github.com/dahs81/otto@v0.2.1-0.20160126165905-6400716cf085/builtin/infra/aws/data/vpc-public-private/main.tf

# Generated by Otto, do not edit manually.

provider "aws" {
  access_key = "${var.aws_access_key}"
  secret_key = "${var.aws_secret_key}"
  region     = "${var.aws_region}"
}

# Main VPC that will contain everything.
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"

  tags { Name = "otto" }
}

# The public subnet is where resources connected to the internet will go
resource "aws_subnet" "public" {
    vpc_id                  = "${aws_vpc.main.id}"
    cidr_block              = "10.0.2.0/24"
    map_public_ip_on_launch = true

    tags { Name = "public" }
}

# The private subnet is where resources that are internal only will go
resource "aws_subnet" "private" {
    vpc_id     = "${aws_vpc.main.id}"
    cidr_block = "10.0.1.0/24"

    # Doesn't matter which AZ we land in, but public/private subnets
    # need to be colocated in an AZ for ELBs to be able to route.
    availability_zone = "${aws_subnet.public.availability_zone}"

    tags { Name = "private" }
}

# Internet accessible route table + gateway for the public subnet
resource "aws_internet_gateway" "public" {
  vpc_id = "${aws_vpc.main.id}"
}

resource "aws_route_table" "public" {
  vpc_id = "${aws_vpc.main.id}"
  route {
      cidr_block = "0.0.0.0/0"
      gateway_id = "${aws_internet_gateway.public.id}"
  }
  tags { Name = "public" }
}

resource "aws_route_table_association" "public" {
  subnet_id      = "${aws_subnet.public.id}"
  route_table_id = "${aws_route_table.public.id}"
}

# SSH key that app implementations can use to grant SSH access to instances
resource "aws_key_pair" "main" {
  key_name   = "otto-${element(split("-", aws_vpc.main.id), 1)}"
  public_key = "${var.ssh_public_key}"
}

# Bastion instance for SSH access to private hosts
resource "aws_security_group" "bastion" {
  name   = "otto-bastion-${element(split("-", aws_vpc.main.id), 1)}"
  vpc_id = "${aws_vpc.main.id}"

  egress {
    protocol    = -1
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    protocol    = -1
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["10.0.0.0/16"]
  }

  ingress {
    protocol    = "tcp"
    from_port   = 22
    to_port     = 22
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "bastion" {
  # TODO: lookup ubuntu AMI by region / instance typej
  # TODO: configurable instance type
  ami                    = "ami-21630d44"
  instance_type          = "t2.micro"
  key_name               = "${aws_key_pair.main.id}"
  subnet_id              = "${aws_subnet.public.id}"
  vpc_security_group_ids = ["${aws_security_group.bastion.id}"]

  # Wait for cloud-init (ensures instance is fully booted before moving on)
  provisioner "remote-exec" {
    inline = ["while sudo pkill -0 cloud-init 2>/dev/null; do sleep 2; done"]
    connection {
      user = "ubuntu"
      host = "${self.public_ip}"
    }
  }

  tags { Name = "otto-bastion" }
}

# NAT instance for internet access from the private subnet
resource "aws_security_group" "nat" {
  name   = "otto-nat-${element(split("-", aws_vpc.main.id), 1)}"
  vpc_id = "${aws_vpc.main.id}"

  ingress {
    protocol    = -1
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["10.0.0.0/16"]
  }
  egress {
    protocol    = -1
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "template_file" "nat" {
  filename = "${path.module}/nat_user_data.conf.tftpl"

  vars {
    vpc_cidr = "10.0.0.0/16"
  }
}

resource "aws_instance" "nat" {
  # TODO: lookup ubuntu AMI by region / instance typej
  # TODO: configurable instance type
  ami                    = "ami-21630d44"
  instance_type          = "t2.micro"
  subnet_id              = "${aws_subnet.public.id}"
  key_name               = "${aws_key_pair.main.id}"
  vpc_security_group_ids = ["${aws_security_group.nat.id}"]

  # Configure as NAT machine
  source_dest_check = false
  user_data         = "${template_file.nat.rendered}"

  # Wait for cloud-init (ensures instance is fully booted before moving on)
  provisioner "remote-exec" {
    inline = ["while sudo pkill -0 cloud-init 2>/dev/null; do sleep 2; done"]
    connection {
      user         = "ubuntu"
      host         = "${self.private_ip}"
      bastion_host = "${aws_instance.bastion.public_ip}"
      bastion_user = "ubuntu"
    }
  }

  tags { Name = "otto-nat" }
}

resource "aws_route_table" "private" {
  vpc_id = "${aws_vpc.main.id}"

  route {
    cidr_block  = "0.0.0.0/0"
    instance_id = "${aws_instance.nat.id}"
  }

  tags { Name = "otto-private" }
}

resource "aws_route_table_association" "mod" {
  subnet_id      = "${aws_subnet.private.id}"
  route_table_id = "${aws_route_table.private.id}"
}