Unable to create unassociated VPN connections without errors - no CloudWAN attachments

[rackerbenoit]

Describe the Bug

While creating an AWS VPN connection, I plan to connect to cloudWAN. I either want an unassociated connection or a cloudWAN connection.

This is not an option in the module. I can create an unnassociated connection with the transit_gateway_enabled = true variable but it will then error on the aws_ec2_tag resource.

 Error: creating ec2 resource () tag (Namespace): tagging resource (): tagging resource (): operation error EC2: CreateTags, https response error StatusCode: 400, RequestID: 26f5316c-911b-4de2-bbb4-f98115f3f964, api error InvalidID: The ID '' is not valid
│ 
│   with module.vpn_connection_use1.aws_ec2_tag.default["Namespace"],
│   on .terraform/modules/vpn_connection_use1/main.tf line 141, in resource "aws_ec2_tag" "default":
│  141: resource "aws_ec2_tag" "default" {

Expected Behavior

I expect to have a cloudWAN option or allow for an unassociated VPN connection status that does not cause aws_ec2_tag errors.

Steps to Reproduce

Do a terraform apply with the following configuration

module "vpn_connection_euw1" {
  source  = "cloudposse/vpn-connection/aws"
  version = "1.8.1"

  providers = {
    aws = aws.euw1
  }

  namespace                    = "auctane"
  name                         = "cgw-prisma-${var.vpn_regions["euw1"].region_name}-cloudwan"
  customer_gateway_device_name = "cgw-prisma-${var.vpn_regions["euw1"].region_name}-cloudwan"
  customer_gateway_bgp_asn     = var.vpn_regions["euw1"].customer_gateway_bgp_asn
  customer_gateway_ip_address  = var.vpn_regions["euw1"].customer_gateway_ip

  transit_gateway_enabled     = true
}

Screenshots

No response

Environment

No response

Additional Context

No response

[rackerbenoit]

Solution

Add CloudWAN attachment support to the module.

---

Changes Required

1. Add CloudWAN variables to variables.tf

variable "cloudwan_enabled" {
  type        = bool
  description = "Set to true to attach the VPN connection to AWS Cloud WAN"
  default     = false
}

variable "cloudwan_core_network_id" {
  type        = string
  description = "AWS Cloud WAN Core Network ID to attach the VPN connection to. Required if cloudwan_enabled is true"
  default     = null
}

2. Update locals in main.tf

Add to the locals block:

locals {
  # ... existing locals ...

  cloudwan_enabled = local.enabled && var.cloudwan_enabled
}

3. Add CloudWAN attachment resource to main.tf

# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_site_to_site_vpn_attachment
resource "aws_networkmanager_site_to_site_vpn_attachment" "default" {
  count = local.cloudwan_enabled ? 1 : 0

  core_network_id    = var.cloudwan_core_network_id
  vpn_connection_arn = one(aws_vpn_connection.default[*].arn)

  tags = module.this.tags

  depends_on = [aws_vpn_connection.default]
}

4. Add CloudWAN outputs to outputs.tf

output "cloudwan_attachment_id" {
  description = "The ID of the CloudWAN VPN attachment"
  value       = one(aws_networkmanager_site_to_site_vpn_attachment.default[*].id)
}

output "cloudwan_attachment_arn" {
  description = "The ARN of the CloudWAN VPN attachment"
  value       = one(aws_networkmanager_site_to_site_vpn_attachment.default[*].arn)
}

output "cloudwan_attachment_state" {
  description = "The state of the CloudWAN VPN attachment"
  value       = one(aws_networkmanager_site_to_site_vpn_attachment.default[*].state)
}

output "cloudwan_attachment_segment_name" {
  description = "The segment name of the CloudWAN VPN attachment (determined by CloudWAN policy)"
  value       = one(aws_networkmanager_site_to_site_vpn_attachment.default[*].segment_name)
}

---

Usage Example

CloudWAN Attached VPN Connection

module "vpn_connection" {
  source  = "cloudposse/vpn-connection/aws"
  version = "1.9.0"  # After this feature is added

  namespace                    = "xxx"
  name                         = "cgw-prisma-us-east-1"
  customer_gateway_device_name = "cgw-prisma-us-east-1"
  customer_gateway_bgp_asn     = 64721
  customer_gateway_ip_address  = "x.x.x.x"

  # CloudWAN attachment
  cloudwan_enabled         = true
  cloudwan_core_network_id = "core-network-09daa2ce2d7d6a031"
}

output "vpn_connection_id" {
  value = module.vpn_connection.vpn_connection_id
}

output "cloudwan_attachment_id" {
  value = module.vpn_connection.cloudwan_attachment_id
}

output "cloudwan_segment" {
  value = module.vpn_connection.cloudwan_attachment_segment_name
}