Amazon AWS Transit Gateway

Terraform proof of concept: AWS workload VPC 192.168.0.0/16

Public workload subnet 192.168.125.0/24
  Workload route table
    +-- vpn_routed_prefixes (more-specific) --> AWS Transit Gateway ASN 65020
    |                                             |
    |                                VPN connection 1
    |                                        |
    |                                   +----+----+
    |                                   |         |
    |                                Tunnel 1  Tunnel 2
    |                                   |         |
    |                             Cloudflare WAN ASN 13335
    |                                  162.159.135.1
    |
    +-- 0.0.0.0/0 (remaining IPv4) --> Internet Gateway --> Internet

TGW attachment subnets: 192.168.124.0/28 and 192.168.124.16/28

curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" "https://api.cloudflare.com/client/v4/accounts/<CLOUDFLARE_ACCOUNT_ID>/magic/ipsec_tunnels" | jq -r '.result.ipsec_tunnels[] | "\(.interface_address)\t\(.name)"' | sort
curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" "https://api.cloudflare.com/client/v4/accounts/<CLOUDFLARE_ACCOUNT_ID>/magic/gre_tunnels" | jq -r '.result.gre_tunnels[] | "\(.interface_address)\t\(.name)"' | sort

aws ec2 modify-transit-gateway --transit-gateway-id <AWS_TGW_ID> --options AmazonSideAsn=65020

aws ec2 describe-vpn-connections --vpn-connection-ids <AWS_VPN_CONNECTION_01_ID> --query 'VpnConnections[].{VpnId:VpnConnectionId,Tunnels:VgwTelemetry[].{OutsideIP:OutsideIpAddress,Status:Status,ImportedRoutes:AcceptedRouteCount,Message:StatusMessage}}' --output table --no-cli-pager

aws ec2 search-transit-gateway-routes --transit-gateway-route-table-id <AWS_TGW_ROUTE_TABLE_ID> --filters Name=state,Values=active --max-results 1000 --query '{AdditionalRoutesAvailable:AdditionalRoutesAvailable,Routes:Routes[].{CIDR:DestinationCidrBlock,Type:Type,State:State,Attachments:TransitGatewayAttachments[].TransitGatewayAttachmentId}}' --output json --no-cli-pager

aws sts get-caller-identity --query Account --output text

export CLOUDFLARE_API_TOKEN="<API_TOKEN>"

$env:CLOUDFLARE_API_TOKEN = "<API_TOKEN>"

terraform {
  # terraform test uses override_during, which requires Terraform 1.11.0 or later.
  required_version = ">= 1.11.0"

  # Keep provider behavior within the minor versions tested by this guide.
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.67.0"
    }

    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 5.27.0"
    }
  }
}

# Authentication comes from CLOUDFLARE_API_TOKEN rather than a Terraform variable,
# which keeps the API token out of configuration and variable files.
provider "cloudflare" {}

provider "aws" {
  region = var.aws_region
  # Refuse to operate if the active credentials point at the wrong AWS account.
  allowed_account_ids = [var.expected_account_id]

  default_tags {
    tags = {
      Deployment = var.deployment_name
      ManagedBy  = "Terraform"
    }
  }
}

variable "aws_region" {
  description = "AWS Region for the reference deployment."
  type        = string
  default     = "us-east-2"
}

variable "expected_account_id" {
  description = "Twelve-digit AWS account ID allowed to receive the deployment."
  type        = string

  validation {
    condition     = can(regex("^[0-9]{12}$", var.expected_account_id))
    error_message = "expected_account_id must be a 12-digit AWS account ID."
  }
}

variable "cloudflare_account_id" {
  description = "Cloudflare account ID that owns the Cloudflare WAN configuration."
  type        = string

  validation {
    condition     = can(regex("^[0-9a-fA-F]{32}$", var.cloudflare_account_id))
    error_message = "cloudflare_account_id must be a 32-character hexadecimal Cloudflare account ID."
  }
}

variable "deployment_name" {
  description = "Name used to tag the reference deployment."
  type        = string
  default     = "cloudflare-wan-reference"

  validation {
    condition     = can(regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", var.deployment_name))
    error_message = "deployment_name may contain only letters, numbers, periods, underscores, and hyphens."
  }
}

variable "vpc_cidr" {
  description = "IPv4 CIDR for the workload VPC."
  type        = string
  default     = "192.168.0.0/16"

  validation {
    # Require the canonical network address so containment checks are unambiguous.
    condition = try(
      can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$", var.vpc_cidr)) &&
      cidrhost(var.vpc_cidr, 0) == split("/", var.vpc_cidr)[0] &&
      tonumber(split("/", var.vpc_cidr)[1]) >= 16 &&
      tonumber(split("/", var.vpc_cidr)[1]) <= 28,
      false
    )
    error_message = "vpc_cidr must be an IPv4 network with an AWS-supported /16 through /28 prefix."
  }
}

variable "workload_subnet_cidr" {
  description = "Public subnet for workloads that use split Internet and Cloudflare WAN connectivity."
  type        = string
  default     = "192.168.125.0/24"

  validation {
    condition = try(
      can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$", var.workload_subnet_cidr)) &&
      cidrhost(var.workload_subnet_cidr, 0) == split("/", var.workload_subnet_cidr)[0] &&
      tonumber(split("/", var.workload_subnet_cidr)[1]) >= 16 &&
      tonumber(split("/", var.workload_subnet_cidr)[1]) <= 28,
      false
    )
    error_message = "workload_subnet_cidr must be an IPv4 network with an AWS-supported /16 through /28 prefix."
  }
}

variable "vpn_routed_prefixes" {
  description = "IPv4 destination prefixes routed through the Transit Gateway and Site-to-Site VPNs instead of the Internet Gateway."
  type        = list(string)
  default     = []

  validation {
    # The default route belongs to the Internet Gateway; only more-specific
    # canonical networks can be selected for the VPN path.
    condition = length(distinct(var.vpn_routed_prefixes)) == length(var.vpn_routed_prefixes) && alltrue([
      for cidr in var.vpn_routed_prefixes : try(
        can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$", cidr)) &&
        cidrhost(cidr, 0) == split("/", cidr)[0] &&
        tonumber(split("/", cidr)[1]) >= 1 &&
        tonumber(split("/", cidr)[1]) <= 32,
        false
      )
    ])
    error_message = "vpn_routed_prefixes must contain unique canonical IPv4 network CIDRs more specific than 0.0.0.0/0."
  }

  validation {
    # Overlapping local and remote address space cannot be routed unambiguously.
    condition = alltrue([
      for cidr in var.vpn_routed_prefixes : try(
        cidrhost("${cidrhost(cidr, 0)}/${split("/", var.vpc_cidr)[1]}", 0) != cidrhost(var.vpc_cidr, 0) &&
        cidrhost("${cidrhost(var.vpc_cidr, 0)}/${split("/", cidr)[1]}", 0) != cidrhost(cidr, 0),
        false
      )
    ])
    error_message = "vpn_routed_prefixes must not overlap vpc_cidr."
  }
}

variable "tgw_subnet_a_cidr" {
  description = "Transit Gateway attachment subnet in the first Availability Zone."
  type        = string
  default     = "192.168.124.0/28"

