AWS VPC Terraform module

Upstream version 6.6.1

2 controls from NIST Cybersecurity Framework v2.0 requirements

Terraform Module Source

nistcsf.compliance.tf/terraform-aws-modules/vpc/aws

Compliance Inputs Outputs Resources Diff (1)README

236 unique

Name	Type	Default	Description
Enforced · locked by active controls
flow_log_cloudwatch_log_group_kms_key_idlog_group_encryption_at_rest_enabled	string	null	The ARN of the KMS Key to use when encrypting log data for VPC flow logs
flow_log_cloudwatch_log_group_retention_in_dayscloudwatch_log_group_retention_period_365	number	365	Specifies the number of days you want to retain log events in the specified log group for VPC flow logs
Optional
amazon_side_asn	string	"64512"	The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN
azs	list(string)	[]	A list of availability zones names or ids in the region
cidr	string	"10.0.0.0/16"	(Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`
create_database_internet_gateway_route	bool	false	Controls if an internet gateway route for public database access should be created
create_database_nat_gateway_route	bool	false	Controls if a nat gateway route should be created to give internet access to the database subnets
create_database_subnet_group	bool	true	Controls if database subnet group should be created (n.b. database_subnets must also be set)
create_database_subnet_route_table	bool	false	Controls if separate route table for database should be created
create_egress_only_igw	bool	true	Controls if an Egress Only Internet Gateway is created and its related routes
create_elasticache_subnet_group	bool	true	Controls if elasticache subnet group should be created
create_elasticache_subnet_route_table	bool	false	Controls if separate route table for elasticache should be created
create_flow_log_cloudwatch_iam_role	bool	false	Whether to create IAM role for VPC Flow Logs
create_flow_log_cloudwatch_log_group	bool	false	Whether to create CloudWatch log group for VPC Flow Logs
create_igw	bool	true	Controls if an Internet Gateway is created for public subnets and the related routes that connect them
create_multiple_intra_route_tables	bool	false	Indicates whether to create a separate route table for each intra subnet. Default: `false`
create_multiple_public_route_tables	bool	false	Indicates whether to create a separate route table for each public subnet. Default: `false`
create_private_nat_gateway_route	bool	true	Controls if a nat gateway route should be created to give internet access to the private subnets
create_redshift_subnet_group	bool	true	Controls if redshift subnet group should be created
create_redshift_subnet_route_table	bool	false	Controls if separate route table for redshift should be created
create_vpc	bool	true	Controls if VPC should be created (it affects almost all resources)
customer_gateway_tags	map(string)	{}	Additional tags for the Customer Gateway
customer_gateways	map(map(any))	{}	Maps of Customer Gateway's attributes (BGP ASN and Gateway's Internet-routable external IP address)
customer_owned_ipv4_pool	string	null	The customer owned IPv4 address pool. Typically used with the `map_customer_owned_ip_on_launch` argument. The `outpost_arn` argument must be specified when configured
database_acl_tags	map(string)	{}	Additional tags for the database subnets network ACL
database_dedicated_network_acl	bool	false	Whether to use dedicated network ACL (not default) and custom rules for database subnets
database_inbound_acl_rules	list(map(string))	[...]	Database subnets inbound network ACL rules
database_outbound_acl_rules	list(map(string))	[...]	Database subnets outbound network ACL rules
database_route_table_tags	map(string)	{}	Additional tags for the database route tables
database_subnet_assign_ipv6_address_on_creation	bool	false	Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`
database_subnet_enable_dns64	bool	true	Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`
database_subnet_enable_resource_name_dns_a_record_on_launch	bool	false	Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`
database_subnet_enable_resource_name_dns_aaaa_record_on_launch	bool	true	Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`
database_subnet_group_name	string	null	Name of database subnet group
database_subnet_group_tags	map(string)	{}	Additional tags for the database subnet group
database_subnet_ipv6_native	bool	false	Indicates whether to create an IPv6-only subnet. Default: `false`
database_subnet_ipv6_prefixes	list(string)	[]	Assigns IPv6 database subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list
database_subnet_names	list(string)	[]	Explicit values to use in the Name tag on database subnets. If empty, Name tags are generated
database_subnet_private_dns_hostname_type_on_launch	string	null	The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`
database_subnet_suffix	string	"db"	Suffix to append to database subnets name
database_subnet_tags	map(string)	{}	Additional tags for the database subnets
database_subnets	list(string)	[]	A list of database subnets inside the VPC
default_network_acl_egress	list(map(string))	[...]	List of maps of egress rules to set on the Default Network ACL
default_network_acl_ingress	list(map(string))	[...]	List of maps of ingress rules to set on the Default Network ACL
default_network_acl_name	string	null	Name to be used on the Default Network ACL
default_network_acl_tags	map(string)	{}	Additional tags for the Default Network ACL
default_route_table_name	string	null	Name to be used on the default route table
default_route_table_propagating_vgws	list(string)	[]	List of virtual gateways for propagation
default_route_table_routes	list(map(string))	[]	Configuration block of routes. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route
