setup_aws_network.yml

---

# Copyright 2021 Cloudera, Inc. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: Update existing AWS VPC
  when: infra__aws_vpc_id != ""
  block:
    - name: Prepare AWS VPC tags
      ansible.builtin.set_fact:
        __aws_vpc_tags: "{{ __aws_vpc_tags | default([]) | union([tag_entry]) }}"
      vars:
        tag_entry: "Key={{ __tag.key }},Value={{ __tag.value |quote}}"
      loop: "{{ infra__tags | dict2items }}"
      loop_control:
        loop_var: __tag

    # Using CLI due to hardcoded module behavior - see https://github.com/boto/boto3/issues/2929
    - name: Update AWS VPC
      when: __aws_vpc_tags is defined and __aws_vpc_tags | length > 0
      ansible.builtin.command: "aws ec2 create-tags --region {{ infra__region }} --resources {{ infra__aws_vpc_id }} --tags {{ __aws_vpc_tags | join(' ') }}"

- name: Set up AWS VPC
  when: infra__aws_vpc_id == ""
  block:
    - name: Create AWS VPC
      amazon.aws.ec2_vpc_net:
        region: "{{ infra__region }}"
        name: "{{ infra__vpc_name }}"
        cidr_block: "{{ infra__vpc_cidr }}"
        tags: "{{ infra__tags }}" # TODO - Filter out name, per module warning
        state: present
      register: __aws_vpc_info

    - name: Set fact for AWS VPC ID
      ansible.builtin.set_fact:
        infra__aws_vpc_id: "{{ __aws_vpc_info.vpc.id }}"

- name: Update existing AWS VPC Public Subnets
  when: infra__aws_public_subnet_ids | count > 0
  amazon.aws.ec2_vpc_subnet:
    region: "{{ infra__region }}"
    vpc_id: "{{ infra__aws_vpc_id }}"
    cidr: "{{ __aws_public_subnet_item.cidr }}"
    map_public: "{{ __aws_public_subnet_item.map_public }}"
    assign_instances_ipv6: "{{ __aws_public_subnet_item.assign_instances_ipv6 }}"
    state: present
    purge_tags: no
    tags: "{{ infra__tags | combine(__aws_public_subnet_item.tags, recursive=True) }}"
  loop_control:
    loop_var: __aws_public_subnet_item
    index_var: __aws_public_subnet_index
  loop: "{{ infra__vpc_public_subnets_info }}"

- name: Update existing AWS VPC Private Subnets
  when: infra__aws_private_subnet_ids | count > 0
  amazon.aws.ec2_vpc_subnet:
    region: "{{ infra__region }}"
    vpc_id: "{{ infra__aws_vpc_id }}"
    cidr: "{{ __aws_private_subnet_item.cidr }}"
    state: present
    purge_tags: no
    tags: "{{ infra__tags | combine(__aws_private_subnet_item.tags, recursive=True) }}"
  loop_control:
    loop_var: __aws_private_subnet_item
    index_var: __aws_private_subnet_index
  loop: "{{ infra__vpc_private_subnets_info }}"

- name: Set up AWS Public Network infrastructure
  when: infra__aws_subnet_ids is undefined  # L0 (fully public), L1 (semi-private), or L2 (fully-private), but not for existing network or L3 (outbound restricted)
  # when: not (infra__tunnel and not infra__public_endpoint_access) and infra__aws_subnet_ids is undefined # L0 (all public) or L1 (public/private)
  block:
    - name: Create AWS Internet Gateway (IGW)
      community.aws.ec2_vpc_igw:
        vpc_id: "{{ infra__aws_vpc_id }}"
        region: "{{ infra__region }}"
        state: present
        tags: "{{ infra__tags | combine({ 'Name': infra__aws_igw_name }, recursive=True) }}"
      register: __aws_igw

    - name: Set fact for AWS IGW ID
      when: __aws_igw.gateway_id is defined
      ansible.builtin.set_fact:
        infra__aws_igw_id: "{{ __aws_igw.gateway_id }}"

