cowork

prod-hq-network/main.tf

@@ -1,17 +1,25 @@
 // prod - main
 provider "aws" {
-  region = "ap-northeast-2"
-
+  region                  = "ap-northeast-2"
+  profile                 = "22shop"
+  shared_credentials_file = "C:/Users/aa/.aws/credentials"
   #2.x버전의 AWS공급자 허용
-  version = "~> 2.0"
+  version = "~> 3.0"
 
 }
 
 locals {
+  region = "ap-northeast-2"
   common_tags = {
-    project = "22shop"
+    project = "22shop-eks"
     owner   = "icurfer"
-
+  }
+  cidr = {
+    vpc    = "10.3.0.0/16"
+    zone_a = "10.3.1.0/24"
+    zone_c = "10.3.3.0/24"
+    zone_a_private = "10.3.2.0/24"
+    zone_c_private = "10.3.4.0/24"
   }
   tcp_port = {
     any_port    = 0
@@ -45,6 +53,19 @@ locals {
 // GET 계정정보
 data "aws_caller_identity" "this" {}
 
+// 테라폼클라우드
+# data "terraform_remote_state" "hq_vpc_id" {
+#   backend = "remote"
+
+#   config = {
+#     organization = "22shop"
+
+#     workspaces = {
+#       name = "hq-network"
+#     }
+#   }
+# }
+
 // eks를 위한 iam역할 생성 데이터 조회
 data "aws_iam_policy_document" "eks-assume-role-policy" {
   statement {
@@ -67,7 +88,7 @@ data "aws_iam_policy_document" "eks_node_group_role" {
   }
 }
 
-# module "vpc_hq" {
+//vpc 생성
 module "vpc_hq" {
   source = "../modules/vpc"
   #   source = "github.com/Seong-dong/team_prj/tree/main/modules/vpc"
@@ -76,6 +97,7 @@ module "vpc_hq" {
 
 }
 
+//외부통신 gateway
 module "vpc_igw" {
   source = "../modules/igw"
 
@@ -88,16 +110,36 @@ module "vpc_igw" {
   ]
 }
 
+// public 서브넷 생성
 module "subnet_public" {
   source = "../modules/vpc-subnet"
 
   vpc_id         = module.vpc_hq.vpc_hq_id
-  subnet-az-list = var.subnet-az-public
+  subnet-az-list = {
+    "zone-a" = {
+      name = "${local.region}a"
+      cidr = local.cidr.zone_a
+    }
+    "zone-c" = {
+      name = "${local.region}c"
+      cidr = local.cidr.zone_c
+    }
+  }
   public_ip_on   = true
   # vpc_name       = "${local.common_tags.project}-public"
   #alb-ingress 생성을 위해 지정
   k8s_ingress        = true
-  vpc_name = local.eks_ingress_type.public
+  # vpc_name = local.eks_ingress_type.public
+  vpc_name = local.eks_ingress_type.private
+}
+// private외부통신을 위한 nat
+module "nat_gw" {
+  source = "../modules/nat-gateway"
+  subnet_id = module.subnet_public.subnet.zone-a.id
+
+  depends_on = [
+    module.vpc_igw
+  ]
 }
 
 // public route
@@ -110,33 +152,59 @@ module "route_public" {
 
 module "route_add" {
   source          = "../modules/route-add"
-  route_public_id = module.route_public.route_public_id
+  route_id = module.route_public.route_id
   igw_id          = module.vpc_igw.igw_id
+  gw_type = "igw"
 }
 
 module "route_association" {
   source         = "../modules/route-association"
-  route_table_id = module.route_public.route_public_id
+  route_table_id = module.route_public.route_id
 
   association_count = 2
   subnet_ids        = [module.subnet_public.subnet.zone-a.id, module.subnet_public.subnet.zone-c.id]
 }
+#----------------------------------------------------------------------------------------------------#
+######################################################################################################
+#----------------------------------------------------------------------------------------------------#
+module "subnet_private" {
+  source = "../modules/vpc-subnet"
 
-# // private subnet
-# module "subnet_private" {
-#   source = "../modules/vpc-subnet"
+  vpc_id         = module.vpc_hq.vpc_hq_id
+  subnet-az-list = {
+    "zone-a" = {
+      name = "${local.region}a"
+      cidr = local.cidr.zone_a_private
+    }
+    "zone-c" = {
+      name = "${local.region}c"
+      cidr = local.cidr.zone_c_private
+    }
+  }
+  public_ip_on   = false
+  # vpc_name       = "${local.common_tags.project}-public"
+  #alb-ingress 생성을 위해 지정
+  k8s_ingress        = false
+  vpc_name = "null"
+}
 
-#   vpc_id         = module.vpc_hq.vpc_hq_id
-#   subnet-az-list = var.subnet-az-private
-#   public_ip_on   = false
-#   k8s_ingress        = false
-#   #alb-ingress 생성을 위해 지정
-#   vpc_name = local.eks_ingress_type.public
-# }
+// private route
+module "route_private" {
+  source   = "../modules/route-table"
+  tag_name = "${local.common_tags.project}-private_tbl"
+  vpc_id   = module.vpc_hq.vpc_hq_id
 
-# module "route_private" {
-#   source   = "../modules/route-table"
-#   tag_name = "${local.common_tags.project}-private_route_table"
-#   vpc_id   = module.vpc_hq.vpc_hq_id
+}
+module "route_add_nat" {
+  source          = "../modules/route-add"
+  route_id = module.route_private.route_id
+  nat_id = module.nat_gw.nat_id
+  gw_type = "nat"
+}
+module "route_association_nat" {
+  source         = "../modules/route-association"
+  route_table_id = module.route_private.route_id
 
-# }
+  association_count = 2
+  subnet_ids        = [module.subnet_private.subnet.zone-a.id, module.subnet_private.subnet.zone-c.id]
+}