diff --git a/modules/autoscale_gwlb/README.md b/modules/autoscale_gwlb/README.md
index 77b929d..4bc29f4 100755
--- a/modules/autoscale_gwlb/README.md
+++ b/modules/autoscale_gwlb/README.md
@@ -46,6 +46,7 @@ module "example_module" {
gateway_name = "asg_gateway"
gateway_instance_type = "c5.xlarge"
key_name = "publickey"
+ ip_mode = "IPv4"
instances_tags = {
key1 = "value1"
key2 = "value2"
@@ -66,7 +67,6 @@ module "example_module" {
allow_upload_download = true
enable_cloudwatch = false
gateway_bootstrap_script = "echo 'this is bootstrap script' > /home/admin/bootstrap.txt"
- enable_ipv6 = false
}
```
@@ -85,6 +85,7 @@ module "example_module" {
| gateway_name | The name tag of the Security Gateways instances | string | **Default:** Check-Point-ASG-gateway-tf |
| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge |
| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | |
+| ip_mode | Specifies the IP mode for the GWLB. When set to DualStack, the gateway supports both IPv4 and IPv6 traffic. [Please see version compatibility in the following guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/IPv6-Support.htm) | string | "IPv4"/"DualStack"
**Default:** "IPv4" |
| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 |
| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true |
| instances_tags | (Optional) A map of tags as key=value pairs. All tags will be added to all AutoScaling Group instances | map(string) | **Default:** {} |
@@ -103,7 +104,6 @@ module "example_module" {
| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 |
| gateway_maintenance_mode_password_hash | (Optional) Maintenance-mode password for recovery purposes. | string | |
security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []|
-| enable_ipv6 | Enables dual-stack networking (IPv4 and IPv6) for the GWLB, [Please see version compatibility in the following guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/IPv6-Support.htm) | bool | true/false
**Default:** false
## Outputs
diff --git a/modules/autoscale_gwlb/asg_userdata.yaml b/modules/autoscale_gwlb/asg_userdata.yaml
index 0c6852d..e2719de 100755
--- a/modules/autoscale_gwlb/asg_userdata.yaml
+++ b/modules/autoscale_gwlb/asg_userdata.yaml
@@ -13,17 +13,16 @@ network:
- *eth0-dns1
bridge_interfaces:
- eth0
+ ipv6_enabled: ${IPMode}
kernel_parameters:
sim:
- sim_geneve_enabled=1
- sim_geneve_br_dev=br0
fw:
-
- fwtls_bridge_mode_inspection=1
- fw_geneve_enabled=1
bootcmd:
- - echo "brctl hairpin br0 eth0 on" >> /etc/rc.local
- - echo "cpprod_util CPPROD_SetValue \"fw1\" \"AwsGwlb\" 4 1 1" >> /etc/rc.local
+ - $CGEDIR/scripts/hairpin_on.sh AwsGwlb
runcmd:
- |
python3 /etc/cloud_config.py enableCloudWatch=\"${EnableCloudWatch}\" sicKey=\"${SICKey}\" installationType=\"autoscale\" osVersion=\"${OsVersion}\" allowUploadDownload=\"${AllowUploadDownload}\" templateVersion=\"1.0.5\" templateName=\"autoscale_gwlb\" templateType=\"terraform_registry\" shell=\"${Shell}\" enableInstanceConnect=\"${EnableInstanceConnect}\" passwordHash=\"${PasswordHash}\" MaintenanceModePassword=\"${MaintenanceModePassword}\" bootstrapScript64=\"${BootstrapScript}\"
