Palo Alto VM-Series detrás de Gateway Load Balancer en AWS

terraform {
  required_version = ">= 1.5"
  required_providers {
    aws    = { source = "hashicorp/aws", version = "~> 5.0" }
    random = { source = "hashicorp/random", version = "~> 3.6" }
  }
}

provider "aws" {
  region = var.region
  default_tags {
    tags = {
      Project   = "kf-gwlb-lab"
      ManagedBy = "terraform"
      Owner     = "csegovia"
    }
  }
}

variable "region" {
  type    = string
  default = "us-east-1"
}

variable "vpc_cidr" {
  description = "Verificado libre contra la tabla de rutas del PA-410."
  type        = string
  default     = "10.20.0.0/16"
}

variable "azs" {
  type    = list(string)
  default = ["us-east-1a", "us-east-1b"]
}

# Cinco subnets por AZ. Cada una tiene un rol distinto en el path de GENEVE.
locals {
  az = { a = var.azs[0], b = var.azs[1] }

  subnets = {
    a = {
      public = "10.20.0.0/24" # NAT GW
      mgmt   = "10.20.1.0/24" # eth0 del VM-Series
      fwdata = "10.20.2.0/24" # eth1, GENEVE, target del GWLB
      gwlbe  = "10.20.3.0/24" # endpoints del GWLB
      app    = "10.20.4.0/24" # workloads
    }
    b = {
      public = "10.20.10.0/24"
      mgmt   = "10.20.11.0/24"
      fwdata = "10.20.12.0/24"
      gwlbe  = "10.20.13.0/24"
      app    = "10.20.14.0/24"
    }
  }

  # Rutas app -> GWLBE para cada prefijo del lab, por AZ.
  app_lab_routes = {
    for p in setproduct(keys(local.subnets), var.lab_cidrs) :
    "${p[0]}|${p[1]}" => { az = p[0], cidr = p[1] }
  }
}

# --- VPN / BGP ---------------------------------------------------------------

variable "cgw_public_ip" {
  description = "IP publica del PA-410 (ethernet1/1)."
  type        = string
  default     = "<IP-PUBLICA-CGW>"
}

variable "cgw_asn" {
  description = "AS local del PA-410, ya existente en el VR default."
  type        = number
  default     = 65000
}

variable "vgw_asn" {
  type    = number
  default = 64512
}

variable "tunnel1_inside_cidr" {
  description = "169.254.100.0/30 NO se puede: la usa el peer HEX-CASA."
  type        = string
  default     = "169.254.200.0/30"
}

variable "tunnel2_inside_cidr" {
  type    = string
  default = "169.254.201.0/30"
}

variable "lab_cidrs" {
  description = "Prefijos del home lab que se alcanzan por el tunel y se inspeccionan."
  type        = list(string)
  default = [
    "192.168.100.0/24",
    "192.168.106.0/24",
    "10.1.0.0/16",
    "10.142.0.0/16",
  ]
}

# --- Firewalls ---------------------------------------------------------------

# Parametro publico de SSM que publica AWS Marketplace. Resuelve al AMI
# correcto por region sin hardcodear IDs.
#
#   prod-<ID-DEL-LISTING> = listing "VM-Series Next-Gen Virtual Firewall
#                        w/Advanced Threat Prevention (PAYG)"
#
# OJO: usar el AMI de OTRO listing hace que la instancia facture contra una
# suscripcion que no tiene. El product code va atado al listing.
variable "panos_ssm_parameter" {
  type    = string
  default = "/aws/service/marketplace/prod-<ID-DEL-LISTING>/pan-os-11.1.15"
}

# Override manual. Si se setea, gana sobre el parametro SSM.
variable "panos_ami_id" {
  type    = string
  default = ""
}

variable "panos_instance_type" {
  description = "GWLB necesita minimo 10.0.2. m5.xlarge soporta las NICs necesarias."
  type        = string
  default     = "m5.xlarge"
}

variable "key_pair_name" {
  type = string
}

# Lista, no string: la IP publica de salida del equipo desde el que se
# administra NO siempre es la de ethernet1/1 del PA-410. Con un solo valor la
# unica salida era agregar la IP real a mano en la consola, y como los bloques
# ingress son inline, el siguiente terraform apply la revocaba en silencio.
variable "admin_cidrs" {
  description = "CIDRs con acceso de gestion a los VM-Series (SSH, HTTPS, ICMP)."
  type        = list(string)
  default     = ["<IP-PUBLICA-CGW>/32"]
}

resource "aws_vpc" "lab" {
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags                 = { Name = "kf-gwlb-vpc" }
}

