kadet-hub
terraform-aws
Renders Terraform JSON for AWS VPCs with subnets, routing and NAT, and hardened S3 buckets, pinned to hashicorp/aws.
- Latest
- 0.1.2 ·
- License
- Apache-2.0
- Owners
- Moep90
- Source
- github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
- Thumbs up
- 👍 0 on GitHub Discussions
- Popularity
- 18 · 546 pulls
Request a feature Report a problem
Badge
Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".
[](https://kadet-hub.org/generators/terraform-aws/)terraform-aws Generator
Published on kadet-hub (catalog): pin a released version by digest from its catalog page.
Kapitan kadet generator that renders a Terraform root module in JSON syntax for AWS, pinned to hashicorp/aws 6.69.1:
vpc: a VPC with a public and a private subnet per Availability Zone, route tables, an internet gateway, optional NAT gateways and a default security group without rules. Subnet CIDRs are computed at compile time, so the compiled files and the plan show concrete ranges.s3_bucket: a bucket with Block Public Access, ACLs disabled, default encryption, versioning and a bucket policy that denies requests without TLS.
Run terraform init and terraform plan in the compiled directory. Credentials are not part of the inventory or the output; the provider reads them from its usual environment at plan time.
Usage
Kapitan Configuration
parameters:
kapitan:
dependencies:
- type: oci
source: ghcr.io/kadet-hub/terraform-aws@sha256:<digest>
output_path: lib/terraform-aws
compile:
- input_type: kadet
input_paths:
- lib/terraform-aws
output_path: terraform/
output_type: jsonoutput_type: json is required. Without it Kapitan writes YAML, which Terraform ignores. Every output key ends in .tf, so Kapitan writes *.tf.json files.
Example
parameters:
generators:
terraform-aws:
region: eu-central-1
default_tags:
Environment: production
vpc:
prod:
cidr: 10.10.0.0/16
azs: [eu-central-1a, eu-central-1b, eu-central-1c]
nat: per_az
tags:
Team: platform
s3_bucket:
audit-logs:
bucket: example-audit-logs-eu-central-1
kms_key_arn: arn:aws:kms:eu-central-1:123456789012:key/00000000-0000-0000-0000-000000000000With the subnet defaults, prod gets public subnets 10.10.0.0/24 to 10.10.2.0/24 and private subnets 10.10.100.0/24 to 10.10.102.0/24, one NAT gateway with an Elastic IP in each public subnet, and one private route table per AZ.
Inventory Contract
All keys live under parameters.generators.terraform-aws. Unknown keys and values of the wrong type fail the compile.
| Key | Default | Effect |
|---|---|---|
region |
required | provider.aws.region |
default_tags |
none | provider.aws.default_tags.tags |
vpc.<name> |
one VPC bundle, file network-<name>.tf.json |
|
s3_bucket.<name> |
one bucket bundle, file bucket-<name>.tf.json |
Bundle names must match [a-z][a-z0-9_-]*. With - replaced by _ they become the Terraform resource names (<n> below). Two names that map to the same Terraform address fail the compile.
vpc
| Key | Default | Effect |
|---|---|---|
cidr |
required | IPv4 VPC CIDR, /16 to /28 |
azs |
required | list of Availability Zone names; one public and one private subnet each |
subnet_newbits |
8 |
bits added to the VPC prefix for each subnet (/16 + 8 = /24) |
public_offset |
0 |
public subnet i is subnet number public_offset + i of the VPC CIDR |
private_offset |
100 |
private subnet i is subnet number private_offset + i |
public_subnets |
true |
public subnets, public route table with 0.0.0.0/0 to the internet gateway |
nat |
none |
none, single, per_az or regional, see below |
enable_dns_hostnames |
true |
VPC attribute |
enable_dns_support |
true |
VPC attribute |
lock_default_sg |
true |
adopt the VPC’s default security group and remove all its rules |
tags |
{} |
added to every resource of the bundle; the generator sets Name, and Tier (public or private) on subnets |
Subnet numbering matches Terraform’s cidrsubnet(cidr, subnet_newbits, index). The compile fails if an index does not fit into the VPC CIDR, if the subnets would be smaller than /28, or if the public and private ranges overlap. Subnets never map public IPs on launch.
nat |
NAT resources | Private route tables |
|---|---|---|
none |
none | one shared, no default route |
single |
one Elastic IP and NAT gateway in the first public subnet | one shared, 0.0.0.0/0 to that NAT gateway |
per_az |
one Elastic IP and NAT gateway per public subnet | one per AZ, 0.0.0.0/0 to the NAT gateway in the same AZ |
regional |
one regional NAT gateway (availability_mode = "regional", addresses managed by AWS) |
one shared, 0.0.0.0/0 to the regional NAT gateway |
single and per_az need public_subnets: true. regional works without public subnets, but the internet gateway is still emitted: AWS creates a route table for a regional NAT gateway with a default route to the VPC’s internet gateway.