\ No newline at end of file
diff --git a/modules/autoscale_gwlb/asg_userdata_ipv6.yaml b/modules/autoscale_gwlb/asg_userdata_ipv6.yaml
deleted file mode 100644
index 174af69..0000000
--- a/modules/autoscale_gwlb/asg_userdata_ipv6.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-#cloud-config
-network:
- version: 1
- config:
- - type: bridge
- name: br0
- mtu: *eth0-mtu
- subnets:
- - address: *eth0-private
- type: static
- gateway: *default-gateway
- dns_nameservers:
- - *eth0-dns1
- bridge_interfaces:
- - eth0
-kernel_parameters:
- sim:
- - sim_geneve_enabled=1
- - sim_geneve_br_dev=br0
- fw:
-
- - fwtls_bridge_mode_inspection=1
- - fw_geneve_enabled=1
-bootcmd:
- - echo "brctl hairpin br0 eth0 on" >> /etc/rc.local
- - echo "cpprod_util CPPROD_SetValue \"fw1\" \"AwsGwlb\" 4 1 1" >> /etc/rc.local
- - cp /etc/basedb /etc/basedb.bak
- - grep -vx "ipv6 t" /etc/basedb.bak | grep -vx "ipv6 f" > /etc/basedb;
- - echo "ipv6 t" >> /etc/basedb
- - /etc/rc3.d/S07ipv6gen
-runcmd:
- - |
- python3 /etc/cloud_config.py enableCloudWatch=\"${EnableCloudWatch}\" sicKey=\"${SICKey}\" installationType=\"autoscale\" osVersion=\"${OsVersion}\" allowUploadDownload=\"${AllowUploadDownload}\" templateVersion=\"20231012\" templateName=\"autoscale_gwlb\" templateType=\"terraform_registry\" shell=\"${Shell}\" enableInstanceConnect=\"${EnableInstanceConnect}\" passwordHash=\"${PasswordHash}\" MaintenanceModePassword=\"${MaintenanceModePassword}\" bootstrapScript64=\"${BootstrapScript}\"
diff --git a/modules/autoscale_gwlb/locals.tf b/modules/autoscale_gwlb/locals.tf
index 2c81153..1eb632f 100755
--- a/modules/autoscale_gwlb/locals.tf
+++ b/modules/autoscale_gwlb/locals.tf
@@ -33,6 +33,10 @@ locals {
regex_valid_cidr_range = "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(/(3[0-2]|2[0-9]|1[0-9]|[0-9]))?$"
+ # IPv6 configuration helpers
+ ipv6_enabled = var.ip_mode != "IPv4"
+ ipv4_enabled = var.ip_mode != "IPv6"
+
tags_asg_format = null_resource.tags_as_list_of_maps.*.triggers
//Splits the version and licence and returns the os version
diff --git a/modules/autoscale_gwlb/main.tf b/modules/autoscale_gwlb/main.tf
index 2a9e909..179aee1 100755
--- a/modules/autoscale_gwlb/main.tf
+++ b/modules/autoscale_gwlb/main.tf
@@ -15,7 +15,8 @@ resource "aws_security_group" "permissive_sg" {
from_port = ingress.value.from_port
to_port = ingress.value.to_port
protocol = ingress.value.protocol
- cidr_blocks = ingress.value.cidr_blocks
+ cidr_blocks = local.ipv4_enabled ? [for cidr in ingress.value.cidr_blocks : cidr if strcontains(cidr, ".")] : []
+ ipv6_cidr_blocks = local.ipv6_enabled ? [for cidr in ingress.value.cidr_blocks : cidr if strcontains(cidr, ":")] : []
}
}
@@ -25,7 +26,8 @@ resource "aws_security_group" "permissive_sg" {
from_port = 0
to_port = 0
protocol = "-1"
- cidr_blocks = ["0.0.0.0/0"]
+ cidr_blocks = local.ipv4_enabled ? ["0.0.0.0/0"] : []
+ ipv6_cidr_blocks = local.ipv6_enabled ? ["::/0"] : []
}
}
@@ -35,7 +37,8 @@ resource "aws_security_group" "permissive_sg" {
