VPC Privatelink partners support

[mtb-xt]

Hi team,

As I understand, at the moment vpc component and module do not support connecting to a partner privatelink (I'm talking about MongoDB Atlas in this case).

From the module side - there is an issue discussing this - cloudposse/terraform-aws-vpc#114

But the component does not support this at all - couple of limitations -
Only one security group is created for all endpoints - https://docs.cloudposse.com/components/library/aws/vpc/#modules - endpoint_security_groups - which is fine for internal endpoints, but for partner\saas services we would need more granularity.

And there is no way to actually tell the vpc component to create such a private link interface, again, because the underlying module doesn't support it.

Is this something you guys have in your roadmap? If not, I can try to make PRs, but I would appreciate guidance in what you think is acceptable architecture and layout for this.

[dudymas]

I believe we already have a customer using MongoDB Atlas over Private Link. I'll look into upstreaming soon and follow up.

[mtb-xt]

If you think it's a satisfactory go-between, I could share the basic code behind engineering a private link module or (more preferred) component. If you made it an override file you could likely just use it in the component and keep it upgraded without many issues.

Yes, that would be great! Thanks.

I'll look into how much effort it would be to add an external/non-AWS VPC Endpoint module for the VPC module. While I doubt it's a lot of effort, we'll need to prioritize a few other things first.

This would also be much appreciated

[dudymas]

Here's a basic gist:

data "aws_ssm_parameter" "atlas_public_key" {
  name = "/atlas/public_key"
}

data "aws_ssm_parameter" "atlas_private_key" {
  name = "/atlas/private_key"

  with_decryption = true
}

provider "mongodbatlas" {
  public_key  = data.aws_ssm_parameter.atlas_public_key.value
  private_key = data.aws_ssm_parameter.atlas_private_key.value
}

data "aws_ssm_parameter" "project_id" {
  name = "/atlas/project_id"

  with_decryption = true
}

resource "mongodbatlas_privatelink_endpoint" "default" {
  project_id    = data.aws_ssm_parameter.project_id.value
  provider_name = "AWS"
  region        = var.region
}

module "security_group" {
  source  = "cloudposse/security-group/aws"
  version = "2.2.0"

  create_before_destroy      = true
  preserve_security_group_id = false
  attributes                 = module.this.attributes
  vpc_id                     = module.vpc.outputs.vpc_id

  rules_map = {
    ingress = [{
      key         = "vpc_ingress"
      type        = "ingress"
      from_port   = 27015
      to_port     = 27018
      protocol    = "tcp"
      cidr_blocks = [module.vpc.outputs.vpc_cidr]
    }]
  }

  allow_all_egress = true

  context = module.this.context
}

resource "aws_vpc_endpoint" "mongo_endpoint" {
  vpc_id             = module.vpc.outputs.vpc_id
  service_name       = mongodbatlas_privatelink_endpoint.default.endpoint_service_name
  vpc_endpoint_type  = "Interface"
  subnet_ids         = module.vpc.outputs.private_subnet_ids
  security_group_ids = [module.security_group.id]

  tags = module.this.tags
}

resource "mongodbatlas_privatelink_endpoint_service" "this" {
  project_id          = data.aws_ssm_parameter.project_id.value
  private_link_id     = mongodbatlas_privatelink_endpoint.default.private_link_id
  endpoint_service_id = aws_vpc_endpoint.mongo_endpoint.id
  provider_name       = "AWS"
}

Notes

• This code assumed a remote-state.tf that looks up a vpc component. You can see our vpc component here: https://github.com/cloudposse-terraform-components/aws-vpc
• you can use variables instead of ssm
• the security group settings are just for example and should be tweaked to your setup
• you would want to add more if this needs to be multiple endpoints (i.e. put this into a module, then put a for_each on that module)

Hope this helps!

[mtb-xt]

@dudymas sorry, got caught up with something else.

I realize to make changes, this change needs to be implemented in the aws-vpc module. Would you be able to do it? Or you need a PR from us?

[osterman]

@mtb-xt: Thanks for checking!

We'd be happy to help — just a quick note that hands-on implementation like this falls under our Flexible Support, which includes development work, bug fixes, and module enhancements. You can find details here: cloudposse.com/pricing/support.

In the meantime, feel free to open up a PR with the changes and post it here in the thread. We'll promptly review it as part of Essential Support.