From 7623b3c5697c869629eddd4eebc5ab9bf24c1c0d Mon Sep 17 00:00:00 2001
From: test-name <test@email.com>
Date: Thu, 4 Jul 2019 09:40:31 +0300
Subject: [PATCH] Terraform-New-Node-Aws

---
 deploy/terraform-aws/iam.tf                   |  58 ++++++
 deploy/terraform-aws/main.tf                  |  24 +++
 deploy/terraform-aws/output.tf                |   9 +
 deploy/terraform-aws/query.tf                 |  18 ++
 deploy/terraform-aws/rds.tf                   |  39 ++++
 deploy/terraform-aws/resources.tf             | 111 ++++++++++++
 deploy/terraform-aws/s3.tf                    |  49 +++++
 deploy/terraform-aws/securitygroups.tf        | 139 ++++++++++++++
 deploy/terraform-aws/subnets.tf               |  63 +++++++
 deploy/terraform-aws/terraform.tfvars.example |  22 +++
 deploy/terraform-aws/variables.tf             |  84 +++++++++
 deploy/terraform-aws/vpc.tf                   | 169 ++++++++++++++++++
 12 files changed, 785 insertions(+)
 create mode 100644 deploy/terraform-aws/iam.tf
 create mode 100644 deploy/terraform-aws/main.tf
 create mode 100644 deploy/terraform-aws/output.tf
 create mode 100644 deploy/terraform-aws/query.tf
 create mode 100644 deploy/terraform-aws/rds.tf
 create mode 100644 deploy/terraform-aws/resources.tf
 create mode 100644 deploy/terraform-aws/s3.tf
 create mode 100644 deploy/terraform-aws/securitygroups.tf
 create mode 100644 deploy/terraform-aws/subnets.tf
 create mode 100644 deploy/terraform-aws/terraform.tfvars.example
 create mode 100644 deploy/terraform-aws/variables.tf
 create mode 100644 deploy/terraform-aws/vpc.tf

diff --git a/deploy/terraform-aws/iam.tf b/deploy/terraform-aws/iam.tf
new file mode 100644
index 0000000..d8495ea
--- /dev/null
+++ b/deploy/terraform-aws/iam.tf
@@ -0,0 +1,58 @@
+resource "aws_iam_role" "stellar_role" {
+  name = "stellar_assume_role"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+  tags = {
+      tag-key = "Stellar-Assume-Role"
+  }
+}
+
+resource "aws_iam_instance_profile" "stellar_profile" {
+  name = "stellar_profile"
+  role = "${aws_iam_role.stellar_role.name}"
+}
+
+resource "aws_iam_role_policy" "stellar_policy" {
+  name = "stellar_policy"
+  role = "${aws_iam_role.stellar_role.id}"
+  policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "",
+            "Effect": "Allow",
+            "Action": [
+                "s3:PutObject",
+                "s3:DeleteObject"
+            ],
+            "Resource": "arn:aws:s3:::stellar-core-${var.NODENAME}-${var.SUFFIX}/*"
+        },
+        {
+            "Sid": "",
+            "Effect": "Allow",
+            "Action": [
+                "cloudwatch:GetMetricData",
+                "cloudwatch:GetMetricStatistics",
+                "cloudwatch:ListMetrics"
+            ],
+            "Resource": "*"
+        }
+    ]
+ }
+EOF
+}
+
diff --git a/deploy/terraform-aws/main.tf b/deploy/terraform-aws/main.tf
new file mode 100644
index 0000000..1a04947
--- /dev/null
+++ b/deploy/terraform-aws/main.tf
@@ -0,0 +1,24 @@
+###############################
+##   AWS  Connection config ##
+##############################
+
+provider "aws" {
+  region                  = "${var.aws_region}"
+  shared_credentials_file = "~/.aws/credentials"
+  profile                 = "default"
+}
+
+
+
+#terraform {
+#  backend "s3" {
+#    encrypt = true
+    # cannot contain interpolations
+     #bucket = "${aws_s3_bucket.tf_bucket.bucket}"
+    #bucket = "my-terraform-state-s3"
+     #region = "${aws_s3_bucket.tf_bucket.region}"
+#    region = "us-east-2"
+    # dynamodb_table = "example-iac-terraform-state-lock-dynamo"
+#    key = "terraform.tfstate"
+#  }
+#}
