Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.aws_vpc.default: Refreshing state...
data.aws_subnet_ids.this: Refreshing state...

------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.vpc1.aws_egress_only_internet_gateway.this[0] will be created
  + resource "aws_egress_only_internet_gateway" "this" {
      + id     = (known after apply)
      + tags   = {
          + "Name" = "vpc1"
        }
      + vpc_id = (known after apply)
    }

  # module.vpc1.aws_route.private_ipv6_egress[0] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + destination_prefix_list_id  = (known after apply)
      + egress_only_gateway_id      = (known after apply)
      + gateway_id                  = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + nat_gateway_id              = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # module.vpc1.aws_route.private_ipv6_egress[1] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + destination_prefix_list_id  = (known after apply)
      + egress_only_gateway_id      = (known after apply)
      + gateway_id                  = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + nat_gateway_id              = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # module.vpc1.aws_route.private_ipv6_egress[2] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + destination_prefix_list_id  = (known after apply)
      + egress_only_gateway_id      = (known after apply)
      + gateway_id                  = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + nat_gateway_id              = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # module.vpc1.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc1-private-eu-west-1a"
        }
      + vpc_id           = (known after apply)
    }

  # module.vpc1.aws_route_table.private[1] will be created
  + resource "aws_route_table" "private" {
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc1-private-eu-west-1b"
        }
      + vpc_id           = (known after apply)
    }

  # module.vpc1.aws_route_table.private[2] will be created
  + resource "aws_route_table" "private" {
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc1-private-eu-west-1c"
        }
      + vpc_id           = (known after apply)
    }

  # module.vpc1.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.vpc1.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.vpc1.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.vpc1.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = true
      + availability_zone               = "eu-west-1a"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.10.1.0/24"
      + id                              = (known after apply)
      + ipv6_cidr_block                 = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Name" = "vpc1-private-eu-west-1a"
        }
      + vpc_id                          = (known after apply)
    }

  # module.vpc1.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = true
      + availability_zone               = "eu-west-1b"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.10.2.0/24"
      + id                              = (known after apply)
      + ipv6_cidr_block                 = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Name" = "vpc1-private-eu-west-1b"
        }
      + vpc_id                          = (known after apply)
    }

  # module.vpc1.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = true
      + availability_zone               = "eu-west-1c"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.10.3.0/24"
      + id                              = (known after apply)
      + ipv6_cidr_block                 = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Name" = "vpc1-private-eu-west-1c"
        }
      + vpc_id                          = (known after apply)
    }

  # module.vpc1.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                              = (known after apply)
      + assign_generated_ipv6_cidr_block = true
      + cidr_block                       = "10.10.0.0/16"
      + default_network_acl_id           = (known after apply)
      + default_route_table_id           = (known after apply)
      + default_security_group_id        = (known after apply)
      + dhcp_options_id                  = (known after apply)
      + enable_classiclink               = (known after apply)
      + enable_classiclink_dns_support   = (known after apply)
      + enable_dns_hostnames             = false
      + enable_dns_support               = true
      + id                               = (known after apply)
      + instance_tenancy                 = "default"
      + ipv6_association_id              = (known after apply)
      + ipv6_cidr_block                  = (known after apply)
      + main_route_table_id              = (known after apply)
      + owner_id                         = (known after apply)
      + tags                             = {
          + "Name" = "vpc1"
        }
    }

  # module.vpc2.aws_route_table.private[0] will be created
  + resource "aws_route_table" "private" {
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc2-private-eu-west-1a"
        }
      + vpc_id           = (known after apply)
    }

  # module.vpc2.aws_route_table.private[1] will be created
  + resource "aws_route_table" "private" {
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc2-private-eu-west-1b"
        }
      + vpc_id           = (known after apply)
    }

  # module.vpc2.aws_route_table.private[2] will be created
  + resource "aws_route_table" "private" {
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = (known after apply)
      + tags             = {
          + "Name" = "vpc2-private-eu-west-1c"
        }
      + vpc_id           = (known after apply)
    }

  # module.vpc2.aws_route_table_association.private[0] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.vpc2.aws_route_table_association.private[1] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.vpc2.aws_route_table_association.private[2] will be created
  + resource "aws_route_table_association" "private" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # module.vpc2.aws_subnet.private[0] will be created
  + resource "aws_subnet" "private" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = false
      + availability_zone               = "eu-west-1a"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.20.1.0/24"
      + id                              = (known after apply)
      + ipv6_cidr_block                 = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Name" = "vpc2-private-eu-west-1a"
        }
      + vpc_id                          = (known after apply)
    }

  # module.vpc2.aws_subnet.private[1] will be created
  + resource "aws_subnet" "private" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = false
      + availability_zone               = "eu-west-1b"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.20.2.0/24"
      + id                              = (known after apply)
      + ipv6_cidr_block                 = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Name" = "vpc2-private-eu-west-1b"
        }
      + vpc_id                          = (known after apply)
    }

  # module.vpc2.aws_subnet.private[2] will be created
  + resource "aws_subnet" "private" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = false
      + availability_zone               = "eu-west-1c"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.20.3.0/24"
      + id                              = (known after apply)
      + ipv6_cidr_block                 = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Name" = "vpc2-private-eu-west-1c"
        }
      + vpc_id                          = (known after apply)
    }

  # module.vpc2.aws_vpc.this[0] will be created
  + resource "aws_vpc" "this" {
      + arn                              = (known after apply)
      + assign_generated_ipv6_cidr_block = false
      + cidr_block                       = "10.20.0.0/16"
      + default_network_acl_id           = (known after apply)
      + default_route_table_id           = (known after apply)
      + default_security_group_id        = (known after apply)
      + dhcp_options_id                  = (known after apply)
      + enable_classiclink               = (known after apply)
      + enable_classiclink_dns_support   = (known after apply)
      + enable_dns_hostnames             = false
      + enable_dns_support               = true
      + id                               = (known after apply)
      + instance_tenancy                 = "default"
      + ipv6_association_id              = (known after apply)
      + ipv6_cidr_block                  = (known after apply)
      + main_route_table_id              = (known after apply)
      + owner_id                         = (known after apply)
      + tags                             = {
          + "Name" = "vpc2"
        }
    }

  # module.tgw.module.tgw.aws_ec2_transit_gateway.this[0] will be created
  + resource "aws_ec2_transit_gateway" "this" {
      + amazon_side_asn                    = 64532
      + arn                                = (known after apply)
      + association_default_route_table_id = (known after apply)
      + auto_accept_shared_attachments     = "enable"
      + default_route_table_association    = "enable"
      + default_route_table_propagation    = "enable"
      + description                        = "My TGW shared with several other AWS accounts"
      + dns_support                        = "enable"
      + id                                 = (known after apply)
      + owner_id                           = (known after apply)
      + propagation_default_route_table_id = (known after apply)
      + tags                               = {
          + "Name"    = "my-tgw"
          + "Purpose" = "tgw-complete-example"
        }
      + vpn_ecmp_support                   = "enable"
    }

  # module.tgw.module.tgw.aws_ec2_transit_gateway_route_table.this[0] will be created
  + resource "aws_ec2_transit_gateway_route_table" "this" {
      + default_association_route_table = (known after apply)
      + default_propagation_route_table = (known after apply)
      + id                              = (known after apply)
      + tags                            = {
          + "Name"    = "my-tgw"
          + "Purpose" = "tgw-complete-example"
        }
      + transit_gateway_id              = (known after apply)
    }

Plan: 26 to add, 0 to change, 0 to destroy.

create_tgw = true 
share_tgw = true
ram_allow_external_principals = true
ram_principals = [<account_b>]
enable_default_route_table_association = false
enable_default_route_table_propagation = false

create_tgw = false 
share_tgw = true

vpc_attachments = {
  vpc-1 = {
    <snip>
    tgw_id = module.account_a.this_ec2_transit_gateway_id
    transit_gateway_route_table_id = module.account_a.this_ec2_transit_gateway_route_table_id
    transit_gateway_default_route_table_association = false
    transit_gateway_default_route_table_propagation = false
  }
}

module.account_b.aws_ec2_transit_gateway_route_table_association.this["vpc-1"]  will be created
module.account_b.aws_ec2_transit_gateway_route_table_propagation.this["vpc-1"] will be created
module.account_b.aws_ec2_transit_gateway_vpc_attachment.this["vpc-1"] will be created