  validation {
    condition = try(
      can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$", var.tgw_subnet_a_cidr)) &&
      cidrhost(var.tgw_subnet_a_cidr, 0) == split("/", var.tgw_subnet_a_cidr)[0] &&
      tonumber(split("/", var.tgw_subnet_a_cidr)[1]) >= 16 &&
      tonumber(split("/", var.tgw_subnet_a_cidr)[1]) <= 28,
      false
    )
    error_message = "tgw_subnet_a_cidr must be an IPv4 network with an AWS-supported /16 through /28 prefix."
  }
}

variable "tgw_subnet_b_cidr" {
  description = "Transit Gateway attachment subnet in the second Availability Zone."
  type        = string
  default     = "192.168.124.16/28"

  validation {
    condition = try(
      can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$", var.tgw_subnet_b_cidr)) &&
      cidrhost(var.tgw_subnet_b_cidr, 0) == split("/", var.tgw_subnet_b_cidr)[0] &&
      tonumber(split("/", var.tgw_subnet_b_cidr)[1]) >= 16 &&
      tonumber(split("/", var.tgw_subnet_b_cidr)[1]) <= 28,
      false
    )
    error_message = "tgw_subnet_b_cidr must be an IPv4 network with an AWS-supported /16 through /28 prefix."
  }
}

variable "tunnel_inside_cidrs" {
  description = "Two unique AWS VPN tunnel /30 networks per Cloudflare anycast IP, ordered by VPN connection and tunnel."
  type        = list(string)
  default = [
    "169.254.240.44/30",
    "169.254.240.48/30",
  ]

  validation {
    # Every AWS VPN connection contains exactly two tunnels.
    condition = length(var.tunnel_inside_cidrs) == length(var.cloudflare_anycast_ips) * 2 && length(distinct(var.tunnel_inside_cidrs)) == length(var.tunnel_inside_cidrs) && alltrue([
      for cidr in var.tunnel_inside_cidrs : try(
        split("/", cidr)[1] == "30" &&
        cidrhost(cidr, 0) == split("/", cidr)[0] &&
        cidrhost("${cidrhost(cidr, 0)}/20", 0) == "169.254.240.0" &&
        cidrhost("${cidrhost(cidr, -1)}/20", 0) == "169.254.240.0",
        false
      )
    ])
    error_message = "tunnel_inside_cidrs must contain two unique /30 network addresses within 169.254.240.0/20 for each Cloudflare anycast IP."
  }
}

variable "vpn_preshared_keys" {
  description = "Two AWS-compatible pre-shared keys per Cloudflare anycast IP, in tunnel order."
  type        = list(string)
  # Sensitive suppresses CLI display, but the keys are still stored in state.
  sensitive = true

  validation {
    # List order matches tunnel_inside_cidrs and the generated tunnel numbering.
    # Key format matches the AWS Site-to-Site VPN PreSharedKey constraints.
    condition = length(var.vpn_preshared_keys) == length(var.cloudflare_anycast_ips) * 2 && alltrue([
      for key in var.vpn_preshared_keys : can(regex("^[A-Za-z1-9._][A-Za-z0-9._]{7,63}$", key))
    ])
    error_message = "vpn_preshared_keys must contain two keys per Cloudflare anycast IP; each key must contain 8-64 letters, numbers, periods, or underscores and cannot begin with 0."
  }

  validation {
    # The AWS provider identifies tunnel1_address by matching the tunnel 1 PSK.
    # Identical PSKs disable that match and can swap the AWS public IPv4
    # addresses assigned to the Cloudflare WAN tunnels.
    condition     = length(distinct(var.vpn_preshared_keys)) == length(var.vpn_preshared_keys)
    error_message = "vpn_preshared_keys must be unique for every tunnel."
  }
}

variable "cloudflare_anycast_ips" {
  description = "One or two Cloudflare anycast IPs leased to cloudflare_account_id."
  type        = list(string)
  default     = ["162.159.135.1"]

  validation {
    # Each anycast IP backs one AWS VPN connection containing two tunnels.
    condition = length(var.cloudflare_anycast_ips) >= 1 && length(var.cloudflare_anycast_ips) <= 2 && length(distinct(var.cloudflare_anycast_ips)) == length(var.cloudflare_anycast_ips) && alltrue([
      for address in var.cloudflare_anycast_ips : try(
        can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}$", address)) &&
        cidrhost("${address}/32", 0) == address,
        false
      )
    ])
    error_message = "cloudflare_anycast_ips must contain one or two distinct IPv4 addresses."
  }
}

variable "aws_transit_gateway_asn" {
  description = "Private ASN used by the AWS Transit Gateway."
  type        = number
  default     = 65020

  validation {
    condition     = floor(var.aws_transit_gateway_asn) == var.aws_transit_gateway_asn && ((var.aws_transit_gateway_asn >= 64512 && var.aws_transit_gateway_asn <= 65534) || (var.aws_transit_gateway_asn >= 4200000000 && var.aws_transit_gateway_asn <= 4294967294))
    error_message = "aws_transit_gateway_asn must be an AWS-supported private ASN."
  }
}

variable "cloudflare_asn" {
  description = "CF Account ASN configured in Cloudflare WAN and used by every AWS customer gateway."
  type        = number
  default     = 13335

  validation {
    # Cloudflare defaults to 13335 and permits a private 2-byte ASN instead.
    condition     = floor(var.cloudflare_asn) == var.cloudflare_asn && (var.cloudflare_asn == 13335 || (var.cloudflare_asn >= 64512 && var.cloudflare_asn <= 65534))
    error_message = "cloudflare_asn must match the CF Account ASN: 13335 or a private ASN from 64512 through 65534."
  }

  validation {
    # The CF Account ASN must differ from the customer device ASN on each tunnel.
    condition     = var.cloudflare_asn != var.aws_transit_gateway_asn
    error_message = "cloudflare_asn must differ from aws_transit_gateway_asn."
  }
}

variable "cloudflare_additional_advertised_prefixes" {
  description = "Additional prefixes for Cloudflare to advertise to AWS on every BGP session. Eligible Cloudflare WAN routes are advertised without listing them here."
  type        = list(string)
  default     = []

  validation {
    condition = length(distinct(var.cloudflare_additional_advertised_prefixes)) == length(var.cloudflare_additional_advertised_prefixes) && alltrue([
      for cidr in var.cloudflare_additional_advertised_prefixes : try(
        can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$", cidr)) &&
        cidrhost(cidr, 0) == split("/", cidr)[0],
        false
      )
    ])
    error_message = "cloudflare_additional_advertised_prefixes must contain unique IPv4 network CIDRs."
  }
}

variable "cloudflare_tunnel_names" {
  description = "Optional Cloudflare WAN tunnel names in tunnel order, two per Cloudflare anycast IP. Leave empty to use <deployment_name>-tun-01, -02, and so on."
  type        = list(string)
  default     = []

  validation {
    # Cloudflare rejects a tunnel whose name matches any other tunnel in the account.
    condition = length(var.cloudflare_tunnel_names) == 0 || (
      length(var.cloudflare_tunnel_names) == length(var.cloudflare_anycast_ips) * 2 &&
      length(distinct(var.cloudflare_tunnel_names)) == length(var.cloudflare_tunnel_names) &&
      alltrue([for name in var.cloudflare_tunnel_names : can(regex("^[A-Za-z0-9_-]+$", name))])
    )
    error_message = "cloudflare_tunnel_names must be empty or contain two unique names per Cloudflare anycast IP, using only letters, numbers, hyphens, and underscores."
  }
}

data "aws_availability_zones" "available" {
  state = "available"
}

locals {
  # Resources require two AZs; try() keeps expression evaluation safe until the
  # VPC precondition can return a clear error in a single-AZ Region.
  availability_zone_a = data.aws_availability_zones.available.names[0]
  availability_zone_b = try(data.aws_availability_zones.available.names[1], data.aws_availability_zones.available.names[0])
  subnet_cidrs        = [var.workload_subnet_cidr, var.tgw_subnet_a_cidr, var.tgw_subnet_b_cidr]
  subnet_pairs        = [[0, 1], [0, 2], [1, 2]]