from_port = egress.value.from_port
to_port = egress.value.to_port
protocol = egress.value.protocol
- cidr_blocks = egress.value.cidr_blocks
+ cidr_blocks = local.ipv4_enabled ? [for cidr in egress.value.cidr_blocks : cidr if strcontains(cidr, ".")] : []
+ ipv6_cidr_blocks = local.ipv6_enabled ? [for cidr in egress.value.cidr_blocks : cidr if strcontains(cidr, ":")] : []
}
}
@@ -45,7 +48,8 @@ resource "aws_security_group" "permissive_sg" {
from_port = 0
to_port = 0
protocol = "-1"
- cidr_blocks = ["0.0.0.0/0"]
+ cidr_blocks = local.ipv4_enabled ? ["0.0.0.0/0"] : []
+ ipv6_cidr_blocks = local.ipv6_enabled ? ["::/0"] : []
}
}
tags = {
@@ -53,20 +57,6 @@ resource "aws_security_group" "permissive_sg" {
}
}
-resource "aws_vpc_security_group_ingress_rule" "ingress_rule_ipv6" {
- count = var.enable_ipv6 ? 1 : 0
- security_group_id = aws_security_group.permissive_sg.id
- cidr_ipv6 = "::/0"
- ip_protocol = "-1"
- }
-
-resource "aws_vpc_security_group_egress_rule" "egress_rule_ipv6" {
- count = var.enable_ipv6 ? 1 : 0
- security_group_id = aws_security_group.permissive_sg.id
- cidr_ipv6 = "::/0"
- ip_protocol = "-1"
-}
-
resource "aws_launch_template" "asg_launch_template" {
name_prefix = local.asg_name
image_id = module.amis.ami_id
@@ -102,7 +92,7 @@ resource "aws_launch_template" "asg_launch_template" {
description = "Initial template version"
- user_data = base64encode(templatefile("${path.module}/${var.enable_ipv6 ? "asg_userdata_ipv6.yaml" : "asg_userdata.yaml"}", {
+ user_data = base64encode(templatefile("${path.module}/asg_userdata.yaml", {
// script's arguments
PasswordHash = local.gateway_password_hash_base64,
MaintenanceModePassword = local.maintenance_mode_password_hash_base64,
@@ -113,7 +103,7 @@ resource "aws_launch_template" "asg_launch_template" {
AllowUploadDownload = var.allow_upload_download,
BootstrapScript = local.gateway_bootstrap_script64,
OsVersion = local.version_split
- enable_ipv6 = var.enable_ipv6
+ IPMode = var.ip_mode == "IPv4" ? "false" : "true"
}))
}
resource "aws_autoscaling_group" "asg" {
diff --git a/modules/autoscale_gwlb/output.tf b/modules/autoscale_gwlb/output.tf
index 95e2d8b..ecbc617 100755
--- a/modules/autoscale_gwlb/output.tf
+++ b/modules/autoscale_gwlb/output.tf
@@ -39,6 +39,6 @@ output "autoscale_iam_role_name" {
value = aws_iam_role.role.*.name
}
-output "enable_ipv6"{
- value = var.enable_ipv6
+output "ip_mode"{
+ value = var.ip_mode
}
diff --git a/modules/autoscale_gwlb/variables.tf b/modules/autoscale_gwlb/variables.tf
index 08eebad..7ba9c1c 100755
--- a/modules/autoscale_gwlb/variables.tf
+++ b/modules/autoscale_gwlb/variables.tf
@@ -194,8 +194,12 @@ variable "security_rules" {
}))
default = []
}
-variable "enable_ipv6" {
- type = bool
- description = "Enable IPv6 settings of AWS resources."
- default = false
+variable "ip_mode" {
+ type = string
+ description = "IP mode of AWS resources."
+ default = "IPv4"
+ validation {
+ condition = contains(["IPv4", "DualStack"], var.ip_mode)
+ error_message = "The ip_mode value must be one of: IPv4 or DualStack."