default_route_table_tags	map(string)	{}	Additional tags for the default route table
default_security_group_egress	list(map(string))	[]	List of maps of egress rules to set on the default security group
default_security_group_ingress	list(map(string))	[]	List of maps of ingress rules to set on the default security group
default_security_group_name	string	null	Name to be used on the default security group
default_security_group_tags	map(string)	{}	Additional tags for the default security group
default_vpc_enable_dns_hostnames	bool	true	Should be true to enable DNS hostnames in the Default VPC
default_vpc_enable_dns_support	bool	true	Should be true to enable DNS support in the Default VPC
default_vpc_name	string	null	Name to be used on the Default VPC
default_vpc_tags	map(string)	{}	Additional tags for the Default VPC
dhcp_options_domain_name	string	""	Specifies DNS name for DHCP options set (requires enable_dhcp_options set to true)
dhcp_options_domain_name_servers	list(string)	["AmazonProvidedDNS"]	Specify a list of DNS server addresses for DHCP options set, default to AWS provided (requires enable_dhcp_options set to true)
dhcp_options_ipv6_address_preferred_lease_time	number	null	How frequently, in seconds, a running instance with an IPv6 assigned to it goes through DHCPv6 lease renewal (requires enable_dhcp_options set to true)
dhcp_options_netbios_name_servers	list(string)	[]	Specify a list of netbios servers for DHCP options set (requires enable_dhcp_options set to true)
dhcp_options_netbios_node_type	string	""	Specify netbios node_type for DHCP options set (requires enable_dhcp_options set to true)
dhcp_options_ntp_servers	list(string)	[]	Specify a list of NTP servers for DHCP options set (requires enable_dhcp_options set to true)
dhcp_options_tags	map(string)	{}	Additional tags for the DHCP option set (requires enable_dhcp_options set to true)
elasticache_acl_tags	map(string)	{}	Additional tags for the elasticache subnets network ACL
elasticache_dedicated_network_acl	bool	false	Whether to use dedicated network ACL (not default) and custom rules for elasticache subnets
elasticache_inbound_acl_rules	list(map(string))	[...]	Elasticache subnets inbound network ACL rules
elasticache_outbound_acl_rules	list(map(string))	[...]	Elasticache subnets outbound network ACL rules
elasticache_route_table_tags	map(string)	{}	Additional tags for the elasticache route tables
elasticache_subnet_assign_ipv6_address_on_creation	bool	false	Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`
elasticache_subnet_enable_dns64	bool	true	Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`
elasticache_subnet_enable_resource_name_dns_a_record_on_launch	bool	false	Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`
elasticache_subnet_enable_resource_name_dns_aaaa_record_on_launch	bool	true	Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`
elasticache_subnet_group_name	string	null	Name of elasticache subnet group
elasticache_subnet_group_tags	map(string)	{}	Additional tags for the elasticache subnet group
elasticache_subnet_ipv6_native	bool	false	Indicates whether to create an IPv6-only subnet. Default: `false`
elasticache_subnet_ipv6_prefixes	list(string)	[]	Assigns IPv6 elasticache subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list
elasticache_subnet_names	list(string)	[]	Explicit values to use in the Name tag on elasticache subnets. If empty, Name tags are generated
elasticache_subnet_private_dns_hostname_type_on_launch	string	null	The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`
elasticache_subnet_suffix	string	"elasticache"	Suffix to append to elasticache subnets name
elasticache_subnet_tags	map(string)	{}	Additional tags for the elasticache subnets
elasticache_subnets	list(string)	[]	A list of elasticache subnets inside the VPC
enable_dhcp_options	bool	false	Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type
enable_dns_hostnames	bool	true	Should be true to enable DNS hostnames in the VPC
enable_dns_support	bool	true	Should be true to enable DNS support in the VPC
enable_flow_log	bool	false	Whether or not to enable VPC Flow Logs
enable_ipv6	bool	false	Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block
enable_nat_gateway	bool	false	Should be true if you want to provision NAT Gateways for each of your private networks
enable_network_address_usage_metrics	bool	null	Determines whether network address usage metrics are enabled for the VPC
enable_public_redshift	bool	false	Controls if redshift should have public routing table
enable_vpn_gateway	bool	false	Should be true if you want to create a new VPN Gateway resource and attach it to the VPC
external_nat_ip_ids	list(string)	[]	List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse_nat_ips)
external_nat_ips	list(string)	[]	List of EIPs to be used for `nat_public_ips` output (used in combination with reuse_nat_ips and external_nat_ip_ids)
flow_log_cloudwatch_iam_role_arn	string	""	The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow_log_destination_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided
flow_log_cloudwatch_iam_role_conditions	list({...})	[]	Additional conditions of the CloudWatch role assumption policy
flow_log_cloudwatch_log_group_class	string	null	Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS
flow_log_cloudwatch_log_group_name_prefix	string	"/aws/vpc-flow-log/"	Specifies the name prefix of CloudWatch Log Group for VPC flow logs
flow_log_cloudwatch_log_group_name_suffix	string	""	Specifies the name suffix of CloudWatch Log Group for VPC flow logs
flow_log_cloudwatch_log_group_skip_destroy	bool	false	Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state
flow_log_deliver_cross_account_role	string	null	(Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts.
