[Issue 1037] Create non-default networking configuration

[coilysiren]

Summary

Fixes #1037

Time to review: 10 mins

Major Changes

• Create a new VPC via the terraform-aws-modules/vpc/aws module
• Updates the VPC endpoints (see vpc-endpoints.tf) to the latest pattern used by the Nava template, which puts them inside of modules/network/
• Adds a staging networking terraform configuration file (infra/networks/staging.s3.tfbackend)

---

Warning

Potential Risk

Given the type of change being made here, its easily possible for terraform to get confused about what should be deployed where. That's why I've already had to make changes in advance of this one, to update the VPC / subnet selection logic. That was these changes:

• [Issue 1037] Harden subnet selection logic #1047
• [Issue 1037] Allow choosing between multiple VPCs #1052
• [DMS] Select the DMS security VPC with a VPC filter #1072

Additional Context

Additionally, this PR is going to make it so that we are trying to deploy a new named VPC inside of the default networking configuration. In my opinion, that new VPC should be named dev. I will then follow-up later to create the prod VPC. Neither the dev nor the prod VPC will actually be used, not until I make another follow-up PR.

Yet More Context

To pull this off, I had to import the subnet backfill into the staging terraform state. The idea was that I didn't want to create duplicates of the subnet backfills. To do that, I had to run these commands:

terraform init -backend-config=staging.s3.tfbackend -reconfigure

terraform import  -var="environment_name=staging" 'aws_eip.backfill_private["us-east-1b"]' 'eipalloc-0bb8c35bf764c3bb4'
terraform import  -var="environment_name=staging" 'aws_eip.backfill_private["us-east-1c"]' 'eipalloc-0fe1a378791710d16'
terraform import  -var="environment_name=staging" 'aws_eip.backfill_private["us-east-1a"]' 'eipalloc-04e82fbd2ffc46760'
terraform import  -var="environment_name=staging" 'aws_subnet.backfill_private["us-east-1a"]' 'subnet-0eaabb77c8a4cb36f'
terraform import  -var="environment_name=staging" 'aws_subnet.backfill_private["us-east-1b"]' 'subnet-0d07d20186586955c'
terraform import  -var="environment_name=staging" 'aws_route_table.backfill_private["us-east-1a"]' 'rtb-0c3f83c55ed80ced1'
terraform import  -var="environment_name=staging" 'aws_route_table.backfill_private["us-east-1b"]' 'rtb-03f37f2f0041d2e10'
terraform import  -var="environment_name=staging" 'aws_route_table.backfill_private["us-east-1c"]' 'rtb-0204f7ff0aafd3fde'
terraform import  -var="environment_name=staging" 'aws_subnet.backfill_private["us-east-1c"]' 'subnet-030ca9f9cb581f502'
terraform import  -var="environment_name=staging" 'aws_nat_gateway.backfill_private_1' 'nat-016521ed99f539813'
terraform import  -var="environment_name=staging" 'aws_nat_gateway.backfill_private_0' 'nat-079ce3476c4199f63'
terraform import  -var="environment_name=staging" 'aws_nat_gateway.backfill_private_2' 'nat-074c4ad21b794f3c2'

terraform import  -var="environment_name=staging" 'aws_route_table_association.backfill_private["us-east-1c"]' 'rtbassoc-024a59ee23cba1e93'
terraform import  -var="environment_name=staging" 'aws_route_table_association.backfill_private["us-east-1b"]' 'rtbassoc-01800a6a80ac53ec7'
terraform import  -var="environment_name=staging" 'aws_route_table_association.backfill_private["us-east-1a"]' 'rtbassoc-0001ddfac545921c9'

terraform import  -var="environment_name=staging" 'aws_route.backfill_private_0' 'rtb-0c3f83c55ed80ced1_0.0.0.0/0'
terraform import  -var="environment_name=staging" 'aws_route.backfill_private_1' 'rtb-03f37f2f0041d2e10_0.0.0.0/0'
terraform import  -var="environment_name=staging" 'aws_route.backfill_private_2' 'rtb-0204f7ff0aafd3fde_0.0.0.0/0'

[jamesbursa]

Thanks for implementing!

[jamesbursa]

Untested idea:

Suggested change

	# S3 and DynamoDB use Gateway VPC endpoints. All other services use Interface VPC endpoints
	interface_vpc_endpoints = toset([for aws_service in local.aws_service_integrations : aws_service if !contains(["s3", "dynamodb"], aws_service)])
	gateway_vpc_endpoints = toset([for aws_service in local.aws_service_integrations : aws_service if contains(["s3", "dynamodb"], aws_service)])
	# S3 and DynamoDB use Gateway VPC endpoints. All other services use Interface VPC endpoints
	gateway_services = ["s3", "dynamodb"]
	interface_vpc_endpoints = setsubtract(local.aws_service_integrations, local.gateway_services)
	gateway_vpc_endpoints = setintersection(local.aws_service_integrations, local.gateway_services)

[coilysiren]

I would try that, but this file is a straight copy from the Nava template, and I kinda wanna keep it that way.

This is a good suggestion for the Nava template though! => https://github.com/navapbc/template-infra/blob/main/infra/modules/network/vpc-endpoints.tf