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.lab.id
  tags   = { Name = "kf-gwlb-igw" }
}

# --- Subnets -----------------------------------------------------------------

resource "aws_subnet" "public" {
  for_each          = local.subnets
  vpc_id            = aws_vpc.lab.id
  cidr_block        = each.value.public
  availability_zone = local.az[each.key]
  tags              = { Name = "kf-public-${each.key}" }
}

resource "aws_subnet" "mgmt" {
  for_each          = local.subnets
  vpc_id            = aws_vpc.lab.id
  cidr_block        = each.value.mgmt
  availability_zone = local.az[each.key]
  tags              = { Name = "kf-mgmt-${each.key}" }
}

resource "aws_subnet" "fwdata" {
  for_each          = local.subnets
  vpc_id            = aws_vpc.lab.id
  cidr_block        = each.value.fwdata
  availability_zone = local.az[each.key]
  tags              = { Name = "kf-fwdata-${each.key}" }
}

resource "aws_subnet" "gwlbe" {
  for_each          = local.subnets
  vpc_id            = aws_vpc.lab.id
  cidr_block        = each.value.gwlbe
  availability_zone = local.az[each.key]
  tags              = { Name = "kf-gwlbe-${each.key}" }
}

resource "aws_subnet" "app" {
  for_each          = local.subnets
  vpc_id            = aws_vpc.lab.id
  cidr_block        = each.value.app
  availability_zone = local.az[each.key]
  tags              = { Name = "kf-app-${each.key}" }
}

# --- NAT Gateway por AZ ------------------------------------------------------
# Uno por AZ. Con uno solo compartido el retorno cruza AZ y el path se vuelve
# dificil de explicar. Son US$0.045/hr cada uno: el segundo item mas caro
# despues de los firewalls.

resource "aws_eip" "nat" {
  for_each   = local.subnets
  domain     = "vpc"
  tags       = { Name = "kf-eip-nat-${each.key}" }
  depends_on = [aws_internet_gateway.igw]
}

resource "aws_nat_gateway" "nat" {
  for_each      = local.subnets
  allocation_id = aws_eip.nat[each.key].id
  subnet_id     = aws_subnet.public[each.key].id
  tags          = { Name = "kf-nat-${each.key}" }
  depends_on    = [aws_internet_gateway.igw]
}

# --- Security groups ---------------------------------------------------------

resource "aws_security_group" "mgmt" {
  name        = "kf-sg-mgmt"
  description = "Gestion de los VM-Series"
  vpc_id      = aws_vpc.lab.id

  ingress {
    description = "HTTPS GUI"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = concat(var.admin_cidrs, var.lab_cidrs)
  }
  ingress {
    description = "SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = concat(var.admin_cidrs, var.lab_cidrs)
  }
  ingress {
    description = "ICMP"
    from_port   = -1
    to_port     = -1
    protocol    = "icmp"
    cidr_blocks = concat(var.admin_cidrs, var.lab_cidrs)
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  tags = { Name = "kf-sg-mgmt" }
}

# GOTCHA GWLB #1: si falta el 6081 el target queda unhealthy y AWS no dice
# por que. Es el error mas comun de toda la integracion.
resource "aws_security_group" "fwdata" {
  name        = "kf-sg-fwdata"
  description = "Interfaz de datos: GENEVE + health check del GWLB"
  vpc_id      = aws_vpc.lab.id

  ingress {
    description = "GENEVE desde el GWLB"
    from_port   = 6081
    to_port     = 6081
    protocol    = "udp"
    cidr_blocks = [var.vpc_cidr]
  }
  ingress {
    description = "Health check del target group"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = [var.vpc_cidr]
  }
  ingress {
    from_port   = -1
    to_port     = -1
    protocol    = "icmp"
    cidr_blocks = [var.vpc_cidr]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  tags = { Name = "kf-sg-fwdata" }
}

resource "aws_security_group" "app" {
  name        = "kf-sg-app"
  description = "Workloads"
  vpc_id      = aws_vpc.lab.id

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = concat([var.vpc_cidr], var.lab_cidrs)
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  tags = { Name = "kf-sg-app" }
}

