feat: imagebuilder endpoint

README.md

@@ -26,7 +26,7 @@ Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, Sa
 CloudFormation, CodePipeline, Storage Gateway, AppMesh, Transfer, Service Catalog, AppStream API, AppStream Streaming,
 Athena, Rekognition, Elastic File System (EFS), Cloud Directory, Elastic Beanstalk (+ Health), Elastic Map Reduce(EMR),
 DataSync, EBS, SMS, Elastic Inference Runtime, QLDB Session, Step Functions, Access Analyzer, Auto Scaling Plans,
-Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure, DMS
+Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure, DMS, EC2 Image Builder
 
 * [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html)
 * [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html)
@@ -521,6 +521,7 @@ No Modules.
 | enable\_flow\_log | Whether or not to enable VPC Flow Logs | `bool` | `false` | no |
 | enable\_git\_codecommit\_endpoint | Should be true if you want to provision an Git Codecommit endpoint to the VPC | `bool` | `false` | no |
 | enable\_glue\_endpoint | Should be true if you want to provision a Glue endpoint to the VPC | `bool` | `false` | no |
+| enable\_imagebuilder\_endpoint | Should be true if you want to provision an EC2 Image Builder endpoint to the VPC | `bool` | `false` | no |
 | enable\_ipv6 | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. | `bool` | `false` | no |
 | enable\_kinesis\_firehose\_endpoint | Should be true if you want to provision a Kinesis Firehose endpoint to the VPC | `bool` | `false` | no |
 | enable\_kinesis\_streams\_endpoint | Should be true if you want to provision a Kinesis Streams endpoint to the VPC | `bool` | `false` | no |
@@ -576,6 +577,10 @@ No Modules.
 | glue\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Glue endpoint | `list(string)` | `[]` | no |
 | glue\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Glue endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | igw\_tags | Additional tags for the internet gateway | `map(string)` | `{}` | no |
+| imagebuilder\_endpoint\_policy | A policy to attach to the endpoint that controls access to the service. Defaults to full access | `string` | `null` | no |
+| imagebuilder\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EC2 Image Builder endpoint | `bool` | `false` | no |
+| imagebuilder\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EC2 Image Builder endpoint | `list(string)` | `[]` | no |
+| imagebuilder\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EC2 Image Builder endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | instance\_tenancy | A tenancy option for instances launched into the VPC | `string` | `"default"` | no |
 | intra\_acl\_tags | Additional tags for the intra subnets network ACL | `map(string)` | `{}` | no |
 | intra\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for intra subnets | `bool` | `false` | no |
@@ -952,6 +957,9 @@ No Modules.
 | vpc\_endpoint\_glue\_dns\_entry | The DNS entries for the VPC Endpoint for Glue. |
 | vpc\_endpoint\_glue\_id | The ID of VPC endpoint for Glue |
 | vpc\_endpoint\_glue\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Glue. |
+| vpc\_endpoint\_imagebuilder\_dns\_entry | The DNS entries for the VPC Endpoint for EC2 Image Builder. |
+| vpc\_endpoint\_imagebuilder\_id | The ID of VPC endpoint for EC2 Image Builder |
+| vpc\_endpoint\_imagebuilder\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for EC2 Image Builder. |
 | vpc\_endpoint\_kinesis\_firehose\_dns\_entry | The DNS entries for the VPC Endpoint for Kinesis Firehose. |
 | vpc\_endpoint\_kinesis\_firehose\_id | The ID of VPC endpoint for Kinesis Firehose |
 | vpc\_endpoint\_kinesis\_firehose\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Kinesis Firehose. |

outputs.tf

@@ -1442,6 +1442,21 @@ output "vpc_endpoint_rds_dns_entry" {
   value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
 }
 
+output "vpc_endpoint_imagebuilder_id" {
+  description = "The ID of VPC endpoint for EC2 Image Builder"
+  value       = concat(aws_vpc_endpoint.imagebuilder.*.id, [""])[0]
+}
+
+output "vpc_endpoint_imagebuilder_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for EC2 Image Builder."
+  value       = flatten(aws_vpc_endpoint.imagebuilder.*.network_interface_ids)
+}
+
+output "vpc_endpoint_imagebuilder_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for EC2 Image Builder."
+  value       = flatten(aws_vpc_endpoint.imagebuilder.*.dns_entry)
+}
+
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"

variables.tf

@@ -2159,6 +2159,36 @@ variable "dms_endpoint_private_dns_enabled" {
   default     = false
 }
 
+variable "enable_imagebuilder_endpoint" {
+  description = "Should be true if you want to provision an EC2 Image Builder endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "imagebuilder_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for EC2 Image Builder endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "imagebuilder_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for EC2 Image Builder endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "imagebuilder_endpoint_policy" {
+  description = "A policy to attach to the endpoint that controls access to the service. Defaults to full access"
+  type        = string
+  default     = null
+}
+
+variable "imagebuilder_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for EC2 Image Builder endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "map_public_ip_on_launch" {
   description = "Should be false if you do not want to auto-assign public IP on launch"
   type        = bool

vpc-endpoints.tf

@@ -1588,3 +1588,31 @@ resource "aws_vpc_endpoint" "dms" {
   private_dns_enabled = var.dms_endpoint_private_dns_enabled
   tags                = local.vpce_tags
 }
+
+####################################
+# VPC Endpoint for EC2 Image Builder
+####################################
+data "aws_vpc_endpoint_service" "imagebuilder" {
+  count = var.create_vpc && var.enable_imagebuilder_endpoint ? 1 : 0
+
+  service = "imagebuilder"
+}
+
+resource "aws_vpc_endpoint" "imagebuilder" {
+  count = var.create_vpc && var.enable_imagebuilder_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.imagebuilder[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.imagebuilder_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.imagebuilder_endpoint_subnet_ids, aws_subnet.private.*.id)
+  policy              = var.imagebuilder_endpoint_policy
+  private_dns_enabled = var.imagebuilder_endpoint_private_dns_enabled
+  tags = merge(
+    {
+      "Name" = format("%s-%s", var.name, data.aws_vpc_endpoint_service.imagebuilder[0].service)
+    },
+    local.vpce_tags
+  )
+}