File size: 2,732 Bytes
f08f35f 56f8d6f f08f35f 56f8d6f f08f35f 56f8d6f f08f35f 56f8d6f f08f35f 56f8d6f f08f35f 56f8d6f f08f35f | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 | terraform {
required_version = ">= 1.5"
required_providers {
aws = { source = "hashicorp/aws", version = "~> 6.0" }
}
}
resource "aws_security_group" "endpoint" {
name_prefix = "xet-privatelink-"
description = "Xet upload endpoints"
vpc_id = var.vpc_id
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = var.client_cidr_blocks
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = var.tags
}
# --- hf CLI upload path -----------------------------------------------------
# Created in pendingAcceptance. We accept by hand, so this blocks until we do.
resource "aws_vpc_endpoint" "cas" {
count = var.cas_service_name == null ? 0 : 1
vpc_id = var.vpc_id
service_name = var.cas_service_name
service_region = var.service_region
vpc_endpoint_type = "Interface"
subnet_ids = var.subnet_ids
security_group_ids = [aws_security_group.endpoint.id]
private_dns_enabled = false
timeouts {
create = "30m"
}
tags = var.tags
}
resource "aws_route53_zone" "xethub" {
count = var.cas_service_name == null ? 0 : 1
name = "xethub.hf.co"
vpc {
vpc_id = var.vpc_id
}
tags = var.tags
}
resource "aws_route53_record" "cas_server" {
count = var.cas_service_name == null ? 0 : 1
zone_id = aws_route53_zone.xethub[0].zone_id
name = "cas-server.xethub.hf.co"
type = "CNAME"
ttl = 60
records = [aws_vpc_endpoint.cas[0].dns_entry[0].dns_name]
}
# --- S3 API path ------------------------------------------------------------
resource "aws_vpc_endpoint" "s3_gateway" {
count = var.s3_service_name == null ? 0 : 1
vpc_id = var.vpc_id
service_name = var.s3_service_name
service_region = var.service_region
vpc_endpoint_type = "Interface"
subnet_ids = coalesce(var.s3_subnet_ids, var.subnet_ids)
security_group_ids = [aws_security_group.endpoint.id]
private_dns_enabled = false
timeouts {
create = "30m"
}
tags = var.tags
}
resource "aws_route53_zone" "s3" {
count = var.s3_service_name == null ? 0 : 1
name = "s3.hf.co"
vpc {
vpc_id = var.vpc_id
}
tags = var.tags
}
# s3.hf.co is the zone apex, where a CNAME is not allowed. Alias instead.
resource "aws_route53_record" "s3" {
count = var.s3_service_name == null ? 0 : 1
zone_id = aws_route53_zone.s3[0].zone_id
name = "s3.hf.co"
type = "A"
alias {
name = aws_vpc_endpoint.s3_gateway[0].dns_entry[0].dns_name
zone_id = aws_vpc_endpoint.s3_gateway[0].dns_entry[0].hosted_zone_id
evaluate_target_health = false
}
}
|