DT-523 add vpc s3 endpoint resource

[christopher-comet]

https://comet-ml.atlassian.net/browse/DT-523

[christopher-comet]

Deployed the changes.
tfplan.json

❯ terraform state list | grep vpc_endpoint                                                                                                                                          deployment-team-dev  12:37:25
module.comet_vpc[0].aws_vpc_endpoint.s3

[christopher-comet]

Added a name

[christopher-comet]

Endpoint exists

❯ aws ec2 describe-vpc-endpoints --region us-east-2 --filters Name=service-name,Values=com.amazonaws.us-east-2.s3                               

{
    "VpcEndpoints": [
        {
            "VpcEndpointId": "vpce-0cb24d1c5c8feebcb",
            "VpcEndpointType": "Gateway",
            "VpcId": "vpc-05cd3309793289ab1",
            "ServiceName": "com.amazonaws.us-east-2.s3",
            "State": "available",
            "PolicyDocument": "{\"Version\":\"2008-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"*\",\"Resource\":\"*\"}]}",
            "RouteTableIds": [
                "rtb-0174756fef3d994f3",
                "rtb-0763b317f918e1e2e"
            ],
            "SubnetIds": [],
            "Groups": [],
            "PrivateDnsEnabled": false,
            "RequesterManaged": false,
            "NetworkInterfaceIds": [],
            "DnsEntries": [],
            "CreationTimestamp": "2025-05-27T19:31:11+00:00",
            "Tags": [
                {
                    "Key": "Terraform",
                    "Value": "true"
                },
                {
                    "Key": "Environment",
                    "Value": "prod"
                },
                {
                    "Key": "Name",
                    "Value": "comet-prod-s3-endpoint"
                }
            ],
            "OwnerId": "897196112581"
        }
    ]
}

Verify route table entries

❯ PL_ID=$(aws ec2 describe-prefix-lists --region us-east-2  --filters Name=prefix-list-name,Values=com.amazonaws.us-east-2.s3  --query "PrefixLists[0].PrefixListId" --output text)

❯ echo "S3 prefix-list id = $PL_ID"                                                                                                                                                     
S3 prefix-list id = pl-7ba54012

❯ for RT in rtb-0174756fef3d994f3 rtb-0763b317f918e1e2e; do                                                                                                       
  echo "Checking RTB $RT…"
  aws ec2 describe-route-tables \
    --region us-east-2 \
    --route-table-ids $RT \
    --query "RouteTables[0].Routes[?DestinationPrefixListId=='${PL_ID}']"
done

Checking RTB rtb-0174756fef3d994f3…
[
    {
        "DestinationPrefixListId": "pl-7ba54012",
        "GatewayId": "vpce-0cb24d1c5c8feebcb",
        "Origin": "CreateRoute",
        "State": "active"
    }
]
Checking RTB rtb-0763b317f918e1e2e…
[
    {
        "DestinationPrefixListId": "pl-7ba54012",
        "GatewayId": "vpce-0cb24d1c5c8feebcb",
        "Origin": "CreateRoute",
        "State": "active"
    }
]

[Copilot]

Pull Request Overview

Adds a gateway VPC endpoint for S3 and wires in a new region variable, while updating default ElastiCache versions for Redis 7.

• Update default Redis engine version and parameter group to v7
• Introduce region variable in the VPC module
• Provision an aws_vpc_endpoint for S3 and pass region through the root module

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

File	Description
variables.tf	Bump ElastiCache engine version and param group
modules/comet_vpc/variables.tf	Add required region variable
modules/comet_vpc/main.tf	Add aws_vpc_endpoint resource for S3
main.tf	Pass var.region into the VPC module

Files not reviewed (1)

• .terraform.lock.hcl: Language not supported

Comments suppressed due to low confidence (2)

modules/comet_vpc/main.tf:44

• [nitpick] The resource name s3 is ambiguous; consider renaming it to s3_endpoint for clarity and consistency with other endpoint resources.

resource "aws_vpc_endpoint" "s3" {

variables.tf:261

• The default ElastiCache engine version was changed from "7.1.0" to "7.1"—please verify that AWS accepts this shorter format and update the variable description or docs if necessary.

default     = "7.1"

[Copilot]

[nitpick] Consider adding a validation block to the region variable to enforce only supported AWS region identifiers (e.g., us-east-1, eu-west-1).

Suggested change

	type = string
	type = string
	validation {
	condition = can(regex("^([a-z]{2}-[a-z]+-[0-9]{1})$", var.region))
	error_message = "The region must be a valid AWS region identifier, e.g., 'us-east-1', 'eu-west-1'."
	}

[Copilot]

Hardcoding the partition as com.amazonaws may break in GovCloud or China partitions—use the data.aws_partition source to build the service name dynamically.

[darenjacobs]

I approve. This looks fine. You may want to consider incorporating this submodule: https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws/latest/submodules/vpc-endpoints