Skip to content

Commit c4ee92c

Browse files
yfodilremyleone
yfodil
and
remyleone
authored
feat(s2s-vpn): add s2s vpn resources (#3505)
* feat(s2s-vpn): add s2s vpn resources * add s2svpn to nightly matrix * fix * lint * fix * Apply suggestion from @remyleone * remove comment * fix doc * go mod tidy * compress cassettes --------- Co-authored-by: Rémy Léone <rleone@scaleway.com> Co-authored-by: Rémy Léone <remy.leone@gmail.com>
1 parent 62b9068 commit c4ee92c

30 files changed

+6663
-2
lines changed

‎.github/workflows/nightly.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ jobs:
4646
- rdb
4747
- redis
4848
- registry
49+
- s2svpn
4950
- sdb
5051
- secret
5152
- tem

‎docs/resources/s2s_vpn_connection.md‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
---
2+
subcategory: "S2S VPN"
3+
page_title: "Scaleway: scaleway_s2s_vpn_connection"
4+
---
5+
6+
# Resource: scaleway_s2s_vpn_connection
7+
8+
Creates and manages Scaleway Site-to-Site VPN Connections.
9+
A connection links a Scaleway VPN Gateway to a Customer Gateway and establishes an IPSec tunnel with BGP routing.
10+
11+
For more information, see [the main documentation](https://www.scaleway.com/en/docs/site-to-site-vpn/reference-content/understanding-s2svpn/).
12+
13+
## Example Usage
14+
15+
### Basic Connection
16+
17+
```terraform
18+
resource "scaleway_vpc" "vpc" {
19+
name = "my-vpc"
20+
}
21+
22+
resource "scaleway_vpc_private_network" "pn" {
23+
name = "my-private-network"
24+
vpc_id = scaleway_vpc.vpc.id
25+
ipv4_subnet {
26+
subnet = "10.0.1.0/24"
27+
}
28+
}
29+
30+
resource "scaleway_s2s_vpn_gateway" "gateway" {
31+
name = "my-vpn-gateway"
32+
gateway_type = "VGW-S"
33+
private_network_id = scaleway_vpc_private_network.pn.id
34+
}
35+
36+
resource "scaleway_s2s_vpn_customer_gateway" "customer_gw" {
37+
name = "my-customer-gateway"
38+
ipv4_public = "203.0.113.1"
39+
asn = 65000
40+
}
41+
42+
resource "scaleway_s2s_vpn_routing_policy" "policy" {
43+
name = "my-routing-policy"
44+
prefix_filter_in = ["10.0.2.0/24"]
45+
prefix_filter_out = ["10.0.1.0/24"]
46+
}
47+
48+
resource "scaleway_s2s_vpn_connection" "main" {
49+
name = "my-vpn-connection"
50+
vpn_gateway_id = scaleway_s2s_vpn_gateway.gateway.id
51+
customer_gateway_id = scaleway_s2s_vpn_customer_gateway.customer_gw.id
52+
initiation_policy = "customer_gateway"
53+
enable_route_propagation = true
54+
55+
bgp_config_ipv4 {
56+
routing_policy_id = scaleway_s2s_vpn_routing_policy.policy.id
57+
private_ip = "169.254.0.1/30"
58+
peer_private_ip = "169.254.0.2/30"
59+
}
60+
61+
ikev2_ciphers {
62+
encryption = "aes256"
63+
integrity = "sha256"
64+
dh_group = "modp2048"
65+
}
66+
67+
esp_ciphers {
68+
encryption = "aes256"
69+
integrity = "sha256"
70+
dh_group = "modp2048"
71+
}
72+
}
73+
```
74+
75+
## Argument Reference
76+
77+
The following arguments are supported:
78+
79+
- `vpn_gateway_id` - (Required) The ID of the VPN gateway to attach to the connection.
80+
- `customer_gateway_id` - (Required) The ID of the customer gateway to attach to the connection.
81+
- `initiation_policy` - (Optional) Defines who initiates the IPSec tunnel.
82+
- `enable_route_propagation` - (Optional) Defines whether route propagation is enabled or not.
83+
- `bgp_config_ipv4` - (Optional) BGP configuration for IPv4. See [BGP Config](#bgp-config) below.
84+
- `bgp_config_ipv6` - (Optional) BGP configuration for IPv6. See [BGP Config](#bgp-config) below.
85+
- `ikev2_ciphers` - (Optional) IKEv2 cipher configuration for Phase 1 (tunnel establishment). See [Cipher Config](#cipher-config) below.
86+
- `esp_ciphers` - (Optional) ESP cipher configuration for Phase 2 (data encryption). See [Cipher Config](#cipher-config) below.
87+
- `name` - (Optional) The name of the connection.
88+
- `tags` - (Optional) The list of tags to apply to the connection.
89+
