Building the Connectivity

In one of the posts, I talk about setting up an AWS landing zone using the control tower.

Followed these steps from the control tower section of the Management account

• Create an OU named "Infrastructure."

• Create an AWS account named "Network" from the account factory.

• Disable automatic creation of VPCs in all regions by the Account Factory in AWS Control Tower.

Now that our network account is ready, we must deploy a VPC resource using Terraform via the GitHub Actions workflow.

In another post, I discussed the steps to integrate GitHub with AWS using OIDC. In the same way, HCP Terraform must also be integrated with AWS for infrastructure provisioning. Add HCP as the OIDC provider on the AWS and create an IAM role. This role must be added as a variable on your HCP workspace/organization.

Our new VPC contains the following resources:

• Two public subnets
• Two private subnets
• One internet gateway
• Four routing tables

A successful workflow summary will look like this;

Connect to the "Network" account and verify the VPC creation.

The last step is to create a resource share using AWS Resource Access Manager(RAM) to share all four VPC subnets with the "Sandbox" OU.

Our terraform code contains a file named ram.tf as follows;

# Creates a Resource Access Manager (RAM) Resource Share
resource "aws_ram_resource_share" "subnet_share" {
  name = var.ram_name
  tags = local.tags
}

# Associates Private Subnets to RAM
resource "aws_ram_resource_association" "private_subnets" {
  count              = length(var.private_subnet_cidr)
  resource_arn       = aws_subnet.private[count.index].arn
  resource_share_arn = aws_ram_resource_share.subnet_share.arn
}

# Associates Public Subnets to RAM
resource "aws_ram_resource_association" "public_subnets" {
  count              = length(var.public_subnet_cidr)
  resource_arn       = aws_subnet.public[count.index].arn
  resource_share_arn = aws_ram_resource_share.subnet_share.arn
}

# Share resources to Sandbox OU
resource "aws_ram_principal_association" "ram_principal_association" {
  principal          = var.ou_arn
  resource_share_arn = aws_ram_resource_share.subnet_share.arn
}        

One quick tip is to add the ARN of OU to the Terraform workspace.

Resource share has been created and will look like the one below. Notice "shared by me", ie, the Network Account

Connect to the "development" account, and you will see "shared with me" under RAM.

In this way, all future accounts within Sandbox OU will inherit the shared VPC from the Network account.