    - name: Create AWS VPC Public Subnets
      amazon.aws.ec2_vpc_subnet:
        region: "{{ infra__region }}"
        vpc_id: "{{ infra__aws_vpc_id }}"
        cidr: "{{ __aws_public_subnet_item.cidr }}"
        state: present
        tags: "{{ infra__tags | combine(__aws_public_subnet_item.tags, recursive=True) }}"
        map_public: yes
        az: "{{ __aws_az_info.availability_zones[__aws_subnet_index % infra__aws_vpc_az_count | int].zone_name }}"
      loop_control:
        loop_var: __aws_public_subnet_item
        index_var: __aws_subnet_index
      loop: "{{ infra__vpc_public_subnets_info }}"
      register: __aws_public_subnets

    - name: Set fact for AWS Public Subnet IDs
      ansible.builtin.set_fact:
        infra__aws_public_subnet_ids: "{{ infra__aws_public_subnet_ids | default([]) | union([__aws_subnet_item.subnet.id | default('')]) }}"
      loop_control:
        loop_var: __aws_subnet_item
      loop: "{{ __aws_public_subnets.results }}"

    - name: List the Route Tables for the AWS VPC
      community.aws.ec2_vpc_route_table_info:
        region: "{{ infra__region }}"
        filters:
          vpc-id: "{{ infra__aws_vpc_id }}"
      register: __aws_route_table_list

    - name: Configure the Public Route Table for the AWS VPC
      community.aws.ec2_vpc_route_table:
        region: "{{ infra__region }}"
        vpc_id: "{{ infra__aws_vpc_id }}"
        route_table_id: "{{ __aws_route_table_id }}"
        lookup: id
        state: present
        tags: "{{ infra__tags | combine({ 'Name': infra__aws_public_route_table_name }, recursive=True) }}"
        routes:
          - dest: "0.0.0.0/0"
            gateway_id: "{{ infra__aws_igw_id }}"
        subnets: "{{ infra__aws_public_subnet_ids }}"
      vars:
        __aws_route_table_id: "{{ __aws_route_table_list.route_tables | json_query(__aws_rtb_jq) | flatten | first }}"
        __aws_rtb_jq: "[*].associations[?main == `true` ].route_table_id"

    - name: Set facts for AWS Subnet IDs with Public Subnet details if not CCM Tunneled
      when: not infra__tunnel
      ansible.builtin.set_fact:
        infra__aws_subnet_ids: "{{ infra__aws_public_subnet_ids }}"

- name: Setup AWS Private Networking infrastructure
  when: infra__tunnel and infra__aws_subnet_ids is undefined # L1 (semi-private) or L2 (fully private), but not for existing network or L0 (fully public) or L3 (outbound restricted)
  block:
    - name: Create AWS VPC Private Subnets
      amazon.aws.ec2_vpc_subnet:
        region: "{{ infra__region }}"
        vpc_id: "{{ infra__aws_vpc_id }}"
        cidr: "{{ __aws_private_subnet_item.cidr }}"
        state: present
        tags: "{{ infra__tags | combine(__aws_private_subnet_item.tags, recursive = true) }}"
        map_public: no
        az: "{{ __aws_az_info.availability_zones[__aws_subnet_index % infra__aws_vpc_az_count | int].zone_name }}"
      loop_control:
        loop_var: __aws_private_subnet_item
        index_var: __aws_subnet_index
        label: "{{ __aws_private_subnet_item.name }}"
      loop: "{{ infra__vpc_private_subnets_info }}"
      register: __aws_private_subnets

    - name: Set fact for AWS Private Subnet IDs
      ansible.builtin.set_fact:
        infra__aws_private_subnet_ids: "{{ infra__aws_private_subnet_ids | default([]) | union([__aws_subnet_item.subnet.id | default('')]) }}"
      loop_control:
        loop_var: __aws_subnet_item
      loop: "{{ __aws_private_subnets.results }}"

