ECS Networking and Private Connectivity

# Create and validate a new wildcard certificate in the existing Route 53 zone.
enable_acm_dns_validation = true
hosted_zone_name          = "example.com"
create_dns_records        = true

# Look up an existing issued wildcard certificate for the hostname's parent.
enable_acm_dns_validation = false
hosted_zone_name          = "example.com"
create_dns_records        = true

# Use an issued certificate and manage DNS outside Terraform.
ssl_certificate_arn       = "arn:aws:acm:us-east-1:123456789012:certificate/REPLACE_ME"
enable_acm_dns_validation = false
create_dns_records        = false

vpc_cidr             = "10.0.0.0/16"
region_az            = ["us-east-1a", "us-east-1b", "us-east-1c"]
public_subnets       = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
private_subnets      = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
enable_ipv6          = true # set false for IPv4-only networks
single_nat_gateway   = false
enable_vpc_endpoints = true

# Extra private routes via Transit Gateway (module-created VPC only)
private_additional_transit_gateway_routes = [
  { cidr_block = "10.100.0.0/16", transit_gateway_id = "tgw-xxxxxxxx" },
]

alb_additional_inbound_security_group_ids = ["sg-xxxxxxxx"]

existing_vpc_id             = "vpc-xxxxx"
existing_private_subnet_ids = ["subnet-xxxxx", "subnet-yyyyy", "subnet-zzzzz"]
existing_public_subnet_ids  = ["subnet-aaaaa", "subnet-bbbbb", "subnet-ccccc"]
# Must match the existing VPC CIDR (default is 10.0.0.0/16). Used for SG/WAF-related
# CIDR rules even when the module does not create the VPC.
vpc_cidr = "10.8.0.0/16"

alb_access_type = "public" # "public" or "private"
alb_allowed_cidrs = [
  "0.0.0.0/0" # tighten for production
]
alb_allowed_ipv6_cidrs = ["::/0"]

# WAF IP allowlisting (recommended for production)
waf_enable_ip_allowlisting = true
waf_allowlist_ipv4_cidrs = [
  "203.0.113.0/24",
  "198.51.100.42/32",
]
waf_allowlist_ipv6_cidrs = [
  "2001:db8::/48",
]

# Optional: additional source ranges for agent webhook invocation only
waf_webhook_allowlist_ipv4_cidrs = ["198.51.100.0/24"]
waf_webhook_allowlist_ipv6_cidrs = ["2001:db8:5678::/48"]

enable_runlayer_agentcore_runtime              = true
enable_privatelink                             = true
runlayer_agentcore_network_mode                = "VPC"
runlayer_agentcore_consumer_vpc_id             = "vpc-REPLACE_ME"
runlayer_agentcore_consumer_private_subnet_ids = ["subnet-REPLACE_ME", "subnet-REPLACE_ME_TOO"]

waf_allowlist_exempt_uri_path_prefixes = [
  "/api/v1/integrations/slack/",    # Slack events, interactivity, app install
  "/api/v1/integrations/ms-teams/", # Teams messages and admin consent
]

enable_dual_alb = true

# Optional: existing private hosted zone
private_hosted_zone_id     = "Z1234567890ABC"
private_hosted_zone_vpc_id = "vpc-1234567890abcdef0"
private_hosted_zone_additional_vpc_ids = [
  "vpc-0987654321fedcba0",
]

alb_internal_allowed_cidrs = [
  "10.200.0.0/16", # Corporate VPN
]
alb_internal_allowed_ipv6_cidrs = [
  "fd00::/64",
]

enable_dual_alb = true
# cross_account_hosted_zone_id = "ZXXXXXXXX"  # configure aws.route53 assume_role when set
# manage_service_vpc_private_hosted_zone_association = true

vpc_peering_connections = {
  "customer-vpc" = {
    peering_connection_id = "pcx-0abc123def456"
    peer_vpc_cidr         = "172.16.0.0/16"
    peer_owner_id         = "123456789012" # REQUIRED
    peer_region           = "us-east-1"    # optional
  }
}

enable_privatelink              = true
privatelink_allowed_principals  = ["arn:aws:iam::123456789012:root"]
privatelink_acceptance_required = true
# privatelink_subnet_ids = ["subnet-aaaa", "subnet-bbbb"]
# privatelink_additional_supported_regions = ["us-west-2"]

output "privatelink_service_name" {
  value = module.runlayer_infrastructure.privatelink_service_name
}

private_connection_types = ["aws_privatelink"] # add "tunnel" if needed
# tunnel_router_listener_priority = 15
# tunnel_trace_sample_ratio = 0.1
# tunnel_otel_collector_desired_count = 2 # optional HA for tunnel telemetry
# tunnel_aws_endpoint_security_group_id = "sg-xxxxxxxx" # required for tunnels with an existing VPC

-e RUNLAYER_TUNNEL_METADATA=version

trusted_ca_pem = file("${path.module}/company-ca.pem")