This module will provision a specified number of nat instances in the public subnets to allow outbound internet traffic from the private subnets. For route publishing and High Availability each instance runs the AWSnycast service. If the nat instance becomes unavailable it will remove the instance from the route table (this requires at least 2 instances). NAT instances are an alternative to NAT Gateways to determine which one is best for your use case please see the following:
- https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-comparison.html
- https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html
- https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html
ami_name_pattern
- The regex to filter which ami used (defaults to Ubuntu Xenial 16.04)ami_publisher
- The ami publisher id (defaults to Canonical's)instance_type
- The type of instance to provision (required)instance_count
- The number of nat instances to provision. At least two are required for HA. It is recommended to have one per subnet (required)az_list
- A list of availability zones to provision in (required)public_subnet_ids
- A list of the public subnets to provision in (required)private_subnet_ids
- A list of the private subnets to allow traffic from (required)security_groups
- A list of security groups applied to the nat instances (required)aws_key_name
- The name of the AWS key pair to provision the instances with (required)ssh_bastion_host
- The ip of the bastion hostssh_bastion_user
- The name of bastion user (required for ssh_bastion_host)aws_private_key
- The contents of private key file for the bastion instance (required for ssh_bastion_host; this is fed to theprivate_key
argument; renamed in v1.4, formerlyaws_key_location
)tags
- A list of tags to apply to the nat instancesroute_table_identifier
- The identifier used in the route table regexp used by AWSnycast. For backwards compatibility it defaults to "rt-private". If you are using the terraform-aws-vpc module you will need to set its value to "private"
private_ips
- A list of the nat instances private ipspublic_ips
- A list of the nat instances public ipsinstance_ids
- A list of the nat instance ids
resource "aws_security_group" "nat" {
name = "nat"
description = "Allow nat traffic"
vpc_id = "${module.vpc.vpc_id}"
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
module "nat" {
source = "github.com/terraform-community-modules/tf_aws_nat"
name = "${var.name}"
instance_type = "t2.nano"
instance_count = "2"
aws_key_name = "mykeyname"
public_subnet_ids = "${module.vpc.public_subnets}"
private_subnet_ids = "${module.vpc.private_subnets}"
vpc_security_group_ids = ["${aws_security_group.nat.id}"]
az_list = "${var.azs}"
subnets_count = "${length(var.azs)}"
route_table_identifier = "private"
ssh_bastion_user = "ubuntu"
ssh_bastion_host = "${aws_instance.bastion.public_ip}"
# this was formerly aws_key_location, renamed in v1.4
aws_private_key = "${file("pathtokeyfile")}"
}
Apache2, see the included LICENSE file for more information.