Add some code to allow dns resolution (#2)

* add facility for allowing DNS over multi-account peering

* update the documentation

* trying aknysh's suggestion

* update docs

* Revert "trying aknysh's suggestion"

This reverts commit 7a3f94c.

* terraform fmt

README.md

@@ -84,6 +84,7 @@ Available targets:
 
 | Name | Description | Type | Default | Required |
 |------|-------------|:----:|:-----:|:-----:|
+| accepter_allow_remote_vpc_dns_resolution | Allow accepter VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the requester VPC | string | `true` | no |
 | accepter_aws_assume_role_arn | Accepter AWS Assume Role ARN | string | - | yes |
 | accepter_region | Accepter AWS region | string | - | yes |
 | accepter_vpc_id | Accepter VPC ID filter | string | `` | no |
@@ -94,9 +95,10 @@ Available targets:
 | enabled | Set to false to prevent the module from creating or accessing any resources | string | `true` | no |
 | name | Name (e.g. `app` or `cluster`) | string | - | yes |
 | namespace | Namespace (e.g. `eg` or `cp`) | string | - | yes |
+| requester_allow_remote_vpc_dns_resolution | Allow requester VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the accepter VPC | string | `true` | no |
 | requester_aws_assume_role_arn | Requester AWS Assume Role ARN | string | - | yes |
 | requester_region | Requester AWS region | string | - | yes |
-| requester_vpc_id | Requestor VPC ID filter | string | `` | no |
+| requester_vpc_id | Requester VPC ID filter | string | `` | no |
 | requester_vpc_tags | Requester VPC Tags filter | map | `<map>` | no |
 | stage | Stage (e.g. `prod`, `dev`, `staging`) | string | - | yes |
 | tags | Additional tags (e.g. `{"BusinessUnit" = "XYZ"`) | map | `<map>` | no |

accepter.tf

@@ -20,6 +20,11 @@ variable "accepter_vpc_tags" {
  default = {}
 }
 
+variable "accepter_allow_remote_vpc_dns_resolution" {
+ default = "true"
+ description = "Allow accepter VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the requester VPC"
+}
+
 # Accepter's credentials
 provider "aws" {
  alias = "accepter"
@@ -112,6 +117,15 @@ resource "aws_vpc_peering_connection_accepter" "accepter" {
  tags = "${module.accepter.tags}"
 }
 
+resource "aws_vpc_peering_connection_options" "accepter" {
+ provider = "aws.accepter"
+ vpc_peering_connection_id = "${join("", aws_vpc_peering_connection.requester.*.id)}"
+
+ accepter {
+ allow_remote_vpc_dns_resolution = "${var.accepter_allow_remote_vpc_dns_resolution}"
+ }
+}
+
 output "accepter_connection_id" {
  value = "${join("", aws_vpc_peering_connection_accepter.accepter.*.id)}"
  description = "Accepter VPC peering connection ID"

docs/terraform.md

@@ -2,6 +2,7 @@
 
 | Name | Description | Type | Default | Required |
 |------|-------------|:----:|:-----:|:-----:|
+| accepter_allow_remote_vpc_dns_resolution | Allow accepter VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the requester VPC | string | `true` | no |
 | accepter_aws_assume_role_arn | Accepter AWS Assume Role ARN | string | - | yes |
 | accepter_region | Accepter AWS region | string | - | yes |
 | accepter_vpc_id | Accepter VPC ID filter | string | `` | no |
@@ -12,9 +13,10 @@
 | enabled | Set to false to prevent the module from creating or accessing any resources | string | `true` | no |
 | name | Name (e.g. `app` or `cluster`) | string | - | yes |
 | namespace | Namespace (e.g. `eg` or `cp`) | string | - | yes |
+| requester_allow_remote_vpc_dns_resolution | Allow requester VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the accepter VPC | string | `true` | no |
 | requester_aws_assume_role_arn | Requester AWS Assume Role ARN | string | - | yes |
 | requester_region | Requester AWS region | string | - | yes |
-| requester_vpc_id | Requestor VPC ID filter | string | `` | no |
+| requester_vpc_id | Requester VPC ID filter | string | `` | no |
 | requester_vpc_tags | Requester VPC Tags filter | map | `<map>` | no |
 | stage | Stage (e.g. `prod`, `dev`, `staging`) | string | - | yes |
 | tags | Additional tags (e.g. `{"BusinessUnit" = "XYZ"`) | map | `<map>` | no |

requester.tf

@@ -20,6 +20,11 @@ variable "requester_vpc_tags" {
  default = {}
 }
 
+variable "requester_allow_remote_vpc_dns_resolution" {
+ default = "true"
+ description = "Allow requester VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the accepter VPC"
+}
+
 # Requestors's credentials
 provider "aws" {
  alias = "requester"
@@ -96,14 +101,26 @@ resource "aws_vpc_peering_connection" "requester" {
  tags = "${module.requester.tags}"
 }
 
+resource "aws_vpc_peering_connection_options" "requester" {
+ provider = "aws.requester"
+
+ # As options can't be set until the connection has been accepted
+ # create an explicit dependency on the accepter.
+ vpc_peering_connection_id = "${join("", aws_vpc_peering_connection.requester.*.id)}"
+
+ requester {
+ allow_remote_vpc_dns_resolution = "${var.requester_allow_remote_vpc_dns_resolution}"
+ }
+}
+
 locals {
  requester_aws_route_table_ids = "${distinct(sort(data.aws_route_table.requester.*.route_table_id))}"
  requester_aws_route_table_ids_count = "${length(local.requester_aws_route_table_ids)}"
  requester_cidr_block_associations = "${flatten(data.aws_vpc.requester.*.cidr_block_associations)}"
  requester_cidr_block_associations_count = "${length(local.requester_cidr_block_associations)}"
 }
 
-# Create routes from requester to accepter 
+# Create routes from requester to accepter
 resource "aws_route" "requester" {
  count = "${local.enabled ? local.requester_aws_route_table_ids_count * local.accepter_cidr_block_associations_count : 0}"
  provider = "aws.requester"