flow_log_destination_arn	string	""	The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create_flow_log_cloudwatch_log_group is set to false this argument must be provided
flow_log_destination_type	string	"cloud-watch-logs"	Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs
flow_log_file_format	string	null	(Optional) The format for the flow log. Valid values: `plain-text`, `parquet`
flow_log_hive_compatible_partitions	bool	false	(Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3
flow_log_log_format	string	null	The fields to include in the flow log record, in the order in which they should appear
flow_log_max_aggregation_interval	number	600	The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. Valid Values: `60` seconds or `600` seconds
flow_log_per_hour_partition	bool	false	(Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries
flow_log_traffic_type	string	"ALL"	The type of traffic to capture. Valid values: ACCEPT, REJECT, ALL
igw_tags	map(string)	{}	Additional tags for the internet gateway
instance_tenancy	string	"default"	A tenancy option for instances launched into the VPC
intra_acl_tags	map(string)	{}	Additional tags for the intra subnets network ACL
intra_dedicated_network_acl	bool	false	Whether to use dedicated network ACL (not default) and custom rules for intra subnets
intra_inbound_acl_rules	list(map(string))	[...]	Intra subnets inbound network ACLs
intra_outbound_acl_rules	list(map(string))	[...]	Intra subnets outbound network ACLs
intra_route_table_tags	map(string)	{}	Additional tags for the intra route tables
intra_subnet_assign_ipv6_address_on_creation	bool	false	Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`
intra_subnet_enable_dns64	bool	true	Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`
intra_subnet_enable_resource_name_dns_a_record_on_launch	bool	false	Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`
intra_subnet_enable_resource_name_dns_aaaa_record_on_launch	bool	true	Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`
intra_subnet_ipv6_native	bool	false	Indicates whether to create an IPv6-only subnet. Default: `false`
intra_subnet_ipv6_prefixes	list(string)	[]	Assigns IPv6 intra subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list
intra_subnet_names	list(string)	[]	Explicit values to use in the Name tag on intra subnets. If empty, Name tags are generated
intra_subnet_private_dns_hostname_type_on_launch	string	null	The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`
intra_subnet_suffix	string	"intra"	Suffix to append to intra subnets name
intra_subnet_tags	map(string)	{}	Additional tags for the intra subnets
intra_subnets	list(string)	[]	A list of intra subnets inside the VPC
ipv4_ipam_pool_id	string	null	(Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR
ipv4_netmask_length	number	null	(Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4_ipam_pool_id
ipv6_cidr	string	null	(Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length`
ipv6_cidr_block_network_border_group	string	null	By default when an IPv6 CIDR is assigned to a VPC a default ipv6_cidr_block_network_border_group will be set to the region of the VPC. This can be changed to restrict advertisement of public addresses to specific Network Border Groups such as LocalZones
ipv6_ipam_pool_id	string	null	(Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block`
ipv6_netmask_length	number	null	(Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56`
manage_default_network_acl	bool	true	Should be true to adopt and manage Default Network ACL
manage_default_route_table	bool	true	Should be true to manage default route table
manage_default_security_group	bool	true	Should be true to adopt and manage default security group
manage_default_vpc	bool	false	Should be true to adopt and manage Default VPC
map_customer_owned_ip_on_launch	bool	false	Specify true to indicate that network interfaces created in the subnet should be assigned a customer owned IP address. The `customer_owned_ipv4_pool` and `outpost_arn` arguments must be specified when set to `true`. Default is `false`
map_public_ip_on_launch	bool	false	Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default is `false`
name	string	""	Name to be used on all the resources as identifier
nat_eip_tags	map(string)	{}	Additional tags for the NAT EIP
nat_gateway_destination_cidr_block	string	"0.0.0.0/0"	Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route
nat_gateway_tags	map(string)	{}	Additional tags for the NAT gateways
one_nat_gateway_per_az	bool	false	Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`