diff --git a/deploy/terraform-aws/output.tf b/deploy/terraform-aws/output.tf
new file mode 100644
index 0000000..57205cc
--- /dev/null
+++ b/deploy/terraform-aws/output.tf
@@ -0,0 +1,9 @@
+output "aws_eip_natip" {
+  value = "${aws_eip.nat.public_ip}"
+  description = "The NAT IP address of the Stellar Subnet for Whitelisting"
+}
+
+
+
+
+
diff --git a/deploy/terraform-aws/query.tf b/deploy/terraform-aws/query.tf
new file mode 100644
index 0000000..b850150
--- /dev/null
+++ b/deploy/terraform-aws/query.tf
@@ -0,0 +1,18 @@
+#################################
+# Fetch latest Ubuntu in Region #
+#################################
+
+data "aws_ami" "latest-ubuntu" {
+most_recent = true
+owners = ["099720109477"] # Canonical
+
+  filter {
+      name   = "name"
+      values = ["ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*"]
+  }
+
+  filter {
+      name   = "state"
+      values = ["available"]
+  }
+}
diff --git a/deploy/terraform-aws/rds.tf b/deploy/terraform-aws/rds.tf
new file mode 100644
index 0000000..1dae9fb
--- /dev/null
+++ b/deploy/terraform-aws/rds.tf
@@ -0,0 +1,39 @@
+
+resource "aws_db_subnet_group" "postgres-subnet" {
+  name = "postgres-subnet"
+  description = "RDS subnet group"
+  subnet_ids = ["${aws_subnet.private-subnet.id}","${aws_subnet.private-subnet-b.id}"]
+}
+
+resource "aws_db_parameter_group" "postgres-parameters" {
+name = "postgres-parameters"
+family = "postgres9.6"
+description = "postgres parameter group"
+
+#parameter {
+  #name = "max_allowed_packet"
+  #value = "16777216"
+  #}
+}
+
+resource "aws_db_instance" "postgres" {
+  allocated_storage = 100 # 100 GB of storage, gives us more IOPS than a lower number
+  engine = "postgres"
+  engine_version = "9.6.11"
+  instance_class = "db.m4.xlarge"
+  identifier = "${var.DB_IDENTIFIER}"
+  name = "${var.DB_NAME}"
+  username = "${var.DB_USER}" 
+  password = "${var.DB_PASS}"
+  db_subnet_group_name = "${aws_db_subnet_group.postgres-subnet.name}"
+  parameter_group_name = "${aws_db_parameter_group.postgres-parameters.name}"
+  multi_az = "false" # set to true to have high availability: 2 instances synchronized with each other
+  vpc_security_group_ids = ["${aws_security_group.allow-postgres.id}"]
+  storage_type = "gp2"
+  #backup_retention_period = 30 
+  availability_zone = "${aws_subnet.private-subnet.availability_zone}" # prefered AZ
+
+tags {
+  Name = "postgres-instance"
+  }
+}
diff --git a/deploy/terraform-aws/resources.tf b/deploy/terraform-aws/resources.tf
new file mode 100644
index 0000000..cc9c695
--- /dev/null
+++ b/deploy/terraform-aws/resources.tf
@@ -0,0 +1,111 @@
+
+# Define SSH key pair for our instances
+resource "aws_key_pair" "default" {
+  key_name = "default-key"
+  public_key = "${file("${var.key_path}")}"
+}
+
+##################
+# EC2 Instances ##
+##################
+# Define stellar inside the private subnet
+
+resource "aws_instance" "stellar" {
+   ami = "${data.aws_ami.latest-ubuntu.id}"
+   instance_type = "t3.medium"
+   key_name = "${aws_key_pair.default.id}"
+   subnet_id = "${aws_subnet.private-subnet.id}"
+   vpc_security_group_ids = ["${aws_security_group.stellar-sg.id}"]
+   associate_public_ip_address = false
+   source_dest_check = false
+   iam_instance_profile = "${aws_iam_instance_profile.stellar_profile.name}"
+root_block_device {
+    volume_size = "100"
+    volume_type = "standard"
+  }   
+
+  tags {
+    Name = "Stellar-core"
+  }
+}
+
+# Define database inside the private subnet
+resource "aws_instance" "bastion" {
+   ami = "${data.aws_ami.latest-ubuntu.id}"
+   instance_type = "t2.micro"
+   key_name = "${aws_key_pair.default.id}"