+ }
}
\ No newline at end of file
diff --git a/modules/gwlb/README.md b/modules/gwlb/README.md
index fd1fc1a..7812f8e 100755
--- a/modules/gwlb/README.md
+++ b/modules/gwlb/README.md
@@ -38,6 +38,8 @@ module "example_module" {
// --- General Settings ---
key_name = "publickey"
+ ip_mode = "IPv4"
+ allocate_public_IP = false
enable_volume_encryption = true
volume_size = 200
enable_instance_connect = false
@@ -102,6 +104,8 @@ module "example_module" {
| vpc_id | Select an existing VPC | string | |
| subnet_ids | The VPC subnets ID | string | |
| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | |
+| ip_mode | Specifies the IP mode for inspection of traffic encapsulation in IPv4 Geneve headers. When set to DualStack, both IPv4 and IPv6 traffic are inspected (supported on version R81.20 with JHF 99 and above). | string | "IPv4"/"DualStack"
**Default:** "IPv4" |
+| allocate_public_IP | Allocate a Public IP for gateway members. | bool | true/false
**Default:** false |
| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true |
| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false |
| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true terraform destroy won't work properly | bool | true/false
**Default:** false |
@@ -137,7 +141,6 @@ module "example_module" {
| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 |
| gateway_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command "grub2-mkpasswd-pbkdf2" on Linux and paste it here). | string | |
| management_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command "grub2-mkpasswd-pbkdf2" on Linux and paste it here). | string | |
-| enable_ipv6 | Enables dual-stack networking (IPv4 and IPv6) for the GWLB, [Please see version compatibility in the following guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/IPv6-Support.htm) | bool | true/false
**Default:** false |
## Outputs
To display the outputs defined by the module, create an `outputs.tf` file with the following structure:
@@ -155,5 +158,5 @@ output "instance_public_ip" {
| gwlb_name | The name of the deployed Gateway Load Balancer |
| gwlb_service_name | The service name for the deployed Gateway Load Balancer |
| gwlb_arn | The arn for the deployed Gateway Load Balancer |
-| enable_ipv6 | Dual-stack IPv4/IPv6 compatible |
+| ip_mode | The IP mode of AWS resources. |
diff --git a/modules/gwlb/main.tf b/modules/gwlb/main.tf
index e36cf74..d4bd7c1 100755
--- a/modules/gwlb/main.tf
+++ b/modules/gwlb/main.tf
@@ -18,14 +18,14 @@ module "gateway_load_balancer" {
target_group_port = 6081
listener_port = 6081
cross_zone_load_balancing = var.enable_cross_zone_load_balancing
- enable_ipv6 = var.enable_ipv6
+ ip_mode = var.ip_mode
}
resource "aws_vpc_endpoint_service" "gwlb_endpoint_service" {
depends_on = [module.gateway_load_balancer]
gateway_load_balancer_arns = module.gateway_load_balancer[*].load_balancer_arn
acceptance_required = var.connection_acceptance_required
- supported_ip_address_types = var.enable_ipv6 ? ["ipv4", "ipv6"] : ["ipv4"]
+ supported_ip_address_types = var.ip_mode != "IPv4" ? ["ipv4", "ipv6"] : ["ipv4"]
tags = {
"Name" = "gwlb-endpoint-service-${var.gateway_load_balancer_name}"
}
@@ -59,7 +59,7 @@ module "autoscale_gwlb" {
management_server = var.management_server
configuration_template = var.configuration_template
volume_type = var.volume_type
- enable_ipv6 = var.enable_ipv6
+ ip_mode = var.ip_mode
}
data "aws_region" "current"{}
diff --git a/modules/gwlb/output.tf b/modules/gwlb/output.tf
index a32f428..fcb2bcc 100755
--- a/modules/gwlb/output.tf
+++ b/modules/gwlb/output.tf
@@ -20,6 +20,6 @@ output "controller_name" {
output "template_name" {
value = var.configuration_template
}
-output "enable_ipv6"{
- value = var.enable_ipv6
+output "ip_mode"{
+ value = var.ip_mode
}
\ No newline at end of file
diff --git a/modules/gwlb/variables.tf b/modules/gwlb/variables.tf
index 06a1cf5..bcdd1ef 100755
--- a/modules/gwlb/variables.tf
+++ b/modules/gwlb/variables.tf
@@ -249,8 +249,12 @@ variable "volume_type" {
description = "General Purpose SSD Volume Type"
default = "gp3"
}
-variable "enable_ipv6" {
- type = bool
- description = "Enable IPv6 settings of AWS resources."
- default = false
+variable "ip_mode" {
+ type = string
+ description = "IP mode of AWS resources."
+ default = "IPv4"
+ validation {
+ condition = contains(["IPv4", "DualStack"], var.ip_mode)
+ error_message = "The ip_mode value must be one of: IPv4 or DualStack."
