---
- name: AWS | CREATE INFRA | vpc
  amazon.aws.ec2_vpc_net:
    state: present
    name: "{{ aws_vpc_name }}-{{ aws_vpc_prefix }}-vpc"
    cidr_block: "{{ aws_vpc_cidr_block }}"
    tenancy: default
    region: "{{ aws_region }}"
    tags:
      owner: "{{ aws_vpc_name }}"
      purpose: "{{ aws_purpose_tag }}"
  register: aws_vpc

- name: AWS | CREATE INFRA | internet gateway
  amazon.aws.ec2_vpc_igw:
    state: present
    vpc_id: "{{ aws_vpc.vpc.id }}"
    region: "{{ aws_region }}"
    tags:
      Name: "{{ aws_vpc_name }}-{{aws_vpc_prefix }}-vpc-igw"
      owner: "{{ aws_vpc_name }}"
      purpose: "{{ aws_purpose_tag }}"
  register: aws_gateway

- name: Create security group internal
  amazon.aws.ec2_group: 
    state: present
    name: "{{ aws_vpc_name }}-{{aws_vpc_prefix }}-sec-group"
    region: "{{ aws_region }}"
    description: Inbound WinRM and RDP, http for demo servers and internal AD ports 
    rules:
      - proto: tcp 
        ports:
          - 80 # HTTP
          - 443 # HTTPS
          - 22 # SSH
          - 5986 # WinRM
          - 3389 # RDP
        cidr_ip: 0.0.0.0/0
      - proto: icmp
        to_port: -1
        from_port: -1
        cidr_ip: 0.0.0.0/0
      - proto: tcp
        ports: 
          - 80 # HTTP
          - 5986 # WinRM
          - 3389 # RDP
          - 53 # DNS
          - 88 # Kerberos Authentication
          - 135 # RPC
          - 139 # Netlogon
          - 389 # LDAP
          - 445 # SMB
          - 464 # Kerberos Authentication
          - 5432 # PostgreSQL
          - 636 # LDAPS (LDAP over TLS)
          - 873 # Rsync 
          - 3268-3269 # Global Catalog 
          - 1024-65535 # Ephemeral RPC ports
        cidr_ip: 10.0.0.0/16
      - proto: udp 
        ports: 
          - 53 # DNS
          - 88 # Kerberos Authentication
          - 123 # NTP
          - 137-138 # Netlogon 
          - 389 # LDAP 
          - 445 # SMB
          - 464 # Kerberos Authentication
          - 1024-65535 # Ephemeral RPC ports
        cidr_ip: 10.0.0.0/16
    rules_egress:
      - proto: -1 
        cidr_ip: 0.0.0.0/0
    vpc_id: "{{ aws_vpc.vpc.id }}"
    tags:
      Name: "{{ aws_vpc_name }}-{{aws_vpc_prefix }}-sec-group"
      owner: "{{ aws_vpc_name }}"
      purpose: "{{ aws_purpose_tag }}"

- name: Create a subnet on the VPC
  amazon.aws.ec2_vpc_subnet:
    state: present
    vpc_id: "{{ aws_vpc.vpc.id }}"
    cidr: "{{ aws_subnet_cidr }}"
    region: "{{ aws_region }}"
    map_public: yes
    tags:
      Name: "{{ aws_vpc_name }}-{{aws_vpc_prefix }}-subnet"
      owner: "{{ aws_vpc_name }}"
      purpose: "{{ aws_purpose_tag }}"
  register: aws_subnet

- name: Create a subnet route table 
  amazon.aws.ec2_vpc_route_table:
    state: present 
    vpc_id: "{{ aws_vpc.vpc.id }}"
    region: "{{ aws_region }}"
    subnets:
      - "{{ aws_subnet.subnet.id }}"
    routes:
      - dest: 0.0.0.0/0 
        gateway_id: "{{ aws_gateway.gateway_id }}"
    tags: 
      Name: "{{ aws_vpc_name }}-{{aws_vpc_prefix }}-vpc-rtbl"
      owner: "{{ aws_vpc_name }}"
      purpose: "{{ aws_purpose_tag }}"

- name: Create AWS keypair
  amazon.aws.ec2_key:
    name: "{{ aws_vpc_name }}-{{aws_vpc_prefix }}-demo-key"
    region: "{{ aws_region }}"
    key_material: "{{ aws_public_key }}"
    state: present
    tags:
      owner: "{{ aws_vpc_name }}"
      purpose: "{{ aws_purpose_tag }}"