DNS privado híbrido (on-premises ↔ nube)

# DNS privado híbrido — GCP
#
# Inbound server policy (on-premises consulta las IPs que toma de cada subnet),
# forwarding zone privada para corp.example.com y el Cloud Router anunciando
# 35.199.192.0/19, el rango desde el que Cloud DNS envía las consultas reenviadas.

locals {
  # Origen de toda consulta que Cloud DNS reenvía: on-premises necesita la ruta de vuelta.
  cloud_dns_source_range = "35.199.192.0/19"
  onprem_fqdn            = "${trimsuffix(var.onprem_domain, ".")}."
  zone_fqdn              = "${trimsuffix(var.private_zone_name, ".")}."
}

resource "google_dns_policy" "inbound" {
  project                   = var.project_id
  name                      = "${var.name}-inbound"
  description               = "Permite que on-premises consulte las zonas privadas de esta VPC"
  enable_inbound_forwarding = true
  enable_logging            = true

  networks {
    network_url = var.network_id
  }
}

resource "google_dns_managed_zone" "onprem" {
  #checkov:skip=CKV_GCP_16:DNSSEC no aplica a una forwarding zone privada (las respuestas las da on-premises).
  project     = var.project_id
  name        = "${var.name}-onprem"
  dns_name    = local.onprem_fqdn
  description = "Reenvía ${var.onprem_domain} a los DNS on-premises"
  visibility  = "private"

  private_visibility_config {
    networks {
      network_url = var.network_id
    }
  }

  forwarding_config {
    dynamic "target_name_servers" {
      for_each = var.onprem_dns_servers
      content {
        ipv4_address = target_name_servers.value
        # Siempre por la VPC, aunque el destino no sea RFC 1918 (gotcha: forwarding-path-private).
        forwarding_path = "private"
      }
    }
  }
}

resource "google_dns_managed_zone" "cloud" {
  #checkov:skip=CKV_GCP_16:DNSSEC no aplica a zonas privadas en Cloud DNS.
  project     = var.project_id
  name        = "${var.name}-cloud"
  dns_name    = local.zone_fqdn
  description = "Zona privada resoluble desde on-premises vía la inbound policy"
  visibility  = "private"

  private_visibility_config {
    networks {
      network_url = var.network_id
    }
  }
}

# Sin este anuncio, on-premises recibe la consulta pero la respuesta no vuelve
# (gotcha: return-route-35-199-192-0-19).
resource "google_compute_router" "hybrid" {
  project = var.project_id
  name    = "${var.name}-router"
  region  = var.region
  network = var.network_id

  bgp {
    asn               = var.router_asn
    advertise_mode    = "CUSTOM"
    advertised_groups = ["ALL_SUBNETS"]

    advertised_ip_ranges {
      range       = local.cloud_dns_source_range
      description = "Origen de las consultas reenviadas por Cloud DNS"
    }
  }
}

variable "project_id" {
  description = "Proyecto host de la VPC hub."
  type        = string
}

variable "region" {
  description = "Región del Cloud Router y de la VPN/Interconnect."
  type        = string
  default     = "us-central1"
}

variable "name" {
  description = "Prefijo para nombrar los recursos (ej. \"dns-hub\")."
  type        = string

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{2,19}$", var.name))
    error_message = "name: 3-20 caracteres, empieza con letra, minúsculas, números o guiones."
  }
}

variable "network_id" {
  description = "ID de la VPC hub (projects/<p>/global/networks/<n>), la que tiene la VPN o el Interconnect."
  type        = string
}

variable "onprem_dns_servers" {
  description = "IPs de los DNS on-premises."
  type        = list(string)

  validation {
    condition     = length(var.onprem_dns_servers) >= 1
    error_message = "onprem_dns_servers: al menos uno."
  }
}

variable "onprem_domain" {
  description = "Dominio corporativo que se reenvía a on-premises."
  type        = string
  default     = "corp.example.com"
}

variable "private_zone_name" {
  description = "Zona privada que on-premises tiene que resolver."
  type        = string
  default     = "gcp.example.internal"
}

variable "router_asn" {
  description = "ASN privado del Cloud Router que habla BGP con on-premises."
  type        = number
  default     = 64514
}

output "cloud_dns_source_range" {
  description = "Rango a permitir (UDP y TCP 53) en el firewall on-premises y a rutear de vuelta por la VPN/Interconnect."
  value       = local.cloud_dns_source_range
}

output "inbound_forwarder_hint" {
  description = "Las IPs de entrada se ven después del apply con este comando."
  value       = "gcloud compute addresses list --project ${var.project_id} --filter='purpose = \"DNS_RESOLVER\"'"
}

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 8.6"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# DNS privado híbrido — AWS
#
# Route 53 Resolver en la VPC hub: inbound endpoint para on-premises, outbound
# endpoint + regla FORWARD para corp.example.com, y la private hosted zone
# asociada a la VPC del inbound endpoint.

