feat: Add EC2 Instance Connect Endpoint support

Author: alvinjaison

README.md

@@ -264,6 +264,7 @@ No modules.
 | [aws_default_route_table.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table) | resource |
 | [aws_default_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | resource |
 | [aws_default_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc) | resource |
+| [aws_ec2_instance_connect_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_instance_connect_endpoint) | resource |
 | [aws_egress_only_internet_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/egress_only_internet_gateway) | resource |
 | [aws_eip.nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
 | [aws_elasticache_subnet_group.elasticache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | resource |
@@ -359,6 +360,7 @@ No modules.
 | <a name="input_create_flow_log_cloudwatch_iam_role"></a> [create\_flow\_log\_cloudwatch\_iam\_role](#input\_create\_flow\_log\_cloudwatch\_iam\_role) | Whether to create IAM role for VPC Flow Logs | `bool` | `false` | no |
 | <a name="input_create_flow_log_cloudwatch_log_group"></a> [create\_flow\_log\_cloudwatch\_log\_group](#input\_create\_flow\_log\_cloudwatch\_log\_group) | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |
 | <a name="input_create_igw"></a> [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
+| <a name="input_create_instance_connect_endpoint"></a> [create\_instance\_connect\_endpoint](#input\_create\_instance\_connect\_endpoint) | Whether to create an EC2 Instance Connect Endpoint | `bool` | `false` | no |
 | <a name="input_create_multiple_intra_route_tables"></a> [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 | <a name="input_create_multiple_public_route_tables"></a> [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
 | <a name="input_create_private_nat_gateway_route"></a> [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the private subnets | `bool` | `true` | no |
@@ -456,6 +458,9 @@ No modules.
 | <a name="input_flow_log_per_hour_partition"></a> [flow\_log\_per\_hour\_partition](#input\_flow\_log\_per\_hour\_partition) | (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries | `bool` | `false` | no |
 | <a name="input_flow_log_traffic_type"></a> [flow\_log\_traffic\_type](#input\_flow\_log\_traffic\_type) | The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL | `string` | `"ALL"` | no |
 | <a name="input_igw_tags"></a> [igw\_tags](#input\_igw\_tags) | Additional tags for the internet gateway | `map(string)` | `{}` | no |
+| <a name="input_instance_connect_preserve_client_ip"></a> [instance\_connect\_preserve\_client\_ip](#input\_instance\_connect\_preserve\_client\_ip) | Whether to preserve the client IP address when connecting via EC2 Instance Connect Endpoint | `bool` | `false` | no |
+| <a name="input_instance_connect_security_group_ids"></a> [instance\_connect\_security\_group\_ids](#input\_instance\_connect\_security\_group\_ids) | List of security group IDs to associate with the Instance Connect Endpoint | `list(string)` | `[]` | no |
+| <a name="input_instance_connect_subnet_id"></a> [instance\_connect\_subnet\_id](#input\_instance\_connect\_subnet\_id) | The ID of the subnet in which to create the Instance Connect Endpoint | `string` | `null` | no |
 | <a name="input_instance_tenancy"></a> [instance\_tenancy](#input\_instance\_tenancy) | A tenancy option for instances launched into the VPC | `string` | `"default"` | no |
 | <a name="input_intra_acl_tags"></a> [intra\_acl\_tags](#input\_intra\_acl\_tags) | Additional tags for the intra subnets network ACL | `map(string)` | `{}` | no |
 | <a name="input_intra_dedicated_network_acl"></a> [intra\_dedicated\_network\_acl](#input\_intra\_dedicated\_network\_acl) | Whether to use dedicated network ACL (not default) and custom rules for intra subnets | `bool` | `false` | no |
@@ -632,6 +637,7 @@ No modules.
 | <a name="output_elasticache_subnets_ipv6_cidr_blocks"></a> [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
 | <a name="output_igw_arn"></a> [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 | <a name="output_igw_id"></a> [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
+| <a name="output_instance_connect_endpoint_id"></a> [instance\_connect\_endpoint\_id](#output\_instance\_connect\_endpoint\_id) | The ID of the EC2 Instance Connect Endpoint |
 | <a name="output_intra_network_acl_arn"></a> [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
 | <a name="output_intra_network_acl_id"></a> [intra\_network\_acl\_id](#output\_intra\_network\_acl\_id) | ID of the intra network ACL |
 | <a name="output_intra_route_table_association_ids"></a> [intra\_route\_table\_association\_ids](#output\_intra\_route\_table\_association\_ids) | List of IDs of the intra route table association |

