From 9d6a671f3e2916409d143ddb41fe184b5ce7c120 Mon Sep 17 00:00:00 2001 From: mianava Date: Mon, 5 Oct 2026 15:42:47 -0400 Subject: [PATCH 1/3] Set up S3 VPC Endpoint --- terraform/services/020-vpc-network/README.md | 4 ++ terraform/services/020-vpc-network/conf.sh | 1 + terraform/services/020-vpc-network/data.tf | 7 ++++ terraform/services/020-vpc-network/main.tf | 7 ++++ terraform/services/020-vpc-network/tofu.tf | 37 +++++++++++++++++++ .../services/020-vpc-network/variables.tf | 17 +++++++++ .../policy_cdap_only.tf | 12 ++++++ 7 files changed, 85 insertions(+) create mode 100644 terraform/services/020-vpc-network/README.md create mode 100644 terraform/services/020-vpc-network/conf.sh create mode 100644 terraform/services/020-vpc-network/data.tf create mode 100644 terraform/services/020-vpc-network/main.tf create mode 100644 terraform/services/020-vpc-network/tofu.tf create mode 100644 terraform/services/020-vpc-network/variables.tf diff --git a/terraform/services/020-vpc-network/README.md b/terraform/services/020-vpc-network/README.md new file mode 100644 index 000000000..ac4aeb1d2 --- /dev/null +++ b/terraform/services/020-vpc-network/README.md @@ -0,0 +1,4 @@ +# VPC Network +Establishes network configuration for our VPCs to support in-network traffic. +CMS Cloud generates our VPCs, though we set this configuration. + diff --git a/terraform/services/020-vpc-network/conf.sh b/terraform/services/020-vpc-network/conf.sh new file mode 100644 index 000000000..ceac829df --- /dev/null +++ b/terraform/services/020-vpc-network/conf.sh @@ -0,0 +1 @@ +TARGET_ENVS="cdap-test cdap-prod ab2d-test bcda-test dpc-test" diff --git a/terraform/services/020-vpc-network/data.tf b/terraform/services/020-vpc-network/data.tf new file mode 100644 index 000000000..dfa7c4f54 --- /dev/null +++ b/terraform/services/020-vpc-network/data.tf @@ -0,0 +1,7 @@ +data "aws_route_tables" "private" { + vpc_id = module.platform.vpc_id + filter { + name = "tag:Tier" + values = ["private"] + } +} \ No newline at end of file diff --git a/terraform/services/020-vpc-network/main.tf b/terraform/services/020-vpc-network/main.tf new file mode 100644 index 000000000..7b4cc1460 --- /dev/null +++ b/terraform/services/020-vpc-network/main.tf @@ -0,0 +1,7 @@ +resource "aws_vpc_endpoint" "s3" { + vpc_id = module.platform.vpc_id + service_name = "com.amazonaws.${module.platform.primary_region.name}.s3" + vpc_endpoint_type = "Gateway" + route_table_ids = data.aws_route_tables.private.ids + tags = merge(module.platform.default_tags, { Name = "${var.app}-east-${var.env}}-s3-gw-endpoint" }) +} diff --git a/terraform/services/020-vpc-network/tofu.tf b/terraform/services/020-vpc-network/tofu.tf new file mode 100644 index 000000000..616d803d7 --- /dev/null +++ b/terraform/services/020-vpc-network/tofu.tf @@ -0,0 +1,37 @@ +terraform { + required_providers { + aws = { + source = "hashicorp/aws" + version = "~>6.0" + } + } + + backend "s3" { + key = "vpc-network/terraform.tfstate" + } +} + +provider "aws" { + region = "us-east-1" + default_tags { + tags = module.platform.default_tags + } +} + +provider "aws" { + alias = "secondary" + region = "us-west-2" + default_tags { + tags = module.platform.default_tags + } +} + +module "platform" { + source = "../../modules/platform" + providers = { aws = aws, aws.secondary = aws.secondary } + + app = var.app + env = var.env + root_module = "https://github.com/CMSgov/cdap/tree/main/terraform/services/${basename(abspath(path.module))}/" + service = replace(basename(abspath(path.module)), "/^[0-9]+-/", "") +} diff --git a/terraform/services/020-vpc-network/variables.tf b/terraform/services/020-vpc-network/variables.tf new file mode 100644 index 000000000..22a5db6c2 --- /dev/null +++ b/terraform/services/020-vpc-network/variables.tf @@ -0,0 +1,17 @@ +variable "app" { + description = "The application name (ab2d, bcda, dpc, cdap)" + type = string + validation { + condition = contains(["ab2d", "bcda", "dpc", "cdap"], var.app) + error_message = "Valid value for app is ab2d, bcda, dpc, or cdap." + } +} + +variable "env" { + description = "The application environment (dev, test, mgmt, sbx, sandbox, prod)" + type = string + validation { + condition = contains(["dev", "test", "sandbox", "prod"], var.env) + error_message = "Valid value for env is dev, test, sandbox, or prod." + } +} diff --git a/terraform/services/900-github-actions-role/policy_cdap_only.tf