  # Each anycast IP creates one AWS customer gateway and one two-tunnel VPN.
  customer_gateways = {
    for index, anycast_ip in var.cloudflare_anycast_ips : format("%02d", index + 1) => {
      cloudflare_anycast_ip = anycast_ip
      tunnel1_index         = index * 2
      tunnel2_index         = index * 2 + 1
    }
  }
}

resource "aws_vpc" "workload" {
  cidr_block           = var.vpc_cidr
  instance_tenancy     = "default"
  enable_dns_support   = true
  enable_dns_hostnames = false

  tags = {
    Name = "${var.deployment_name}-vpc"
  }

  lifecycle {
    precondition {
      condition     = length(data.aws_availability_zones.available.names) >= 2
      error_message = "The selected AWS Region must have at least two available Availability Zones."
    }

    precondition {
      # Check both ends of each subnet against the VPC to prevent partial overlap.
      condition = alltrue([
        for cidr in local.subnet_cidrs : try(
          cidrhost(cidr, 0) == split("/", cidr)[0] &&
          tonumber(split("/", cidr)[1]) >= tonumber(split("/", var.vpc_cidr)[1]) &&
          cidrhost("${cidrhost(cidr, 0)}/${split("/", var.vpc_cidr)[1]}", 0) == cidrhost(var.vpc_cidr, 0) &&
          cidrhost("${cidrhost(cidr, -1)}/${split("/", var.vpc_cidr)[1]}", 0) == cidrhost(var.vpc_cidr, 0),
          false
        )
      ])
      error_message = "Each subnet CIDR must be a valid network contained within vpc_cidr."
    }

    precondition {
      # Evaluate every pair so no workload or attachment subnet can overlap.
      condition = try(alltrue([
        for pair in local.subnet_pairs :
        cidrhost("${cidrhost(local.subnet_cidrs[pair[1]], 0)}/${split("/", local.subnet_cidrs[pair[0]])[1]}", 0) != cidrhost(local.subnet_cidrs[pair[0]], 0) &&
        cidrhost("${cidrhost(local.subnet_cidrs[pair[0]], 0)}/${split("/", local.subnet_cidrs[pair[1]])[1]}", 0) != cidrhost(local.subnet_cidrs[pair[1]], 0)
      ]), false)
      error_message = "The workload and Transit Gateway subnet CIDRs must not overlap."
    }
  }
}

resource "aws_subnet" "workload" {
  vpc_id                  = aws_vpc.workload.id
  cidr_block              = var.workload_subnet_cidr
  availability_zone       = local.availability_zone_a
  map_public_ip_on_launch = true

  tags = {
    Name = "${var.deployment_name}-workload"
  }
}

# The workload subnet uses direct Internet Gateway egress for destinations that
# do not match a more-specific VPN route. Workloads still need a public IPv4
# address and security controls; this reference deployment does not create workloads.
resource "aws_internet_gateway" "workload" {
  vpc_id = aws_vpc.workload.id

  tags = {
    Name = "${var.deployment_name}-igw"
  }
}

resource "aws_subnet" "tgw_a" {
  vpc_id            = aws_vpc.workload.id
  cidr_block        = var.tgw_subnet_a_cidr
  availability_zone = local.availability_zone_a

  tags = {
    Name = "${var.deployment_name}-tgw-${local.availability_zone_a}"
  }
}

resource "aws_subnet" "tgw_b" {
  vpc_id            = aws_vpc.workload.id
  cidr_block        = var.tgw_subnet_b_cidr
  availability_zone = local.availability_zone_b

  tags = {
    Name = "${var.deployment_name}-tgw-${local.availability_zone_b}"
  }
}

resource "aws_route_table" "workload" {
  vpc_id = aws_vpc.workload.id

  tags = {
    Name = "${var.deployment_name}-workload-rt"
  }
}

resource "aws_route_table_association" "workload" {
  subnet_id      = aws_subnet.workload.id
  route_table_id = aws_route_table.workload.id
}

resource "aws_ec2_transit_gateway" "cloudflare" {
  amazon_side_asn                = var.aws_transit_gateway_asn
  auto_accept_shared_attachments = "disable"
  # Explicit associations and propagations below avoid implicit routing changes.
  default_route_table_association    = "disable"
  default_route_table_propagation    = "disable"
  dns_support                        = "enable"
  multicast_support                  = "disable"
  security_group_referencing_support = "disable"
  vpn_ecmp_support                   = "enable"

  tags = {
    Name = "${var.deployment_name}-tgw"
  }
}

resource "aws_ec2_transit_gateway_route_table" "cloudflare" {
  transit_gateway_id = aws_ec2_transit_gateway.cloudflare.id

  tags = {
    Name = "${var.deployment_name}-tgw-rt"
  }
}

resource "aws_ec2_transit_gateway_vpc_attachment" "workload" {
  subnet_ids                                      = [aws_subnet.tgw_a.id, aws_subnet.tgw_b.id]
  transit_gateway_id                              = aws_ec2_transit_gateway.cloudflare.id
  vpc_id                                          = aws_vpc.workload.id
  appliance_mode_support                          = "disable"
  dns_support                                     = "enable"
  ipv6_support                                    = "disable"
  security_group_referencing_support              = "disable"
  transit_gateway_default_route_table_association = false
  transit_gateway_default_route_table_propagation = false

  tags = {
    Name = "${var.deployment_name}-vpc-attachment"
  }
}

resource "aws_ec2_transit_gateway_route_table_association" "workload" {
  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.workload.id
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.cloudflare.id
}

resource "aws_ec2_transit_gateway_route_table_propagation" "workload" {
  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.workload.id
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.cloudflare.id
}