+ }
}
\ No newline at end of file
diff --git a/modules/gwlb_master/README.md b/modules/gwlb_master/README.md
index 9cedb8a..2801c8c 100755
--- a/modules/gwlb_master/README.md
+++ b/modules/gwlb_master/README.md
@@ -43,6 +43,7 @@ module "example_module" {
// --- General Settings ---
key_name = "publickey"
+ ip_mode = "IPv4"
enable_volume_encryption = true
volume_size = 200
enable_instance_connect = false
@@ -82,7 +83,6 @@ module "example_module" {
gateway_management = "Locally managed"
admin_cidr = ""
gateways_addresses = ""
- enable_ipv6 = false
// --- Other parameters ---
volume_type = "gp3"
@@ -98,6 +98,7 @@ module "example_module" {
| public_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. (e.g., {"us-east-1a" = 1}) | map | |
| subnets_bit_length | Number of additional bits with which to extend the VPC CIDR. For example, if given a `vpc_cidr` ending in /16 and a `subnets_bit_length` value of 4, the resulting subnet address will have length /20 | number | |
| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | |
+| ip_mode | Specifies the IP mode for inspection of traffic encapsulation in IPv4 Geneve headers. When set to DualStack, both IPv4 and IPv6 traffic are inspected (supported on version R81.20 with JHF 99 and above). | string | "IPv4"/"DualStack"
**Default:** "IPv4" |
| enable_volume_encryption | Encrypt environment instances volume with the default AWS KMS key | bool | true/false
**Default:** true |
| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false |
| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true, Terraform destroy won't work properly | bool | true/false
**Default:** false |
@@ -133,7 +134,6 @@ module "example_module" {
| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 |
| gateway_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | **Default:** "" |
| management_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | **Default:** "" |
-| enable_ipv6 | Enables dual-stack networking (IPv4 and IPv6) for the GWLB, [Please see version compatibility in the following guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/IPv6-Support.htm) | bool | true/false
**Default:** false |
## Outputs
@@ -152,4 +152,4 @@ output "instance_public_ip" {
| gwlb_name | The name of the deployed Gateway Load Balancer |
| gwlb_service_name | The service name for the deployed Gateway Load Balancer |
| gwlb_arn | The arn for the deployed Gateway Load Balancer |
-| enable_ipv6 | Dual-stack IPv4/IPv6 compatible |
+| ip_mode | The IP mode of AWS resources. |
diff --git a/modules/gwlb_master/main.tf b/modules/gwlb_master/main.tf
index e02c1f8..85dddd6 100755
--- a/modules/gwlb_master/main.tf
+++ b/modules/gwlb_master/main.tf
@@ -5,7 +5,7 @@ module "launch_vpc" {
public_subnets_map = var.public_subnets_map
private_subnets_map = {}
subnets_bit_length = var.subnets_bit_length
- enable_ipv6 = var.enable_ipv6
+ ip_mode = var.ip_mode
}
module "gwlb" {
@@ -57,5 +57,5 @@ module "gwlb" {
gateways_addresses = var.gateways_addresses
volume_type = var.volume_type
- enable_ipv6 = var.enable_ipv6
+ ip_mode = var.ip_mode
}
\ No newline at end of file
diff --git a/modules/gwlb_master/output.tf b/modules/gwlb_master/output.tf
index 1db63d7..d8f46e2 100755
--- a/modules/gwlb_master/output.tf
+++ b/modules/gwlb_master/output.tf
@@ -22,6 +22,6 @@ output "controller_name" {
output "template_name" {
value = var.configuration_template
}
-output "enable_ipv6"{
- value = var.enable_ipv6
+output "ip_mode"{
+ value = var.ip_mode
}
\ No newline at end of file
diff --git a/modules/gwlb_master/variables.tf b/modules/gwlb_master/variables.tf
index 0ec3681..ea8707e 100755
--- a/modules/gwlb_master/variables.tf
+++ b/modules/gwlb_master/variables.tf
@@ -260,8 +260,12 @@ variable "volume_type" {
description = "General Purpose SSD Volume Type"
default = "gp3"
}
-variable "enable_ipv6" {
- type = bool
- description = "Enable IPv6 settings of AWS resources."
- default = false
+variable "ip_mode" {
+ type = string
+ description = "IP mode of AWS resources."
+ default = "IPv4"
+ validation {
+ condition = contains(["IPv4", "DualStack"], var.ip_mode)
+ error_message = "The ip_mode value must be one of: IPv4 or DualStack."