# =============================================================================
# Gateway Load Balancer
# El GWLB encapsula en GENEVE (UDP 6081) y reparte hacia los VM-Series.
# Los firewalls trabajan como bump-in-the-wire: no rutean, no hacen NAT.
# =============================================================================

resource "aws_lb" "gwlb" {
  name                             = "kf-gwlb"
  load_balancer_type               = "gateway"
  subnets                          = [for k, v in aws_subnet.fwdata : v.id]
  # Probado en true (2026-08-17) para descartar que fuera la causa de que el
  # GWLB no entregue al target: NO cambio nada, el trafico sigue muriendo entre
  # el endpoint y el target. Se vuelve a false, que es el diseno buscado
  # (inspeccion local por AZ) y evita cargos de trafico cross-AZ.
  enable_cross_zone_load_balancing = false

  tags = { Name = "kf-gwlb" }
}

# GOTCHA GWLB #2: el health check no puede pegarle a un path cualquiera del
# PAN-OS. Se usa TCP:80 y hay que habilitar HTTP en el interface management
# profile de la interfaz de datos, o el target nunca pasa a healthy.
resource "aws_lb_target_group" "fw" {
  name        = "kf-gwlb-tg"
  target_type = "ip"
  protocol    = "GENEVE"
  port        = 6081
  vpc_id      = aws_vpc.lab.id

  health_check {
    protocol            = "TCP"
    port                = 80
    interval            = 10
    healthy_threshold   = 3
    unhealthy_threshold = 3
  }

  # El firewall no reescribe la 5-tupla, asi que el flujo debe volver siempre
  # a la misma instancia.
  stickiness {
    type    = "source_ip_dest_ip_proto"
    enabled = true
  }

  tags = { Name = "kf-gwlb-tg" }
}

# Se registra la IP de la ENI de datos, no el instance-id: con target_type
# "instance" el GWLB usaria la interfaz primaria, que aca es la de gestion.
resource "aws_lb_target_group_attachment" "fw" {
  for_each          = local.subnets
  target_group_arn  = aws_lb_target_group.fw.arn
  target_id         = aws_network_interface.fw_data[each.key].private_ip
  availability_zone = local.az[each.key]
  port              = 6081
}

resource "aws_lb_listener" "gwlb" {
  load_balancer_arn = aws_lb.gwlb.arn
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.fw.arn
  }
}

# --- Endpoint service + endpoints por AZ -------------------------------------

resource "aws_vpc_endpoint_service" "gwlb" {
  acceptance_required        = false
  gateway_load_balancer_arns = [aws_lb.gwlb.arn]
  tags                       = { Name = "kf-gwlb-endpoint-service" }
}

resource "aws_vpc_endpoint" "gwlbe" {
  for_each          = local.subnets
  vpc_id            = aws_vpc.lab.id
  service_name      = aws_vpc_endpoint_service.gwlb.service_name
  vpc_endpoint_type = "GatewayLoadBalancer"
  subnet_ids        = [aws_subnet.gwlbe[each.key].id]
  tags              = { Name = "kf-gwlbe-${each.key}" }
}

# No se usa data "aws_ami" con most_recent: en la lista de AMIs de Palo Alto
# la 11.1.15 es una release MAS nueva que la 11.1.6-h35, pero su AMI tiene
# fecha ANTERIOR. Ordenar por CreationDate elige la version equivocada.
data "aws_ssm_parameter" "panos" {
  count = var.panos_ami_id == "" ? 1 : 0
  name  = var.panos_ssm_parameter
}

locals {
  panos_ami = var.panos_ami_id != "" ? var.panos_ami_id : data.aws_ssm_parameter.panos[0].value
}

# Dos NICs: gestion y datos. Sin overlay routing, sin NAT, sin interfaz
# untrust. Todo el trafico entra y sale encapsulado en GENEVE por eth1.