# Route only approved destination prefixes through the Transit Gateway. AWS
# longest-prefix matching gives these routes precedence over the Internet default.
resource "aws_route" "cloudflare" {
  for_each = toset(var.vpn_routed_prefixes)

  route_table_id         = aws_route_table.workload.id
  destination_cidr_block = each.value
  transit_gateway_id     = aws_ec2_transit_gateway.cloudflare.id

  depends_on = [aws_ec2_transit_gateway_vpc_attachment.workload]
}

# All destinations not selected above use direct Internet Gateway egress.
resource "aws_route" "internet" {
  route_table_id         = aws_route_table.workload.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.workload.id
}

resource "aws_customer_gateway" "cloudflare" {
  for_each = local.customer_gateways

  bgp_asn    = var.cloudflare_asn
  ip_address = each.value.cloudflare_anycast_ip
  type       = "ipsec.1"
  # AWS returns an existing customer gateway for an identical type, IP address,
  # and ASN unless the device name differs, so this name keeps the gateway unique.
  device_name = "${var.deployment_name}-cgw-${each.key}"

  tags = {
    Name = "${var.deployment_name}-cgw-${each.key}"
  }

  lifecycle {
    # AWS cannot delete an in-use customer gateway, so establish its replacement first.
    create_before_destroy = true
  }
}

resource "aws_vpn_connection" "cloudflare" {
  for_each = local.customer_gateways

  customer_gateway_id   = aws_customer_gateway.cloudflare[each.key].id
  transit_gateway_id    = aws_ec2_transit_gateway.cloudflare.id
  type                  = "ipsec.1"
  static_routes_only    = false
  preshared_key_storage = "Standard"

  local_ipv4_network_cidr  = "0.0.0.0/0"
  remote_ipv4_network_cidr = "0.0.0.0/0"
  outside_ip_address_type  = "PublicIpv4"
  tunnel_bandwidth         = "standard"
  tunnel_inside_ip_version = "ipv4"

  # Each VPN consumes the two tunnel inputs assigned to its anycast IP.
  tunnel1_inside_cidr                  = var.tunnel_inside_cidrs[each.value.tunnel1_index]
  tunnel1_preshared_key                = var.vpn_preshared_keys[each.value.tunnel1_index]
  tunnel1_replay_window_size           = 2048
  tunnel1_dpd_timeout_action           = "restart"
  tunnel1_phase1_encryption_algorithms = ["AES256"]
  tunnel1_phase2_encryption_algorithms = ["AES256"]
  tunnel1_phase1_integrity_algorithms  = ["SHA2-256"]
  tunnel1_phase2_integrity_algorithms  = ["SHA2-256"]
  tunnel1_phase1_dh_group_numbers      = [20]
  tunnel1_phase2_dh_group_numbers      = [20]
  tunnel1_phase1_lifetime_seconds      = 28800
  tunnel1_phase2_lifetime_seconds      = 3600
  tunnel1_ike_versions                 = ["ikev2"]
  tunnel1_startup_action               = "start"

  tunnel2_inside_cidr                  = var.tunnel_inside_cidrs[each.value.tunnel2_index]
  tunnel2_preshared_key                = var.vpn_preshared_keys[each.value.tunnel2_index]
  tunnel2_replay_window_size           = 2048
  tunnel2_dpd_timeout_action           = "restart"
  tunnel2_phase1_encryption_algorithms = ["AES256"]
  tunnel2_phase2_encryption_algorithms = ["AES256"]
  tunnel2_phase1_integrity_algorithms  = ["SHA2-256"]
  tunnel2_phase2_integrity_algorithms  = ["SHA2-256"]
  tunnel2_phase1_dh_group_numbers      = [20]
  tunnel2_phase2_dh_group_numbers      = [20]
  tunnel2_phase1_lifetime_seconds      = 28800
  tunnel2_phase2_lifetime_seconds      = 3600
  tunnel2_ike_versions                 = ["ikev2"]
  tunnel2_startup_action               = "start"

  tags = {
    Name = "${var.deployment_name}-vpn-${each.key}"
  }
}

resource "aws_ec2_transit_gateway_route_table_association" "vpn" {
  for_each = aws_vpn_connection.cloudflare

  transit_gateway_attachment_id  = each.value.transit_gateway_attachment_id
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.cloudflare.id
}

resource "aws_ec2_transit_gateway_route_table_propagation" "vpn" {
  for_each = aws_vpn_connection.cloudflare

  transit_gateway_attachment_id  = each.value.transit_gateway_attachment_id
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.cloudflare.id
}

locals {
  # Cloudflare tunnel names must be unique within the account. Use the supplied names, or
  # prefix generated names with deployment_name. Periods are replaced because tunnel names
  # avoid special characters.
  cloudflare_tunnel_name_prefix = replace(var.deployment_name, ".", "-")

  # Expand each anycast IP and AWS VPN connection into two Cloudflare WAN tunnel objects. Tunnel keys
  # remain globally ordered as 01-02 for anycast IP 1 and 03-04 for anycast IP 2.
  cloudflare_tunnels = merge([
    for vpn_key, vpn in local.customer_gateways : {
      (format("%02d", vpn.tunnel1_index + 1)) = {
        name                  = length(var.cloudflare_tunnel_names) > 0 ? var.cloudflare_tunnel_names[vpn.tunnel1_index] : "${local.cloudflare_tunnel_name_prefix}-tun-${format("%02d", vpn.tunnel1_index + 1)}"
        vpn_connection_key    = vpn_key
        cloudflare_anycast_ip = vpn.cloudflare_anycast_ip
        customer_endpoint     = aws_vpn_connection.cloudflare[vpn_key].tunnel1_address
        aws_bgp_holdtime      = aws_vpn_connection.cloudflare[vpn_key].tunnel1_bgp_holdtime
        inside_cidr           = var.tunnel_inside_cidrs[vpn.tunnel1_index]
        psk                   = var.vpn_preshared_keys[vpn.tunnel1_index]
      }
      (format("%02d", vpn.tunnel2_index + 1)) = {
        name                  = length(var.cloudflare_tunnel_names) > 0 ? var.cloudflare_tunnel_names[vpn.tunnel2_index] : "${local.cloudflare_tunnel_name_prefix}-tun-${format("%02d", vpn.tunnel2_index + 1)}"
        vpn_connection_key    = vpn_key
        cloudflare_anycast_ip = vpn.cloudflare_anycast_ip
        customer_endpoint     = aws_vpn_connection.cloudflare[vpn_key].tunnel2_address
        aws_bgp_holdtime      = aws_vpn_connection.cloudflare[vpn_key].tunnel2_bgp_holdtime
        inside_cidr           = var.tunnel_inside_cidrs[vpn.tunnel2_index]
        psk                   = var.vpn_preshared_keys[vpn.tunnel2_index]
      }
    }
  ]...)
}

resource "cloudflare_magic_wan_ipsec_tunnel" "aws" {
  for_each = local.cloudflare_tunnels

  account_id          = var.cloudflare_account_id
  name                = each.value.name
  description         = "AWS Transit Gateway tunnel ${each.key} managed by Terraform"
  customer_endpoint   = each.value.customer_endpoint
  cloudflare_endpoint = each.value.cloudflare_anycast_ip
  # AWS uses host 1 and Cloudflare uses host 2 in each /30 inside network.
  interface_address = "${cidrhost(each.value.inside_cidr, 2)}/30"
  # The provider writes this secret to Terraform state; protect the backend.
  psk               = each.value.psk
  replay_protection = true
  # BGP and the Cloudflare routing table, not automatic return routing, select paths.
  automatic_return_routing = false