examples/ec2-instance-connect-endpoint/main.tf

@@ -5,9 +5,11 @@ provider "aws" {
 data "aws_availability_zones" "available" {}
 
 locals {
-  name   = "ex-${basename(path.cwd)}"
-  region = "us-east-1"
-  azs    = slice(data.aws_availability_zones.available.names, 0, 2)
+  name            = "ex-${basename(path.cwd)}"
+  region          = "us-east-1"
+  azs             = slice(data.aws_availability_zones.available.names, 0, 3)
+  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
+  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
 
   tags = {
     Example    = local.name
@@ -23,24 +25,31 @@ locals {
 module "vpc" {
   source = "../../"
 
-  name = local.name
+  name = "example-vpc"
   cidr = "10.0.0.0/16"
 
   azs             = local.azs
-  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
-  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
+  private_subnets = local.private_subnets
+  public_subnets  = local.public_subnets
 
   enable_nat_gateway = true
   single_nat_gateway = true
 
+  # EC2 Instance Connect Endpoint configuration
   create_instance_connect_endpoint    = true
   instance_connect_subnet_id          = element(local.private_subnets, 0)
   instance_connect_security_group_ids = [aws_security_group.allow_ssh.id]
   instance_connect_preserve_client_ip = false
 
-  tags = local.tags
+  tags = merge({
+    Name = "example-vpc"
+  }, local.tags)
 }
 
+################################################################################
+# Security Group for EC2 Instance Connect
+################################################################################
+
 resource "aws_security_group" "allow_ssh" {
   name        = "allow-ssh"
   description = "Allow SSH access for EC2 Instance Connect"
@@ -59,4 +68,8 @@ resource "aws_security_group" "allow_ssh" {
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
+
+  tags = merge({
+    Name = "allow-ssh"
+  }, local.tags)
 }

wrappers/main.tf

@@ -16,6 +16,7 @@ module "wrapper" {
   create_flow_log_cloudwatch_iam_role    = try(each.value.create_flow_log_cloudwatch_iam_role, var.defaults.create_flow_log_cloudwatch_iam_role, false)
   create_flow_log_cloudwatch_log_group   = try(each.value.create_flow_log_cloudwatch_log_group, var.defaults.create_flow_log_cloudwatch_log_group, false)
   create_igw                             = try(each.value.create_igw, var.defaults.create_igw, true)
+  create_instance_connect_endpoint       = try(each.value.create_instance_connect_endpoint, var.defaults.create_instance_connect_endpoint, false)
   create_multiple_intra_route_tables     = try(each.value.create_multiple_intra_route_tables, var.defaults.create_multiple_intra_route_tables, false)
   create_multiple_public_route_tables    = try(each.value.create_multiple_public_route_tables, var.defaults.create_multiple_public_route_tables, false)
   create_private_nat_gateway_route       = try(each.value.create_private_nat_gateway_route, var.defaults.create_private_nat_gateway_route, true)
@@ -183,6 +184,9 @@ module "wrapper" {
   flow_log_per_hour_partition                                       = try(each.value.flow_log_per_hour_partition, var.defaults.flow_log_per_hour_partition, false)
   flow_log_traffic_type                                             = try(each.value.flow_log_traffic_type, var.defaults.flow_log_traffic_type, "ALL")
   igw_tags                                                          = try(each.value.igw_tags, var.defaults.igw_tags, {})
+  instance_connect_preserve_client_ip                               = try(each.value.instance_connect_preserve_client_ip, var.defaults.instance_connect_preserve_client_ip, false)
+  instance_connect_security_group_ids                               = try(each.value.instance_connect_security_group_ids, var.defaults.instance_connect_security_group_ids, [])
+  instance_connect_subnet_id                                        = try(each.value.instance_connect_subnet_id, var.defaults.instance_connect_subnet_id, null)
   instance_tenancy                                                  = try(each.value.instance_tenancy, var.defaults.instance_tenancy, "default")
   intra_acl_tags                                                    = try(each.value.intra_acl_tags, var.defaults.intra_acl_tags, {})
   intra_dedicated_network_acl                                       = try(each.value.intra_dedicated_network_acl, var.defaults.intra_dedicated_network_acl, false)