Terraformで別アカウントで管理しているVPCと新規作成VPCをPeering接続する

つくるもの

別アカウントで運用中の作成済VPCに対して、新規に作成するVPCとの間でPeering接続を行います。

実装

事前準備

新環境VPCの作成

vpc.tf

# 新環境VPC
resource "aws_vpc" "this" {
  cidr_block           = var.vpc_cidr_block
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = {
    Name = "${var.env}-vpc"
  }
}

# Public subnet
resource "aws_subnet" "public_1a" {
  vpc_id                  = aws_vpc.this.id
  cidr_block              = var.public_subnets[0]
  map_public_ip_on_launch = true
  availability_zone       = var.azs[0]
  tags = {
    Name = "${var.env}-subnet-public-1a"
  }
}
resource "aws_subnet" "public_1c" {
  vpc_id                  = aws_vpc.this.id
  cidr_block              = var.public_subnets[1]
  map_public_ip_on_launch = true
  availability_zone       = var.azs[1]
  tags = {
    Name = "${var.env}-subnet-public-1c"
  }
}

# IGW
resource "aws_internet_gateway" "stg" {
  vpc_id = aws_vpc.this.id
}

# Route table for public subnets (Route table 1)
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.this.id
  tags = {
    Name = "${var.env}-route-table-public"
  }
}
resource "aws_route" "public" {
  route_table_id         = aws_route_table.public.id
  gateway_id             = aws_internet_gateway.stg.id
  destination_cidr_block = "0.0.0.0/0"
}
resource "aws_route_table_association" "public_1a" {
  subnet_id      = aws_subnet.public_1a.id
  route_table_id = aws_route_table.public.id
}
resource "aws_route_table_association" "public_1c" {
  subnet_id      = aws_subnet.public_1c.id
  route_table_id = aws_route_table.public.id
}

# Private subnet (Route table 1)
resource "aws_subnet" "private_app_1a" {
  vpc_id                  = aws_vpc.this.id
  cidr_block              = var.private_app_subnets[0]
  map_public_ip_on_launch = false
  availability_zone       = var.azs[0]
  tags = {
    Name = "${var.env}-subnet-private-app-1a"
  }
}
resource "aws_subnet" "private_app_1c" {
  vpc_id                  = aws_vpc.this.id
  cidr_block              = var.private_app_subnets[1]
  map_public_ip_on_launch = false
  availability_zone       = var.azs[1]
  tags = {
    Name = "${var.env}-subnet-private-app-1c"
  }
}

# NAT (public_1aのみ)
resource "aws_eip" "nat_gateway" {
  vpc        = true
  depends_on = [aws_internet_gateway.stg]
  tags = {
    Name = "${var.env}-subnet-public-1a"
  }
}
resource "aws_nat_gateway" "stg_1" {
  allocation_id = aws_eip.nat_gateway.id
  subnet_id     = aws_subnet.public_1a.id
  depends_on    = [aws_internet_gateway.stg]
  tags = {
    Name = "${var.env}-subnet-public-1a"
  }
}

# Route table for private subnets (Route table 2)
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.this.id
  tags = {
    Name = "${var.env}-route-table-private"
  }
}
resource "aws_route" "private" {
  route_table_id         = aws_route_table.private.id
  nat_gateway_id         = aws_nat_gateway.stg_1.id
  destination_cidr_block = "0.0.0.0/0"
}
resource "aws_route_table_association" "private_1a" {
  subnet_id      = aws_subnet.private_app_1a.id
  route_table_id = aws_route_table.private.id
}
resource "aws_route_table_association" "private_1c" {
  subnet_id      = aws_subnet.private_app_1c.id
  route_table_id = aws_route_table.private.id
}

variables.tf

# Peering接続する2つのVPCのCIDRレンジは異なるように設定する
variable "vpc_cidr_block" {
  type    = string
  default = "10.0.0.0/16"
}
variable "azs" {
  type    = list(string)
  default = ["ap-northeast-1a", "ap-northeast-1c"]
}
variable "public_subnets" {
  type    = list(string)
  default = ["10.0.0.0/24", "10.0.1.0/24"]
}
variable "private_app_subnets" {
  type    = list(string)
  default = ["10.0.8.0/24", "10.0.9.0/24"]