outpost_acl_tags	map(string)	{}	Additional tags for the outpost subnets network ACL
outpost_arn	string	null	ARN of Outpost you want to create a subnet in
outpost_az	string	null	AZ where Outpost is anchored
outpost_dedicated_network_acl	bool	false	Whether to use dedicated network ACL (not default) and custom rules for outpost subnets
outpost_inbound_acl_rules	list(map(string))	[...]	Outpost subnets inbound network ACLs
outpost_outbound_acl_rules	list(map(string))	[...]	Outpost subnets outbound network ACLs
outpost_subnet_assign_ipv6_address_on_creation	bool	false	Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`
outpost_subnet_enable_dns64	bool	true	Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`
outpost_subnet_enable_resource_name_dns_a_record_on_launch	bool	false	Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`
outpost_subnet_enable_resource_name_dns_aaaa_record_on_launch	bool	true	Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`
outpost_subnet_ipv6_native	bool	false	Indicates whether to create an IPv6-only subnet. Default: `false`
outpost_subnet_ipv6_prefixes	list(string)	[]	Assigns IPv6 outpost subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list
outpost_subnet_names	list(string)	[]	Explicit values to use in the Name tag on outpost subnets. If empty, Name tags are generated
outpost_subnet_private_dns_hostname_type_on_launch	string	null	The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`
outpost_subnet_suffix	string	"outpost"	Suffix to append to outpost subnets name
outpost_subnet_tags	map(string)	{}	Additional tags for the outpost subnets
outpost_subnets	list(string)	[]	A list of outpost subnets inside the VPC
private_acl_tags	map(string)	{}	Additional tags for the private subnets network ACL
private_dedicated_network_acl	bool	false	Whether to use dedicated network ACL (not default) and custom rules for private subnets
private_inbound_acl_rules	list(map(string))	[...]	Private subnets inbound network ACLs
private_outbound_acl_rules	list(map(string))	[...]	Private subnets outbound network ACLs
private_route_table_tags	map(string)	{}	Additional tags for the private route tables
private_subnet_assign_ipv6_address_on_creation	bool	false	Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`
private_subnet_enable_dns64	bool	true	Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`
private_subnet_enable_resource_name_dns_a_record_on_launch	bool	false	Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`
private_subnet_enable_resource_name_dns_aaaa_record_on_launch	bool	true	Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`
private_subnet_ipv6_native	bool	false	Indicates whether to create an IPv6-only subnet. Default: `false`
private_subnet_ipv6_prefixes	list(string)	[]	Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list
private_subnet_names	list(string)	[]	Explicit values to use in the Name tag on private subnets. If empty, Name tags are generated
private_subnet_private_dns_hostname_type_on_launch	string	null	The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`
private_subnet_suffix	string	"private"	Suffix to append to private subnets name
private_subnet_tags	map(string)	{}	Additional tags for the private subnets
private_subnet_tags_per_az	map(map(string))	{}	Additional tags for the private subnets where the primary key is the AZ
private_subnets	list(string)	[]	A list of private subnets inside the VPC
propagate_intra_route_tables_vgw	bool	false	Should be true if you want route table propagation
propagate_private_route_tables_vgw	bool	false	Should be true if you want route table propagation
propagate_public_route_tables_vgw	bool	false	Should be true if you want route table propagation
public_acl_tags	map(string)	{}	Additional tags for the public subnets network ACL
public_dedicated_network_acl	bool	false	Whether to use dedicated network ACL (not default) and custom rules for public subnets
public_inbound_acl_rules	list(map(string))	[...]	Public subnets inbound network ACLs
public_outbound_acl_rules	list(map(string))	[...]	Public subnets outbound network ACLs
public_route_table_tags	map(string)	{}	Additional tags for the public route tables
public_subnet_assign_ipv6_address_on_creation	bool	false	Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`
public_subnet_enable_dns64	bool	true	Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`
public_subnet_enable_resource_name_dns_a_record_on_launch	bool	false	Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`
