-
Notifications
You must be signed in to change notification settings - Fork 0
/
development_vpc.tf
187 lines (157 loc) · 6.92 KB
/
development_vpc.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
##############################################################################
# Create Multizone VPC
##############################################################################
module development_vpc {
source = "./multizone_vpc"
# Account Variables
unique_id = "${var.unique_id}-development"
ibm_region = var.ibm_region
resource_group_id = data.ibm_resource_group.resource_group.id
# Network Variables
enable_public_gateway = var.development_vpc_enable_public_gateway
acl_rules = var.development_vpc_acl_rules
security_group_rules = var.development_vpc_default_security_group_rules
subnet_zones = var.development_vpc_zones
# Subnet Variables
application_tier_cidr_blocks = var.development_vpc_application_tier_cidr_blocks
database_tier_cidr_blocks = var.development_vpc_database_tier_cidr_blocks
web_tier_cidr_blocks = var.development_vpc_web_tier_cidr_blocks
}
##############################################################################
##############################################################################
# Web tier Instances
##############################################################################
module development_web_tier_compute {
source = "./vsi_workspace"
# Account Variables
unique_id = "${var.unique_id}-development-web"
resource_group_id = data.ibm_resource_group.resource_group.id
# VPC Variables
vpc_id = module.development_vpc.vpc_id
subnet_ids = module.development_vpc.web_tier_subnets.*.id
subnet_zones = module.development_vpc.web_tier_subnets.*.zone
ssh_public_key = ibm_is_ssh_key.ssh_key.id
# VSI Variables
image = var.development_web_tier_image
machine_type = var.development_web_tier_machine_type
# Create a single object containing all security group rules
security_group_rules = merge(
var.development_application_tier_security_group_rules,
# Allow Application Tier to Access Web Tier
{
"allow-in-application-sg" = {
source = module.development_application_tier_compute.security_group_id
direction = "inbound"
}
},
# Allow Production Access via Transit Gateway
{
for i in module.production_vpc.admin_tier_subnets :
"allow-inbound-traffic-subnet-${i.name}" => {
source = i.ipv4_cidr_block
direction = "inbound"
}
},
{
for i in module.production_vpc.admin_tier_subnets :
"allow-outbound-traffic-subnet-${i.name}" => {
source = i.ipv4_cidr_block
direction = "outbound"
}
}
)
}
##############################################################################
##############################################################################
# application tier Instances
##############################################################################
module development_application_tier_compute {
source = "./vsi_workspace"
# Account Variables
unique_id = "${var.unique_id}-development-application"
resource_group_id = data.ibm_resource_group.resource_group.id
# VPC Variables
vpc_id = module.development_vpc.vpc_id
subnet_ids = module.development_vpc.application_tier_subnets.*.id
subnet_zones = module.development_vpc.application_tier_subnets.*.zone
ssh_public_key = ibm_is_ssh_key.ssh_key.id
# VSI Variables
image = var.development_application_tier_image
machine_type = var.development_application_tier_machine_type
# Create a single object containing all security group rules
security_group_rules = merge(
var.development_application_tier_security_group_rules,
# Allow Web and DB Tier Access
{
"allow-in-web-sg" = {
source = module.development_web_tier_compute.security_group_id
direction = "inbound"
},
"allow-in-database-sg" = {
source = module.development_database_tier_compute.security_group_id
direction = "inbound"
},
},
# Allow Production Access via Transit Gateway
{
for i in module.production_vpc.admin_tier_subnets :
"allow-inbound-traffic-subnet-${i.name}" => {
source = i.ipv4_cidr_block
direction = "inbound"
}
},
{
for i in module.production_vpc.admin_tier_subnets :
"allow-outbound-traffic-subnet-${i.name}" => {
source = i.ipv4_cidr_block
direction = "outbound"
}
}
)
}
##############################################################################
##############################################################################
# database tier Instances
##############################################################################
module development_database_tier_compute {
source = "./vsi_workspace"
# Account Variables
unique_id = "${var.unique_id}-development-database"
resource_group_id = data.ibm_resource_group.resource_group.id
# VPC Variables
vpc_id = module.development_vpc.vpc_id
subnet_ids = module.development_vpc.database_tier_subnets.*.id
subnet_zones = module.development_vpc.database_tier_subnets.*.zone
ssh_public_key = ibm_is_ssh_key.ssh_key.id
# VSI Variables
image = var.development_database_tier_image
machine_type = var.development_database_tier_machine_type
# Create a single object containing all security group rules
security_group_rules = merge(
# Add Custom Security Group Rules
var.development_database_tier_security_group_rules,
# Allow App Tier Access
{
"allow-in-application-sg" = {
source = module.development_application_tier_compute.security_group_id
direction = "inbound"
}
},
# Allow Production Access via Transit Gateway
{
for i in module.production_vpc.admin_tier_subnets :
"allow-inbound-traffic-subnet-${i.name}" => {
source = i.ipv4_cidr_block
direction = "inbound"
}
},
{
for i in module.production_vpc.admin_tier_subnets :
"allow-outbound-traffic-subnet-${i.name}" => {
source = i.ipv4_cidr_block
direction = "outbound"
}
}
)
}
##############################################################################