Error: error associating EC2 Transit Gateway Route Table (tgw-rtb-<id>) association (tgw-attach-<id>): InvalidRouteTableID.NotFound: Transit Gateway Route Table tgw-rtb-<id> was deleted or does not exist.
        status code: 400, request id: <id>

Error: error associating EC2 Transit Gateway Route Table (tgw-rtb-<id>) association (tgw-attach-<id>): InvalidRouteTableID.NotFound: Transit Gateway Route Table tgw-rtb-<id> was deleted or does not exist.
        status code: 400, request id: <id>

  transit_gateway_default_route_table_association = false
  transit_gateway_default_route_table_propagation = false

  lifecycle {
    ignore_changes = [
      transit_gateway_default_route_table_association,
      transit_gateway_default_route_table_propagation
    ]
  }

module "tgw" {
  source  = "terraform-aws-modules/transit-gateway/aws"
  version = "= 2.8.1"

  name        = local.name
  description = "TGW shared with several other AWS accounts"

  create_tgw = var.create_tgw
  share_tgw  = var.share_tgw

  amazon_side_asn = 64532
  enable_auto_accept_shared_attachments = var.enable_auto_accept_shared_attachments

  enable_mutlicast_support = var.enable_mutlicast_support
  ram_resource_share_arn   = var.ram_resource_share_arn

  enable_default_route_table_association = false
  enable_default_route_table_propagation = true

  vpc_attachments = {
    "${var.env}-vpc" = {
      vpc_id       = module.vpc.vpc_id
      tgw_id       = var.tgw_id
      subnet_ids   = module.vpc.private_subnets
      dns_support  = var.enable_dns_support_tgw
      ipv6_support = false

      transit_gateway_default_route_table_association = var.create_tgw ? true : false
      transit_gateway_default_route_table_propagation = var.create_tgw ? false : true
    }
  }

  ram_allow_external_principals = true
  ram_principals                = var.ram_principals
  tags = {
    topology = var.create_tgw ? "hub" : "spoke"
  }
}

locals {
  subaccount_vpc_attachments = var.create_tgw ? compact([for x in tolist(data.aws_ec2_transit_gateway_vpc_attachments.filtered[0].ids) : x == module.tgw.ec2_transit_gateway_vpc_attachment_ids[0] ? "" : x]) : []
}

data "aws_ec2_transit_gateway_vpc_attachments" "filtered" {
  count = var.create_tgw ? 1 : 0

  filter {
    name   = "transit-gateway-id"
    values = [module.tgw.ec2_transit_gateway_id]
  }
}

resource "aws_ec2_transit_gateway_route" "spoke_routes" {
  count = var.create_tgw ? 1 : 0

  destination_cidr_block         = module.vpc.vpc_cidr_block
  transit_gateway_attachment_id  = module.tgw.ec2_transit_gateway_vpc_attachment_ids[0]
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.spoke_route_table[0].id
}

resource "aws_ec2_transit_gateway_route_table" "spoke_route_table" {
  count = var.create_tgw ? 1 : 0

  transit_gateway_id = module.tgw.ec2_transit_gateway_id
}

resource "aws_ec2_transit_gateway_route_table_association" "spoke_route_table_association" {
  for_each = toset(local.subaccount_vpc_attachments)

  transit_gateway_attachment_id  = each.key
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.spoke_route_table[0].id
}

resource "aws_ec2_transit_gateway_route_table_association" "hub_route_table_association" {
  count = var.create_tgw ? 1 : 0

  transit_gateway_attachment_id  = module.tgw.ec2_transit_gateway_vpc_attachment_ids[0]
  transit_gateway_route_table_id = module.tgw.ec2_transit_gateway_propagation_default_route_table_id
}

resource "aws_route" "this_public" {
  count = length(var.routes_destination_cidr_blocks)

  route_table_id         = module.vpc.public_route_table_ids[0]
  destination_cidr_block = element(var.routes_destination_cidr_blocks, count.index)
  transit_gateway_id     = var.create_tgw ? module.tgw.ec2_transit_gateway_id : var.tgw_id
}

resource "aws_route" "this_private" {
  count = length(var.routes_destination_cidr_blocks)

  route_table_id         = module.vpc.private_route_table_ids[0]
  destination_cidr_block = element(var.routes_destination_cidr_blocks, count.index)
  transit_gateway_id     = var.create_tgw ? module.tgw.ec2_transit_gateway_id : var.tgw_id
}

  # module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["staging-vpc"] will be updated in-place
  ~ resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
        id                                              = "tgw-attach-0408540f40c2c1646"
        tags                                            = {
            "Name"     = "staging-tgw"
            "topology" = "spoke"
        }
      ~ transit_gateway_default_route_table_association = true -> false
        # (9 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
  for_each = var.vpc_attachments
  ...
  .
  ...

  tags = merge(
    var.tags,
    { Name = var.name },
    var.tgw_vpc_attachment_tags,
  )
}

resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
  for_each = var.vpc_attachments
  ...
  .
  ...

  tags = merge(
    var.tags,
    { Name = var.name },
    var.tgw_vpc_attachment_tags,
    each.value.tags
  )
}

$ terraform modules -version
Terraform v1.2.5
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v4.22.0

$ terraform version
Terraform v1.2.5
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v4.22.0

$ terraform providers -version
Terraform v1.2.5
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v4.22.0

locals {
  region = "us-east-1"
  name   = "wolf-test"
}

provider "aws" {
  region = local.region
}

module "tgw" {
  source    = "terraform-aws-modules/transit-gateway/aws"
  version   = "~> 2.0"
  name      = "${local.name}-tgw"
  share_tgw = false

  vpc_attachments = {
    vpc1 = {
      vpc_id       = module.vpc1.vpc_id
      subnet_ids   = module.vpc1.public_subnets
      dns_support  = true
      ipv6_support = false
      tgw_routes = [{ destination_cidr_block = "10.20.0.0/16" }]
    },
    vpc2 = {
      vpc_id       = module.vpc2.vpc_id
      subnet_ids   = module.vpc2.public_subnets
      dns_support  = true
      ipv6_support = false
      tgw_routes = [{ destination_cidr_block = "10.21.0.0/16" }]
    }
  }
}

module "vpc1" {
  source         = "terraform-aws-modules/vpc/aws"
  version        = "~> 3.0"
  name           = "${local.name}-vpc1"
  cidr           = "10.20.0.0/16"
  azs            = ["${local.region}a", "${local.region}b", "${local.region}c"]
  public_subnets = ["10.20.1.0/24", "10.20.2.0/24", "10.20.3.0/24"]
  enable_ipv6    = false
}

module "vpc2" {
  source         = "terraform-aws-modules/vpc/aws"
  version        = "~> 3.0"
  name           = "${local.name}-vpc2"
  cidr           = "10.21.0.0/16"
  azs            = ["${local.region}a", "${local.region}b", "${local.region}c"]
  public_subnets = ["10.21.1.0/24", "10.21.2.0/24", "10.21.3.0/24"]
  enable_ipv6    = false
}

terraform init
terraform apply

include {
  path = find_in_parent_folders()
}

terraform {
  source  = "[email protected]:TierMobility/terraform-aws-transit-gateway.git?ref=bb1a74673f26a807a195e5ea4648d8078db61ec1" # I'm using TierMobility's branch because of the default route addition.
}

inputs = {
  name = "my-tgw"
  ram_principals = [
    "arn:aws:organizations::1111222233334444:organization/o-organization_id"
  ]
}

include {
  path = find_in_parent_folders()
}

terraform {
  source = "[email protected]:terraform-aws-modules/terraform-aws-vpc.git?ref=v2.33.0"
}