  # Leave target unset so bidirectional checks use the default target: the AWS
  # inside address in the same /30.
  health_check = {
    enabled   = true
    rate      = "mid"
    type      = "request"
    direction = "bidirectional"
  }

  bgp = {
    customer_asn   = var.aws_transit_gateway_asn
    extra_prefixes = var.cloudflare_additional_advertised_prefixes
  }
}

output "resource_ids" {
  description = "AWS resource IDs used to verify the deployment."
  value = {
    vpc_id                      = aws_vpc.workload.id
    workload_subnet_id          = aws_subnet.workload.id
    internet_gateway_id         = aws_internet_gateway.workload.id
    transit_gateway_id          = aws_ec2_transit_gateway.cloudflare.id
    transit_gateway_route_table = aws_ec2_transit_gateway_route_table.cloudflare.id
    vpc_attachment_id           = aws_ec2_transit_gateway_vpc_attachment.workload.id
    vpn_connection_ids          = { for key, vpn in aws_vpn_connection.cloudflare : key => vpn.id }
    vpn_attachment_ids          = { for key, vpn in aws_vpn_connection.cloudflare : key => vpn.transit_gateway_attachment_id }
    cloudflare_tunnel_ids       = { for key, tunnel in cloudflare_magic_wan_ipsec_tunnel.aws : key => tunnel.id }
  }
}

output "workload_egress_routes" {
  description = "Workload route-table destinations split between the VPN and Internet Gateway paths."
  value = {
    vpn              = sort(var.vpn_routed_prefixes)
    internet_default = aws_route.internet.destination_cidr_block
  }
}

output "bgp_asns" {
  description = "BGP ASNs used to configure Cloudflare WAN."
  value = {
    aws_transit_gateway = var.aws_transit_gateway_asn
    cloudflare          = var.cloudflare_asn
  }
}

output "cloudflare_tunnel_mapping" {
  description = "AWS and Cloudflare values for the two or four Terraform-managed tunnels."
  # Keep this list in tunnel-number order for direct operational correlation.
  value = [
    for key in sort(keys(local.cloudflare_tunnels)) : {
      tunnel                       = cloudflare_magic_wan_ipsec_tunnel.aws[key].name
      vpn_connection_id            = aws_vpn_connection.cloudflare[local.cloudflare_tunnels[key].vpn_connection_key].id
      aws_outside_ip               = local.cloudflare_tunnels[key].customer_endpoint
      cloudflare_anycast_ip        = local.cloudflare_tunnels[key].cloudflare_anycast_ip
      inside_cidr                  = local.cloudflare_tunnels[key].inside_cidr
      aws_inside_ip                = cidrhost(local.cloudflare_tunnels[key].inside_cidr, 1)
      cloudflare_interface_address = "${cidrhost(local.cloudflare_tunnels[key].inside_cidr, 2)}/30"
      # AWS sets this value; Cloudflare negotiates the lower of it and 240 seconds.
      aws_bgp_holdtime     = local.cloudflare_tunnels[key].aws_bgp_holdtime
      cloudflare_tunnel_id = cloudflare_magic_wan_ipsec_tunnel.aws[key].id
    }
  ]
}

output "cloudflare_bgp_status" {
  description = "Cloudflare BGP status refreshed during the most recent Terraform operation."
  # Provider status is a state snapshot, not continuous monitoring telemetry.
  value = {
    for key, tunnel in cloudflare_magic_wan_ipsec_tunnel.aws : key => tunnel.bgp_status
  }
}

output "vpn_telemetry" {
  description = "AWS tunnel telemetry refreshed during the most recent Terraform operation."
  # Refresh state before relying on these provider-reported values.
  value = {
    for key, vpn in aws_vpn_connection.cloudflare : key => vpn.vgw_telemetry
  }
}

expected_account_id   = "REPLACE_WITH_AWS_ACCOUNT_ID"
cloudflare_account_id = "REPLACE_WITH_CLOUDFLARE_ACCOUNT_ID"
deployment_name       = "cloudflare-wan-reference"
aws_region            = "us-east-2"

# These three subnets must be canonical, non-overlapping networks inside the VPC.
vpc_cidr             = "192.168.0.0/16"
workload_subnet_cidr = "192.168.125.0/24"
tgw_subnet_a_cidr    = "192.168.124.0/28"
tgw_subnet_b_cidr    = "192.168.124.16/28"

# Only these destinations use the Site-to-Site VPNs. All other IPv4 traffic
# uses the Internet Gateway default route.
vpn_routed_prefixes = [
  "172.16.0.0/16",
]

# Accounts using one anycast IP have two tunnels.
tunnel_inside_cidrs = [
  "169.254.240.44/30",
  "169.254.240.48/30",
]

# PSKs are sensitive and persist in Terraform state; never commit terraform.tfvars.
vpn_preshared_keys = [
  "REPLACE_WITH_UNIQUE_TUNNEL_01_PSK",
  "REPLACE_WITH_UNIQUE_TUNNEL_02_PSK",
]

# One anycast IP is the baseline and backs tunnels 01-02.
cloudflare_anycast_ips  = ["162.159.135.1"]
aws_transit_gateway_asn = 65020
# Set to the CF Account ASN shown under Networking > Routes > WAN configuration.
cloudflare_asn                            = 13335
cloudflare_additional_advertised_prefixes = []

# Optional. Cloudflare tunnel names must be unique in the Cloudflare account.
# Leave empty to use <deployment_name>-tun-01, -02, and so on, or list two names
# per anycast IP in tunnel order, for example:
# cloudflare_tunnel_names = ["aws-tun-01", "aws-tun-02"]
cloudflare_tunnel_names = []

expected_account_id   = "REPLACE_WITH_AWS_ACCOUNT_ID"
cloudflare_account_id = "REPLACE_WITH_CLOUDFLARE_ACCOUNT_ID"
deployment_name       = "cloudflare-wan-reference"
aws_region            = "us-east-2"

# These three subnets must be canonical, non-overlapping networks inside the VPC.
vpc_cidr             = "192.168.0.0/16"
workload_subnet_cidr = "192.168.125.0/24"
tgw_subnet_a_cidr    = "192.168.124.0/28"
tgw_subnet_b_cidr    = "192.168.124.16/28"

# Only these destinations use the Site-to-Site VPNs. All other IPv4 traffic
# uses the Internet Gateway default route.
vpn_routed_prefixes = [
  "172.16.0.0/16",
]

# Accounts using two anycast IPs have four tunnels. Entries 1-2 belong to
# anycast IP 1 and entries 3-4 belong to anycast IP 2.
tunnel_inside_cidrs = [
  "169.254.240.44/30",
  "169.254.240.48/30",
  "169.254.240.52/30",
  "169.254.240.56/30",
]

# PSKs are sensitive and persist in Terraform state; never commit terraform.tfvars.
vpn_preshared_keys = [
  "REPLACE_WITH_UNIQUE_TUNNEL_01_PSK",
  "REPLACE_WITH_UNIQUE_TUNNEL_02_PSK",
  "REPLACE_WITH_UNIQUE_TUNNEL_03_PSK",
  "REPLACE_WITH_UNIQUE_TUNNEL_04_PSK",
]