- `is_ipv6` - (Optional) Defines IP version of the IPSec Tunnel. Defaults to `false` (IPv4).
90+
- `region` - (Defaults to [provider](../index.md#region) `region`) The [region](../guides/regions_and_zones.md#regions) in which the connection should be created.
91+
- `project_id` - (Defaults to [provider](../index.md#project_id) `project_id`) The ID of the project the connection is associated with.
92+
93+
### BGP Config
94+
95+
The `bgp_config_ipv4` and `bgp_config_ipv6` blocks support:
96+
97+
- `routing_policy_id` - (Required) The ID of the routing policy to use for BGP route filtering.
98+
- `private_ip` - (Optional) The BGP peer IP on Scaleway side (within the IPSec tunnel), in CIDR notation (e.g., `169.254.0.1/30`). If not provided, Scaleway will assign it automatically.
99+
- `peer_private_ip` - (Optional) The BGP peer IP on customer side (within the IPSec tunnel), in CIDR notation (e.g., `169.254.0.2/30`). If not provided, Scaleway will assign it automatically.
100+
101+
### Cipher Config
102+
103+
The `ikev2_ciphers` and `esp_ciphers` blocks support:
104+
105+
- `encryption` - (Required) The encryption algorithm.
106+
- `integrity` - (Optional) The integrity/hash algorithm.
107+
- `dh_group` - (Optional) The Diffie-Hellman group.
108+
109+
## Attributes Reference
110+
111+
In addition to all arguments above, the following attributes are exported:
112+
113+
- `id` - The ID of the connection.
114+
- `status` - The status of the connection.
115+
- `tunnel_status` - The status of the IPSec tunnel.
116+
- `bgp_status_ipv4` - The status of the BGP IPv4 session.
117+
- `bgp_status_ipv6` - The status of the BGP IPv6 session.
118+
- `bgp_session_ipv4` - The BGP IPv4 session information. See [BGP Session](#bgp-session) below.
119+
- `bgp_session_ipv6` - The BGP IPv6 session information. See [BGP Session](#bgp-session) below.
120+
- `secret_id` - The ID of the secret containing the pre-shared key (PSK) for the connection.
121+
- `secret_version` - The version of the secret containing the PSK.
122+
- `route_propagation_enabled` - Whether route propagation is enabled.
123+
- `created_at` - The date and time of the creation of the connection (RFC 3339 format).
124+
- `updated_at` - The date and time of the last update of the connection (RFC 3339 format).
125+
- `organization_id` - The Organization ID the connection is associated with.
126+
127+
### BGP Session
128+
129+
The `bgp_session_ipv4` and `bgp_session_ipv6` blocks contain (read-only):
130+
131+
- `routing_policy_id` - The routing policy ID used for this BGP session.
132+
- `private_ip` - The BGP peer IP on Scaleway side (within the tunnel).
133+
- `peer_private_ip` - The BGP peer IP on customer side (within the tunnel).
134+
135+
~> **Important:** Connections' IDs are [regional](../guides/regions_and_zones.md#resource-ids), which means they are of the form `{region}/{id}`, e.g. `fr-par/11111111-1111-1111-1111-111111111111`
136+
137+
~> **Important:** The pre-shared key (PSK) is auto-generated when the connection is created and stored in Scaleway Secret Manager. You can retrieve it using the `scaleway_secret_version` datasource or via the API.
138+
139+
## Retrieving the Pre-Shared Key (PSK)
140+
141+
The PSK is stored in Secret Manager and can be retrieved using:
142+
143+
```terraform
144+
data "scaleway_secret_version" "s2s_psk" {
145+
secret_id = scaleway_s2s_vpn_connection.main.secret_id
146+
revision = tostring(scaleway_s2s_vpn_connection.main.secret_version)
147+
}
148+
149+
# The PSK is available as base64-encoded data
150+
output "psk" {
151+
value = data.scaleway_secret_version.s2s_psk.data
152+
sensitive = true
153+
}
154+
```
155+
156+
## Import
157+
158+
Connections can be imported using `{region}/{id}`, e.g.
159+
160+
```bash
161+
terraform import scaleway_s2s_vpn_connection.main fr-par/11111111-1111-1111-1111-111111111111
162+
```