inputs = {
  name = "dev_databases"
  cidr = "10.135.0.0/16"

  azs = [
    "us-west-2a",
    "us-west-2b",
    "us-west-2c",
    "us-west-2d",
  ]

  database_subnets = [
    "10.135.0.0/22",
    "10.135.4.0/22",
    "10.135.8.0/22",
    "10.135.12.0/22",
  ]

  private_subnets = [
    "10.135.254.0/24",
    "10.135.255.0/24",
  ]
}

include {
  path = find_in_parent_folders()
}

terraform {
  source  = "[email protected]:TierMobility/terraform-aws-transit-gateway.git?ref=bb1a74673f26a807a195e5ea4648d8078db61ec1"
}

dependency "vpc" {
  config_path = "../dev_databases/vpc"
}

dependency "root-tgw" {
  config_path = "../../networking-acc-1234/tgw"
}

inputs = {
  create_tgw = false
  vpc_attachments = {
    s = {
      tgw_id =  dependency.root-tgw.outputs.this_ec2_transit_gateway_id
      vpc_id = dependency.vpc.outputs.vpc_id
      subnet_ids = concat(
        dependency.vpc.outputs.database_subnets,
      )
    }
  }
  transit_gateway_route_table_id = dependency.root-tgw.outputs.this_ec2_transit_gateway_route_table_id
}

Error: Invalid index

  on main.tf line 70, in resource "aws_ec2_transit_gateway_vpc_attachment" "this":
  70:   transit_gateway_id = lookup(each.value, "tgw_id", aws_ec2_transit_gateway.this[0].id)
    |----------------
    | aws_ec2_transit_gateway.this is empty tuple

The given key does not identify an element in this collection value.

Releasing state lock. This may take a few moments...
[terragrunt] 2020/04/21 17:21:31 Hit multiple errors:
exit status 1

provider "aws" {
  region = var.aws_region

  # Only these AWS Account IDs may be operated on by this template
  allowed_account_ids = [var.aws_account_id]
}

terraform {
  backend "s3" {}

  required_version = "= 0.13.7"

  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = "~> 3.26"
    }
  }
}

provider "aws" {
  alias  = "dev"

  region = var.aws_region

  assume_role {
    role_arn     = "arn:aws:iam::xxxxxxxx:role/allow-full-access-from-other-accounts"
  }
}

provider "aws" {
  alias  = "staging"

  region = var.aws_region

  assume_role {
    role_arn     = "arn:aws:iam::zzzzzz:role/allow-full-access-from-other-accounts"
  }
}

provider "aws" {
  alias  = "prod"

  region = var.aws_region

  assume_role {
    role_arn     = "arn:aws:iam::wwwww:role/allow-full-access-from-other-accounts"
  }
}


module "tgw" {
  source  = "terraform-aws-modules/transit-gateway/aws"
  version = "2.1.0"

  create_tgw  = true
  name        = var.name
  description = var.description

  enable_default_route_table_association = var.enable_default_route_table_association
  enable_default_route_table_propagation = var.enable_default_route_table_propagation
  enable_auto_accept_shared_attachments = var.enable_auto_accept_shared_attachments
  enable_vpn_ecmp_support = var.enable_vpn_ecmp_support
  enable_dns_support = var.enable_dns_support

  tags = var.tags
}

module "tgw_dev" {
  source  = "terraform-aws-modules/transit-gateway/aws"
  version = "2.1.0"

  providers = {
    aws = aws.dev
  }

  name        = "${var.name}-tgw-dev"
  description = "${var.description} Dev attachment"

  share_tgw   = true
  create_tgw  = false
  ram_resource_share_arn = module.tgw.ram_resource_share_id
  enable_auto_accept_shared_attachments = var.enable_auto_accept_shared_attachments

  enable_dns_support = var.enable_dns_support

  enable_default_route_table_association = var.enable_default_route_table_association
  enable_default_route_table_propagation = var.enable_default_route_table_propagation
  enable_vpn_ecmp_support = var.enable_vpn_ecmp_support

  ram_allow_external_principals = var.ram_allow_external_principals
  ram_principals = var.ram_principals

  vpc_attachments = {
    dev_vpc = {
      tgw_id       = module.tgw.ec2_transit_gateway_id
      vpc_id       = var.dev_vpc_id
      subnet_ids   = var.dev_vpc_private_app_subnet_ids
      dns_support  = true
      ipv6_support = false
      transit_gateway_default_route_table_association = false
      transit_gateway_default_route_table_propagation = false

      tgw_routes = [
        {
          destination_cidr_block = var.dev_destination_cidr_block
        },
      ]
    }
  }
}

Error: error creating EC2 Tag (ops.company.cloud/provisioner) for resource (): error tagging resource (): InvalidParameterValue: Value ( null ) for parameter resourceId is invalid. Null/empty value for resourceId is invalid
	status code: 400, request id: 42192f9f-1546-4714-b9b2-b5b4e948ef64

  on .terraform/modules/tgw/main.tf line 44, in resource "aws_ec2_tag" "this":
  44: resource "aws_ec2_tag" "this" {

$ terraform -v
Terraform v0.12.20
+ provider.aws v2.47.0

module "vpc" {
  source = "git::ssh://[email protected]/systems/terraform-aws-vpc.git"
  # Local copy of master branch of https://github.com/terraform-aws-modules/terraform-aws-vpc

  name = var.environment
  create_vpc = true

  cidr                 = "10.${var.network_number}.0.0/16"
  private_subnets     = ["10.${var.network_number}.0.0/24","10.${var.network_number}.1.0/24","10.${var.network_number}.2.0/24"]
  public_subnets      = ["10.${var.network_number}.10.0/24","10.${var.network_number}.11.0/24","10.${var.network_number}.12.0/24"]

  enable_nat_gateway       = "true"
  single_nat_gateway       = "false"
  enable_s3_endpoint       = "true"
  enable_dynamodb_endpoint = "false"

  enable_dns_hostnames = "true"
  enable_dns_support   = "true"

  azs = var.azs

  tags = {
    "Environment" = var.environment
  }
}

module "tgw" {
  source = "git::ssh://[email protected]:systems/terraform-aws-transit-gateway.git"
   # Local copy of Master branch of https://github.com/terraform-aws-modules/terraform-aws-transit-gateway

  name = "Our-tgw"
  description = "Our transit gateway to datacenters"

  vpc_attachments = {
    vpc = {
      vpc_id = module.vpc.vpc_id
      subnet_ids = module.vpc.private_subnets
      tgw_id       = data.terraform_remote_state.region_infrastructure.outputs.transit_gw_id
      dns_support = true
      ipv6_support = true

      tgw_routes = [
        "208.1.0.0/22", "207.1.0.0/22"
      ]
    }
  }

  ram_allow_external_principals = false

  tags = {
        Name        = "${var.environment} TGW"
        Environment = "${var.environment}"
  }
}

Error: Invalid for_each argument

  on .terraform/modules/tgw/main.tf line 89, in resource "aws_ec2_transit_gateway_route_table_association" "this":
  89:   for_each = local.vpc_attachments_without_default_route_table_association

The "for_each" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the for_each depends on.


Error: Invalid for_each argument

  on .terraform/modules/tgw/main.tf line 97, in resource "aws_ec2_transit_gateway_route_table_propagation" "this":
  97:   for_each = local.vpc_attachments_without_default_route_table_association

The "for_each" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the for_each depends on.

Releasing state lock. This may take a few moments...