resource "aws_network_interface" "fw_mgmt" {
  for_each        = local.subnets
  subnet_id       = aws_subnet.mgmt[each.key].id
  security_groups = [aws_security_group.mgmt.id]
  tags            = { Name = "kf-fw-${each.key}-mgmt" }
}

resource "aws_network_interface" "fw_data" {
  for_each          = local.subnets
  subnet_id         = aws_subnet.fwdata[each.key].id
  security_groups   = [aws_security_group.fwdata.id]
  source_dest_check = false
  tags              = { Name = "kf-fw-${each.key}-data" }
}

resource "aws_eip" "fw_mgmt" {
  for_each          = local.subnets
  domain            = "vpc"
  network_interface = aws_network_interface.fw_mgmt[each.key].id
  tags              = { Name = "kf-eip-fw-${each.key}-mgmt" }
  depends_on        = [aws_internet_gateway.igw]
}

resource "aws_instance" "fw" {
  for_each      = local.subnets
  ami           = local.panos_ami
  instance_type = var.panos_instance_type
  key_name      = var.key_pair_name

  network_interface {
    network_interface_id = aws_network_interface.fw_mgmt[each.key].id
    device_index         = 0
  }
  network_interface {
    network_interface_id = aws_network_interface.fw_data[each.key].id
    device_index         = 1
  }

  user_data = <<-EOT
    type=dhcp-client
    hostname=kf-fw-gwlb-${each.key}
    dns-primary=169.254.169.253
    dns-secondary=8.8.8.8
    dhcp-accept-server-hostname=no
    dhcp-accept-server-domain=no
  EOT

  root_block_device {
    volume_size = 60
    volume_type = "gp3"
  }

  tags = { Name = "kf-fw-gwlb-${each.key}" }
}

# --- Workloads ---------------------------------------------------------------

data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["al2023-ami-2023.*-x86_64"]
  }
}

# Sin IP publica. Se prueban desde el home lab por el tunel, que es
# justamente el escenario que se quiere demostrar.
resource "aws_instance" "app" {
  for_each = local.subnets

  ami                    = data.aws_ami.al2023.id
  instance_type          = "t3.micro"
  subnet_id              = aws_subnet.app[each.key].id
  private_ip             = cidrhost(local.subnets[each.key].app, 10)
  vpc_security_group_ids = [aws_security_group.app.id]
  key_name               = var.key_pair_name

  user_data = <<-EOT
    #!/bin/bash
    dnf install -y nginx
    echo "kf-gwlb-lab · stack ${each.key} · $(hostname)" > /usr/share/nginx/html/index.html
    systemctl enable --now nginx
  EOT

  tags = { Name = "kf-app-${each.key}" }
}

# PSK: 8-64 chars, alfanumerico mas . y _ , no puede empezar con 0.
resource "random_password" "psk" {
  count            = 2
  length           = 32
  special          = true
  override_special = "._"
  numeric          = true
  upper            = true
  lower            = true
}

resource "aws_customer_gateway" "cgw" {
  bgp_asn    = var.cgw_asn
  ip_address = var.cgw_public_ip
  type       = "ipsec.1"
  tags       = { Name = "kf-cgw-pa410" }
}

resource "aws_vpn_gateway" "vgw" {
  vpc_id          = aws_vpc.lab.id
  amazon_side_asn = var.vgw_asn
  tags            = { Name = "kf-vgw" }
}

resource "aws_vpn_connection" "s2s" {
  customer_gateway_id = aws_customer_gateway.cgw.id
  vpn_gateway_id      = aws_vpn_gateway.vgw.id
  type                = "ipsec.1"
  static_routes_only  = false # BGP

  # --- Tunel 1 ---------------------------------------------------------------
  tunnel1_inside_cidr   = var.tunnel1_inside_cidr
  tunnel1_preshared_key = random_password.psk[0].result
  tunnel1_ike_versions  = ["ikev2"]

  tunnel1_phase1_encryption_algorithms = ["AES256"]
  tunnel1_phase1_integrity_algorithms  = ["SHA2-256"]
  tunnel1_phase1_dh_group_numbers      = [14]
  tunnel1_phase1_lifetime_seconds      = 28800

  tunnel1_phase2_encryption_algorithms = ["AES256"]
  tunnel1_phase2_integrity_algorithms  = ["SHA2-256"]
  tunnel1_phase2_dh_group_numbers      = [14]
  tunnel1_phase2_lifetime_seconds      = 3600

  tunnel1_startup_action      = "start" # AWS inicia; tenemos IP fija
  tunnel1_dpd_timeout_action  = "restart"
  tunnel1_dpd_timeout_seconds = 30

