_days = var.client_vpn_logs_cloudwatch_log_group_retention_in_days
  lifecycle {
    ignore_changes = [
      retention_in_days
    ]
  }

}

resource "aws_cloudwatch_log_stream" "client_vpn_logs" {
  count          = var.enable_connection_logs ? 1 : 0
  name           = "${var.client_vpn_name}-stream"
  log_group_name = aws_cloudwatch_log_group.client_vpn_logs[0].name
}

resource "aws_ec2_client_vpn_endpoint" "client_vpn" {
  description            = "${var.client_vpn_name} VPN endpoint"
  server_certificate_arn = var.server_certificate_arn
  client_cidr_block      = var.client_ipv4_cidr
  vpc_id                 = var.vpc_id
  authentication_options {
    type                           = "federated-authentication"
    saml_provider_arn              = var.identity_provider_arn
    self_service_saml_provider_arn = var.self_service_identity_provider_arn
  }
  connection_log_options {
    enabled               = var.enable_connection_logs
    cloudwatch_log_group  = var.enable_connection_logs ? aws_cloudwatch_log_group.client_vpn_logs[0].name : null
    cloudwatch_log_stream = var.enable_connection_logs ? aws_cloudwatch_log_stream.client_vpn_logs[0].name : null
  }
  self_service_portal = var.self_service_portal
  dns_servers         = var.dns_servers // e.g. ["1.1.1.1", "1.0.0.1"]
  split_tunnel        = var.split_tunnel
  transport_protocol  = "udp"
  vpn_port            = 443
  security_group_ids  = [aws_security_group.client_vpn_sg.id]

  tags = {
    Name = "ITGix Landing Zone - ${var.client_vpn_name}"
  }

  lifecycle {
    // Terraform keeps detecting this as a state drift no matter how many times we apply it
    ignore_changes = [
      connection_log_options[0].cloudwatch_log_stream,
    ]
  }
}

resource "aws_ec2_client_vpn_network_association" "client_vpn_association" {
  count = length(var.target_networks)

  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.client_vpn.id
  subnet_id              = var.target_networks[count.index]
}

resource "aws_ec2_client_vpn_route" "client_vpn_routes" {
  for_each = { for idx, route_subnet_pair in setproduct(var.destination_cidr_block, var.target_networks) : "${route_subnet_pair[0].cidr}_${route_subnet_pair[1]}" => route_subnet_pair }

  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.client_vpn.id
  destination_cidr_block = var.split_tunnel ? each.value[0].cidr : "0.0.0.0/0"
  target_vpc_subnet_id   = each.value[1]
  description            = each.value[0].description

  depends_on = [aws_ec2_client_vpn_network_association.client_vpn_association]
}

# Authorization rules for the Client VPN endpoint
resource "aws_ec2_client_vpn_authorization_rule" "client_vpn_auth_rules" {
  for_each = { for idx, rule in var.authorization_rules : idx => rule }

  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.client_vpn.id
  target_network_cidr    = each.value.target_network_cidr
  access_group_id        = each.value.access_group_id
  authorize_all_groups   = each.value.authorize_all_groups
  description            = each.value.description

  depends_on = [aws_ec2_client_vpn_network_association.client_vpn_association]
}