+   subnet_id = "${aws_subnet.dmz-subnet.id}"
+   vpc_security_group_ids = ["${aws_security_group.bastion-sg.id}"]
+   source_dest_check = false
+root_block_device {
+    volume_size = "8"
+    volume_type = "standard"
+  }
+
+  tags {
+    Name = "Bastion-Host"
+  }
+}
+###################################
+
+######################
+# Define Stellar NLB #
+######################
+resource "aws_lb" "stellar-nlb" {
+  name               = "stellar-nlb"
+  internal           = false
+  load_balancer_type = "network"
+  subnets            = ["${aws_subnet.public-subnet.id}"]
+
+  enable_deletion_protection = true
+
+  tags = {
+    Environment = "production"
+  }
+}
+
+resource "aws_lb_listener" "stellar_front_end" {
+  load_balancer_arn = "${aws_lb.stellar-nlb.arn}"
+  port              = "11625"
+  protocol          = "TCP"
+
+  default_action {
+    type             = "forward"
+    target_group_arn = "${aws_lb_target_group.stellar-nlb-tg.arn}"
+  }
+}
+
+
+resource "aws_lb_target_group" "stellar-nlb-tg" {
+  name     = "stellar-nlb-tg"
+  port     = 11625
+  protocol = "TCP"
+  target_type = "instance"
+  vpc_id   = "${aws_vpc.Application-VPC.id}"
+}
+
+resource "aws_lb_target_group_attachment" "attach" {
+  target_group_arn = "${aws_lb_target_group.stellar-nlb-tg.arn}"
+  target_id        = "${aws_instance.stellar.id}"
+  port             = 11625
+}
+
+###################################
+# Define NAT gateway to Private Subnet
+###################################
+
+resource "aws_eip" "nat" {
+  #instance = "${aws_instance.web.id}"
+  vpc      = true
+}
+
+
+resource "aws_nat_gateway" "stellar_nat_gw" {
+  allocation_id = "${aws_eip.nat.id}"
+  subnet_id     = "${aws_subnet.public-subnet.id}"
+
+  tags = {
+    Name = "gw NAT"
+  }
+}
+
diff --git a/deploy/terraform-aws/s3.tf b/deploy/terraform-aws/s3.tf
new file mode 100644
index 0000000..88b034e
--- /dev/null
+++ b/deploy/terraform-aws/s3.tf
@@ -0,0 +1,49 @@
+resource "aws_s3_bucket" "tf_bucket" {
+  bucket = "${var.NODENAME}-${var.SUFFIX}-tf-state"
+  acl    = "private"
+  tags = {
+    Name        = "TF-bucket"
+  }
+}
+
+resource "aws_s3_bucket" "stellar_bucket" {
+  bucket = "stellar-core-${var.NODENAME}-${var.SUFFIX}"
+  acl    = "public-read"
+  policy = <<EOF
+{
+  "Id": "bucket_policy_site",
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "bucket_policy_site_main",
+      "Action": [
+        "s3:GetObject"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:s3:::stellar-core-${var.NODENAME}-${var.SUFFIX}/*",
+      "Principal": "*"
+    }
+  ]
+}
+EOF
+  tags = {
+    Name        = "My-TF-bucket"
+  }
+}
+
+resource "aws_s3_bucket" "cloudtrail" {
+  bucket = "${var.NODENAME}-${var.SUFFIX}-cloudtrail-logs"
+  acl    = "private"
+  tags = {
+    Name        = "Cloudtrail-bucket"
+  }
+}
+
+resource "aws_s3_bucket" "conf_bucket" {
+  bucket = "${var.NODENAME}-${var.SUFFIX}-config-bucket"
+  acl    = "private"
+
+  tags = {
+    Name        = "Config-bucket"
+  }
+}
diff --git a/deploy/terraform-aws/securitygroups.tf b/deploy/terraform-aws/securitygroups.tf
new file mode 100644
index 0000000..72b9e94
--- /dev/null
+++ b/deploy/terraform-aws/securitygroups.tf
@@ -0,0 +1,139 @@
+#################################################################
+# Defines the security group for RDS Database - Application-VPC #
+#################################################################
+
+resource "aws_security_group" "allow-postgres" {
+  vpc_id = "${aws_vpc.Application-VPC.id}"
+  name = "allow-postgres"
+  description = "allow-postgres"
+  ingress {
+    from_port = 5432
+    to_port = 5432
+    protocol = "tcp"
