Templates Overview

┌─────────────────────────────────────────────────────────────────┐
│ existing_vpc_resources Template (Run First)                     │
│                                                                 │
│  ┌──────────────────┐    ┌─────────────────┐                    │
│  │ Management VPC   │    │ Transit Gateway │                    │
│  │ - FortiManager   │    │ - Spoke VPCs    │                    │
│  │ - FortiAnalyzer  │    │ - Linux Instances                    │
│  │ - Jump Box       │    │ - Test Traffic  │                    │
│  └──────────────────┘    └─────────────────┘                    │
│          │                       │                              │
│          └───────────┬───────────┘                              │
│                      │                                          │
│  ┌───────────────────▼───────────────────┐                      │
│  │ Inspection VPC (with Fortinet-Role    │                      │
│  │ tags for resource discovery)          │                      │
│  │ - Public/Private/GWLBE Subnets        │                      │
│  │ - Route Tables, IGW, NAT GW           │                      │
│  │ - TGW Attachment (optional)           │                      │
│  └───────────────────────────────────────┘                      │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘
                       │ (Fortinet-Role tag discovery)
┌──────────────────────┼──────────────────────────────────────────┐
│ autoscale_template (Run Second)   │                               │
│                      │                                          │
│  ┌────────────────── ▼ ────────────────┐                        │
│  │ Deploys INTO Inspection VPC         │                        │
│  │ - FortiGate Autoscale Group         │                        │
│  │ - Gateway Load Balancer             │                        │
│  │ - GWLB Endpoints                    │                        │
│  │ - Lambda Functions                  │                        │
│  │ - Route modifications               │                        │
│  └─────────────────────────────────────┘                        │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

1. Do you have existing VPCs with Fortinet-Role tags?
   ├─ YES → Deploy autoscale_template only
   │         (Resources discovered via Fortinet-Role tags)
   │
   └─ NO → Continue to question 2

2. Do you need a complete lab environment for testing?
   ├─ YES → Deploy existing_vpc_resources (all components)
   │         Then deploy autoscale_template
   │         See: Lab Environment Pattern
   │
   └─ NO → Continue to question 3

3. Do you need centralized management (FortiManager/FortiAnalyzer)?
   ├─ YES → Deploy existing_vpc_resources (with management VPC)
   │         Then deploy autoscale_template
   │         See: Management VPC Pattern
   │
   └─ NO → Deploy existing_vpc_resources (inspection VPC only)
           Then deploy autoscale_template
           See: Minimal Deployment Pattern

# existing_vpc_resources
enable_build_inspection_vpc   = true
enable_build_management_vpc   = false
enable_build_existing_subnets = false

# Step 1: Deploy existing_vpc_resources (creates Inspection VPC with Fortinet-Role tags)
cd terraform/existing_vpc_resources
cp terraform.tfvars.example terraform.tfvars
# Edit: Enable all components:
#   enable_build_inspection_vpc   = true
#   enable_build_management_vpc   = true
#   enable_build_existing_subnets = true
#   enable_fortimanager           = true
#   enable_fortianalyzer          = true
terraform init && terraform apply

# Step 2: Note outputs (Fortinet-Role tags created automatically)
terraform output  # Save TGW name and FortiManager IP

# Step 3: Deploy autoscale_template (discovers VPCs via Fortinet-Role tags)
cd ../autoscale_template
cp terraform.tfvars.example terraform.tfvars
# Edit: Use SAME cp and env values (critical for tag discovery)
#       Set attach_to_tgw_name from Step 2 output
#       Configure FortiManager integration
terraform init && terraform apply

# Step 4: Verify
ssh -i ~/.ssh/keypair.pem ec2-user@<jump-box-ip>
curl http://<linux-instance-ip>  # Test connectivity

# Step 1: Deploy existing_vpc_resources (Inspection VPC only)
cd terraform/existing_vpc_resources
cp terraform.tfvars.example terraform.tfvars
# Edit:
#   enable_build_inspection_vpc   = true
#   enable_build_management_vpc   = false
#   enable_build_existing_subnets = true  # if TGW needed
#   attach_to_tgw_name            = "production-tgw"  # existing TGW
terraform init && terraform apply