╷
│ Error: Invalid for_each argument
│ 
│   on .terraform/modules/my_tgw/main.tf line 112, in resource "aws_route" "this":
│  112:   for_each = { for x in local.vpc_route_table_destination_cidr : x.rtb_id => x.cidr }
│     ├────────────────
│     │ local.vpc_route_table_destination_cidr will be known only after apply
│ 
│ The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource.
│ 
│ When working with unknown values in for_each, it's better to define the map keys statically in your configuration and place apply-time results only in the map values.
│ 
│ Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a second time to fully converge.
╵

  vpc_attachments = {
    456_vpc = {
      vpc_id       = 456
      subnet_ids   =789
      dns_support  = true
      ipv6_support = false

      tgw_routes = [
        {
          destination_cidr_block = "10.0.0.0/16"
        }
      ]
    }
    123_vpc = {
      vpc_id       = 123
      subnet_ids   = 456
      dns_support  = true
      ipv6_support = false

      tgw_routes = [
        {
          destination_cidr_block = "10.0.0.0/16"
        }
      ]
    }
  }

│ Error: No RAM Resource Share () invitation found
│ 
│ NOTE: If both AWS accounts are in the same AWS Organization and RAM Sharing with AWS Organizations is enabled, this resource is not necessary
│ 
│   with module.tgw_peer.aws_ram_resource_share_accepter.this[0],
│   on .terraform/modules/tgw_peer/main.tf line 170, in resource "aws_ram_resource_share_accepter" "this":
│  170: resource "aws_ram_resource_share_accepter" "this" {
│ 

Terraform v1.3.6
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v4.46.0

Terraform v1.3.6
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v4.46.0

#Providers, versions and additional prerequisites.
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "4.46.0"
    }
  }
}


provider "aws" {
  region  = var.vpcRegion
  profile = "ent"
}
provider "aws" {
  alias = "dev"
  region  = var.vpcRegion
  shared_config_files = [<credentials>]
  profile = "dev"
}

#VPC declaration
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "3.18.1"

  name = "ent-core-infrastructure"
  cidr = "10.5.0.0/16"

  azs                                  = ["${var.vpcRegion}a", "${var.vpcRegion}b", "${var.vpcRegion}c"]
  public_subnets                       = ["10.5.1.0/24", "10.5.2.0/24", "10.5.3.0/24"]
  private_subnets                      = ["10.5.4.0/24", "10.5.5.0/24", "10.5.6.0/24"]
  intra_subnets                        = ["10.5.7.0/24", "10.5.8.0/24", "10.5.9.0/24"]
  single_nat_gateway                   = true
  enable_nat_gateway                   = true
  enable_flow_log                      = false
  create_flow_log_cloudwatch_iam_role  = false
  create_flow_log_cloudwatch_log_group = false
}

#Transit gateway declaration
module "tgw" {
  source  = "terraform-aws-modules/transit-gateway/aws"
  version = "2.8.1"

  name = "e2-ent-tgw-001"
  description = "Enterprise Transit Gateway. Provisioned using Terraform. Acts as the central interface between offices and AWS."

  enable_auto_accept_shared_attachments = true
  enable_mutlicast_support = true



  vpc_attachments = {
    ent-core-infrastructure = {
      vpc_id      = module.vpc.vpc_id
      subnet_ids  = module.vpc.private_subnets
      dns_support = true

      transit_gateway_default_route_table_association = false
      transit_gateway_default_route_table_propagation = false

    }
  }

  #share_tgw = true
  ram_name = "enterprise-transit-gateway-share"
  ram_allow_external_principals = true
  ram_principals = [
    635757009592
  ]
}

module "tgw_peer" {
  source = "terraform-aws-modules/transit-gateway/aws"

  providers = {
    aws = aws.dev
  }

  name = "test-peer"
  description = "test dev peering using a module"

  create_tgw = false
  #share_tgw = true
  #ram_resource_share_arn = module.tgw.ram_resource_share_id
  enable_auto_accept_shared_attachments = true

  vpc_attachments = {
    dev_vpc = {
#existing vpc
      vpc_id = "vpc-xxxxxxxxxxxxxxxxx"
      tgw_id = module.tgw.ec2_transit_gateway_id
      subnet_ids = ["subnet-xxxxxxxx", "subnet-xxxxxxxx"]
      dns_support = true

      transit_gateway_default_route_table_propagation = false
      transit_gateway_default_route_table_association = false

      tgw_routes = [
        {
          destination_cidr_block = "10.5.0.0/16"
        },
        {
          destination_cidr_block = "10.20.0.0/16"
        }
      ]
    }
  }