+    security_groups = ["${aws_security_group.stellar-sg.id}"] # allowing access from stellar
+  }
+
+  vpc_id="${aws_vpc.Application-VPC.id}"
+
+  tags {
+    Name = "Postgres-rds-SG"
+  }
+}
+
+###########################################################
+# Define the security group for Stellar - Application-VPC #
+###########################################################
+
+resource "aws_security_group" "stellar-sg" {
+  name = "stellar-sg"
+  description = "Allow incoming HTTP connections & SSH access"
+
+  ingress {
+    from_port = 11625
+    to_port = 11625
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port = -1
+    to_port = -1
+    protocol = "icmp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port = 22
+    to_port = 22
+    protocol = "tcp"
+    #cidr_blocks =  ["0.0.0.0/0"]
+    security_groups = ["${aws_security_group.bastion-sg.id}"]
+  }
+
+  egress {
+    from_port = 443
+    to_port = 443
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Allow Web Access"
+  }
+
+  egress {
+    from_port = 80
+    to_port = 80
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Allow Web Access"
+  }
+
+  egress {
+    from_port = 11371
+    to_port = 11371
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "apt repository key server"
+  }
+
+  egress {
+    from_port = 5432
+    to_port = 5432
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Postgres Out"
+  }
+
+  egress {
+    from_port = 8086
+    to_port = 8086
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Telegraf Metrics"
+  }
+
+  egress {
+    from_port = 11625
+    to_port = 11625
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Stelar Core P2P"
+  }
+
+  egress {
+    from_port = 22
+    to_port = 22
+    protocol = "tcp"
+    #cidr_blocks = ["0.0.0.0/0"]
+    security_groups = ["${aws_security_group.bastion-sg.id}"]
+    description = "ssh connection Bastion"
+  }
+
+
+  vpc_id="${aws_vpc.Application-VPC.id}"
+
+  tags {
+    Name = "Stellar-SG"
+  }
+}
+
+
+###########################################################
+# Define the security group for Bastion   - Managment-VPC #
+###########################################################
+
+resource "aws_security_group" "bastion-sg" {
+  name = "bastion-sg"
+  description = "Allow traffic from public subnet"
+
+  ingress {
+    from_port = 22
+    to_port = 22
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  vpc_id = "${aws_vpc.Managment-VPC.id}"
+
+  tags {
+    Name = "Bastion-SG"
+  }
+}
diff --git a/deploy/terraform-aws/subnets.tf b/deploy/terraform-aws/subnets.tf
new file mode 100644
index 0000000..9de6153
--- /dev/null
+++ b/deploy/terraform-aws/subnets.tf
@@ -0,0 +1,63 @@
+######################
+# Application - VPC  #
+######################
+
+# Define main public subnet
+resource "aws_subnet" "public-subnet" {
+  vpc_id = "${aws_vpc.Application-VPC.id}"
+  cidr_block = "${var.public_subnet_cidr}"
+  availability_zone = "${var.aws_region}a"
+
+  tags {
+    Name = "App Public Subnet-1"
+  }
+}
+
+
+# Define second public subnet
+resource "aws_subnet" "public-subnet-b" {
+  vpc_id = "${aws_vpc.Application-VPC.id}"
+  cidr_block = "${var.public_b_subnet_cidr}"
+  availability_zone = "${var.aws_region}b"
+
+  tags {
+    Name = "App Public Subnet-2"
+  }
+}
+
+# Define main private subnet
+resource "aws_subnet" "private-subnet" {
+  vpc_id = "${aws_vpc.Application-VPC.id}"
+  cidr_block = "${var.private_subnet_cidr}"
+  availability_zone = "${var.aws_region}b"
+
+  tags {
+    Name = "App Private Subnet-1"
+  }
+}
+
+# Define second private subnet
+resource "aws_subnet" "private-subnet-b" {
+  vpc_id = "${aws_vpc.Application-VPC.id}"