The default none creates nothing that is billed per hour. AWS recommends a NAT gateway in each Availability Zone, because resources in other AZs lose internet access when the AZ of a shared NAT gateway is down (NAT gateway basics). per_az and regional follow that; single trades it for cost.
s3_bucket
| Key | Default | Effect |
|---|---|---|
bucket |
required | bucket name, checked against the S3 naming rules (3 to 63 characters, lowercase letters, digits, . and -) |
versioning |
true |
versioning status Enabled; false emits no versioning resource |
kms_key_arn |
null |
null: SSE-S3 (AES256); a key ARN: SSE-KMS with that key and S3 Bucket Keys enabled |
deny_insecure_transport |
true |
bucket policy denying s3:* on the bucket and its objects when aws:SecureTransport is false |
force_destroy |
false |
let terraform destroy delete a bucket that still holds objects |
tags |
{} |
bucket tags |
Changing versioning from true to false on an existing bucket destroys the versioning resource, which suspends versioning; S3 keeps the existing object versions.
Output
| File | Content |
|---|---|
providers.tf.json |
the only terraform block: required_version = ">= 1.5.0", hashicorp/aws pinned to 6.69.1; the aws provider block |
network-<name>.tf.json |
resources of vpc.<name>; outputs <n>_vpc_id, <n>_public_subnet_ids, <n>_private_subnet_ids |
bucket-<name>.tf.json |
resources of s3_bucket.<name>; outputs <n>_bucket_id, <n>_bucket_arn |
Resources of a vpc bundle; <i> is the index in azs. single uses index 0, so switching from single to per_az keeps the existing NAT gateway.
| Resource | Terraform name | Emitted |
|---|---|---|
| aws_vpc | <n> |
always |
| aws_internet_gateway | <n> |
public_subnets: true or nat: regional |
| aws_subnet | <n>_public_<i>, <n>_private_<i> |
per AZ; public ones with public_subnets: true |
| aws_route_table | <n>_public, <n>_private or <n>_private_<i> |
per AZ for nat: per_az, otherwise one private table |
| aws_route | <n>_public_internet, <n>_private_nat, <n>_private_nat_<i> |
0.0.0.0/0 to the internet gateway or NAT gateway |
| aws_route_table_association | <n>_public_<i>, <n>_private_<i> |
one per subnet |
| aws_eip | <n>_nat_<i> |
nat: single or per_az |
| aws_nat_gateway | <n>_<i>, <n>_regional |
nat other than none |
| aws_default_security_group | <n> |
lock_default_sg: true |
Resources of an s3_bucket bundle, all named <n>:
| Resource | Emitted |
|---|---|
| aws_s3_bucket | always |
| aws_s3_bucket_public_access_block | always, all four settings true |
| aws_s3_bucket_ownership_controls | always, BucketOwnerEnforced |
| aws_s3_bucket_versioning | versioning: true |
| aws_s3_bucket_server_side_encryption_configuration | always |
| aws_s3_bucket_policy | deny_insecure_transport: true, after the public access block |
Defaults
The vpc defaults follow terraform-aws-modules/vpc: DNS hostnames and DNS support enabled, no public IPs on launch, the default security group adopted without rules, NAT off, and Name tags of the form <name>-<tier>-<az>.
For s3_bucket, the public access block and object ownership values match terraform-aws-modules/s3-bucket. Versioning and the TLS-only policy, which the module leaves off, are on by default here, following the Amazon S3 security best practices.
Resource arguments follow the provider documentation (MPL-2.0); the examples here are written for this generator.
Versions
Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.
Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms
This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.
Checks find known patterns; they do not prove a generator safe. What a listing covers
| Version | Built for (schema-checked) |
|---|---|
| 0.1.2 | hashicorp/aws 6.69.1 |
| 0.1.1 | hashicorp/aws 6.68.0 |
| 0.1.0 | not recorded |
0.1.2#
Inventory
parameters:
kapitan:
dependencies:
- type: oci
source: ghcr.io/kadet-hub/terraform-aws:0.1.2@sha256:5030e53e51c3eafc3404d6c77bbf6276ce8628894d65419917945081cf2b151f
output_path: lib/terraform-awsVerify
gh attestation verify \
oci://ghcr.io/kadet-hub/terraform-aws@sha256:5030e53e51c3eafc3404d6c77bbf6276ce8628894d65419917945081cf2b151f \
--owner kadet-hub \
--cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/mainTransparency log: Rekor entry 3275156172, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.