‎docs/resources/s2s_vpn_customer_gateway.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
subcategory: "S2S VPN"
3+
page_title: "Scaleway: scaleway_s2s_vpn_customer_gateway"
4+
---
5+
6+
# Resource: scaleway_s2s_vpn_customer_gateway
7+
8+
Creates and manages Scaleway Site-to-Site VPN Customer Gateways.
9+
A customer gateway represents your external VPN endpoint (e.g., a firewall, router, or VPN appliance).
10+
11+
For more information, see [the main documentation](https://www.scaleway.com/en/docs/site-to-site-vpn/reference-content/understanding-s2svpn/).
12+
13+
## Example Usage
14+
15+
### Basic
16+
17+
```terraform
18+
resource "scaleway_s2s_vpn_customer_gateway" "customer_gw" {
19+
name = "my-customer-gateway"
20+
ipv4_public = "203.0.113.1"
21+
asn = 65000
22+
}
23+
```
24+
25+
### With IPv6
26+
27+
```terraform
28+
resource "scaleway_s2s_vpn_customer_gateway" "customer_gw" {
29+
name = "my-customer-gateway"
30+
ipv4_public = "203.0.113.1"
31+
ipv6_public = "2001:db8::1"
32+
asn = 65000
33+
}
34+
```
35+
36+
### Using Instance Public IP
37+
38+
```terraform
39+
resource "scaleway_instance_ip" "vpn_endpoint_ip" {}
40+
41+
resource "scaleway_instance_server" "vpn_endpoint" {
42+
name = "vpn-endpoint"
43+
type = "DEV1-S"
44+
image = "ubuntu_jammy"
45+
ip_ids = [scaleway_instance_ip.vpn_endpoint_ip.id]
46+
}
47+
48+
resource "scaleway_s2s_vpn_customer_gateway" "customer_gw" {
49+
name = "my-customer-gateway"
50+
ipv4_public = scaleway_instance_ip.vpn_endpoint_ip.address
51+
asn = 65000
52+
}
53+
```
54+
55+
## Argument Reference
56+
57+
The following arguments are supported:
58+
59+
- `asn` - (Required) The AS Number of the customer gateway. Must be different from Scaleway's ASN (12876). For testing, you can use a private ASN (64512-65535).
60+
- `ipv4_public` - (Optional) The public IPv4 address of the customer gateway (your VPN endpoint).
61+
- `ipv6_public` - (Optional) The public IPv6 address of the customer gateway (your VPN endpoint).
62+
- `name` - (Optional) The name of the customer gateway. If not provided, it will be randomly generated.
63+
- `tags` - (Optional) The list of tags to apply to the customer gateway.
64+
- `region` - (Defaults to [provider](../index.md#region) `region`) The [region](../guides/regions_and_zones.md#regions) in which the customer gateway should be created.
65+
- `project_id` - (Defaults to [provider](../index.md#project_id) `project_id`) The ID of the project the customer gateway is associated with.
66+
67+
## Attributes Reference
68+
69+
In addition to all arguments above, the following attributes are exported:
70+
71+
- `id` - The ID of the customer gateway.
72+
- `created_at` - The date and time of the creation of the customer gateway (RFC 3339 format).
73+
- `updated_at` - The date and time of the last update of the customer gateway (RFC 3339 format).
74+
- `organization_id` - The Organization ID the customer gateway is associated with.
75+
76+
~> **Important:** Customer Gateways' IDs are [regional](../guides/regions_and_zones.md#resource-ids), which means they are of the form `{region}/{id}`, e.g. `fr-par/11111111-1111-1111-1111-111111111111`
77+
78+
## Import
79+
80+
Customer Gateways can be imported using `{region}/{id}`, e.g.
81+
82+
```bash
83+
terraform import scaleway_s2s_vpn_customer_gateway.main fr-par/11111111-1111-1111-1111-111111111111
84+
```