# Step 2: Deploy autoscale_template
cd ../autoscale_template
cp terraform.tfvars.example terraform.tfvars
# Edit: Use SAME cp and env values
#       Set attach_to_tgw_name to production TGW
#       Configure production-appropriate capacity
terraform init && terraform apply

# Step 3: Update TGW route tables (if needed)
# Route spoke VPC traffic (0.0.0.0/0) to inspection VPC attachment

# Step 4: Test and validate
# Verify traffic flows through FortiGate

# Step 1: Deploy existing_vpc_resources (Inspection + Management VPCs)
cd terraform/existing_vpc_resources
cp terraform.tfvars.example terraform.tfvars
# Edit:
#   enable_build_inspection_vpc   = true
#   enable_build_management_vpc   = true
#   enable_fortimanager           = true
#   enable_fortianalyzer          = true
#   enable_build_existing_subnets = false
terraform init && terraform apply

# Step 2: Configure FortiManager
# Access FortiManager GUI: https://<fmgr-ip>
# Enable VM device recognition if FMG 7.6.3+
config system global
    set fgfm-allow-vm enable
end

# Step 3: Deploy autoscale_template
cd ../autoscale_template
cp terraform.tfvars.example terraform.tfvars
# Edit: Use SAME cp and env values
#       enable_fortimanager_integration = true
#       fortimanager_ip = <from Step 1 output>
#       enable_dedicated_management_vpc = true
terraform init && terraform apply

# Step 4: Authorize devices on FortiManager
# Device Manager > Device & Groups
# Right-click unauthorized device > Authorize

# Step 1: Deploy existing_vpc_resources (Inspection VPC only)
cd terraform/existing_vpc_resources
cp terraform.tfvars.example terraform.tfvars
# Edit:
#   enable_build_inspection_vpc   = true
#   enable_build_management_vpc   = false
#   enable_build_existing_subnets = false
#   inspection_access_internet_mode = "eip"  # simpler, lower cost
terraform init && terraform apply

# Step 2: Deploy autoscale_template
cd ../autoscale_template
cp terraform.tfvars.example terraform.tfvars
# Edit: Use SAME cp and env values
#       enable_tgw_attachment = false
#       access_internet_mode = "eip"
terraform init && terraform apply

# Step 3: Note GWLB endpoint IDs for spoke VPC integration
terraform output gwlb_endpoint_az1_id
terraform output gwlb_endpoint_az2_id

# Step 4: Integrate spoke VPCs
# Deploy GWLB endpoints in spoke VPCs
# Update spoke VPC route tables to point to GWLB endpoints

aws_region          = "us-west-2"
availability_zone_1 = "a"
availability_zone_2 = "c"
cp                  = "acme"      # Creates tags like "acme-test-inspection-vpc"
env                 = "test"
vpc_cidr_ns_inspection = "10.0.0.0/16"
vpc_cidr_management    = "10.3.0.0/16"

aws_region          = "us-west-2"  # MUST MATCH
availability_zone_1 = "a"          # MUST MATCH
availability_zone_2 = "c"          # MUST MATCH
cp                  = "acme"       # MUST MATCH - used for tag lookup
env                 = "test"       # MUST MATCH - used for tag lookup
vpc_cidr_inspection = "10.0.0.0/16"  # Should match existing VPC CIDR
vpc_cidr_management = "10.3.0.0/16"  # Should match if using management VPC

attach_to_tgw_name = "acme-test-tgw"  # Matches cp-env naming convention

# autoscale_template/vpc_inspection.tf
data "aws_vpc" "inspection" {
  filter {
    name   = "tag:Fortinet-Role"
    values = ["${var.cp}-${var.env}-inspection-vpc"]  # e.g., "acme-test-inspection-vpc"
  }
}