terraform/aws: add aws-app-connector-s3-privatelink

[maxiscoding28]

Proposed in #52.

What it does

Adds terraform/aws/aws-app-connector-s3-privatelink/. Four files, 436 lines.

The example routes traffic for one S3 bucket over a private path. Every other bucket, and all other traffic, keeps egressing publicly.

Why it is worth an example

Pointing an app connector at a public S3 endpoint does not work well. S3 regional endpoints resolve to a large pool of addresses that rotates. The connector keeps discovering new addresses, so the route set grows and never settles.

The fix is to give the bucket a stable private address first, then advertise that. Three pieces have to line up:

1. An S3 interface VPC endpoint with private_dns_only_for_inbound_resolver_endpoint = false. Resolving the bucket domain inside the VPC now returns the endpoint ENI.
2. A split DNS entry on the exact bucket FQDN. Split DNS does not match siblings, so other buckets stay public. This is what scopes the change to one bucket.
3. The connector advertises the VPC resolver and the endpoint ENI. The resolver is the only one that knows the private DNS mapping, and a client outside the VPC cannot reach it directly.

Checks

All three jobs from terraform-examples.yml, run against a clean clone:

Check	Result
tflint --chdir=terraform --recursive	pass
check-terraform-fmt.sh	pass
check-variables-tailscale-install-scripts.sh	pass
terraform validate	pass

Applied end to end in a sandbox account (us-west-2) and verified:

• 32 resources created, no changes to existing infrastructure
• the bucket resolves to the endpoint ENI from a tailnet client, and to rotating public S3 addresses from off-tailnet
• the object returns 200 over the private path and 403 from the public internet
• both routes advertised and enabled with no autoApprovers entry, confirming policy-file routes are implicitly approved
• the split DNS entry was added alongside existing entries rather than replacing the tailnet DNS config

Style guide

• One locals block at the top of main.tf with every customizable value
• example-${basename(path.cwd)} prefix, Name tag on every resource that takes tags
• Local names match the mock example: vpc_cidr_block, instance_subnet_id, instance_security_group_ids
• Uses internal-modules/aws-vpc and internal-modules/aws-ec2-instance, both removable
• terraform fmt clean, # comments, AWS provider >= 6.0, < 7.0, Tailscale >= 0.24

What the user provides

The example takes no Terraform inputs. It needs AWS and Tailscale credentials in the environment, and two edits to your policy file.

Before applying, tag:example-infra and tag:example-appconnector need owners, or key creation fails. Every example in the repo needs this.

After applying, the app connector definition has to be added by hand. Terraform creates the split DNS entry and the device key, but not this. The provider has no app connector resource, and the definition lives in nodeAttrs in the policy file. The only way to write that from Terraform is tailscale_acl, which replaces the whole policy file, so no example in this repo uses it.

The README shows the stanza, and the s3_domain and s3_advertised_routes outputs give the two values that need filling in.