‎docs/resources/s2s_vpn_gateway.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
---
2+
subcategory: "S2S VPN"
3+
page_title: "Scaleway: scaleway_s2s_vpn_gateway"
4+
---
5+
6+
# Resource: scaleway_s2s_vpn_gateway
7+
8+
Creates and manages Scaleway Site-to-Site VPN Gateways.
9+
For more information, see [the main documentation](https://www.scaleway.com/en/docs/site-to-site-vpn/reference-content/understanding-s2svpn/).
10+
11+
## Example Usage
12+
13+
### Basic
14+
15+
```terraform
16+
resource "scaleway_vpc" "vpc" {
17+
name = "my-vpc"
18+
}
19+
20+
resource "scaleway_vpc_private_network" "pn" {
21+
name = "my-private-network"
22+
vpc_id = scaleway_vpc.vpc.id
23+
ipv4_subnet {
24+
subnet = "10.0.1.0/24"
25+
}
26+
}
27+
28+
resource "scaleway_s2s_vpn_gateway" "gateway" {
29+
name = "my-vpn-gateway"
30+
gateway_type = "VGW-S"
31+
private_network_id = scaleway_vpc_private_network.pn.id
32+
}
33+
```
34+
35+
## Argument Reference
36+
37+
The following arguments are supported:
38+
39+
- `gateway_type` - (Required) The VPN gateway type (commercial offer type).
40+
- `private_network_id` - (Required) The ID of the Private Network to attach to the VPN gateway.
41+
- `name` - (Optional) The name of the VPN gateway. If not provided, it will be randomly generated.
42+
- `tags` - (Optional) The list of tags to apply to the VPN gateway.
43+
- `public_config` - (Optional) The public endpoint configuration of the VPN gateway. See [Public Config](#public-config) below.
44+
- `ipam_private_ipv4_id` - (Optional) The ID of the IPAM private IPv4 address to attach to the VPN gateway.
45+
- `ipam_private_ipv6_id` - (Optional) The ID of the IPAM private IPv6 address to attach to the VPN gateway.
46+
- `region` - (Defaults to [provider](../index.md#region) `region`) The [region](../guides/regions_and_zones.md#regions) in which the VPN gateway should be created.
47+
- `zone` - (Defaults to [provider](../index.md#zone) `zone`) The [zone](../guides/regions_and_zones.md#zones) in which the VPN gateway should be created.
48+
- `project_id` - (Defaults to [provider](../index.md#project_id) `project_id`) The ID of the project the VPN gateway is associated with.
49+
50+
### Public Config
51+
52+
The `public_config` block supports:
53+
54+
- `ipam_ipv4_id` - (Optional) The ID of the IPAM IPv4 address to use as the public IP for the VPN gateway.
55+
- `ipam_ipv6_id` - (Optional) The ID of the IPAM IPv6 address to use as the public IP for the VPN gateway.
56+
57+
## Attributes Reference
58+
59+
In addition to all arguments above, the following attributes are exported:
60+
61+
- `id` - The ID of the VPN gateway.
62+
- `asn` - The AS Number of the VPN gateway (typically 12876 for Scaleway).
63+
- `status` - The status of the VPN gateway.
64+
- `public_config` - The public endpoint configuration, including the assigned public IPs.
65+
- `created_at` - The date and time of the creation of the VPN gateway (RFC 3339 format).
66+
- `updated_at` - The date and time of the last update of the VPN gateway (RFC 3339 format).
67+
- `organization_id` - The Organization ID the VPN gateway is associated with.
68+
69+
~> **Important:** VPN Gateways' IDs are [regional](../guides/regions_and_zones.md#resource-ids), which means they are of the form `{region}/{id}`, e.g. `fr-par/11111111-1111-1111-1111-111111111111`
70+
71+
## Import
72+
73+
VPN Gateways can be imported using `{region}/{id}`, e.g.
74+
75+
```bash
76+
terraform import scaleway_s2s_vpn_gateway.main fr-par/11111111-1111-1111-1111-111111111111
77+
```

