Add NAT - use if want IP whitelisting

[Thomas-mcinally]

Adding NAT with an elastic IP allows you to have a constant IP for traffic from Lambda. This can be used to add IP whitelisting for Kraken api keys

[github-actions]

Terraform plan in terraform

Plan: 16 to add, 2 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_default_security_group.default_security_group_for_vpc will be created
  + resource "aws_default_security_group" "default_security_group_for_vpc" {
      + arn                    = (known after apply)
      + description            = (known after apply)
      + egress                 = [
          + {
              + cidr_blocks      = [
                  + "0.0.0.0/0",
                ]
              + description      = "Allow all outbound traffic"
              + from_port        = 0
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "-1"
              + security_groups  = []
              + self             = false
              + to_port          = 0
            },
        ]
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = []
              + description      = "Allow only inbound traffic that is a response to a request made previously"
              + from_port        = 0
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "-1"
              + security_groups  = []
              + self             = true
              + to_port          = 0
            },
        ]
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "Kraken-DCA-default-security-group"
        }
      + tags_all               = {
          + "Name" = "Kraken-DCA-default-security-group"
        }
      + vpc_id                 = (known after apply)
    }

  # aws_eip.nat_eip will be created
  + resource "aws_eip" "nat_eip" {
      + allocation_id        = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = (known after apply)
      + id                   = (known after apply)
      + instance             = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags_all             = (known after apply)
      + vpc                  = true
    }

  # aws_instance.ec2_nat_instance will be created
  + resource "aws_instance" "ec2_nat_instance" {
      + ami                                  = "ami-0bbb886f29931c526"
      + arn                                  = (known after apply)
      + associate_public_ip_address          = (known after apply)
      + availability_zone                    = (known after apply)
      + cpu_core_count                       = (known after apply)
      + cpu_threads_per_core                 = (known after apply)
      + disable_api_stop                     = (known after apply)
      + disable_api_termination              = (known after apply)
      + ebs_optimized                        = (known after apply)
      + get_password_data                    = false
      + host_id                              = (known after apply)
      + host_resource_group_arn              = (known after apply)
      + id                                   = (known after apply)
      + instance_initiated_shutdown_behavior = (known after apply)
      + instance_state                       = (known after apply)
      + instance_type                        = "t3.micro"
      + ipv6_address_count                   = (known after apply)
      + ipv6_addresses                       = (known after apply)
      + key_name                             = (known after apply)
      + monitoring                           = (known after apply)
      + outpost_arn                          = (known after apply)
      + password_data                        = (known after apply)
      + placement_group                      = (known after apply)
      + placement_partition_number           = (known after apply)
      + primary_network_interface_id         = (known after apply)
      + private_dns                          = (known after apply)
      + private_ip                           = (known after apply)
      + public_dns                           = (known after apply)
      + public_ip                            = (known after apply)
      + secondary_private_ips                = (known after apply)
      + security_groups                      = (known after apply)
      + subnet_id                            = (known after apply)
      + tags                                 = {
          + "Name" = "nat_instance"
          + "Role" = "nat"
        }
      + tags_all                             = {
          + "Name" = "nat_instance"
          + "Role" = "nat"
        }
      + tenancy                              = (known after apply)
      + user_data                            = (known after apply)
      + user_data_base64                     = (known after apply)
      + user_data_replace_on_change          = false
      + vpc_security_group_ids               = (known after apply)

      + network_interface {
          + delete_on_termination = false
          + device_index          = 0
          + network_card_index    = 0
          + network_interface_id  = (known after apply)
        }
    }

  # aws_internet_gateway.ig will be created
  + resource "aws_internet_gateway" "ig" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Name" = "Kraken DCA internet gateway"
        }
      + tags_all = {
          + "Name" = "Kraken DCA internet gateway"
        }
      + vpc_id   = (known after apply)
    }

  # aws_lambda_function.kraken-dca-lambda will be updated in-place
  ~ resource "aws_lambda_function" "kraken-dca-lambda" {
        id                             = "kraken-dca-lambda"
      ~ layers                         = [
          - "arn:aws:lambda:eu-west-2:194627472784:layer:kraken_dca_dependencies:98",
        ] -> (known after apply)
        tags                           = {}
        # (20 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # aws_lambda_function.kraken-withdraw-lambda will be updated in-place
  ~ resource "aws_lambda_function" "kraken-withdraw-lambda" {
        id                             = "kraken-withdraw-lambda"
      ~ layers                         = [
          - "arn:aws:lambda:eu-west-2:194627472784:layer:kraken_dca_dependencies:98",
        ] -> (known after apply)
        tags                           = {}
        # (20 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # aws_lambda_layer_version.kraken_dca_dependencies must be replaced
-/+ resource "aws_lambda_layer_version" "kraken_dca_dependencies" {
      ~ arn                         = "arn:aws:lambda:eu-west-2:194627472784:layer:kraken_dca_dependencies:98" -> (known after apply)
      - compatible_architectures    = [] -> null
      - compatible_runtimes         = [] -> null
      ~ created_date                = "2024-02-07T08:15:31.494+0000" -> (known after apply)
      ~ id                          = "**********************************************************************" -> (known after apply)
      ~ layer_arn                   = "arn:aws:lambda:eu-west-2:194627472784:layer:kraken_dca_dependencies" -> (known after apply)
      + signing_job_arn             = (known after apply)
      + signing_profile_version_arn = (known after apply)
      ~ source_code_hash            = "X4uxc7ROZBcHseOB7Hub8Di+6Y9G5OO95dkP369p1fg=" -> "NkRHWgvEQawh+NCTsVHuFHKlnnV5wg5hIXGJOr4njQs=" # forces replacement
      ~ source_code_size            = 12306828 -> (known after apply)
      ~ version                     = "98" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # aws_network_interface.nat_ec2_network_interface will be created
  + resource "aws_network_interface" "nat_ec2_network_interface" {
      + arn                       = (known after apply)
      + id                        = (known after apply)
      + interface_type            = (known after apply)
      + ipv4_prefix_count         = (known after apply)
      + ipv4_prefixes             = (known after apply)
      + ipv6_address_count        = (known after apply)
      + ipv6_address_list         = (known after apply)
      + ipv6_address_list_enabled = false
      + ipv6_addresses            = (known after apply)
      + ipv6_prefix_count         = (known after apply)
      + ipv6_prefixes             = (known after apply)
      + mac_address               = (known after apply)
      + outpost_arn               = (known after apply)
      + owner_id                  = (known after apply)
      + private_dns_name          = (known after apply)
      + private_ip                = (known after apply)
      + private_ip_list           = (known after apply)
      + private_ip_list_enabled   = false
      + private_ips               = (known after apply)
      + private_ips_count         = (known after apply)
      + security_groups           = (known after apply)
      + source_dest_check         = false
      + subnet_id                 = (known after apply)
      + tags_all                  = (known after apply)
    }

