Networking (VPC)

terraform {
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

provider "aws" {
  region  = "us-east-1"
  profile = "compass"
  default_tags {
    tags = { Project = "Compass", ManagedBy = "terraform" }
  }
}

resource "aws_vpc" "main" {
  cidr_block           = "10.50.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  tags = { Name = "compass-vpc" }
}

locals {
  azs = ["us-east-1a", "us-east-1b"]
}

# Public subnets - one per AZ. 10.50.0.0/24 and 10.50.1.0/24.
resource "aws_subnet" "public" {
  for_each                = toset(local.azs)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.50.${index(local.azs, each.key)}.0/24"
  availability_zone       = each.key
  map_public_ip_on_launch = true
  tags = { Name = "compass-public-${each.key}", Tier = "public" }
}

# Private subnets - 10.50.10.0/24 and 10.50.11.0/24.
resource "aws_subnet" "private" {
  for_each          = toset(local.azs)
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.50.${10 + index(local.azs, each.key)}.0/24"
  availability_zone = each.key
  tags = { Name = "compass-private-${each.key}", Tier = "private" }
}

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
  tags   = { Name = "compass-igw" }
}

# EIP for the NAT GW
resource "aws_eip" "nat" {
  domain     = "vpc"
  depends_on = [aws_internet_gateway.igw]
  tags       = { Name = "compass-nat-eip" }
}

# Single NAT GW in az-a (dev-grade; for prod, one per AZ)
resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public["us-east-1a"].id
  tags          = { Name = "compass-nat" }
  depends_on    = [aws_internet_gateway.igw]
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
  tags = { Name = "compass-rt-public" }
}

resource "aws_route_table_association" "public" {
  for_each       = aws_subnet.public
  subnet_id      = each.value.id
  route_table_id = aws_route_table.public.id
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main.id
  }
  tags = { Name = "compass-rt-private" }
}

resource "aws_route_table_association" "private" {
  for_each       = aws_subnet.private
  subnet_id      = each.value.id
  route_table_id = aws_route_table.private.id
}

# Free Gateway Endpoints (S3 + DynamoDB) - day-one cost saver
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.us-east-1.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
  tags              = { Name = "compass-s3-endpoint" }
}

resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.us-east-1.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
  tags              = { Name = "compass-ddb-endpoint" }
}

# SG for the Lambda when it runs in the VPC (chapter 4)
resource "aws_security_group" "lambda" {
  name        = "compass-lambda-sg"
  description = "egress-only SG for gfn-reports Lambda"
  vpc_id      = aws_vpc.main.id
  tags        = { Name = "compass-lambda-sg" }
}

resource "aws_vpc_security_group_egress_rule" "lambda_all" {
  security_group_id = aws_security_group.lambda.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

# SG placeholder for the future RDS (chapter 6). Allow tcp/5432 from Lambda SG only.
resource "aws_security_group" "rds" {
  name        = "compass-rds-sg"
  description = "allow Postgres from Lambda SG"
  vpc_id      = aws_vpc.main.id
  tags        = { Name = "compass-rds-sg" }
}

resource "aws_vpc_security_group_ingress_rule" "rds_from_lambda" {
  security_group_id            = aws_security_group.rds.id
  referenced_security_group_id = aws_security_group.lambda.id
  ip_protocol                  = "tcp"
  from_port                    = 5432
  to_port                      = 5432
}

# Apply
cd compass-vpc/
terraform init
terraform plan
terraform apply

# Verify
aws ec2 describe-vpcs \
  --filters "Name=tag:Project,Values=Compass" \
  --query 'Vpcs[].{Id:VpcId,Cidr:CidrBlock,Tags:Tags[?Key==`Name`].Value|[0]}' \
  --output table --profile compass

aws ec2 describe-subnets \
  --filters "Name=tag:Project,Values=Compass" \
  --query 'Subnets[].{Id:SubnetId,AZ:AvailabilityZone,Cidr:CidrBlock,Public:MapPublicIpOnLaunch}' \
  --output table --profile compass

aws ec2 describe-vpc-endpoints \
  --filters "Name=tag:Project,Values=Compass" \
  --query 'VpcEndpoints[].{Service:ServiceName,Type:VpcEndpointType,State:State}' \
  --output table --profile compass