+  cidr_block = "${var.private_subnet_b_cidr}"
+  availability_zone = "${var.aws_region}a"
+
+  tags {
+    Name = "App Private Subnet-2"
+  }
+}
+
+###################
+# Managment - VPC #
+###################
+
+# Define the public subnet
+resource "aws_subnet" "dmz-subnet" {
+  vpc_id = "${aws_vpc.Managment-VPC.id}"
+  cidr_block = "${var.dmz_subnet_cidr}"
+  availability_zone = "${var.aws_region}a"
+
+  tags {
+    Name = "DMZ-Subnet"
+  }
+}
diff --git a/deploy/terraform-aws/terraform.tfvars.example b/deploy/terraform-aws/terraform.tfvars.example
new file mode 100644
index 0000000..09b1c92
--- /dev/null
+++ b/deploy/terraform-aws/terraform.tfvars.example
@@ -0,0 +1,22 @@
+#########################
+# Terraform Node Config #
+#########################
+
+NODENAME = "node"
+SUFFIX = "nd36"
+
+aws_region = "us-west-1"
+
+# To add - Selection of specific AZ's
+
+#########################
+# PostgresDB Parameters #
+#########################
+
+DB_USER  = "stellar" 
+DB_PASS  = "defaultpassword" 
+DB_NAME  = "core" 
+DB_IDENTIFIER  = "stellar-core-db"
+
+
+
diff --git a/deploy/terraform-aws/variables.tf b/deploy/terraform-aws/variables.tf
new file mode 100644
index 0000000..758ad4d
--- /dev/null
+++ b/deploy/terraform-aws/variables.tf
@@ -0,0 +1,84 @@
+#########################
+# Variables to override #
+#########################
+
+variable "NODENAME" {
+  description = "The Name of the Node Partner"
+  default = "node"
+}
+
+variable "SUFFIX" {
+  description = "Unique suffix for Node"
+  default = "suf42"
+}
+
+variable "DB_USER" { default = "stellar" }
+variable "DB_PASS" { default = "defaultpassword" }
+variable "DB_NAME" { default = "core" }
+variable "DB_IDENTIFIER" { default = "stellar-core-db" }
+
+#####################
+# Key to launch EC2 #
+#####################
+
+variable "key_path" {
+  description = "SSH Public Key path"
+  #default = "/root/.ssh/id_rsa.pub"
+  default = "~/terraform7/ec2key/key.pub"
+}
+
+#######################
+# Region to deploy on #
+#######################
+
+variable "aws_region" {
+  description = "Region for the VPC"
+}
+
+#######################
+# Application Subnets # 
+#######################
+
+variable "app_vpc_cidr" {
+  description = "CIDR for the VPC"
+  default = "172.31.0.0/16"
+}
+
+variable "public_subnet_cidr" {
+  description = "CIDR for the public subnet"
+  default = "172.31.16.0/20"
+}
+
+variable "public_b_subnet_cidr" {
+  description = "CIDR for the public subnet"
+  default = "172.31.32.0/20"
+}
+
+variable "private_subnet_cidr" {
+  description = "CIDR for the private subnet"
+  default = "172.31.0.0/20"
+}
+
+variable "private_subnet_b_cidr" {
+  description = "CIDR for the private subnet"
+  default = "172.31.48.0/20"
+}
+
+variable "ami" {
+  description = "Amazon Linux AMI"
+  default = "ami-0d8f6eb4f641ef691"
+}
+
+#####################
+# Managment Subnets #
+#####################
+
+variable "mng_vpc_cidr" {
+  description = "CIDR for the VPC"
+  default = "10.0.0.0/16"
+}
+
+variable "dmz_subnet_cidr" {
+  description = "CIDR for the public subnet"
+  default = "10.0.0.0/20"
+}
diff --git a/deploy/terraform-aws/vpc.tf b/deploy/terraform-aws/vpc.tf
new file mode 100644
index 0000000..02ab303
--- /dev/null
+++ b/deploy/terraform-aws/vpc.tf
@@ -0,0 +1,169 @@
+##############################
+#   Subnet Group for RDS     #
+##############################
+
+resource "aws_db_subnet_group" "default" {
+  name       = "main"
+  subnet_ids = ["${aws_subnet.private-subnet.id}", "${aws_subnet.public-subnet.id}"]
+
+  tags = {
+    Name = "My DB subnet group"
+  }
+}
+
+##############################