public_subnet_enable_resource_name_dns_aaaa_record_on_launch	bool	true	Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`
public_subnet_ipv6_native	bool	false	Indicates whether to create an IPv6-only subnet. Default: `false`
public_subnet_ipv6_prefixes	list(string)	[]	Assigns IPv6 public subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list
public_subnet_names	list(string)	[]	Explicit values to use in the Name tag on public subnets. If empty, Name tags are generated
public_subnet_private_dns_hostname_type_on_launch	string	null	The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`
public_subnet_suffix	string	"public"	Suffix to append to public subnets name
public_subnet_tags	map(string)	{}	Additional tags for the public subnets
public_subnet_tags_per_az	map(map(string))	{}	Additional tags for the public subnets where the primary key is the AZ
public_subnets	list(string)	[]	A list of public subnets inside the VPC
putin_khuylo	bool	true	Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
redshift_acl_tags	map(string)	{}	Additional tags for the redshift subnets network ACL
redshift_dedicated_network_acl	bool	false	Whether to use dedicated network ACL (not default) and custom rules for redshift subnets
redshift_inbound_acl_rules	list(map(string))	[...]	Redshift subnets inbound network ACL rules
redshift_outbound_acl_rules	list(map(string))	[...]	Redshift subnets outbound network ACL rules
redshift_route_table_tags	map(string)	{}	Additional tags for the redshift route tables
redshift_subnet_assign_ipv6_address_on_creation	bool	false	Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`
redshift_subnet_enable_dns64	bool	true	Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true`
redshift_subnet_enable_resource_name_dns_a_record_on_launch	bool	false	Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`
redshift_subnet_enable_resource_name_dns_aaaa_record_on_launch	bool	true	Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `true`
redshift_subnet_group_name	string	null	Name of redshift subnet group
redshift_subnet_group_tags	map(string)	{}	Additional tags for the redshift subnet group
redshift_subnet_ipv6_native	bool	false	Indicates whether to create an IPv6-only subnet. Default: `false`
redshift_subnet_ipv6_prefixes	list(string)	[]	Assigns IPv6 redshift subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list
redshift_subnet_names	list(string)	[]	Explicit values to use in the Name tag on redshift subnets. If empty, Name tags are generated
redshift_subnet_private_dns_hostname_type_on_launch	string	null	The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`
redshift_subnet_suffix	string	"redshift"	Suffix to append to redshift subnets name
redshift_subnet_tags	map(string)	{}	Additional tags for the redshift subnets
redshift_subnets	list(string)	[]	A list of redshift subnets inside the VPC
region	string	null	Region where the resource(s) will be managed. Defaults to the region set in the provider configuration
reuse_nat_ips	bool	false	Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable
secondary_cidr_blocks	list(string)	[]	List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool
single_nat_gateway	bool	false	Should be true if you want to provision a single shared NAT Gateway across all of your private networks
tags	map(string)	{}	A map of tags to add to all resources
use_ipam_pool	bool	false	Determines whether IPAM pool is used for CIDR allocation
vpc_block_public_access_exclusions	map(any)	{}	A map of VPC block public access exclusions
vpc_block_public_access_options	map(string)	{}	A map of VPC block public access options
vpc_flow_log_iam_policy_name	string	"vpc-flow-log-to-cloudwatch"	Name of the IAM policy
vpc_flow_log_iam_policy_use_name_prefix	bool	true	Determines whether the name of the IAM policy (`vpc_flow_log_iam_policy_name`) is used as a prefix
vpc_flow_log_iam_role_name	string	"vpc-flow-log-role"	Name to use on the VPC Flow Log IAM role created
vpc_flow_log_iam_role_path	string	null	The path for the VPC Flow Log IAM Role
vpc_flow_log_iam_role_use_name_prefix	bool	true	Determines whether the IAM role name (`vpc_flow_log_iam_role_name_name`) is used as a prefix
vpc_flow_log_permissions_boundary	string	null	The ARN of the Permissions Boundary for the VPC Flow Log IAM Role
vpc_flow_log_tags	map(string)	{}	Additional tags for the VPC Flow Logs
vpc_tags	map(string)	{}	Additional tags for the VPC
vpn_gateway_az	string	null	The Availability Zone for the VPN Gateway
vpn_gateway_id	string	""	ID of VPN Gateway to attach to the VPC
vpn_gateway_tags	map(string)	{}	Additional tags for the VPN gateway