locals {
  # TCP además de UDP: respuestas grandes (DNSSEC, muchos registros) caen a TCP.
  dns_protocols = ["udp", "tcp"]
}

resource "aws_security_group" "resolver" {
  name        = "${var.name}-resolver"
  description = "Route 53 Resolver endpoints: DNS desde y hacia on-premises"
  vpc_id      = var.vpc_id
}

resource "aws_vpc_security_group_ingress_rule" "dns_from_onprem" {
  for_each = { for pair in setproduct(var.onprem_cidrs, local.dns_protocols) : "${pair[0]}-${pair[1]}" => pair }

  security_group_id = aws_security_group.resolver.id
  description       = "DNS desde on-premises (${each.value[1]})"
  cidr_ipv4         = each.value[0]
  ip_protocol       = each.value[1]
  from_port         = 53
  to_port           = 53
}

resource "aws_vpc_security_group_egress_rule" "dns_to_onprem" {
  for_each = { for pair in setproduct(var.onprem_cidrs, local.dns_protocols) : "${pair[0]}-${pair[1]}" => pair }

  security_group_id = aws_security_group.resolver.id
  description       = "DNS hacia on-premises (${each.value[1]})"
  cidr_ipv4         = each.value[0]
  ip_protocol       = each.value[1]
  from_port         = 53
  to_port           = 53
}

# Cada IP es una ENI que se cobra por hora (gotcha: resolver-endpoints-fixed-cost).
resource "aws_route53_resolver_endpoint" "inbound" {
  name               = "${var.name}-inbound"
  direction          = "INBOUND"
  security_group_ids = [aws_security_group.resolver.id]

  dynamic "ip_address" {
    for_each = var.endpoint_subnet_ids
    content {
      subnet_id = ip_address.value
    }
  }
}

resource "aws_route53_resolver_endpoint" "outbound" {
  name               = "${var.name}-outbound"
  direction          = "OUTBOUND"
  security_group_ids = [aws_security_group.resolver.id]

  dynamic "ip_address" {
    for_each = var.endpoint_subnet_ids
    content {
      subnet_id = ip_address.value
    }
  }
}

resource "aws_route53_resolver_rule" "onprem" {
  name                 = "${var.name}-onprem"
  domain_name          = var.onprem_domain
  rule_type            = "FORWARD"
  resolver_endpoint_id = aws_route53_resolver_endpoint.outbound.id

  dynamic "target_ip" {
    for_each = var.onprem_dns_servers
    content {
      ip   = target_ip.value
      port = 53
    }
  }
}

resource "aws_route53_resolver_rule_association" "this" {
  for_each = merge({ hub = var.vpc_id }, var.spoke_vpc_ids)

  name             = "${var.name}-${each.key}"
  resolver_rule_id = aws_route53_resolver_rule.onprem.id
  vpc_id           = each.value
}

# Tiene que estar asociada a la VPC del inbound endpoint para que on-premises la resuelva.
resource "aws_route53_zone" "cloud" {
  #checkov:skip=CKV2_AWS_38:DNSSEC signing no aplica a private hosted zones.
  #checkov:skip=CKV2_AWS_39:El query logging se configura a nivel VPC (Resolver query logging), fuera del alcance del patrón.
  name = var.private_zone_name

  vpc {
    vpc_id = var.vpc_id
  }
}

variable "name" {
  description = "Prefijo para nombrar los recursos (ej. \"dns-hub\")."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9-]{3,20}$", var.name))
    error_message = "name: 3-20 caracteres, minúsculas, números o guiones."
  }
}

variable "region" {
  description = "Región del hub."
  type        = string
  default     = "us-east-1"
}

variable "vpc_id" {
  description = "VPC hub (la que tiene la VPN o el Direct Connect)."
  type        = string
}

variable "endpoint_subnet_ids" {
  description = "Subnets para las ENIs de los endpoints, en al menos dos AZs distintas."
  type        = list(string)

  validation {
    condition     = length(var.endpoint_subnet_ids) >= 2 && length(var.endpoint_subnet_ids) <= 6
    error_message = "endpoint_subnet_ids: entre 2 y 6 (Resolver exige al menos dos IPs por endpoint)."
  }
}

variable "onprem_cidrs" {
  description = "Rangos on-premises que consultan el inbound endpoint y donde viven los DNS destino."
  type        = list(string)
}

variable "onprem_dns_servers" {
  description = "IPs de los DNS on-premises."
  type        = list(string)

  validation {
    condition     = length(var.onprem_dns_servers) >= 1 && length(var.onprem_dns_servers) <= 6
    error_message = "onprem_dns_servers: entre 1 y 6 (máximo de target IPs por regla)."
  }
}

variable "onprem_domain" {
  description = "Dominio corporativo que se reenvía a on-premises."
  type        = string
  default     = "corp.example.com"
}

variable "private_zone_name" {
  description = "Private hosted zone que on-premises tiene que resolver."
  type        = string
  default     = "aws.example.internal"
}

variable "spoke_vpc_ids" {
  description = "VPCs adicionales (misma cuenta y región) que usan la regla de reenvío. Para otras cuentas, compartila con AWS RAM."
  type        = map(string)
  default     = {}
}

variable "tags" {
  description = "Tags comunes."
  type        = map(string)
  default     = {}
}

output "inbound_endpoint_ips" {
  description = "IPs para los forwarders condicionales on-premises (se conocen después del apply)."
  value       = [for ip in aws_route53_resolver_endpoint.inbound.ip_address : ip.ip]
}

output "resolver_rule_id" {
  description = "Regla de reenvío, para compartir con AWS RAM a otras cuentas."
  value       = aws_route53_resolver_rule.onprem.id
}

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.67"
    }
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = var.tags
  }
}