+#   Application VPC          #
+##############################
+
+# Define our VPC
+resource "aws_vpc" "Application-VPC" {
+  cidr_block = "${var.app_vpc_cidr}"
+  enable_dns_hostnames = true
+
+  tags {
+    Name = "Application-VPC"
+  }
+}
+
+# Define the internet gateway
+resource "aws_internet_gateway" "gw" {
+  vpc_id = "${aws_vpc.Application-VPC.id}"
+
+  tags {
+    Name = "App-VPC-IGW"
+  }
+}
+
+# Define the public route table
+resource "aws_route_table" "web-public-rt" {
+  vpc_id = "${aws_vpc.Application-VPC.id}"
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = "${aws_internet_gateway.gw.id}"
+  }
+  route {
+    cidr_block = "10.0.0.0/24"
+    gateway_id = "${aws_vpc_peering_connection.dmztofed.id}"
+  }
+
+  tags {
+    Name = "Fed-Public-RT"
+  }
+}
+
+# Assign the route table to the public Subnet
+resource "aws_route_table_association" "web-public-attach" {
+  subnet_id = "${aws_subnet.public-subnet.id}"
+  route_table_id = "${aws_route_table.web-public-rt.id}"
+}
+
+resource "aws_route_table_association" "web-public-attach-b" {
+  subnet_id = "${aws_subnet.public-subnet-b.id}"
+  route_table_id = "${aws_route_table.web-public-rt.id}"
+}
+
+resource "aws_main_route_table_association" "public-main-rt" {
+  vpc_id         = "${aws_vpc.Application-VPC.id}"
+  route_table_id = "${aws_route_table.web-public-rt.id}"
+}
+
+# Define the private route table
+resource "aws_route_table" "web-private-rt" {
+  vpc_id = "${aws_vpc.Application-VPC.id}"
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = "${aws_nat_gateway.stellar_nat_gw.id}"
+  }
+  route {
+    cidr_block = "10.0.0.0/24"
+    gateway_id = "${aws_vpc_peering_connection.dmztofed.id}"
+  }
+
+  tags {
+    Name = "Fed-Private-RT"
+  }
+}
+
+# Assign the route table to the Private Subnet
+resource "aws_route_table_association" "fed-rt-attach" {
+  subnet_id = "${aws_subnet.private-subnet.id}"
+  route_table_id = "${aws_route_table.web-private-rt.id}"
+}
+
+resource "aws_route_table_association" "fed-rt-attach-b" {
+  subnet_id = "${aws_subnet.private-subnet-b.id}"
+  route_table_id = "${aws_route_table.web-private-rt.id}"
+}
+
+#####################
+# Managment - VPC   #
+#####################
+# Define our VPC
+resource "aws_vpc" "Managment-VPC" {
+  cidr_block = "${var.mng_vpc_cidr}"
+  enable_dns_hostnames = true
+
+  tags {
+    Name = "Managment-Vpc"
+  }
+}
+
+# Define the internet gateway
+resource "aws_internet_gateway" "gw-dmz" {
+  vpc_id = "${aws_vpc.Managment-VPC.id}"
+
+  tags {
+    Name = "Mng-Vpc-IGW"
+  }
+}
+
+# Define the route table
+resource "aws_route_table" "dmz-rt" {
+  vpc_id = "${aws_vpc.Managment-VPC.id}"
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = "${aws_internet_gateway.gw-dmz.id}"
+  }
+
+  route {
+    cidr_block = "172.31.0.0/16"
+    gateway_id = "${aws_vpc_peering_connection.dmztofed.id}"
+  }
+
+  tags {
+    Name = "Managment-RT"
+  }
+}
+
+# Assign the route table to the public Subnet
+resource "aws_route_table_association" "dmz-rt-attach" {
+  subnet_id = "${aws_subnet.dmz-subnet.id}"
+  route_table_id = "${aws_route_table.dmz-rt.id}"
+}
+
+resource "aws_main_route_table_association" "dmz-main-rt" {
+  vpc_id         = "${aws_vpc.Managment-VPC.id}"
+  route_table_id = "${aws_route_table.dmz-rt.id}"
+}
+
+
+
+######################
+# Peering connection #
+######################
+
+resource "aws_vpc_peering_connection" "dmztofed" {
+  peer_vpc_id   = "${aws_vpc.Managment-VPC.id}"
+  vpc_id        = "${aws_vpc.Application-VPC.id}"
+  auto_accept   = true
+
+  tags = {
+    Name = "VPC Peering between DMZ and Fed"
+  }
+}
+
+#############################
+