  depends_on = [module.tgw]
}

module.tgw.aws_ram_resource_share.this[0]: Creating...
module.vpc.aws_eip.nat[0]: Creating...
module.tgw.aws_ec2_transit_gateway.this[0]: Creating...
module.vpc.aws_vpc.this[0]: Creating...
module.vpc.aws_eip.nat[0]: Creation complete after 1s [id=eipalloc-0fa702f441bc91b2a]
module.tgw.aws_ram_resource_share.this[0]: Creation complete after 1s [id=arn:aws:ram:us-east-2:845940089308:resource-share/836a1157-d934-4cc0-8ab4-97121919b482]
module.tgw.aws_ram_principal_association.this[0]: Creating...
module.tgw.aws_ram_principal_association.this[1]: Creating...
module.vpc.aws_vpc.this[0]: Creation complete after 1s [id=vpc-0539a16057343bbb8]
module.vpc.aws_subnet.private[1]: Creating...
module.vpc.aws_route_table.private[0]: Creating...
module.vpc.aws_route_table.public[0]: Creating...
module.vpc.aws_subnet.public[1]: Creating...
module.vpc.aws_route_table.intra[0]: Creating...
module.vpc.aws_subnet.public[0]: Creating...
module.vpc.aws_subnet.intra[2]: Creating...
module.tgw.aws_ram_principal_association.this[1]: Creation complete after 0s [id=arn:aws:ram:us-east-2:845940089308:resource-share/836a1157-d934-4cc0-8ab4-97121919b482,635757009592]
module.vpc.aws_subnet.public[2]: Creating...
module.tgw.aws_ram_principal_association.this[0]: Creation complete after 1s [id=arn:aws:ram:us-east-2:845940089308:resource-share/836a1157-d934-4cc0-8ab4-97121919b482,778348368122]
module.vpc.aws_route_table.intra[0]: Creation complete after 1s [id=rtb-0fff5ea3f40b2a838]
module.vpc.aws_internet_gateway.this[0]: Creating...
module.vpc.aws_subnet.private[0]: Creating...
module.vpc.aws_route_table.public[0]: Creation complete after 1s [id=rtb-070441310eab3c9f1]
module.vpc.aws_subnet.private[2]: Creating...
module.vpc.aws_subnet.private[1]: Creation complete after 1s [id=subnet-03a9cbe89ee0cdc90]
module.vpc.aws_subnet.intra[0]: Creating...
module.vpc.aws_route_table.private[0]: Creation complete after 1s [id=rtb-00836f2861fae2e6f]
module.vpc.aws_subnet.intra[1]: Creating...
module.vpc.aws_subnet.intra[2]: Creation complete after 1s [id=subnet-07e5fcc661f2f60f3]
module.vpc.aws_internet_gateway.this[0]: Creation complete after 0s [id=igw-055a18a645f1e0e6c]
module.vpc.aws_route.public_internet_gateway[0]: Creating...
module.vpc.aws_subnet.private[0]: Creation complete after 0s [id=subnet-0fe23728ddb5d593b]
module.vpc.aws_subnet.private[2]: Creation complete after 0s [id=subnet-0a6f760a35a1d9346]
module.vpc.aws_route_table_association.private[1]: Creating...
module.vpc.aws_route_table_association.private[2]: Creating...
module.vpc.aws_route_table_association.private[0]: Creating...
module.vpc.aws_subnet.intra[1]: Creation complete after 0s [id=subnet-0cb91956aba2196d1]
module.vpc.aws_subnet.intra[0]: Creation complete after 0s [id=subnet-0489db9d27a054fd9]
module.vpc.aws_route_table_association.intra[2]: Creating...
module.vpc.aws_route_table_association.intra[0]: Creating...
module.vpc.aws_route_table_association.private[0]: Creation complete after 0s [id=rtbassoc-00dbe883fbb176716]
module.vpc.aws_route_table_association.private[2]: Creation complete after 0s [id=rtbassoc-02dc25805f57efd6d]
module.vpc.aws_route.public_internet_gateway[0]: Creation complete after 0s [id=r-rtb-070441310eab3c9f11080289494]
module.vpc.aws_route_table_association.intra[1]: Creating...
module.vpc.aws_route_table_association.private[1]: Creation complete after 1s [id=rtbassoc-02bebc6b166aaf31d]
module.tgw.aws_ec2_transit_gateway.this[0]: Still creating... [10s elapsed]
module.vpc.aws_subnet.public[1]: Still creating... [10s elapsed]
module.vpc.aws_subnet.public[0]: Still creating... [10s elapsed]
module.vpc.aws_subnet.public[2]: Still creating... [10s elapsed]
module.vpc.aws_subnet.public[0]: Creation complete after 11s [id=subnet-0a9be6c77de83df75]
module.vpc.aws_subnet.public[1]: Creation complete after 11s [id=subnet-02745b5cecd95fa65]
module.vpc.aws_subnet.public[2]: Creation complete after 11s [id=subnet-027bd5f23ad037261]
module.vpc.aws_route_table_association.public[0]: Creating...
module.vpc.aws_route_table_association.public[2]: Creating...
module.vpc.aws_nat_gateway.this[0]: Creating...
module.vpc.aws_route_table_association.public[1]: Creating...
module.vpc.aws_route_table_association.intra[2]: Still creating... [10s elapsed]
module.vpc.aws_route_table_association.intra[0]: Still creating... [10s elapsed]
module.vpc.aws_route_table_association.intra[1]: Still creating... [10s elapsed]
module.vpc.aws_route_table_association.public[2]: Creation complete after 1s [id=rtbassoc-04c6693b368430990]
module.vpc.aws_route_table_association.public[1]: Creation complete after 1s [id=rtbassoc-0b46b314f4b47a9c9]
module.vpc.aws_route_table_association.public[0]: Creation complete after 1s [id=rtbassoc-031641231e978e0b9]
module.vpc.aws_route_table_association.intra[2]: Creation complete after 14s [id=rtbassoc-0c7440b293d4cd8ae]
module.vpc.aws_route_table_association.intra[0]: Creation complete after 14s [id=rtbassoc-0eb3200d83c16ded5]
module.vpc.aws_route_table_association.intra[1]: Creation complete after 14s [id=rtbassoc-0f5f539a71ab7c679]
module.tgw.aws_ec2_transit_gateway.this[0]: Still creating... [20s elapsed]
module.vpc.aws_nat_gateway.this[0]: Still creating... [10s elapsed]
module.tgw.aws_ec2_transit_gateway.this[0]: Still creating... [30s elapsed]
module.vpc.aws_nat_gateway.this[0]: Still creating... [20s elapsed]
module.tgw.aws_ec2_transit_gateway.this[0]: Still creating... [40s elapsed]
module.vpc.aws_nat_gateway.this[0]: Still creating... [30s elapsed]
module.tgw.aws_ec2_transit_gateway.this[0]: Still creating... [50s elapsed]
module.vpc.aws_nat_gateway.this[0]: Still creating... [40s elapsed]
module.tgw.aws_ec2_transit_gateway.this[0]: Still creating... [1m0s elapsed]
module.vpc.aws_nat_gateway.this[0]: Still creating... [50s elapsed]
module.tgw.aws_ec2_transit_gateway.this[0]: Still creating... [1m10s elapsed]
module.vpc.aws_nat_gateway.this[0]: Still creating... [1m0s elapsed]
module.tgw.aws_ec2_transit_gateway.this[0]: Still creating... [1m20s elapsed]
module.vpc.aws_nat_gateway.this[0]: Still creating... [1m10s elapsed]
module.tgw.aws_ec2_transit_gateway.this[0]: Creation complete after 1m24s [id=tgw-0f09c208839fab7a3]
module.tgw.aws_ec2_tag.this["Name"]: Creating...
module.tgw.aws_ram_resource_association.this[0]: Creating...
module.tgw.aws_ec2_transit_gateway_route_table.this[0]: Creating...
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Creating...
module.tgw.aws_ec2_tag.this["Name"]: Creation complete after 0s [id=tgw-rtb-0c433b1024a8f3a91,Name]
module.tgw.aws_ram_resource_association.this[0]: Creation complete after 1s [id=arn:aws:ram:us-east-2:845940089308:resource-share/836a1157-d934-4cc0-8ab4-97121919b482,arn:aws:ec2:us-east-2:845940089308:transit-gateway/tgw-0f09c208839fab7a3]
module.vpc.aws_nat_gateway.this[0]: Still creating... [1m20s elapsed]
module.tgw.aws_ec2_transit_gateway_route_table.this[0]: Still creating... [10s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [10s elapsed]
module.vpc.aws_nat_gateway.this[0]: Still creating... [1m30s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [20s elapsed]
module.tgw.aws_ec2_transit_gateway_route_table.this[0]: Still creating... [20s elapsed]
module.vpc.aws_nat_gateway.this[0]: Creation complete after 1m34s [id=nat-0579642299de8f17c]
module.vpc.aws_route.private_nat_gateway[0]: Creating...
module.vpc.aws_route.private_nat_gateway[0]: Creation complete after 1s [id=r-rtb-00836f2861fae2e6f1080289494]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [30s elapsed]
module.tgw.aws_ec2_transit_gateway_route_table.this[0]: Still creating... [30s elapsed]
module.tgw.aws_ec2_transit_gateway_route_table.this[0]: Still creating... [40s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [40s elapsed]
module.tgw.aws_ec2_transit_gateway_route_table.this[0]: Creation complete after 43s [id=tgw-rtb-0070fb2694306cc38]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [50s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [1m0s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [1m10s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [1m20s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [1m30s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Still creating... [1m40s elapsed]
module.tgw.aws_ec2_transit_gateway_vpc_attachment.this["ent-core-infrastructure"]: Creation complete after 1m49s [id=tgw-attach-0cc73f35c75659b8e]
module.tgw.aws_ec2_transit_gateway_route_table_propagation.this["ent-core-infrastructure"]: Creating...
module.tgw.aws_ec2_transit_gateway_route_table_association.this["ent-core-infrastructure"]: Creating...
module.tgw.aws_ec2_transit_gateway_route_table_propagation.this["ent-core-infrastructure"]: Creation complete after 0s [id=tgw-rtb-0070fb2694306cc38_tgw-attach-0cc73f35c75659b8e]
module.tgw.aws_ec2_transit_gateway_route_table_association.this["ent-core-infrastructure"]: Still creating... [10s elapsed]
module.tgw.aws_ec2_transit_gateway_route_table_association.this["ent-core-infrastructure"]: Still creating... [20s elapsed]
module.tgw.aws_ec2_transit_gateway_route_table_association.this["ent-core-infrastructure"]: Creation complete after 23s [id=tgw-rtb-0070fb2694306cc38_tgw-attach-0cc73f35c75659b8e]
module.tgw_peer.aws_ram_resource_share_accepter.this[0]: Creating...
module.tgw_peer.aws_ec2_transit_gateway_vpc_attachment.this["dev_vpc"]: Creating...
module.tgw_peer.aws_ec2_transit_gateway_vpc_attachment.this["dev_vpc"]: Still creating... [10s elapsed]
module.tgw_peer.aws_ec2_transit_gateway_vpc_attachment.this["dev_vpc"]: Still creating... [20s elapsed]
module.tgw_peer.aws_ec2_transit_gateway_vpc_attachment.this["dev_vpc"]: Still creating... [30s elapsed]
module.tgw_peer.aws_ec2_transit_gateway_vpc_attachment.this["dev_vpc"]: Still creating... [40s elapsed]
module.tgw_peer.aws_ec2_transit_gateway_vpc_attachment.this["dev_vpc"]: Still creating... [50s elapsed]
module.tgw_peer.aws_ec2_transit_gateway_vpc_attachment.this["dev_vpc"]: Still creating... [1m0s elapsed]
module.tgw_peer.aws_ec2_transit_gateway_vpc_attachment.this["dev_vpc"]: Creation complete after 1m5s [id=tgw-attach-054cc1181d65d5b1e]
╷
│ Error: No RAM Resource Share () invitation found
│ 
│ NOTE: If both AWS accounts are in the same AWS Organization and RAM Sharing with AWS Organizations is enabled, this resource is not necessary
│ 
│   with module.tgw_peer.aws_ram_resource_share_accepter.this[0],
│   on .terraform/modules/tgw_peer/main.tf line 170, in resource "aws_ram_resource_share_accepter" "this":
│  170: resource "aws_ram_resource_share_accepter" "this" {
│ 
╵

provider "aws" {
  region = local.region
}

# This provider is required for attachment only installation in another AWS Account
provider "aws" {
  region = local.region
  alias  = "peer"
}

locals {
  name   = "ex-tgw-${replace(basename(path.cwd), "_", "-")}"
  region = "eu-west-1"

  tags = {
    Example    = local.name
    GithubRepo = "terraform-aws-eks"
    GithubOrg  = "terraform-aws-transit-gateway"
  }
}