# List order is resource identity. Anycast IP 1 backs tunnels 01-02 and VPN
# connection 01; anycast IP 2 backs tunnels 03-04 and VPN connection 02.
cloudflare_anycast_ips  = ["162.159.135.1", "172.64.135.1"]
aws_transit_gateway_asn = 65020
# Set to the CF Account ASN shown under Networking > Routes > WAN configuration.
cloudflare_asn                            = 13335
cloudflare_additional_advertised_prefixes = []

# Optional. Cloudflare tunnel names must be unique in the Cloudflare account.
# Leave empty to use <deployment_name>-tun-01, -02, and so on, or list two names
# per anycast IP in tunnel order, for example:
# cloudflare_tunnel_names = ["aws-tun-01", "aws-tun-02", "aws-tun-03", "aws-tun-04"]
cloudflare_tunnel_names = []

# Mock providers let plan assertions run without credentials or live API calls.
mock_provider "aws" {}
mock_provider "cloudflare" {}

# terraform test also loads terraform.tfvars from the module directory. Set every
# input here so a deployment's terraform.tfvars cannot change the test baseline.
variables {
  expected_account_id   = "123456789012"
  cloudflare_account_id = "0123456789abcdef0123456789abcdef"
  aws_region            = "us-east-2"
  deployment_name       = "cloudflare-wan-reference"
  vpc_cidr              = "192.168.0.0/16"
  workload_subnet_cidr  = "192.168.125.0/24"
  tgw_subnet_a_cidr     = "192.168.124.0/28"
  tgw_subnet_b_cidr     = "192.168.124.16/28"
  # Exercise multiple selective routes instead of relying on the empty default.
  vpn_routed_prefixes    = ["172.16.0.0/16", "172.17.0.0/16"]
  cloudflare_anycast_ips = ["162.159.135.1"]
  tunnel_inside_cidrs = [
    "169.254.240.44/30",
    "169.254.240.48/30",
  ]
  vpn_preshared_keys = [
    "A0123456789abcdef0123456789abcdef0123456789abcdef",
    "B0123456789abcdef0123456789abcdef0123456789abcdef",
  ]
  aws_transit_gateway_asn                   = 65020
  cloudflare_asn                            = 13335
  cloudflare_additional_advertised_prefixes = []
  cloudflare_tunnel_names                   = []
}

# Supply deterministic AZs so the two-AZ safety precondition can be tested offline.
override_data {
  target = data.aws_availability_zones.available
  values = {
    names = ["us-east-2a", "us-east-2b"]
  }
}

# AWS normally computes public IPv4 addresses during apply. Fixed plan-time values make the
# default AWS VPN connection's two Cloudflare WAN-to-AWS tunnel mappings testable offline.
override_resource {
  target          = aws_vpn_connection.cloudflare["01"]
  override_during = plan
  values = {
    tunnel1_address = "198.51.100.1"
    tunnel2_address = "198.51.100.2"
  }
}

# Make route targets known during plan so assertions can verify exact wiring.
override_resource {
  target          = aws_route_table.workload
  override_during = plan
  values = {
    id = "rtb-0123456789abcdef0"
  }
}

override_resource {
  target          = aws_internet_gateway.workload
  override_during = plan
  values = {
    id = "igw-0123456789abcdef0"
  }
}

override_resource {
  target          = aws_ec2_transit_gateway.cloudflare
  override_during = plan
  values = {
    id = "tgw-0123456789abcdef0"
  }
}

# This default positive case protects one anycast IP, one VPN, and two tunnels.
run "valid_reference_configuration" {
  command = plan

  assert {
    condition = (
      length(var.cloudflare_anycast_ips) == 1 &&
      length(var.tunnel_inside_cidrs) == 2 &&
      length(nonsensitive(var.vpn_preshared_keys)) == 2 &&
      length(aws_customer_gateway.cloudflare) == 1 &&
      length(aws_vpn_connection.cloudflare) == 1 &&
      length(cloudflare_magic_wan_ipsec_tunnel.aws) == 2
    )
    error_message = "The default configuration must create one customer gateway, one VPN, and two tunnels from two CIDRs and two PSKs."
  }

  assert {
    condition     = aws_ec2_transit_gateway.cloudflare.amazon_side_asn == var.aws_transit_gateway_asn
    error_message = "The Transit Gateway ASN does not match aws_transit_gateway_asn."
  }

  assert {
    condition     = cloudflare_magic_wan_ipsec_tunnel.aws["01"].name == "cloudflare-wan-reference-tun-01" && cloudflare_magic_wan_ipsec_tunnel.aws["02"].name == "cloudflare-wan-reference-tun-02"
    error_message = "Cloudflare tunnel names must be prefixed with deployment_name."
  }

  assert {
    condition     = cloudflare_magic_wan_ipsec_tunnel.aws["01"].interface_address == "${cidrhost(var.tunnel_inside_cidrs[0], 2)}/30" && cloudflare_magic_wan_ipsec_tunnel.aws["02"].interface_address == "${cidrhost(var.tunnel_inside_cidrs[1], 2)}/30"
    error_message = "A Cloudflare interface address does not match its tunnel CIDR."
  }

  assert {
    condition = (
      cloudflare_magic_wan_ipsec_tunnel.aws["01"].customer_endpoint == "198.51.100.1" &&
      cloudflare_magic_wan_ipsec_tunnel.aws["02"].customer_endpoint == "198.51.100.2"
    )
    error_message = "A customer_endpoint value is mapped to the wrong AWS VPN tunnel."
  }

  assert {
    condition = (
      cloudflare_magic_wan_ipsec_tunnel.aws["01"].cloudflare_endpoint == var.cloudflare_anycast_ips[0] &&
      cloudflare_magic_wan_ipsec_tunnel.aws["02"].cloudflare_endpoint == var.cloudflare_anycast_ips[0]
    )
    error_message = "A Cloudflare anycast IP is mapped to the wrong tunnel."
  }

  assert {
    condition     = cloudflare_magic_wan_ipsec_tunnel.aws["01"].replay_protection == true && cloudflare_magic_wan_ipsec_tunnel.aws["01"].automatic_return_routing == false && cloudflare_magic_wan_ipsec_tunnel.aws["01"].health_check.type == "request" && cloudflare_magic_wan_ipsec_tunnel.aws["01"].health_check.direction == "bidirectional"
    error_message = "The Cloudflare tunnel liveness or routing settings changed unexpectedly."
  }

  assert {
    condition = alltrue([
      for tunnel in cloudflare_magic_wan_ipsec_tunnel.aws :
      tunnel.health_check.enabled == true && tunnel.health_check.rate == "mid" && tunnel.health_check.type == "request" && tunnel.health_check.direction == "bidirectional"
    ])
    error_message = "Every Cloudflare tunnel must use enabled, medium-rate, request-type, bidirectional health checks."
  }

  assert {
    condition     = cloudflare_magic_wan_ipsec_tunnel.aws["01"].bgp.customer_asn == var.aws_transit_gateway_asn && toset(cloudflare_magic_wan_ipsec_tunnel.aws["01"].bgp.extra_prefixes) == toset(var.cloudflare_additional_advertised_prefixes)
    error_message = "The Cloudflare BGP settings do not match the configured inputs."
  }