- Kapitan declared
- >=0.36.3,<0.37
- Kapitan checked
- 0.36.3
- Backends checked
- reclass-rs, omegaconf
- With --cache
- passed
- krab
- compatible
- Built for (schema-checked)
- hashicorp/aws 6.69.1
- Source
- terraform-aws-v0.1.2 ·
cdc32e4e9d85508d8e058deb5b5efb22c826e27c· terraform-aws - Binaries
- none
- Output capabilities
- none
- Digest
sha256:5030e53e51c3eafc3404d6c77bbf6276ce8628894d65419917945081cf2b151f
Checks
Checked by the release run on , gate at 27448d11deef.
- Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules. - Malware ClamAV 1.5.4
No file matched a ClamAV signature. - Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched. - Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls. - Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only). - File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist. - Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read. - Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares. - CI detection Kapitan 0.36.3
The output is the same with CI variables set.
Output diff
Fixture output against 0.1.1: 2 files, 2 hunks.
--- a/compiled/complete/terraform/providers.tf.json
+++ b/compiled/complete/terraform/providers.tf.json
@@ -14,7 +14,7 @@
"required_providers": {
"aws": {
"source": "hashicorp/aws",
- "version": "6.68.0"
+ "version": "6.69.1"
}
},
"required_version": ">= 1.5.0"
--- a/compiled/minimal/terraform/providers.tf.json
+++ b/compiled/minimal/terraform/providers.tf.json
@@ -8,7 +8,7 @@
"required_providers": {
"aws": {
"source": "hashicorp/aws",
- "version": "6.68.0"
+ "version": "6.69.1"
}
},
"required_version": ">= 1.5.0"0.1.1#
Inventory
parameters:
kapitan:
dependencies:
- type: oci
source: ghcr.io/kadet-hub/terraform-aws:0.1.1@sha256:937d9abd2655ac16751d1ff1818341ea0e3574e905762f42eb622a616fced849
output_path: lib/terraform-awsVerify
gh attestation verify \
oci://ghcr.io/kadet-hub/terraform-aws@sha256:937d9abd2655ac16751d1ff1818341ea0e3574e905762f42eb622a616fced849 \
--owner kadet-hub \
--cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/mainTransparency log: Rekor entry 3207891718, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.
- Kapitan declared
- >=0.36.3,<0.37
- Kapitan checked
- 0.36.3
- Backends checked
- not recorded
- With --cache
- not recorded
- krab
- compatible
- Built for (schema-checked)
- hashicorp/aws 6.68.0
- Source
- terraform-aws-v0.1.1 ·
90a1da0e1a83651901e7ad2e7d53ad45d0076416· terraform-aws - Binaries
- none
- Output capabilities
- none
- Digest
sha256:937d9abd2655ac16751d1ff1818341ea0e3574e905762f42eb622a616fced849
Checks
Checked by the release run on , gate at 13da9613a3b1.
- Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules. - Malware ClamAV 1.5.4
No file matched a ClamAV signature. - Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched. - Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls. - Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only). - File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist. - Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read. - Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares. - CI detection Kapitan 0.36.3
The output is the same with CI variables set.
Output diff
No output diff recorded: this version was published before the release run recorded one.
0.1.0#
Inventory
parameters:
kapitan:
dependencies:
- type: oci
source: ghcr.io/kadet-hub/terraform-aws:0.1.0@sha256:1e880703d6463fbc8c891d900602426deeef776a3f25022042bfa1b09180f17a
output_path: lib/terraform-awsVerify
gh attestation verify \
oci://ghcr.io/kadet-hub/terraform-aws@sha256:1e880703d6463fbc8c891d900602426deeef776a3f25022042bfa1b09180f17a \
--owner kadet-hub \
--cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/mainTransparency log: Rekor entry 3207084546, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.
- Kapitan declared
- >=0.36.3,<0.37
- Kapitan checked
- 0.36.3
- Backends checked
- not recorded
- With --cache
- not recorded
- krab
- compatible
- Built for (schema-checked)
- not recorded
- Source
- terraform-aws-v0.1.0 ·
3ec7a80b223e8561ba752c469c23efd664e767fc· terraform-aws - Binaries
- none
- Output capabilities
- none
- Digest
sha256:1e880703d6463fbc8c891d900602426deeef776a3f25022042bfa1b09180f17a
Checks
Checked by the release run on , gate at a8d7487a270f.
- Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules. - Malware ClamAV 1.5.4
No file matched a ClamAV signature. - Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched. - Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls. - Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only). - File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist. - Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read. - Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares. - CI detection Kapitan 0.36.3
The output is the same with CI variables set.
Output diff
No output diff recorded: this version was published before the release run recorded one.