################################################################################
# Transit Gateway Module
################################################################################

module "tgw" {
  source = "../../"

  name            = local.name
  description     = "My TGW shared with several other AWS accounts"
  amazon_side_asn = 64532

  # When "true" there is no need for RAM resources if using multiple AWS accounts
  enable_auto_accept_shared_attachments = true

  vpc_attachments = {
    vpc1 = {
      vpc_id       = module.vpc1.vpc_id
      subnet_ids   = module.vpc1.private_subnets
      dns_support  = true
      ipv6_support = true

      transit_gateway_default_route_table_association = false
      transit_gateway_default_route_table_propagation = false

      tgw_routes = [
        {
          destination_cidr_block = "30.0.0.0/16"
        },
        {
          blackhole              = true
          destination_cidr_block = "0.0.0.0/0"
        }
      ]
    },
    vpc2 = {
      vpc_id     = module.vpc2.vpc_id
      subnet_ids = module.vpc2.private_subnets

      tgw_routes = [
        {
          destination_cidr_block = "50.0.0.0/16"
        },
        {
          blackhole              = true
          destination_cidr_block = "10.10.10.10/32"
        }
      ]
    },
  }

  ram_allow_external_principals = true
  ram_principals                = [307990089504]

  tags = local.tags
}

module "tgw_peer" {
  # This is optional and connects to another account. Meaning you need to be authenticated with 2 separate AWS Accounts
  source = "../../"

  providers = {
    aws = aws.peer
  }

  name            = "${local.name}-peer"
  description     = "My TGW shared with several other AWS accounts"
  amazon_side_asn = 64532

  create_tgw             = false
  share_tgw              = true
  ram_resource_share_arn = module.tgw.ram_resource_share_id
  # When "true" there is no need for RAM resources if using multiple AWS accounts
  enable_auto_accept_shared_attachments = true

  vpc_attachments = {
    vpc1 = {
      tgw_id       = module.tgw.ec2_transit_gateway_id
      vpc_id       = module.vpc1.vpc_id
      subnet_ids   = module.vpc1.private_subnets
      dns_support  = true
      ipv6_support = true

      transit_gateway_default_route_table_association = false
      transit_gateway_default_route_table_propagation = false

      tgw_routes = [
        {
          destination_cidr_block = "30.0.0.0/16"
        },
        {
          blackhole              = true
          destination_cidr_block = "0.0.0.0/0"
        }
      ]
    },
  }

  ram_allow_external_principals = true
  ram_principals                = [307990089504]

  tags = local.tags
}

################################################################################
# Supporting resources
################################################################################

module "vpc1" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 3.0"

  name = "${local.name}-vpc1"
  cidr = "10.10.0.0/16"

  azs             = ["${local.region}a", "${local.region}b", "${local.region}c"]
  private_subnets = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]

  enable_ipv6                                    = true
  private_subnet_assign_ipv6_address_on_creation = true
  private_subnet_ipv6_prefixes                   = [0, 1, 2]

  tags = local.tags
}


module "vpc2" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 3.0"

  providers = {
    aws = aws.peer
  }

  name = "${local.name}-vpc2"
  cidr = "10.20.0.0/16"

  azs             = ["${local.region}a", "${local.region}b", "${local.region}c"]
  private_subnets = ["10.20.1.0/24", "10.20.2.0/24", "10.20.3.0/24"]

  enable_ipv6 = false

  tags = local.tags
}

module "tgw_oregon_public" {
  source  = "terraform-aws-modules/transit-gateway/aws"
  version = "~> 1.0"
  
  name        = "us-west-2_public"
  description = "us-west-2 public transit gateway"
  
  amazon_side_asn = "64512" # should be unique

  enable_auto_accept_shared_attachments = false

  vpc_attachments = {
    oregon = {
      ...
    },
  }

  # example
  peering_attachments = {
    oregon = {
      vpc_id = ""
      subnet_ids = []
    },
  }
}

module "tgw" {
  source  = "terraform-aws-modules/transit-gateway/aws"

  name            = "account-a-tgw"
  description     = "account-a-tgw"
  amazon_side_asn = 66666
  enable_auto_accept_shared_attachments = true

  vpc_attachments = {
    vpc1 = {
      vpc_id                                              = data.aws_vpc.default.id 
      subnet_ids                                       = data.aws_subnet_ids.this.ids
      dns_support                                    = true
      ipv6_support                                    = false
      transit_gateway_default_route_table_association = true
      transit_gateway_default_route_table_propagation = true
      vpc_route_table_ids                         = data.aws_route_tables.rts.ids
      # Route all internal traffic across TGW
      tgw_destination_cidr                  = "172.0.0.0/8"
      # Add TGW route for account A VPC
      tgw_routes = [
        {
          destination_cidr_block = "172.16.0.0/16"
        }
      ]
    }
  }
  ram_allow_external_principals = false
  ram_principals                = ["xxxxxxxxxx"]

  tags = {
    Purpose = "tgw-complete-example"
  }
}

## Lookup Account A TGW
data "aws_ec2_transit_gateway" "tgw" {
  filter {
    name   = "owner-id"
    values = ["50000000000"]
  }
  filter {
    name   = "options.amazon-side-asn"
    values = ["6666666"]
  }
  tags = {
    Name = "account-a-tgw"
    description = "account-a-tgw"
  }
}


## Use tgw module to set up tgw
module "tgw" {
  source  = "terraform-aws-modules/transit-gateway/aws"
  name            = "account-b-tgw-association"
  description     = "account-b-tgw-association"
  amazon_side_asn = 66666
  create_tgw  = false
  share_tgw   = false
  transit_gateway_id = data.aws_ec2_transit_gateway.tgw.id
  vpc_attachments = {
    vpc1 = {
      vpc_id                                              = data.aws_vpc.default.id 
      subnet_ids                                       = data.aws_subnet_ids.this.ids
      dns_support                                    = true
      ipv6_support                                    = false
      vpc_route_table_ids                         = data.aws_route_tables.rts.ids
      # Route all internal traffic across TGW
      tgw_destination_cidr                  = "172.0.0.0/8"
    }
 }
}

Terraform will perform the following actions:

  # module.tgw_east.aws_ec2_tag.this["Name"] will be updated in-place
  ~ resource "aws_ec2_tag" "this" {
        id          = "tgw-rtb-0d398c6b8fc7248c7,Name"
      ~ value       = "rt-tgw-p-dx-useast1" -> "tgw-p-upt-sharedservices-useast1"
        # (2 unchanged attributes hidden)
    }

  # module.tgw_japan.aws_ec2_tag.this["Name"] will be updated in-place
  ~ resource "aws_ec2_tag" "this" {
        id          = "tgw-rtb-0ccbafe954a31456d,Name"
      ~ value       = "rt-tgw-p-dx-apnortheast1" -> "tgw-p-upt-sharedservices-apnortheast1"
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Terraform will perform the following actions:

  # module.tgw_east.aws_ec2_transit_gateway_route_table.this[0] will be updated in-place
  ~ resource "aws_ec2_transit_gateway_route_table" "this" {
        id                              = "tgw-rtb-0d398c6b8fc7248c7"
      ~ tags                            = {
          ~ "Name"                = "tgw-p-upt-sharedservices-useast1" -> "rt-tgw-p-dx-useast1"
            # (1 unchanged element hidden)
        }
      ~ tags_all                        = {
          ~ "Name"                = "tgw-p-upt-sharedservices-useast1" -> "rt-tgw-p-dx-useast1"
            # (8 unchanged elements hidden)
        }
        # (4 unchanged attributes hidden)
    }

  # module.tgw_japan.aws_ec2_transit_gateway_route_table.this[0] will be updated in-place
  ~ resource "aws_ec2_transit_gateway_route_table" "this" {
        id                              = "tgw-rtb-0ccbafe954a31456d"
      ~ tags                            = {
          ~ "Name"                = "tgw-p-upt-sharedservices-apnortheast1" -> "rt-tgw-p-dx-apnortheast1"
            # (1 unchanged element hidden)
        }
      ~ tags_all                        = {
          ~ "Name"                = "tgw-p-upt-sharedservices-apnortheast1" -> "rt-tgw-p-dx-apnortheast1"
            # (8 unchanged elements hidden)
        }
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

module.vpn_tgw[0].aws_ram_resource_share.this[0]: Creating...
module.vpn_tgw[0].aws_ram_resource_share.this[0]: Creation complete after 2s [id=arn:aws:ram:us-east-1:111111111111:resource-share/11111111-1111-1111-1111-111111111111]
module.vpn_tgw[0].aws_ec2_transit_gateway.this[0]: Still creating... [10s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway.this[0]: Still creating... [20s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway.this[0]: Still creating... [30s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway.this[0]: Still creating... [40s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway.this[0]: Still creating... [50s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway.this[0]: Still creating... [1m0s elapsed]
module.vpn_tgw[0].aws_ram_principal_association.this[0]: Creating...
module.vpn_tgw[0].aws_ram_principal_association.this[0]: Creation complete after 1s [id=arn:aws:ram:us-east-1:111111111111:resource-share/11111111-1111-1111-1111-111111111111,111111111111]
module.vpn_tgw[0].aws_ec2_transit_gateway.this[0]: Still creating... [1m20s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway.this[0]: Creation complete after 1m25s [id=tgw-11111111111111111]
module.vpn_tgw[0].aws_ram_resource_association.this[0]: Creating...
module.vpn_tgw[0].aws_ec2_transit_gateway_route_table.this[0]: Creating...
module.vpn_tgw[0].aws_ram_resource_association.this[0]: Creation complete after 2s [id=arn:aws:ram:us-east-1:11111111111111111:resource-share/11111111-1111-1111-1111-111111111111,arn:aws:ec2:us-east-1:11111111111111111:transit-gateway/tgw-11111111111111111]
module.vpn_tgw[0].aws_ec2_transit_gateway_vpc_attachment.this["database"]: Creating...
module.vpn_tgw[0].aws_ec2_transit_gateway_route_table.this[0]: Still creating... [10s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway_vpc_attachment.this["database"]: Still creating... [10s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway_route_table.this[0]: Creation complete after 14s [id=tgw-rtb-11111111111111111]
module.vpn_tgw[0].aws_ec2_transit_gateway_vpc_attachment.this["database"]: Still creating... [20s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway_vpc_attachment.this["database"]: Still creating... [30s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway_vpc_attachment.this["database"]: Still creating... [40s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway_vpc_attachment.this["database"]: Still creating... [50s elapsed]
module.vpn_tgw[0].aws_ec2_transit_gateway_vpc_attachment.this["database"]: Creation complete after 55s [id=tgw-attach-11111111111111111]
module.vpn_tgw_shared[0].aws_ec2_transit_gateway_vpc_attachment.this["vpn"]: Creating...
module.vpn_tgw_shared[0].aws_ram_resource_share_accepter.this[0]: Creating...
module.vpn_tgw_shared[0].aws_ram_resource_share_accepter.this[0]: Creation complete after 4s [id=arn:aws:ram:us-east-1:11111111:resource-share/11111111-1111-1111-1111-111111111111]
╷
│ Error: creating EC2 Transit Gateway VPC Attachment: InvalidTransitGatewayID.NotFound: Transit Gateway tgw-11111111111111111 was deleted or does not exist.
│       status code: 400, request id: 11111111-1111-1111-1111-111111111111
│ 
│   with module.vpn_tgw_shared[0].aws_ec2_transit_gateway_vpc_attachment.this["vpn"],
│   on .terraform/modules/goby.vpn_tgw_shared/main.tf line 65, in resource "aws_ec2_transit_gateway_vpc_attachment" "this":
│   65: resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
│ 
╵

$ terraform version
Terraform v0.15.0
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v3.37.0

  source = "terraform-aws-modules/transit-gateway/aws"
  version = "~> 2.0"

module "tgw" {
  source = "terraform-aws-modules/transit-gateway/aws"
  version = "~> 2.0"

  name            = local.tgw_name
  description     = "Regional core TGW"
  amazon_side_asn = var.asn

  enable_auto_accept_shared_attachments = true 

  vpc_attachments = {
    shared_services_vpc = {
      vpc_id                                          = module.vpc.vpc_id
      subnet_ids                                      = module.vpc.private_subnets
      dns_support                                     = true
      ipv6_support                                    = true
      transit_gateway_default_route_table_association = true
      transit_gateway_default_route_table_propagation = true
    },
  }

  ram_allow_external_principals = true
  ram_principals                = [data.aws_organizations_organization.this.arn]
}

╷
│ Error: Error in function call
│ 
│   on .terraform/modules/sandbox.us_east_2_net.tgw/main.tf line 12, in locals:
│   12:     for k, v in var.vpc_attachments : setproduct([map("key", k)], v["tgw_routes"]) if length(lookup(v, "tgw_routes", {})) > 0
│ 
│ Call to function "map" failed: the "map" function was deprecated in Terraform v0.12 and is no longer available; use tomap({ ... }) syntax to write a literal map.
╵

module "tgw" {
  source = "terraform-aws-modules/transit-gateway/aws"
  name   = "TGW-Name"

  enable_auto_accept_shared_attachments = true
  
  vpc_attachments = {
    vpc = {
      vpc_id       = data.aws_vpc.vpc.id                                 
      subnet_ids   = var.subnets
      dns_support  = true
      ipv6_support = false
    }
  } 

  ram_allow_external_principals = true
  ram_principals                = ["##########"]
  
  tags = {
    Ticket = "######"
  }

  tgw_route_table_tags = {
    Name = "Non-default Route Table"
  }
}

➜ terraform init
Initializing modules...

Error: Unsupported Terraform Core version

  on .terraform/modules/transit-gateway/versions.tf line 2, in terraform:
   2:   required_version = ">= 0.12.7, < 0.14"

provider "aws" {
  region = "us-east-1"
  alias    = "one"
}
provider "aws" {
  region = "us-east-1"
  alias    = "two"
}