  assert {
    condition     = aws_ec2_transit_gateway.cloudflare.default_route_table_association == "disable" && aws_ec2_transit_gateway.cloudflare.default_route_table_propagation == "disable" && aws_ec2_transit_gateway.cloudflare.vpn_ecmp_support == "enable"
    error_message = "The Transit Gateway routing controls changed unexpectedly."
  }

  assert {
    condition     = aws_subnet.workload.map_public_ip_on_launch == true && aws_route.internet.destination_cidr_block == "0.0.0.0/0" && aws_route.internet.gateway_id == "igw-0123456789abcdef0" && aws_route.internet.route_table_id == "rtb-0123456789abcdef0"
    error_message = "The public workload subnet must use the Internet Gateway default route."
  }

  assert {
    condition     = toset([for route in aws_route.cloudflare : route.destination_cidr_block]) == toset(var.vpn_routed_prefixes) && alltrue([for route in aws_route.cloudflare : route.transit_gateway_id == "tgw-0123456789abcdef0" && route.route_table_id == "rtb-0123456789abcdef0"])
    error_message = "The Transit Gateway routes do not match vpn_routed_prefixes."
  }

  assert {
    condition     = aws_customer_gateway.cloudflare["01"].ip_address == var.cloudflare_anycast_ips[0] && tostring(aws_customer_gateway.cloudflare["01"].bgp_asn) == tostring(var.cloudflare_asn)
    error_message = "The AWS customer gateway settings do not match the Cloudflare inputs."
  }

  assert {
    condition     = aws_vpn_connection.cloudflare["01"].tunnel1_inside_cidr == var.tunnel_inside_cidrs[0] && aws_vpn_connection.cloudflare["01"].tunnel2_inside_cidr == var.tunnel_inside_cidrs[1]
    error_message = "The default VPN has the wrong inside CIDRs."
  }

  assert {
    condition     = aws_vpn_connection.cloudflare["01"].static_routes_only == false && aws_vpn_connection.cloudflare["01"].tunnel1_startup_action == "start" && aws_vpn_connection.cloudflare["01"].tunnel1_dpd_timeout_action == "restart" && aws_vpn_connection.cloudflare["01"].tunnel1_replay_window_size == 2048
    error_message = "The dynamic-routing or tunnel liveness settings changed unexpectedly."
  }

  assert {
    condition     = aws_vpn_connection.cloudflare["01"].tunnel2_phase1_encryption_algorithms == toset(["AES256"]) && aws_vpn_connection.cloudflare["01"].tunnel2_phase2_integrity_algorithms == toset(["SHA2-256"]) && aws_vpn_connection.cloudflare["01"].tunnel2_phase1_dh_group_numbers == toset([20]) && aws_vpn_connection.cloudflare["01"].tunnel2_ike_versions == toset(["ikev2"])
    error_message = "The tunnel cryptographic settings changed unexpectedly."
  }

  assert {
    condition     = aws_vpn_connection.cloudflare["01"].tunnel1_phase1_lifetime_seconds == 28800 && aws_vpn_connection.cloudflare["01"].tunnel1_phase2_lifetime_seconds == 3600
    error_message = "The tunnel lifetimes changed unexpectedly."
  }
}

# Customers with two distinct anycast IPs use two VPNs and four tunnels.
run "valid_two_anycast_ip_configuration" {
  command = plan

  override_resource {
    target          = aws_vpn_connection.cloudflare["02"]
    override_during = plan
    values = {
      tunnel1_address = "198.51.100.3"
      tunnel2_address = "198.51.100.4"
    }
  }

  variables {
    cloudflare_anycast_ips = ["162.159.135.1", "162.159.135.2"]
    tunnel_inside_cidrs = [
      "169.254.240.44/30",
      "169.254.240.48/30",
      "169.254.240.52/30",
      "169.254.240.56/30",
    ]
    vpn_preshared_keys = [
      "A0123456789abcdef0123456789abcdef0123456789abcdef",
      "B0123456789abcdef0123456789abcdef0123456789abcdef",
      "C0123456789abcdef0123456789abcdef0123456789abcdef",
      "D0123456789abcdef0123456789abcdef0123456789abcdef",
    ]
  }

  assert {
    condition     = length(aws_customer_gateway.cloudflare) == 2 && length(aws_vpn_connection.cloudflare) == 2 && length(cloudflare_magic_wan_ipsec_tunnel.aws) == 4
    error_message = "The two-anycast-IP configuration must create two customer gateways, two AWS Site-to-Site VPN connections, and four Cloudflare WAN tunnels."
  }

  assert {
    condition     = aws_customer_gateway.cloudflare["01"].ip_address == var.cloudflare_anycast_ips[0] && aws_customer_gateway.cloudflare["02"].ip_address == var.cloudflare_anycast_ips[1]
    error_message = "A customer gateway is mapped to the wrong Cloudflare anycast IP."
  }

  assert {
    condition     = aws_customer_gateway.cloudflare["01"].device_name == "${var.deployment_name}-cgw-01" && aws_customer_gateway.cloudflare["02"].device_name == "${var.deployment_name}-cgw-02"
    error_message = "Each customer gateway must use a unique device name derived from deployment_name."
  }

  assert {
    condition     = cloudflare_magic_wan_ipsec_tunnel.aws["03"].cloudflare_endpoint == var.cloudflare_anycast_ips[1] && cloudflare_magic_wan_ipsec_tunnel.aws["04"].cloudflare_endpoint == var.cloudflare_anycast_ips[1]
    error_message = "Anycast IP 2 must map to Cloudflare tunnels 03 and 04."
  }

  assert {
    condition     = cloudflare_magic_wan_ipsec_tunnel.aws["03"].customer_endpoint == "198.51.100.3" && cloudflare_magic_wan_ipsec_tunnel.aws["04"].customer_endpoint == "198.51.100.4"
    error_message = "Cloudflare WAN tunnels 03 and 04 must map to AWS VPN 02 tunnels 1 and 2."
  }

  assert {
    condition     = [for key in sort(keys(cloudflare_magic_wan_ipsec_tunnel.aws)) : cloudflare_magic_wan_ipsec_tunnel.aws[key].name] == ["cloudflare-wan-reference-tun-01", "cloudflare-wan-reference-tun-02", "cloudflare-wan-reference-tun-03", "cloudflare-wan-reference-tun-04"]
    error_message = "All four Cloudflare tunnel names must be unique and prefixed with deployment_name."
  }

  assert {
    condition     = nonsensitive(cloudflare_magic_wan_ipsec_tunnel.aws["03"].psk) == nonsensitive(var.vpn_preshared_keys[2]) && nonsensitive(cloudflare_magic_wan_ipsec_tunnel.aws["04"].psk) == nonsensitive(var.vpn_preshared_keys[3])
    error_message = "Cloudflare tunnels 03 and 04 must use PSKs 3 and 4."
  }

  assert {
    condition     = aws_vpn_connection.cloudflare["02"].tunnel1_inside_cidr == var.tunnel_inside_cidrs[2] && aws_vpn_connection.cloudflare["02"].tunnel2_inside_cidr == var.tunnel_inside_cidrs[3]
    error_message = "VPN 02 must consume tunnel CIDRs at indexes 2 and 3."
  }
}