‎docs/resources/s2s_vpn_routing_policy.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
subcategory: "S2S VPN"
3+
page_title: "Scaleway: scaleway_s2s_vpn_routing_policy"
4+
---
5+
6+
# Resource: scaleway_s2s_vpn_routing_policy
7+
8+
Creates and manages Scaleway Site-to-Site VPN Routing Policies.
9+
A routing policy defines which routes are accepted from and advertised to the peer gateway via BGP.
10+
11+
For more information, see [the main documentation](https://www.scaleway.com/en/docs/site-to-site-vpn/reference-content/understanding-s2svpn/).
12+
13+
## Example Usage
14+
15+
### Basic
16+
17+
```terraform
18+
resource "scaleway_s2s_vpn_routing_policy" "policy" {
19+
name = "my-routing-policy"
20+
prefix_filter_in = ["10.0.2.0/24"]
21+
prefix_filter_out = ["10.0.1.0/24"]
22+
}
23+
```
24+
25+
### Multiple Prefixes
26+
27+
```terraform
28+
resource "scaleway_s2s_vpn_routing_policy" "policy" {
29+
name = "my-routing-policy"
30+
prefix_filter_in = ["10.0.2.0/24", "10.0.3.0/24"]
31+
prefix_filter_out = ["10.0.1.0/24", "172.16.0.0/16"]
32+
}
33+
```
34+
35+
## Argument Reference
36+
37+
The following arguments are supported:
38+
39+
- `prefix_filter_in` - (Optional) List of IP prefixes (in CIDR notation) to accept from the peer gateway. These are the routes that the customer gateway can announce to Scaleway.
40+
- `prefix_filter_out` - (Optional) List of IP prefixes (in CIDR notation) to advertise to the peer gateway. These are the routes that Scaleway will announce to the customer gateway.
41+
- `name` - (Optional) The name of the routing policy. If not provided, it will be randomly generated.
42+
- `tags` - (Optional) The list of tags to apply to the routing policy.
43+
- `is_ipv6` - (Optional) Defines whether the routing policy is for IPv6 prefixes. Defaults to `false` (IPv4).
44+
- `region` - (Defaults to [provider](../index.md#region) `region`) The [region](../guides/regions_and_zones.md#regions) in which the routing policy should be created.
45+
- `project_id` - (Defaults to [provider](../index.md#project_id) `project_id`) The ID of the project the routing policy is associated with.
46+
47+
## Attributes Reference
48+
49+
In addition to all arguments above, the following attributes are exported:
50+
51+
- `id` - The ID of the routing policy.
52+
- `created_at` - The date and time of the creation of the routing policy (RFC 3339 format).
53+
- `updated_at` - The date and time of the last update of the routing policy (RFC 3339 format).
54+
- `organization_id` - The Organization ID the routing policy is associated with.
55+
56+
~> **Important:** Routing Policies' IDs are [regional](../guides/regions_and_zones.md#resource-ids), which means they are of the form `{region}/{id}`, e.g. `fr-par/11111111-1111-1111-1111-111111111111`
57+
58+
## Import
59+
60+
Routing Policies can be imported using `{region}/{id}`, e.g.
61+
62+
```bash
63+
terraform import scaleway_s2s_vpn_routing_policy.main fr-par/11111111-1111-1111-1111-111111111111
64+
```

0 commit comments

Comments
 (0)