// See Notes in README.md for explanation regarding using data-sources and computed values
data "aws_vpc" "default" {
  default = true
}

data "aws_subnet_ids" "this" {
  vpc_id = data.aws_vpc.default.id
}

module "tgw" {
  **providers = {aws = "aws.one"}**
  source = "../../"
  name            = "my-tgw"
  description     = "My TGW shared with several other AWS accounts"
  amazon_side_asn = 64532
  enable_auto_accept_shared_attachments = true
  vpc_attachments = {
    vpc1 = {
      **providers = {aws = "aws.one"}**
      vpc_id                                          = data.aws_vpc.default.id      # module.vpc1.vpc_id
      subnet_ids                                      = data.aws_subnet_ids.this.ids # module.vpc1.private_subnets
      dns_support                                     = true
      ipv6_support                                    = true
      transit_gateway_default_route_table_association = false
      transit_gateway_default_route_table_propagation = false

      tgw_routes = [
        {
          destination_cidr_block = "30.0.0.0/16"
        },
        {
          blackhole              = true
          destination_cidr_block = "0.0.0.0/0"
        }
      ]
    },
    vpc2 = {
      **providers = {aws = "aws.two"}**
      vpc_id     = data.aws_vpc.default.id      # module.vpc2.vpc_id
      subnet_ids = data.aws_subnet_ids.this.ids # module.vpc2.private_subnets

      tgw_routes = [
        {
          destination_cidr_block = "50.0.0.0/16"
        },
        {
          blackhole              = true
          destination_cidr_block = "10.10.10.10/32"
        }
      ]
    },
  }

  ram_allow_external_principals = false
  ram_principals                = [************]

  tags = {
    Purpose = "tgw-complete-example"
  }
}

module "vpc1" {
  providers = {aws = "aws.one"}
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 2.0"
  name = "vpc1"
  cidr = "10.10.0.0/16"
  azs             = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
  private_subnets = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
  enable_ipv6                                    = true
  private_subnet_assign_ipv6_address_on_creation = true
  private_subnet_ipv6_prefixes                   = [0, 1, 2]
}

module "vpc2" {
  providers = {aws = "aws.two"}
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 2.0"
  name = "vpc2"
  cidr = "10.20.0.0/16"
  azs             = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
  private_subnets = ["10.20.1.0/24", "10.20.2.0/24", "10.20.3.0/24"]
  enable_ipv6 = false
}

module.eks.null_resource.wait_for_cluster: Still creating... [56m40s elapsed]
module.eks.null_resource.wait_for_cluster: Still creating... [56m50s elapsed]
module.eks.null_resource.wait_for_cluster: Still creating... [57m0s elapsed]
module.eks.null_resource.wait_for_cluster: Still creating... [57m10s elapsed]
module.eks.null_resource.wait_for_cluster: Still creating... [57m20s elapsed]

create_tgw = true 
share_tgw = true
ram_allow_external_principals = true
ram_principals = [<account_b>]

create_tgw = false 
share_tgw = true

module.usgce_tgw.aws_ram_resource_share.this[0]: Creation complete after 1s [id=arn:aws-us-gov:ram:us-gov-east-1:<acct_id>:resource-share/<id>]
module.usgce_tgw_poclab_peer.aws_ram_resource_share_accepter.this[0]: Creating...
module.usgce_tgw.aws_ram_principal_association.this[0]: Creation complete after 1s [id=arn:aws-us-gov:ram:us-gov-east-1:<account_id>:resource-share/<id>]
module.usgce_tgw.aws_ram_resource_association.this[0]: Creation complete after 2s [id=arn:aws-us-gov:ram:us-gov-east-1:<account_id>:resource-share/<id>,arn:aws-us-gov:ec2:us-gov-east-1:<account_id>:transit-gateway/tgw-<id>]

Error: No RAM Resource Share (arn:aws-us-gov:ram:us-gov-east-1:<account_id>:resource-share/<id>) invitation found

# module.usgce_tgw_poclab_peer.aws_ram_resource_share_accepter.this[0] will be created

Error: error retrieving resource shares: UnknownResourceException: ResourceShare arn:aws-us-gov:ram:us-gov-east-1:<account_id>:resource-share/<id> could not be found.

Error: No RAM Resource Share (arn:aws-us-gov:ram:us-gov-east-1:<account_id>:resource-share/<id>) invitation found

module.usgce_tgw_poclab_peer.aws_ram_resource_share_accepter.this[0]: Creating...
module.usgce_tgw_poclab_peer.aws_ram_resource_share_accepter.this[0]: Creation complete after 2s [id=arn:aws-us-gov:ram:us-gov-east-1:<account_id>:resource-share/<id>]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

module "tgw_use1" {
...
  ram_principals                = [
      "111111111111", #Acct1
      "222222222222", #Acct2
      "333333333333", #Acct3
      "444444444444", #Acct4
      "555555555555", #Acct4
  ]

  # module.tgw_use1.aws_ram_principal_association.this[2] must be replaced
-/+ resource "aws_ram_principal_association" "this" {
      ~ id                 = "arn:aws:ram:us-east-1:<TGW_ACCT>:resource-share/<tgw_ram_resource_share_id>,333333333333" -> (known after apply)
      ~ principal          = "333333333333" -> "444444444444" # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.tgw_use1.aws_ram_principal_association.this[3] must be replaced
-/+ resource "aws_ram_principal_association" "this" {
      ~ id                 = "arn:aws:ram:us-east-1:<TGW_ACCT>:resource-share/<tgw_ram_resource_share_id>,444444444444" -> (known after apply)
      ~ principal          = "444444444444" -> "555555555555" # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.tgw_use1.aws_ram_principal_association.this[4] will be destroyed
  # (because index [8] is out of range for count)
  - resource "aws_ram_principal_association" "this" {
      - id                 = "arn:aws:ram:us-east-1:<TGW_ACCT>:resource-share/<tgw_ram_resource_share_id>,555555555555" -> null
      - principal          = "555555555555" -> null
      - resource_share_arn = "arn:aws:ram:us-east-1:<TGW_ACCT>:resource-share/<tgw_ram_resource_share_id>" -> null
    }

module "tgw" {
  source  = "terraform-aws-modules/transit-gateway/aws"
  version = "~> 2.6.0"

  name        = var.tgw.name
  description = var.tgw.description
  enable_auto_accept_shared_attachments = true

  # connect other vpcs in their own module
  vpc_attachments = {
    vpc_route = {
      vpc_id       = module.vpc.vpc_id
      subnet_ids   = module.vpc.private_subnets
      dns_support  = true
      ipv6_support = false

      tgw_routes = [
        for cidr in var.tgw.tgw_routes : {
          destination_cidr_block = cidr
        }
      ]
    },
  }

  ram_allow_external_principals = true
  ram_principals                = var.aws_account_id_list

  ram_tags                     = merge(var.tags, var.tgw.name_tags)
  tgw_default_route_table_tags = merge(var.tags, var.tgw.name_tags)
  tgw_route_table_tags         = merge(var.tags, var.tgw.name_tags)
  tgw_tags                     = merge(var.tags, var.tgw.name_tags)
  tgw_vpc_attachment_tags      = merge(var.tags, var.tgw.name_tags)
  tags                         = merge(var.tags, var.tgw.tags)
}

module "tgw" {
  source  = "terraform-aws-modules/transit-gateway/aws"
  version = "~> 2.6.0"

  name = var.tgw.name

  create_tgw             = false
  share_tgw              = false

  vpc_attachments = {
    vpc = {
      tgw_id       = var.tgw.tgw_id
      vpc_id       = module.vpc.vpc_id
      subnet_ids   = module.vpc.private_subnets
      dns_support  = true
      ipv6_support = false

      # transit_gateway_default_route_table_association = false
      # transit_gateway_default_route_table_propagation = false

      tgw_routes = [
        for cidr in var.tgw.tgw_routes : {
          destination_cidr_block = cidr
        }
      ]
    }
  }

  ram_tags                     = merge(var.tags, var.tgw.name_tags)
  tgw_default_route_table_tags = merge(var.tags, var.tgw.name_tags)
  tgw_route_table_tags         = merge(var.tags, var.tgw.name_tags)
  tgw_tags                     = merge(var.tags, var.tgw.name_tags)
  tgw_vpc_attachment_tags      = merge(var.tags, var.tgw.name_tags)
  tags                         = merge(var.tags, var.tgw.tags)
}

tgw = {
  name                   = "aws-logs-tgw"
  tgw_id                 = "tgw-0xxxxx6"
  tgw_routes             = ["10.40.0.0/16", "10.41.0.0/16", "10.42.0.0/16", "10.43.0.0/16", "10.44.0.0/16", "10.45.0.0/16", "10.46.0.0/16", "10.47.0.0/16"]
  tags = {
    "Name"    = "aws-logs-tgw"
  }
  name_tags = {
    "Name" = "aws-logs-tgw"
  }
}