+ }
}
\ No newline at end of file
diff --git a/modules/load_balancer/main.tf b/modules/load_balancer/main.tf
index 4ab4421..9bc4f5c 100755
--- a/modules/load_balancer/main.tf
+++ b/modules/load_balancer/main.tf
@@ -12,7 +12,7 @@ resource "aws_lb" "load_balancer" {
security_groups = var.security_groups
tags = var.tags
enable_cross_zone_load_balancing = var.cross_zone_load_balancing
- ip_address_type = var.enable_ipv6 ? "dualstack" : "ipv4"
+ ip_address_type = var.ip_mode != "IPv4" ? "dualstack" : "ipv4"
}
resource "aws_lb_target_group" "lb_target_group" {
name = substr(format("%s-%s", "${var.prefix_name}-TG", random_id.unique_lb_id.hex), 0, 32)
diff --git a/modules/load_balancer/output.tf b/modules/load_balancer/output.tf
index 3ef5d9a..1e0e08e 100755
--- a/modules/load_balancer/output.tf
+++ b/modules/load_balancer/output.tf
@@ -16,6 +16,6 @@ output "target_group_arn" {
output "load_balancer_tags" {
value = aws_lb.load_balancer.tags
}
-output "enable_ipv6"{
- value = var.enable_ipv6
+output "ip_mode"{
+ value = var.ip_mode
}
\ No newline at end of file
diff --git a/modules/load_balancer/variables.tf b/modules/load_balancer/variables.tf
index eeac58d..8aa78c7 100755
--- a/modules/load_balancer/variables.tf
+++ b/modules/load_balancer/variables.tf
@@ -60,8 +60,12 @@ variable "health_check_protocol" {
type = string
default = null
}
-variable "enable_ipv6" {
- type = bool
- description = "Enable IPv6 settings of AWS resources."
- default = false
+variable "ip_mode" {
+ type = string
+ description = "IP mode of AWS resources."
+ default = "IPv4"
+ validation {
+ condition = contains(["IPv4", "DualStack"], var.ip_mode)
+ error_message = "The ip_mode value must be one of: IPv4 or DualStack."
+ }
}
\ No newline at end of file
diff --git a/modules/vpc/locals.tf b/modules/vpc/locals.tf
new file mode 100644
index 0000000..2fb7510
--- /dev/null
+++ b/modules/vpc/locals.tf
@@ -0,0 +1,4 @@
+locals {
+ ipv6_enabled = var.ip_mode != "IPv4"
+ ipv4_enabled = var.ip_mode != "IPv6"
+}
\ No newline at end of file
diff --git a/modules/vpc/main.tf b/modules/vpc/main.tf
index 7e85501..bebf7db 100755
--- a/modules/vpc/main.tf
+++ b/modules/vpc/main.tf
@@ -1,7 +1,7 @@
// --- VPC ---
resource "aws_vpc" "vpc" {
cidr_block = var.vpc_cidr
- assign_generated_ipv6_cidr_block = var.enable_ipv6
+ assign_generated_ipv6_cidr_block = local.ipv6_enabled
}
// --- Internet Gateway ---
@@ -15,9 +15,16 @@ resource "aws_subnet" "public_subnets" {
vpc_id = aws_vpc.vpc.id
availability_zone = each.key
- cidr_block = cidrsubnet(aws_vpc.vpc.cidr_block, var.subnets_bit_length, each.value)
- ipv6_cidr_block = var.enable_ipv6 ? cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, var.subnets_bit_length, each.value) : null
- map_public_ip_on_launch = true
+
+ # IPv6 Support
+ cidr_block = !local.ipv4_enabled ? null : cidrsubnet(aws_vpc.vpc.cidr_block, var.subnets_bit_length, each.value)
+ ipv6_cidr_block = local.ipv6_enabled ? cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, var.subnets_bit_length, each.value) : null
+ ipv6_native = !local.ipv4_enabled
+ assign_ipv6_address_on_creation = local.ipv6_enabled
+ map_public_ip_on_launch = !local.ipv4_enabled ? null : true
+ enable_resource_name_dns_a_record_on_launch = local.ipv4_enabled
+ enable_resource_name_dns_aaaa_record_on_launch = !local.ipv4_enabled
+
tags = {
Name = format("Public subnet %s", each.value)
}
@@ -29,8 +36,15 @@ resource "aws_subnet" "private_subnets" {
vpc_id = aws_vpc.vpc.id
availability_zone = each.key
- cidr_block = cidrsubnet(aws_vpc.vpc.cidr_block, var.subnets_bit_length, each.value)
