terraform-aws-defaults/variables.tf at main · bendoerr-terraform-modules/terraform-aws-defaults · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
variable "context" {
  type = object({
    attributes     = list(string)
    dns_namespace  = string
    environment    = string
    instance       = string
    instance_short = string
    namespace      = string
    region         = string
    region_short   = string
    role           = string
    role_short     = string
    project        = string
    tags           = map(string)
  })
  description = "Shared Context from Ben's terraform-null-context"
}

variable "budget_monthly_limit" {
  type        = string
  description = ""
}

variable "budget_alert_emails" {
  type        = set(string)
  description = ""
}

variable "iam_alias_postfix" {
  type        = string
  description = ""
}

variable "network" {
  type = object({
    cidr           = string
    enable_nat     = optional(bool, false)
    one_nat        = optional(bool, true)
    enable_private = optional(bool, false)
    ip_mode        = optional(string, "ipv4")
    subnets = list(object({
      az      = string
      public  = optional(string)
      private = optional(string)
    }))
  })
  default = {
    cidr = "0.0.0.0/0"
    subnets = [
      {
        az     = "us-east-1a"
        public = "0.0.0.0/0"
      }
    ]
  }
  description = <<-EOT
    Network configuration for VPC. ip_mode can be 'ipv4' (default), 'dual-stack', or 'ipv6-only'.

    NAT defaults are cost-optimized, not HA-optimized: enable_nat=false, one_nat=true.
    When a caller flips enable_nat=true and leaves one_nat unset, they get a single
    shared NAT gateway (no cross-AZ redundancy in the NAT path). Set one_nat=false
    to get one NAT gateway per AZ.
    EOT

  validation {
    condition     = contains(["ipv4", "dual-stack", "ipv6-only"], var.network.ip_mode)
    error_message = "ip_mode must be one of: ipv4, dual-stack, ipv6-only"
  }

  validation {
    condition = (
      var.network.ip_mode == "ipv6-only" ||
      alltrue([for s in var.network.subnets : s.public != null])
    )
    error_message = "All subnets must have a non-null 'public' CIDR when ip_mode is 'ipv4' or 'dual-stack'."
  }

  validation {
    condition = (
      !var.network.enable_private ||
      var.network.ip_mode == "ipv6-only" ||
      alltrue([for s in var.network.subnets : s.private != null])
    )
    error_message = "All subnets must have a non-null 'private' CIDR when enable_private is true and ip_mode is not 'ipv6-only'."
  }
}