  # aws_route.private_nat_instance will be created
  + resource "aws_route" "private_nat_instance" {
      + destination_cidr_block = "0.0.0.0/0"
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)
    }

  # aws_route.public_internet_gateway will be created
  + resource "aws_route" "public_internet_gateway" {
      + destination_cidr_block = "0.0.0.0/0"
      + gateway_id             = (known after apply)
      + id                     = (known after apply)
      + instance_id            = (known after apply)
      + instance_owner_id      = (known after apply)
      + network_interface_id   = (known after apply)
      + origin                 = (known after apply)
      + route_table_id         = (known after apply)
      + state                  = (known after apply)
    }

  # aws_route_table.private_subnet_route_table will be created
  + resource "aws_route_table" "private_subnet_route_table" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "Kraken-DCA-private-subnet-route-table"
        }
      + tags_all         = {
          + "Name" = "Kraken-DCA-private-subnet-route-table"
        }
      + vpc_id           = (known after apply)
    }

  # aws_route_table.public_subnet_route_table will be created
  + resource "aws_route_table" "public_subnet_route_table" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "Kraken-DCA-public-subnet-route-table"
        }
      + tags_all         = {
          + "Name" = "Kraken-DCA-public-subnet-route-table"
        }
      + vpc_id           = (known after apply)
    }

  # aws_route_table_association.private_route_table_association will be created
  + resource "aws_route_table_association" "private_route_table_association" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # aws_route_table_association.public_route_table_association will be created
  + resource "aws_route_table_association" "public_route_table_association" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # aws_security_group.security_group_to_use_for_nat will be created
  + resource "aws_security_group" "security_group_to_use_for_nat" {
      + arn                    = (known after apply)
      + description            = "Managed by Terraform"
      + egress                 = [
          + {
              + cidr_blocks      = [
                  + "0.0.0.0/0",
                ]
              + description      = "Allow all outbound traffic"
              + from_port        = 0
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "-1"
              + security_groups  = []
              + self             = true
              + to_port          = 0
            },
        ]
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = [
                  + "10.100.0.0/16",
                ]
              + description      = "Allow all inbound traffic from Private IPs in VPC"
              + from_port        = 0
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "-1"
              + security_groups  = []
              + self             = true
              + to_port          = 0
            },
        ]
      + name                   = "nat_instance_security_group"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags_all               = (known after apply)
      + vpc_id                 = (known after apply)
    }

  # aws_subnet.private_subnet will be created
  + resource "aws_subnet" "private_subnet" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = (known after apply)
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.100.0.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = false
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name" = "Kraken DCA private Subnet"
        }
      + tags_all                                       = {
          + "Name" = "Kraken DCA private Subnet"
        }
      + vpc_id                                         = (known after apply)
    }

  # aws_subnet.public_subnet will be created
  + resource "aws_subnet" "public_subnet" {
      + arn                                            = (known after apply)
      + assign_ipv6_address_on_creation                = false
      + availability_zone                              = (known after apply)
      + availability_zone_id                           = (known after apply)
      + cidr_block                                     = "10.100.1.0/24"
      + enable_dns64                                   = false
      + enable_resource_name_dns_a_record_on_launch    = false
      + enable_resource_name_dns_aaaa_record_on_launch = false
      + id                                             = (known after apply)
      + ipv6_cidr_block_association_id                 = (known after apply)
      + ipv6_native                                    = false
      + map_public_ip_on_launch                        = true
      + owner_id                                       = (known after apply)
      + private_dns_hostname_type_on_launch            = (known after apply)
      + tags                                           = {
          + "Name" = "Kraken DCA public Subnet"
        }
      + tags_all                                       = {
          + "Name" = "Kraken DCA public Subnet"
        }
      + vpc_id                                         = (known after apply)
    }

  # aws_vpc.vpc will be created
  + resource "aws_vpc" "vpc" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.100.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_classiclink                   = (known after apply)
      + enable_classiclink_dns_support       = (known after apply)
      + enable_dns_hostnames                 = (known after apply)
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags                                 = {
          + "Name" = "Kraken DCA VPC"
        }
      + tags_all                             = {
          + "Name" = "Kraken DCA VPC"
        }
    }

Plan: 16 to add, 2 to change, 1 to destroy.

📝 Plan generated in Terraform plan #12