main.tf

# Creates the following resources:
# 1. VPC for all cyberchef resources
# 2. Public and Private Subnets
# 3. Internet Gateway
# 4. IG NAT Gateway for public subnets

# Fetch AZs in the current region
data "aws_availability_zones" "available" {
}

locals {
  name_prefix = "${var.app_name}-${var.env}"
}

resource "aws_vpc" "main" {
  count = var.create_vpc == true ? 1 : 0

  cidr_block           = var.cidr_block
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "CyberChef Main VPC"
  }
}

# Create var.az_count private subnets, each in a different AZ
resource "aws_subnet" "private" {
  count = var.create_vpc == true ? var.az_count : 0

  cidr_block        = cidrsubnet(aws_vpc.main[0].cidr_block, 8, count.index)
  availability_zone = data.aws_availability_zones.available.names[count.index]
  vpc_id            = aws_vpc.main[0].id
}

# Create var.az_count public subnets, each in a different AZ
resource "aws_subnet" "public" {
  count = var.create_vpc == true ? var.az_count : 0

  cidr_block              = cidrsubnet(aws_vpc.main[0].cidr_block, 8, var.az_count + count.index)
  availability_zone       = data.aws_availability_zones.available.names[count.index]
  vpc_id                  = aws_vpc.main[0].id
  map_public_ip_on_launch = true
}

# Internet Gateway for the public subnet
resource "aws_internet_gateway" "gw" {
  count = var.create_vpc == true ? 1 : 0

  vpc_id = aws_vpc.main[0].id

  tags = {
    Name = "${local.name_prefix}-gw"
  }
}

# Route the public subnet traffic through the IGW
resource "aws_route" "internet_access" {
  count = var.create_vpc == true ? 1 : 0

  route_table_id         = aws_vpc.main[0].main_route_table_id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.gw[0].id
}

# Create a NAT gateway with an Elastic IP for each private subnet to get internet connectivity
resource "aws_eip" "gw" {
  count = var.create_vpc == true ? var.az_count : 0

  vpc        = true
  depends_on = [aws_internet_gateway.gw]

  tags = {
    Name = "${local.name_prefix}-gw-eip"
  }
}

resource "aws_nat_gateway" "gw" {
  count = var.create_vpc == true ? var.az_count : 0

  subnet_id     = element(aws_subnet.public.*.id, count.index)
  allocation_id = element(aws_eip.gw.*.id, count.index)

  tags = {
    Name = local.name_prefix
  }

  depends_on = [aws_internet_gateway.gw]
}

# Create a new route table for the private subnets, make it route non-local traffic through the NAT gateway to the internet
resource "aws_route_table" "private" {
  count = var.create_vpc == true ? var.az_count : 0

  vpc_id = aws_vpc.main[0].id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = element(aws_nat_gateway.gw.*.id, count.index)
  }

  tags = {
    Name = local.name_prefix
  }
}

# Explicitly associate the newly created route tables to the private subnets (so they don't default to the main route table)
resource "aws_route_table_association" "private" {
  count = var.create_vpc == true ? var.az_count : 0

  subnet_id      = element(aws_subnet.private.*.id, count.index)
  route_table_id = element(aws_route_table.private.*.id, count.index)
}