Skip to content

Peer VPCs across AWS Accounts and Regions #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Eric Thompson (ethompsy) wants to merge 13 commits into
base: main
Choose a base branch
from
Open

Peer VPCs across AWS Accounts and Regions #71

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
3d3221b
try this
ethompsy Jun 3, 2025
cd05a0a
try this
ethompsy Jun 3, 2025
1df33d1
try this
ethompsy Jun 3, 2025
9c7eed1
try this
ethompsy Jun 3, 2025
6b26223
alias both aws providers
ethompsy Jun 4, 2025
533ef44
fixing the pcx
ethompsy Jun 4, 2025
3e99d2d
fixing the pcx
ethompsy Jun 4, 2025
0cf06f1
fixing the pcx
ethompsy Jun 4, 2025
d11f499
fixing the pcx
ethompsy Jun 4, 2025
61ded73
fixing the pcx
ethompsy Jun 4, 2025
448fee1
fixing the pcx
ethompsy Jun 4, 2025
6839ebc
fixing the pcx
ethompsy Jun 4, 2025
e441923
Merge branch 'main' into multi_region_and_account
ethompsy Aug 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,7 @@

.build-harness
build-harness/

# IDE files
.vscode
.history
59 changes: 48 additions & 11 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,48 +1,83 @@
resource "aws_vpc_peering_connection" "default" {
provider = aws.requestor
count = module.this.enabled ? 1 : 0
vpc_id = join("", data.aws_vpc.requestor[*].id)
peer_vpc_id = join("", data.aws_vpc.acceptor[*].id)
peer_owner_id = data.aws_caller_identity.acceptor[0].account_id
peer_region = data.aws_region.acceptor[0].name
auto_accept = false

auto_accept = var.auto_accept
tags = module.this.tags

accepter {
allow_remote_vpc_dns_resolution = var.acceptor_allow_remote_vpc_dns_resolution
timeouts {
create = var.create_timeout
update = var.update_timeout
delete = var.delete_timeout
}
}

# Options must be added after PCX is active
resource "aws_vpc_peering_connection_options" "default" {
provider = aws.requestor
count = module.this.enabled ? 1 : 0
vpc_peering_connection_id = aws_vpc_peering_connection.default[0].id

requester {
allow_remote_vpc_dns_resolution = var.requestor_allow_remote_vpc_dns_resolution
}

tags = module.this.tags
depends_on = [aws_vpc_peering_connection_accepter.default]
}

timeouts {
create = var.create_timeout
update = var.update_timeout
delete = var.delete_timeout
# Accepter's side of the connection.
resource "aws_vpc_peering_connection_accepter" "default" {

@atatevyan atatevyan Feb 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typically, this one won't be needed for the same account/same region case, as it will be treated as the same resource as requester by AWS. For this very reason, the multi-account module exhibits incorrect behavior, trying to rewrite requester tags with accepter tags and vice versa with every next plan/apply cycle, never reaching state convergence. Here, you're using same tags for both requester and accepter, so shouldn't be an issue, however this will break compatibility with multi-account module, if someone tries to migrate from it to this reworked module.

provider = aws.acceptor
count = module.this.enabled ? 1 : 0
vpc_peering_connection_id = aws_vpc_peering_connection.default[0].id
auto_accept = var.auto_accept

accepter {

@atatevyan atatevyan Feb 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider using aws_vpc_peering_connection_options resource instead.

allow_remote_vpc_dns_resolution = var.acceptor_allow_remote_vpc_dns_resolution
}

tags = module.this.tags
}

data "aws_region" "acceptor" {
count = module.this.enabled ? 1 : 0
provider = aws.acceptor
}

data "aws_caller_identity" "acceptor" {
count = module.this.enabled ? 1 : 0
provider = aws.acceptor
}

# Lookup requestor VPC so that we can reference the CIDR
data "aws_vpc" "requestor" {
provider = aws.requestor
count = module.this.enabled ? 1 : 0
id = var.requestor_vpc_id
tags = var.requestor_vpc_tags
}

# Lookup acceptor VPC so that we can reference the CIDR
data "aws_vpc" "acceptor" {
count = module.this.enabled ? 1 : 0
id = var.acceptor_vpc_id
tags = var.acceptor_vpc_tags
provider = aws.acceptor
count = module.this.enabled ? 1 : 0
id = var.acceptor_vpc_id
tags = var.acceptor_vpc_tags
}

data "aws_route_tables" "requestor" {
provider = aws.requestor
count = module.this.enabled ? 1 : 0
vpc_id = join("", data.aws_vpc.requestor[*].id)
tags = var.requestor_route_table_tags
}

data "aws_route_tables" "acceptor" {
provider = aws.acceptor
count = module.this.enabled ? 1 : 0
vpc_id = join("", data.aws_vpc.acceptor[*].id)
tags = var.acceptor_route_table_tags
Expand All @@ -59,6 +94,7 @@ locals {

# Create routes from requestor to acceptor
resource "aws_route" "requestor" {
provider = aws.requestor
count = module.this.enabled ? length(distinct(sort(data.aws_route_tables.requestor[0].ids))) * length(local.acceptor_cidr_blocks) : 0
route_table_id = element(distinct(sort(data.aws_route_tables.requestor[0].ids)), ceil(count.index / length(local.acceptor_cidr_blocks)))
destination_cidr_block = local.acceptor_cidr_blocks[count.index % length(local.acceptor_cidr_blocks)]
Expand All @@ -68,6 +104,7 @@ resource "aws_route" "requestor" {

# Create routes from acceptor to requestor
resource "aws_route" "acceptor" {
provider = aws.acceptor
count = module.this.enabled ? length(distinct(sort(data.aws_route_tables.acceptor[0].ids))) * length(local.requestor_cidr_blocks) : 0
route_table_id = element(distinct(sort(data.aws_route_tables.acceptor[0].ids)), ceil(count.index / length(local.requestor_cidr_blocks)))
destination_cidr_block = local.requestor_cidr_blocks[count.index % length(local.requestor_cidr_blocks)]
Expand Down
1 change: 1 addition & 0 deletions versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ terraform {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
configuration_aliases = [ aws.requestor, aws.acceptor ]
}
}
}