    - name: Configure Private Route Table for the AWS VPC
      when: no
      #when: not infra__public_endpoint_access
      community.aws.ec2_vpc_route_table:
        vpc_id: "{{ infra__aws_vpc_id }}"
        region: "{{ infra__region }}"
        tags: "{{ infra__tags | combine({ 'Name': infra__aws_private_route_table_name }, recursive=True) }}"
        subnets: "{{ infra__aws_private_subnet_ids }}"
        routes: []

    - name: Create Network Gateways (NAT) # and allocate Elastic IP Addresses (EIP) for Public Endpoint Access
      #when: infra__public_endpoint_access
      # Might want a net new flag -- disconnected -- that will not set up any routes to outside, i.e. Level3
      community.aws.ec2_vpc_nat_gateway:
        state: present
        subnet_id: "{{ __aws_public_subnet_id }}"
        wait: true
        if_exist_do_not_create: true
        region: "{{ infra__region }}"
        tags: "{{ infra__tags | combine({ 'Name': '-'.join([infra__aws_nat_gateway_name, __aws_public_subnet_index | string]) }, recursive=True) }}"
      loop_control:
        loop_var: __aws_public_subnet_id
        index_var: __aws_public_subnet_index
      loop: "{{ infra__aws_public_subnet_ids }}"
      register: __aws_ngws

    - name: Configure Private Route Tables #for the AWS VPC for Public Endpoint Access
      #when: infra__public_endpoint_access
      # See above
      community.aws.ec2_vpc_route_table:
        vpc_id: "{{ infra__aws_vpc_id }}"
        region: "{{ infra__region }}"
        tags: "{{ infra__tags | combine({ 'Name': '-'.join([infra__aws_private_route_table_name, __aws_private_subnet_id_index | string]) }, recursive=True) }}"
        subnets: "{{ __aws_private_subnet_id_item }}"
        routes:
        - dest: "0.0.0.0/0"
          nat_gateway_id:  "{{ __aws_ngws.results[ __aws_private_subnet_id_index % __aws_ngws.results | length ].nat_gateway_id }}"
      loop_control:
        loop_var: __aws_private_subnet_id_item
        index_var: __aws_private_subnet_id_index
      loop: "{{ infra__aws_private_subnet_ids }}"

    - name: Set fact for AWS Subnet IDs
      ansible.builtin.set_fact:
        infra__aws_subnet_ids: "{{ infra__aws_public_subnet_ids | default([]) | union(infra__aws_private_subnet_ids) }}"

- name: Create AWS Security Groups
  amazon.aws.ec2_group:
    state: present
    region: "{{ infra__region }}"
    vpc_id: "{{ infra__aws_vpc_id }}"
    name: "{{ __security_group_name_item }}"
    description: "{{ __security_group_name_item }}"
    tags: "{{ infra__tags | combine({ 'Name': __security_group_name_item }, recursive=True) }}"
    rules:  "{{ infra__aws_security_group_rules | union([rule])}}"
  vars:
    rule:
      proto: all
      group_name: "{{ __security_group_name_item }}"
  loop_control:
    loop_var: __security_group_name_item
  loop:
    - "{{ infra__security_group_knox_name }}"
    - "{{ infra__security_group_default_name }}"
  register: __aws_security_group_info

- name: Set fact for Security Group IDs
  ansible.builtin.set_fact:
    infra__aws_security_group_knox_id: "{{ __aws_security_group_info | community.general.json_query(knox) | first }}"
    infra__aws_security_group_default_id: "{{ __aws_security_group_info | community.general.json_query(default) | first }}"
  vars:
    knox: "results[?group_name=='{{ infra__security_group_knox_name }}'].group_id"
    default: "results[?group_name=='{{ infra__security_group_default_name }}'].group_id"


- name: Setup AWS Private Endpoints
  when: infra__aws_private_endpoints | bool
  block:
    - name: Create VPC Endpoint Security Group (Skip if infra__aws_private_endpoints is false)
      amazon.aws.ec2_group:
        state: present
        region: "{{ infra__region }}"
        vpc_id: "{{ infra__aws_vpc_id }}"
        tags: "{{ infra__tags | combine({ 'Name': 'infra__security_group_vpce_name' }, recursive=True) }}"
        name: "{{ infra__security_group_vpce_name }}"
        description: "{{ infra__security_group_vpce_name }}"
        rules:
          - proto: all
            cidr_ip: "{{ infra__vpc_cidr }}"
      register: __aws_vpce_security_group_info

