# AWS VPC Setup
# Terraform configuration for an AWS VPC with public and private subnets,
# an internet gateway, NAT gateway, and associated route tables.
#
# Customize:
#   - Set AWS_REGION to your target AWS region
#   - Set VPC_CIDR to the desired CIDR block for the VPC
#   - Set PROJECT_NAME to identify resources
#   - Set ENVIRONMENT to the deployment stage (dev, staging, prod)

name: aws-vpc-setup
description: Provision an AWS VPC with public/private subnets, NAT gateway, and route tables
tags: [provisioning, aws, vpc, networking, terraform]
tool: terraform
cloud_provider: aws
os_family: agnostic
risk_level: medium
compliance_tags: []

vars:
  AWS_REGION: "{{AWS_REGION}}"
  VPC_CIDR: "{{VPC_CIDR}}"
  PROJECT_NAME: "{{PROJECT_NAME}}"
  ENVIRONMENT: "{{ENVIRONMENT}}"

playbook: |
  ---
  provider "aws" {
    region = var.aws_region
  }

  variable "aws_region" {
    description = "AWS region for all resources"
    type        = string
    default     = "us-east-1"
  }

  variable "vpc_cidr" {
    description = "CIDR block for the VPC"
    type        = string
    default     = "10.0.0.0/16"
  }

  variable "project_name" {
    description = "Project name used for resource tagging"
    type        = string
  }

  variable "environment" {
    description = "Deployment environment (dev, staging, prod)"
    type        = string
    default     = "dev"
  }

  resource "aws_vpc" "main" {
    cidr_block           = var.vpc_cidr
    enable_dns_support   = true
    enable_dns_hostnames = true

    tags = {
      Name        = "${var.project_name}-vpc"
      Environment = var.environment
      ManagedBy   = "terraform"
    }
  }

  resource "aws_subnet" "public" {
    vpc_id                  = aws_vpc.main.id
    cidr_block              = cidrsubnet(var.vpc_cidr, 8, 1)
    availability_zone       = "${var.aws_region}a"
    map_public_ip_on_launch = true

    tags = {
      Name        = "${var.project_name}-public-subnet"
      Environment = var.environment
      Tier        = "public"
    }
  }

  resource "aws_subnet" "private" {
    vpc_id            = aws_vpc.main.id
    cidr_block        = cidrsubnet(var.vpc_cidr, 8, 2)
    availability_zone = "${var.aws_region}a"

    tags = {
      Name        = "${var.project_name}-private-subnet"
      Environment = var.environment
      Tier        = "private"
    }
  }

  resource "aws_internet_gateway" "main" {
    vpc_id = aws_vpc.main.id

    tags = {
      Name        = "${var.project_name}-igw"
      Environment = var.environment
    }
  }

  resource "aws_eip" "nat" {
    domain = "vpc"

    tags = {
      Name        = "${var.project_name}-nat-eip"
      Environment = var.environment
    }
  }

  resource "aws_nat_gateway" "main" {
    allocation_id = aws_eip.nat.id
    subnet_id     = aws_subnet.public.id

    tags = {
      Name        = "${var.project_name}-nat-gw"
      Environment = var.environment
    }

    depends_on = [aws_internet_gateway.main]
  }

  resource "aws_route_table" "public" {
    vpc_id = aws_vpc.main.id

    route {
      cidr_block = "0.0.0.0/0"
      gateway_id = aws_internet_gateway.main.id
    }

    tags = {
      Name        = "${var.project_name}-public-rt"
      Environment = var.environment
    }
  }

  resource "aws_route_table_association" "public" {
    subnet_id      = aws_subnet.public.id
    route_table_id = aws_route_table.public.id
  }

  resource "aws_route_table" "private" {
    vpc_id = aws_vpc.main.id

    route {
      cidr_block     = "0.0.0.0/0"
      nat_gateway_id = aws_nat_gateway.main.id
    }

    tags = {
      Name        = "${var.project_name}-private-rt"
      Environment = var.environment
    }
  }

  resource "aws_route_table_association" "private" {
    subnet_id      = aws_subnet.private.id
    route_table_id = aws_route_table.private.id
  }
