AWS Amazon EC2 Route

aws_route (Terraform)

The Route in Amazon EC2 can be configured in Terraform with the resource name aws_route. The following sections describe 4 examples of how to use the resource and its parameters.

Example Usage from GitHub

atc-labs/terraform-aws-vpc-peering

resource "aws_route" "source-route-private" {
  provider                  = aws.source
  route_table_id            = var.source-route_table-private-id
  destination_cidr_block    = data.aws_vpc.peer.cidr_block
  vpc_peering_connection_id = aws_vpc_peering_connection.vpc_peering_connection.id
}

bstascavage/terraform-vault-consul-deployment

resource "aws_route" "bastion_vpc_dr" {
  provider                  = aws.us-east-1
  count                     = length(module.dr_cluster.public_subnets)
  route_table_id            = module.primary_cluster.bastion_route_table
  destination_cidr_block    = element(module.dr_cluster.public_subnets, count.index)
  vpc_peering_connection_id = aws_vpc_peering_connection.bastion_connectivity_dr.id

annagtaraujo/Terraform-Transit-Gateway

resource "aws_route" "public_internet_gateway_a" {
  route_table_id         = aws_route_table.public_table_a.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.igw_a.id

  timeouts {

fstuck37/terraform-aws-sec-vpc

resource "aws_route" "ngw-default-route" {
  for_each = {for sd in local.subnet_data:sd.name=>sd
           if sd.layer == "ngw" }
  route_table_id         = aws_route_table.routers[each.value.name].id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.inet-gw.id

Parameters

• carrier_gateway_id optional - string
• destination_cidr_block optional - string
• destination_ipv6_cidr_block optional - string
• destination_prefix_list_id optional - string
• egress_only_gateway_id optional - string
• gateway_id optional - string
• id optional computed - string
• instance_id optional computed - string
• instance_owner_id optional computed - string
• local_gateway_id optional - string
• nat_gateway_id optional - string
• network_interface_id optional computed - string
• origin optional computed - string
• route_table_id required - string
• state optional computed - string
• transit_gateway_id optional - string
• vpc_endpoint_id optional - string
• vpc_peering_connection_id optional - string
• timeouts single block
  • create optional - string
  • delete optional - string

Explanation in Terraform Registry

Provides a resource to create a routing table entry (a route) in a VPC routing table.

NOTE on Route Tables and Routes: Terraform currently provides both a standalone Route resource and a Route Table resource with routes defined in-line. At this time you cannot use a Route Table with in-line routes in conjunction with any Route resources. Doing so will cause a conflict of rule settings and will overwrite rules. NOTE on gateway_id attribute: The AWS API is very forgiving with the resource ID passed in the gateway_id attribute. For example an aws_route resource can be created with an aws_nat_gateway or aws_egress_only_internet_gateway ID specified for the gateway_id attribute. Specifying anything other than an aws_internet_gateway or aws_vpn_gateway ID will lead to Terraform reporting a permanent diff between your configuration and recorded state, as the AWS API returns the more-specific attribute. If you are experiencing constant diffs with an aws_route resource, the first thing to check is that the correct attribute is being specified.

Tips: Best Practices for The Other AWS Amazon EC2 Resources

In addition to the aws_default_vpc, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_default_vpc

Ensure to avoid using default VPC

It is better to define the own VPC and use it.

aws_network_acl_rule

Ensure your network ACL rule blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.

aws_ebs_volume

Ensure to use a customer-managed key for EBS volume encryption

It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).

aws_instance

Ensure to avoid storing AWS access keys in user data

It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.

aws_security_group

Ensure your security group blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.