    - name: List the Route Tables for the AWS VPC (Skip if infra__aws_private_endpoints is false)
      community.aws.ec2_vpc_route_table_info:
        region: "{{ infra__region }}"
        filters:
          vpc-id: "{{ infra__aws_vpc_id }}"
      register: __aws_route_table_list_again
    
    - name: Set fact for All Route Table IDs (Skip if infra__aws_private_endpoints is false)
      ansible.builtin.set_fact:
        infra__route_table_ids: "{{ infra__route_table_ids | default([]) | union([route_table_id]) }}"
      vars:
        route_table_id: "{{ __aws_route_tables.associations[0].route_table_id }}"
      loop: "{{ __aws_route_table_list_again.route_tables }}"
      loop_control:
        label: "{{ __aws_route_tables.associations[0].route_table_id }}"
        loop_var: __aws_route_tables

    - name: Create Gateway VPC Endpoints (Skip if infra__aws_private_endpoints is false)
      community.aws.ec2_vpc_endpoint:
        state: present
        region: "{{ infra__region }}"
        vpc_id: "{{ infra__aws_vpc_id }}"
        service: "{{ __infra_gateway_vpc_endpoint }}"
        route_table_ids: "{{ infra__route_table_ids }}"
        tags: "{{ infra__tags | combine({ 'Name': infra__namespace + __infra_gateway_vpc_endpoint.split(infra__region)[1] }, recursive=True) }}"
      vars:
        route_table_id: "{{ route_tables.associations[0].route_table_id }}"
      loop: "{{ infra__aws_gateway_vpc_private_endpoints }}"
      loop_control:
        loop_var: __infra_gateway_vpc_endpoint
      register: __aws_gateway_vpc_endpoints

    - name: Create Interface VPC Endpoints (Skip if infra__aws_private_endpoints is false)
      community.aws.ec2_vpc_endpoint:
        state: present
        region: "{{ infra__region }}"
        vpc_id: "{{ infra__aws_vpc_id }}"
        service: "{{ __infra_interface_vpc_endpoint }}"
        vpc_endpoint_type: Interface
        wait: true
        tags: "{{ infra__tags | combine({ 'Name': infra__namespace + __infra_interface_vpc_endpoint.split(infra__region)[1] }, recursive=True) }}"
      loop: "{{ infra__aws_interface_vpc_private_endpoints }}"
      loop_control:
        loop_var: __infra_interface_vpc_endpoint
      register: __aws_interface_vpc_endpoints

    - name: List Default Security Group for VPC (Skip if infra__aws_private_endpoints is false)
      amazon.aws.ec2_group_info:
        filters:
          vpc-id: "{{ infra__aws_vpc_id }}"
          group-name:
            - default
      register: __aws_vpc_default_sg
    
    - name: Add Subnets and Security Groups to Interface VPC Endpoints (Skip if infra__aws_private_endpoints is false)
      when:
        - __aws_interface_vpc_endpoints is defined
        - __aws_interface_vpc_endpoints.results is defined
      command: >
        aws ec2 modify-vpc-endpoint
        --region {{ infra__region }}
        --vpc-endpoint-id {{ __infra_vpce_loop_var.result.vpc_endpoint_id }}
        --add-subnet-ids {{ infra__aws_public_subnet_ids | join(' ') }} 
        --add-security-group-ids {{ __aws_vpce_security_group_info.group_id }}
        --remove-security-group-ids {{ __aws_vpc_default_sg.security_groups[0].group_id }}
        --private-dns-enabled
      loop_control:
        label: "{{ __infra_vpce_loop_var.result.vpc_endpoint_id | default('') }}"  # Default empty string to avoid ansible label undef error
        loop_var: __infra_vpce_loop_var
      loop: "{{ __aws_interface_vpc_endpoints.results }}"