  # --- Tunel 2 ---------------------------------------------------------------
  tunnel2_inside_cidr   = var.tunnel2_inside_cidr
  tunnel2_preshared_key = random_password.psk[1].result
  tunnel2_ike_versions  = ["ikev2"]

  tunnel2_phase1_encryption_algorithms = ["AES256"]
  tunnel2_phase1_integrity_algorithms  = ["SHA2-256"]
  tunnel2_phase1_dh_group_numbers      = [14]
  tunnel2_phase1_lifetime_seconds      = 28800

  tunnel2_phase2_encryption_algorithms = ["AES256"]
  tunnel2_phase2_integrity_algorithms  = ["SHA2-256"]
  tunnel2_phase2_dh_group_numbers      = [14]
  tunnel2_phase2_lifetime_seconds      = 3600

  tunnel2_startup_action      = "start"
  tunnel2_dpd_timeout_action  = "restart"
  tunnel2_dpd_timeout_seconds = 30

  tags = { Name = "kf-vpn-pa410" }
}

# =============================================================================
# ROUTING
#
# El path completo de un flujo de egress:
#   app -> GWLBE (misma AZ) -> GWLB -> firewall -> GWLB -> GWLBE -> NAT GW -> IGW
#
# El path de un flujo hibrido entrante:
#   home lab -> VGW -> [edge route table] -> GWLBE -> firewall -> GWLBE -> app
# =============================================================================

# --- Public: NAT GW + IGW ----------------------------------------------------
# El retorno del NAT GW tiene que volver por el firewall, si no el flujo queda
# asimetrico y solo se inspecciona la ida.

resource "aws_route_table" "public" {
  for_each = local.subnets
  vpc_id   = aws_vpc.lab.id
  tags     = { Name = "kf-rt-public-${each.key}" }
}

resource "aws_route" "public_default" {
  for_each               = aws_route_table.public
  route_table_id         = each.value.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.igw.id
}

resource "aws_route" "public_return_to_fw" {
  for_each               = local.subnets
  route_table_id         = aws_route_table.public[each.key].id
  destination_cidr_block = each.value.app
  vpc_endpoint_id        = aws_vpc_endpoint.gwlbe[each.key].id
}

resource "aws_route_table_association" "public" {
  for_each       = aws_subnet.public
  subnet_id      = each.value.id
  route_table_id = aws_route_table.public[each.key].id
}

# --- Mgmt --------------------------------------------------------------------
# Trafico de gestion, no se inspecciona a proposito: si el firewall se cae,
# igual se puede llegar a administrarlo.

resource "aws_route_table" "mgmt" {
  vpc_id = aws_vpc.lab.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
  tags = { Name = "kf-rt-mgmt" }
}

resource "aws_route_table_association" "mgmt" {
  for_each       = aws_subnet.mgmt
  subnet_id      = each.value.id
  route_table_id = aws_route_table.mgmt.id
}

# --- Fwdata ------------------------------------------------------------------
# Solo la ruta local. El GENEVE nace y muere dentro de la VPC.

resource "aws_route_table" "fwdata" {
  vpc_id = aws_vpc.lab.id
  tags   = { Name = "kf-rt-fwdata" }
}

resource "aws_route_table_association" "fwdata" {
  for_each       = aws_subnet.fwdata
  subnet_id      = each.value.id
  route_table_id = aws_route_table.fwdata.id
}

# --- GWLBE: salida despues de inspeccion -------------------------------------
# Aca cae el trafico ya inspeccionado que devuelve el firewall.

resource "aws_route_table" "gwlbe" {
  for_each = local.subnets
  vpc_id   = aws_vpc.lab.id
  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.nat[each.key].id
  }
  tags = { Name = "kf-rt-gwlbe-${each.key}" }
}

resource "aws_route_table_association" "gwlbe" {
  for_each       = aws_subnet.gwlbe
  subnet_id      = each.value.id
  route_table_id = aws_route_table.gwlbe[each.key].id
}

# Los prefijos del lab llegan por BGP. GOTCHA #1 del post anterior sigue
# vigente: la propagacion viene apagada por defecto.
resource "aws_vpn_gateway_route_propagation" "gwlbe" {
  for_each       = aws_route_table.gwlbe
  vpn_gateway_id = aws_vpn_gateway.vgw.id
  route_table_id = each.value.id
}

resource "aws_vpn_gateway_route_propagation" "mgmt" {
  vpn_gateway_id = aws_vpn_gateway.vgw.id
  route_table_id = aws_route_table.mgmt.id
}