b/terraform/services/900-github-actions-role/policy_cdap_only.tf index 7f6f3a130..10610d52b 100644 --- a/terraform/services/900-github-actions-role/policy_cdap_only.tf +++ b/terraform/services/900-github-actions-role/policy_cdap_only.tf @@ -69,6 +69,18 @@ data "aws_iam_policy_document" "github_actions_cdap" { resources = ["*"] } + # VPC network management + statement { + sid = "VPCNetwork" + actions = [ + "ec2:CreateVpcEndpoint", + "ec2:DescribeVpcEndpoints", + "ec2:ModifyVpcEndpoint", + "ec2:DeleteVpcEndpoints" + ] + resources = ["*"] + } + # ECR Read — CDAP needs to describe all apps' repositories # for cross-app infrastructure management statement { From 735362faf88c7329aaad8b96e69d29813a664963 Mon Sep 17 00:00:00 2001 From: mianava Date: Mon, 5 Oct 2026 15:59:13 -0400 Subject: [PATCH 2/3] Remove extra character from name --- terraform/services/020-vpc-network/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/services/020-vpc-network/main.tf b/terraform/services/020-vpc-network/main.tf index 7b4cc1460..8235b83fb 100644 --- a/terraform/services/020-vpc-network/main.tf +++ b/terraform/services/020-vpc-network/main.tf @@ -3,5 +3,5 @@ resource "aws_vpc_endpoint" "s3" { service_name = "com.amazonaws.${module.platform.primary_region.name}.s3" vpc_endpoint_type = "Gateway" route_table_ids = data.aws_route_tables.private.ids - tags = merge(module.platform.default_tags, { Name = "${var.app}-east-${var.env}}-s3-gw-endpoint" }) + tags = merge(module.platform.default_tags, { Name = "${var.app}-east-${var.env}-s3-gw-endpoint" }) } From a742c21bd269393c0d8ea9013f19a1eb2263455a Mon Sep 17 00:00:00 2001 From: mianava Date: Mon, 5 Oct 2026 16:28:05 -0400 Subject: [PATCH 3/3] Format --- terraform/services/020-vpc-network/README.md | 68 +++++++++++++++++++ terraform/services/020-vpc-network/main.tf | 2 +- .../policy_cdap_only.tf | 8 +-- 3 files changed, 73 insertions(+), 5 deletions(-) diff --git a/terraform/services/020-vpc-network/README.md b/terraform/services/020-vpc-network/README.md index ac4aeb1d2..4dd995d2c 100644 --- a/terraform/services/020-vpc-network/README.md +++ b/terraform/services/020-vpc-network/README.md @@ -2,3 +2,71 @@ Establishes network configuration for our VPCs to support in-network traffic. CMS Cloud generates our VPCs, though we set this configuration. + + + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | 6.67.0 | + + +## Requirements + +| Name | Version | +|------|---------| +| [aws](#requirement\_aws) | ~>6.0 | + + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [app](#input\_app) | The application name (ab2d, bcda, dpc, cdap) | `string` | n/a | yes | +| [env](#input\_env) | The application environment (dev, test, mgmt, sbx, sandbox, prod) | `string` | n/a | yes | + + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [platform](#module\_platform) | ../../modules/platform | n/a | + + +## Resources + +| Name | Type | +|------|------| +| [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource | +| [aws_route_tables.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route_tables) | data source | + + +## Outputs + +No outputs. + \ No newline at end of file diff --git a/terraform/services/020-vpc-network/main.tf b/terraform/services/020-vpc-network/main.tf index 8235b83fb..ddc277db7 100644 --- a/terraform/services/020-vpc-network/main.tf +++ b/terraform/services/020-vpc-network/main.tf @@ -3,5 +3,5 @@ resource "aws_vpc_endpoint" "s3" { service_name = "com.amazonaws.${module.platform.primary_region.name}.s3" vpc_endpoint_type = "Gateway" route_table_ids = data.aws_route_tables.private.ids - tags = merge(module.platform.default_tags, { Name = "${var.app}-east-${var.env}-s3-gw-endpoint" }) + tags = merge(module.platform.default_tags, { Name = "${var.app}-east-${var.env}-s3-gw-endpoint" }) } diff --git a/terraform/services/900-github-actions-role/policy_cdap_only.tf b/terraform/services/900-github-actions-role/policy_cdap_only.tf index 10610d52b..015be0c3d 100644 --- a/terraform/services/900-github-actions-role/policy_cdap_only.tf +++ b/terraform/services/900-github-actions-role/policy_cdap_only.tf @@ -73,10 +73,10 @@ data "aws_iam_policy_document" "github_actions_cdap" { statement { sid = "VPCNetwork" actions = [ - "ec2:CreateVpcEndpoint", - "ec2:DescribeVpcEndpoints", - "ec2:ModifyVpcEndpoint", - "ec2:DeleteVpcEndpoints" + "ec2:CreateVpcEndpoint", + "ec2:DescribeVpcEndpoints", + "ec2:ModifyVpcEndpoint", + "ec2:DeleteVpcEndpoints" ] resources = ["*"] }