#terraform-aws-modules (2024-03)

terraform Terraform Modules

Discussions related to https://github.com/terraform-aws-modules

Archive: https://archive.sweetops.com/terraform-aws-modules/

2024-03-01

Jonas Mellquist avatar
Jonas Mellquist

Greetings everyone. I’m using the cloudposse/vpn-connection/aws module and I’m facing some issues that I really don’t understand..

My module code is as follows

module "vpn_connection" {
  source  = "cloudposse/vpn-connection/aws"
  version = "1.0.0"

  namespace                                 = var.namespace
  stage                                     = var.env
  name                                      = var.vpn_connection_name
  vpc_id                                    = var.vpc_id
  vpn_gateway_amazon_side_asn               = var.amazon_asn
  customer_gateway_bgp_asn                  = var.customer_asn
  customer_gateway_ip_address               = var.customer_gateway_ip_address
  route_table_ids                           = var.route_table_ids
  vpn_connection_static_routes_only         = true
  vpn_connection_static_routes_destinations = [var.vpn_connection_static_routes_destinations]
  vpn_connection_local_ipv4_network_cidr    = var.vpn_connection_static_routes_destinations
  vpn_connection_remote_ipv4_network_cidr   = var.vpc_cidr
}

route_table_ids should contain a single element found using https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route_tables and vpn_connection_static_routes_destinations is a simple ipv4 cidr coming in as a string

The ‘calling’ of the module

module "vpn-connection" {
  source = "../../modules/vpn-connection"

  namespace                                 = var.namespace
  env                                       = var.environment
  vpn_connection_name                       = var.vpn_connection_name
  vpc_id                                    = module.staging-vpc.vpc_id
  amazon_asn                                = var.amazon_asn
  customer_asn                              = var.customer_asn
  customer_gateway_ip_address               = var.customer_gateway_ip_address
  route_table_ids                           = data.aws_route_tables.route_tables_for_vpn_connection_to_public_subnets.ids
  vpn_connection_static_routes_destinations = var.vpn_connection_static_routes_destinations
  vpc_cidr                                  = var.vpc_cidr
}

Should I not in the route tables inside route_table_ids see a non-propagated / aka static route to the contents of var.vpn_connection_static_routes_destinations

I see Route propagation set to No under the Route table which is also what I want..

But where’s my static route?

Jonas Mellquist avatar
Jonas Mellquist

The VPN connection has the IPv4 cidr listed under Static routes

Also it has: Routing: Static

Jonas Mellquist avatar
Jonas Mellquist

I had hoped to see a route from my AWS resources going via the vgw?

Jonas Mellquist avatar
Jonas Mellquist

I had made an error in the filter of the data.aws_route_tables resource

By using terraform console and output I was able to confirm that I had messed up the filter..

Now the correct route tables has Propagation set to Yes, but still no routes via the vgw..

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.vpn-connection.module.vpn_connection.aws_vpn_gateway_route_propagation.default[0] will be created
  + resource "aws_vpn_gateway_route_propagation" "default" {
      + id             = (known after apply)
      + route_table_id = "rtb-0fae0f6417e87d686"
      + vpn_gateway_id = "vgw-021dbceb8be839911"
    }

  # module.vpn-connection.module.vpn_connection.aws_vpn_gateway_route_propagation.default[1] will be created
  + resource "aws_vpn_gateway_route_propagation" "default" {
      + id             = (known after apply)
      + route_table_id = "rtb-007080840322aad57"
      + vpn_gateway_id = "vgw-021dbceb8be839911"
    }

  # module.vpn-connection.module.vpn_connection.aws_vpn_gateway_route_propagation.default[2] will be created
  + resource "aws_vpn_gateway_route_propagation" "default" {
      + id             = (known after apply)
      + route_table_id = "rtb-09158b5ccf370c9e5"
      + vpn_gateway_id = "vgw-021dbceb8be839911"
    }

Plan: 3 to add, 0 to change, 0 to destroy.

    keyboard_arrow_up