# --- App: todo sale por el GWLBE ---------------------------------------------
# Sin propagacion del VGW aca: si se propagaran los prefijos del lab, el
# trafico iria directo al VGW sin pasar por el firewall.

resource "aws_route_table" "app" {
  for_each = local.subnets
  vpc_id   = aws_vpc.lab.id
  tags     = { Name = "kf-rt-app-${each.key}" }
}

resource "aws_route" "app_default" {
  for_each               = local.subnets
  route_table_id         = aws_route_table.app[each.key].id
  destination_cidr_block = "0.0.0.0/0"
  vpc_endpoint_id        = aws_vpc_endpoint.gwlbe[each.key].id
}

resource "aws_route" "app_to_lab" {
  for_each               = local.app_lab_routes
  route_table_id         = aws_route_table.app[each.value.az].id
  destination_cidr_block = each.value.cidr
  vpc_endpoint_id        = aws_vpc_endpoint.gwlbe[each.value.az].id
}

resource "aws_route_table_association" "app" {
  for_each       = aws_subnet.app
  subnet_id      = each.value.id
  route_table_id = aws_route_table.app[each.key].id
}

# --- Edge route table del VGW ------------------------------------------------
# Esto es lo que hace que el trafico hibrido se inspeccione. Sin esta
# asociacion el trafico del tunel entra directo a las subnets app.

resource "aws_route_table" "vgw_edge" {
  vpc_id = aws_vpc.lab.id
  tags   = { Name = "kf-rt-vgw-edge" }
}

resource "aws_route" "vgw_edge_to_app" {
  for_each               = local.subnets
  route_table_id         = aws_route_table.vgw_edge.id
  destination_cidr_block = each.value.app
  vpc_endpoint_id        = aws_vpc_endpoint.gwlbe[each.key].id
}

resource "aws_route_table_association" "vgw_edge" {
  gateway_id     = aws_vpn_gateway.vgw.id
  route_table_id = aws_route_table.vgw_edge.id
}

output "firewalls" {
  description = "EIP de gestion de cada VM-Series y la IP de datos registrada en el target group."
  value = {
    for k in keys(local.subnets) : k => {
      mgmt_eip = aws_eip.fw_mgmt[k].public_ip
      data_ip  = aws_network_interface.fw_data[k].private_ip
    }
  }
}

output "app_servers" {
  description = "Workloads. Sin IP publica: se prueban desde el home lab por el tunel."
  value       = { for k, v in aws_instance.app : k => v.private_ip }
}

output "gwlb_endpoints" {
  value = { for k, v in aws_vpc_endpoint.gwlbe : k => v.id }
}

output "target_group_arn" {
  description = "Para vigilar el estado con: aws elbv2 describe-target-health --target-group-arn ..."
  value       = aws_lb_target_group.fw.arn
}

# --- Datos para armar el tunel en el PA-410 ---------------------------------

# inside_local / inside_remote salen de los atributos que devuelve AWS, no de
# cidrhost(). AWS asigna el PRIMER host del /30 al VGW y el segundo al customer
# gateway; calcularlo a mano invita a dejarlo al reves, que es justo lo que
# paso antes: el PA quedaba con la .1 (que es del VGW) y peereaba contra la .2.
output "pa440_tunnel1" {
  value = {
    aws_peer_ip   = aws_vpn_connection.s2s.tunnel1_address
    inside_local  = aws_vpn_connection.s2s.tunnel1_cgw_inside_address
    inside_remote = aws_vpn_connection.s2s.tunnel1_vgw_inside_address
    bgp_peer_asn  = var.vgw_asn
  }
}

output "pa440_tunnel2" {
  value = {
    aws_peer_ip   = aws_vpn_connection.s2s.tunnel2_address
    inside_local  = aws_vpn_connection.s2s.tunnel2_cgw_inside_address
    inside_remote = aws_vpn_connection.s2s.tunnel2_vgw_inside_address
    bgp_peer_asn  = var.vgw_asn
  }
}

# CREDENCIAL VIVA. Nunca en el blog ni en screenshots.
output "psk_tunnel1" {
  value     = aws_vpn_connection.s2s.tunnel1_preshared_key
  sensitive = true
}

output "psk_tunnel2" {
  value     = aws_vpn_connection.s2s.tunnel2_preshared_key
  sensitive = true
}