- ipv6_cidr_block = var.enable_ipv6 ? cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, var.subnets_bit_length, each.value) : null
+
+ # IPv6 Support
+ cidr_block = !local.ipv4_enabled ? null : cidrsubnet(aws_vpc.vpc.cidr_block, var.subnets_bit_length, each.value)
+ ipv6_cidr_block = local.ipv6_enabled ? cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, var.subnets_bit_length, each.value) : null
+ ipv6_native = !local.ipv4_enabled
+ assign_ipv6_address_on_creation = local.ipv6_enabled
+ enable_resource_name_dns_a_record_on_launch = local.ipv4_enabled
+ enable_resource_name_dns_aaaa_record_on_launch = !local.ipv4_enabled
+
tags = {
Name = format("Private subnet %s", each.value)
}
@@ -42,8 +56,15 @@ resource "aws_subnet" "tgw_subnets" {
vpc_id = aws_vpc.vpc.id
availability_zone = each.key
- cidr_block = cidrsubnet(aws_vpc.vpc.cidr_block, var.subnets_bit_length, each.value)
- ipv6_cidr_block = var.enable_ipv6 ? cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, var.subnets_bit_length, each.value) : null
+
+ # IPv6 Support
+ cidr_block = !local.ipv4_enabled ? null : cidrsubnet(aws_vpc.vpc.cidr_block, var.subnets_bit_length, each.value)
+ ipv6_cidr_block = local.ipv6_enabled ? cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, var.subnets_bit_length, each.value) : null
+ ipv6_native = !local.ipv4_enabled
+ assign_ipv6_address_on_creation = local.ipv6_enabled
+ enable_resource_name_dns_a_record_on_launch = local.ipv4_enabled
+ enable_resource_name_dns_aaaa_record_on_launch = !local.ipv4_enabled
+
tags = {
Name = format("tgw subnet %s", each.value)
}
@@ -58,19 +79,20 @@ resource "aws_route_table" "public_subnet_rtb" {
}
}
resource "aws_route" "vpc_internet_access" {
+ count = local.ipv4_enabled ? 1 : 0
route_table_id = aws_route_table.public_subnet_rtb.id
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw.id
}
resource "aws_route" "vpc_internet_access_ipv6" {
- count = var.enable_ipv6 ? 1 : 0
+ count = local.ipv6_enabled ? 1 : 0
route_table_id = aws_route_table.public_subnet_rtb.id
destination_ipv6_cidr_block = "::/0"
gateway_id = aws_internet_gateway.igw.id
}
resource "aws_route_table_association" "public_rtb_to_public_subnets" {
- for_each = { for public_subnet in aws_subnet.public_subnets : public_subnet.cidr_block => public_subnet.id }
+ for_each = aws_subnet.public_subnets
route_table_id = aws_route_table.public_subnet_rtb.id
- subnet_id = each.value
+ subnet_id = each.value.id
}
diff --git a/modules/vpc/output.tf b/modules/vpc/output.tf
index fec9c18..905bcea 100755
--- a/modules/vpc/output.tf
+++ b/modules/vpc/output.tf
@@ -16,6 +16,6 @@ output "public_rtb" {
output "aws_igw" {
value = aws_internet_gateway.igw.id
}
-output "enable_ipv6"{
- value = aws_vpc.vpc.assign_generated_ipv6_cidr_block
+output "ip_mode"{
+ value = var.ip_mode
}
\ No newline at end of file
diff --git a/modules/vpc/variables.tf b/modules/vpc/variables.tf
index b1277f8..81b165f 100755
--- a/modules/vpc/variables.tf
+++ b/modules/vpc/variables.tf
@@ -19,9 +19,12 @@ variable "subnets_bit_length" {
type = number
description = "Number of additional bits with which to extend the vpc cidr. For example, if given a vpc_cidr ending in /16 and a subnets_bit_length value of 4, the resulting subnet address will have length /20."
}
-variable "enable_ipv6" {
- type = bool
- description = "Enable IPv6 settings of AWS resources."
- default = false
+variable "ip_mode" {
+ type = string
+ description = "IP mode of AWS resources."
+ default = "IPv4"
+ validation {
+ condition = contains(["IPv4", "DualStack", "IPv6"], var.ip_mode)
+ error_message = "The ip_mode value must be one of: IPv4, DualStack, or IPv6."
+ }
}
-