AWS VPC Lattice

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.85.0"
    }
  }
}

data "aws_db_instance" "orders" {
  db_instance_identifier = "orders-prod"
}

resource "aws_security_group" "artie_resource_gateway" {
  name   = "artie-resource-gateway"
  vpc_id = "vpc-0a1b2c3d4e5f67890"

  egress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = ["10.20.0.0/16"]
  }
}

# Allow the resource gateway to reach the database.
resource "aws_vpc_security_group_ingress_rule" "orders_from_artie" {
  security_group_id            = "sg-0d4c3b2a1f0e98765" # the database's security group
  referenced_security_group_id = aws_security_group.artie_resource_gateway.id
  ip_protocol                  = "tcp"
  from_port                    = 5432
  to_port                      = 5432
}

resource "aws_vpclattice_resource_gateway" "artie" {
  name               = "artie"
  vpc_id             = "vpc-0a1b2c3d4e5f67890"
  subnet_ids         = ["subnet-0aa11bb22cc33dd44", "subnet-0ee55ff66aa77bb88", "subnet-0cc99dd00ee11ff22"]
  security_group_ids = [aws_security_group.artie_resource_gateway.id]
}

resource "aws_vpclattice_resource_configuration" "orders" {
  name                                           = "artie-orders-prod"
  resource_gateway_identifier                    = aws_vpclattice_resource_gateway.artie.id
  type                                           = "ARN"
  allow_association_to_shareable_service_network = false

  resource_configuration_definition {
    arn_resource {
      arn = data.aws_db_instance.orders.db_instance_arn
    }
  }
}

resource "aws_ram_resource_share" "artie" {
  name                      = "artie"
  allow_external_principals = false
}

resource "aws_ram_resource_association" "orders" {
  resource_arn       = aws_vpclattice_resource_configuration.orders.arn
  resource_share_arn = aws_ram_resource_share.artie.arn
}

resource "aws_ram_principal_association" "artie" {
  principal          = "210987654321" # your Artie account
  resource_share_arn = aws_ram_resource_share.artie.arn
}

# Send these values to Artie.
output "artie_resource_share_arn" {
  description = "RAM resource share that contains the resource configurations"
  value       = aws_ram_resource_share.artie.arn
}

output "artie_resource_configurations" {
  description = "One entry per database: the resource configuration ARN and the hostname to use as the source address"
  value = {
    (aws_vpclattice_resource_configuration.orders.name) = {
      resource_configuration_arn = aws_vpclattice_resource_configuration.orders.arn
      hostname                   = data.aws_db_instance.orders.address
      port                       = data.aws_db_instance.orders.db_instance_port
    }
  }
}