# The remaining runs verify a private CF Account ASN and confirm that unsafe or ambiguous inputs fail at plan time.
run "reject_non_network_tunnel_cidr" {
  command = plan

  variables {
    tunnel_inside_cidrs = [
      "169.254.240.45/30",
      "169.254.240.48/30",
    ]
  }

  expect_failures = [var.tunnel_inside_cidrs]
}

run "reject_unsupported_vpc_prefix" {
  command = plan

  variables {
    vpc_cidr = "192.168.0.0/15"
  }

  expect_failures = [var.vpc_cidr]
}

run "reject_unsupported_subnet_prefix" {
  command = plan

  variables {
    workload_subnet_cidr = "192.168.125.0/29"
  }

  expect_failures = [var.workload_subnet_cidr]
}

run "reject_overlapping_subnets" {
  command = plan

  variables {
    tgw_subnet_a_cidr = "192.168.125.0/24"
  }

  expect_failures = [aws_vpc.workload]
}

run "reject_duplicate_cloudflare_anycast_ips" {
  command = plan

  variables {
    cloudflare_anycast_ips = ["162.159.135.1", "162.159.135.1"]
    tunnel_inside_cidrs = [
      "169.254.240.44/30",
      "169.254.240.48/30",
      "169.254.240.52/30",
      "169.254.240.56/30",
    ]
    vpn_preshared_keys = [
      "A0123456789abcdef0123456789abcdef0123456789abcdef",
      "B0123456789abcdef0123456789abcdef0123456789abcdef",
      "C0123456789abcdef0123456789abcdef0123456789abcdef",
      "D0123456789abcdef0123456789abcdef0123456789abcdef",
    ]
  }

  expect_failures = [var.cloudflare_anycast_ips]
}

run "accept_private_cloudflare_asn" {
  command = plan

  variables {
    cloudflare_asn = 65000
  }

  assert {
    condition     = tostring(aws_customer_gateway.cloudflare["01"].bgp_asn) == "65000"
    error_message = "The AWS customer gateway must use a configured private CF Account ASN."
  }
}

run "reject_unsupported_cloudflare_asn" {
  command = plan

  variables {
    cloudflare_asn = 64511
  }

  expect_failures = [var.cloudflare_asn]
}

run "reject_cloudflare_asn_matching_tgw_asn" {
  command = plan

  variables {
    cloudflare_asn = 65020
  }

  expect_failures = [var.cloudflare_asn]
}

run "accept_aws_psk_characters" {
  command = plan

  variables {
    vpn_preshared_keys = [
      "Key.01_a",
      "_Key.02_b",
    ]
  }

  assert {
    condition     = nonsensitive(aws_vpn_connection.cloudflare["01"].tunnel1_preshared_key) == "Key.01_a"
    error_message = "An 8-character PSK with a period and underscore must be accepted."
  }
}

run "reject_psk_with_unsupported_character" {
  command = plan

  variables {
    vpn_preshared_keys = [
      "Invalid-psk-1",
      "B0123456789abcdef0123456789abcdef0123456789abcdef",
    ]
  }

  expect_failures = [var.vpn_preshared_keys]
}

run "reject_short_psk" {
  command = plan

  variables {
    vpn_preshared_keys = [
      "Short_7",
      "B0123456789abcdef0123456789abcdef0123456789abcdef",
    ]
  }

  expect_failures = [var.vpn_preshared_keys]
}

run "reject_psk_with_leading_zero" {
  command = plan

  variables {
    vpn_preshared_keys = [
      "0LeadingZeroKey",
      "B0123456789abcdef0123456789abcdef0123456789abcdef",
    ]
  }

  expect_failures = [var.vpn_preshared_keys]
}

run "reject_default_route_as_vpn_prefix" {
  command = plan

  variables {
    vpn_routed_prefixes = ["0.0.0.0/0"]
  }

  expect_failures = [var.vpn_routed_prefixes]
}

run "reject_mismatched_tunnel_input_cardinality" {
  command = plan

  variables {
    tunnel_inside_cidrs = [
      "169.254.240.44/30",
      "169.254.240.48/30",
      "169.254.240.52/30",
    ]
  }

  expect_failures = [var.tunnel_inside_cidrs]
}

run "reject_mismatched_psk_cardinality" {
  command = plan

  variables {
    vpn_preshared_keys = [
      "A0123456789abcdef0123456789abcdef0123456789abcdef",
    ]
  }

  expect_failures = [var.vpn_preshared_keys]
}

run "reject_duplicate_psks" {
  command = plan

  variables {
    vpn_preshared_keys = [
      "A0123456789abcdef0123456789abcdef0123456789abcdef",
      "A0123456789abcdef0123456789abcdef0123456789abcdef",
    ]
  }

  expect_failures = [var.vpn_preshared_keys]
}

run "reject_zero_cloudflare_anycast_ips" {
  command = plan

  variables {
    cloudflare_anycast_ips = []
    tunnel_inside_cidrs    = []
    vpn_preshared_keys     = []
  }

  expect_failures = [var.cloudflare_anycast_ips]
}

run "reject_more_than_two_cloudflare_anycast_ips" {
  command = plan

  variables {
    cloudflare_anycast_ips = ["162.159.135.1", "162.159.135.2", "162.159.135.3"]
    tunnel_inside_cidrs = [
      "169.254.240.44/30",
      "169.254.240.48/30",
      "169.254.240.52/30",
      "169.254.240.56/30",
      "169.254.240.60/30",
      "169.254.240.64/30",
    ]
    vpn_preshared_keys = [
      "A0123456789abcdef0123456789abcdef0123456789abcdef",
      "B0123456789abcdef0123456789abcdef0123456789abcdef",
      "C0123456789abcdef0123456789abcdef0123456789abcdef",
      "D0123456789abcdef0123456789abcdef0123456789abcdef",
      "E0123456789abcdef0123456789abcdef0123456789abcdef",
      "F0123456789abcdef0123456789abcdef0123456789abcdef",
    ]
  }

  expect_failures = [var.cloudflare_anycast_ips]
}

run "reject_vpn_prefix_overlapping_vpc" {
  command = plan

  variables {
    vpn_routed_prefixes = ["192.168.64.0/18"]
  }

  expect_failures = [var.vpn_routed_prefixes]
}

run "accept_custom_tunnel_names" {
  command = plan

  variables {
    cloudflare_tunnel_names = ["aws-usw1-tun-a", "aws-usw1-tun-b"]
  }

  assert {
    condition     = cloudflare_magic_wan_ipsec_tunnel.aws["01"].name == "aws-usw1-tun-a" && cloudflare_magic_wan_ipsec_tunnel.aws["02"].name == "aws-usw1-tun-b"
    error_message = "Supplied tunnel names must be applied in tunnel order."
  }
}

run "reject_duplicate_tunnel_names" {
  command = plan

  variables {
    cloudflare_tunnel_names = ["aws-tun", "aws-tun"]
  }

  expect_failures = [var.cloudflare_tunnel_names]
}

run "reject_mismatched_tunnel_name_count" {
  command = plan

  variables {
    cloudflare_tunnel_names = ["aws-tun-01"]
  }

  expect_failures = [var.cloudflare_tunnel_names]
}