}

別アカウントの情報を取得

main.tfで別アカウントの情報を読み込みます。

main.tf

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.16"
    }
  }
  required_version = ">= 1.2.0"

# 新環境のアカウント情報の読み込み
provider "aws" {
  region                   = "ap-northeast-1"
  shared_credentials_files = ["$HOME/.aws/credentials"]
  profile                  = "default"
}
data "aws_region" "current" {}
data "aws_caller_identity" "current" {}

# 既存環境の別アカウント情報の読み込み
provider "aws" {
  region                   = "ap-northeast-1"
  alias                    = "other_account"
  shared_credentials_files = ["$HOME/.aws/credentials"]
  profile                  = "other_account" 
}
data "aws_caller_identity" "other_account" {
  provider = aws.other_account
}

既存VPCとのPeering接続

既存VPCをAccepter、新規作成VPCをRequesterとしてPeering接続します。
Peering接続は自動で承認されるように設定します。

vpc_peering.tf

# 既存環境の作成済VPC
data "aws_vpc" "existing_vpc" {
  provider = aws.other_account
  filter {
    name   = "tag:Name"
    values = [var.existing_vpc_name]
  }
}
resource "aws_vpc_peering_connection" "peer" {
  peer_vpc_id   = data.aws_vpc.existing_vpc.id
  vpc_id        = aws_vpc.this.id
  peer_owner_id = data.aws_caller_identity.existing_vpc.account_id
  auto_accept   = false
  tags = {
    Name = "${var.env}-vpc-peering"
    Side = "Requester"
  }
}
resource "aws_vpc_peering_connection_accepter" "peer" {
  provider                  = aws.other_account
  vpc_peering_connection_id = aws_vpc_peering_connection.peer.id
  auto_accept               = true

  tags = {
    Name = "${var.env}-vpc-peering"
    Side = "Accepter"
  }
}
resource "aws_vpc_peering_connection_options" "requester" {
  vpc_peering_connection_id = aws_vpc_peering_connection_accepter.peer.id
  requester {
    allow_remote_vpc_dns_resolution = true
  }
}
resource "aws_vpc_peering_connection_options" "accepter" {
  provider                  = aws.other_account
  vpc_peering_connection_id = aws_vpc_peering_connection_accepter.peer.id

  accepter {
    allow_remote_vpc_dns_resolution = true
  }
}

# 新規作成VPC => 既存VPCへのrouting
resource "aws_route" "peer_to_existing_vpc" {
  route_table_id            = aws_route_table.private.id
  destination_cidr_block    = data.aws_vpc.existing_vpc.cidr_block
  vpc_peering_connection_id = aws_vpc_peering_connection.peer.id
}

data "aws_route_table" "existing_vpc" {
  provider = aws.other_account

  filter {
    name   = "tag:Name"
    values = [var.existing_vpc_route_table_name]
  }
}

# 既存VPC => 新規作成VPCへのrouting
resource "aws_route" "existing_vpc" {
  provider                  = aws.other_account
  route_table_id            = data.aws_route_table.existing_vpc.id
  destination_cidr_block    = aws_vpc.this.cidr_block
  vpc_peering_connection_id = aws_vpc_peering_connection.peer.id
}

variable.tf

# 既存環境のVPC名を入力
variable "existing_vpc_name" {
  type    = string
  default = "input peering accepter vpc name here"
}

# 既存環境のVPCのルートテーブル名(Route Table 3)を入力
variable "existing_vpc_route_table_name" {
  type    = string
  default = "input peering accepter vpc's route table name here"
}