Amazon Elastic VMware Service (EVS)

# Attach to the user/role that will create the EVS environment
{
  "Effect": "Allow",
  "Action": "iam:CreateServiceLinkedRole",
  "Resource": "arn:aws:iam::*:role/aws-service-role/evs.amazonaws.com/AWSServiceRoleForEVS",
  "Condition": {
    "StringLike": { "iam:AWSServiceName": "evs.amazonaws.com" }
  }
}

aws ec2 modify-vpc-attribute --vpc-id vpc-xxxxxxxxxxxxxxxxx --enable-dns-hostnames
aws ec2 modify-vpc-attribute --vpc-id vpc-xxxxxxxxxxxxxxxxx --enable-dns-support

aws ec2 create-capacity-reservation \
  --availability-zone us-east-1a \
  --instance-type i4i.metal \
  --instance-platform Linux/UNIX \
  --instance-count 4 \
  --tag-specifications 'ResourceType=capacity-reservation,Tags=[{Key=Name,Value=evs-odcr-mgmt}]'

# Verify it reaches 'active' state before proceeding
aws ec2 describe-capacity-reservations \
  --query 'CapacityReservations[*].[CapacityReservationId,State,AvailableInstanceCount]'

# ── Target region and AZ ──────────────────────────────────────────────────────
# All EVS resources must be in the same AZ.
variable "aws_region" { default = "us-east-1" }   # change to your region
variable "az"         { default = "us-east-1a" } # change to your target AZ

# ── VPC & subnet CIDRs ────────────────────────────────────────────────────────
# vpc_cidr minimum /22 — cannot be changed after EVS deployment.
# service_access_cidr hosts the Route Server endpoints and DNS resolver ENIs.
variable "vpc_cidr"            { default = "10.0.0.0/16"  }
variable "service_access_cidr" { default = "10.0.0.0/24"  }

# ── DNS domain ────────────────────────────────────────────────────────────────
# Must match the Route 53 private hosted zone name exactly.
# All VCF components are registered under this domain.
variable "domain_name" { default = "evs.vcloudone.local" }

# ── Resolver IPs ──────────────────────────────────────────────────────────────
# Two static IPs within service_access_cidr.
# These become the DHCP domain-name-servers — must be stable and ordered.
variable "resolver_ip_1" { default = "10.0.0.10" }  # primary DNS
variable "resolver_ip_2" { default = "10.0.0.11" }  # secondary DNS

# ── BGP ASNs ──────────────────────────────────────────────────────────────────
# route_server_asn: VPC Route Server ASN — must differ from nsx_peer_asn.
# nsx_peer_asn: NSX Tier-0 ASN — default NSX value is 65000.
variable "route_server_asn" { default = 65100 }
variable "nsx_peer_asn"     { default = 65000 }

# ── VCF component IPs ─────────────────────────────────────────────────────────
# Must be in the Management VM VLAN (default 10.0.11.x).
# A and PTR records are created for every entry in this map.
variable "vcf_components" {
  default = {
    "cloud-builder" = "10.0.11.9"
    "sddc-manager"  = "10.0.11.10"
    "vcenter"       = "10.0.11.11"
    "nsx-mgr-01"    = "10.0.11.12"
    "nsx-mgr-02"    = "10.0.11.13"
    "nsx-mgr-03"    = "10.0.11.14"
    "nsx-edge-01"   = "10.0.11.21"
    "nsx-edge-02"   = "10.0.11.22"
  }
}

# ── ESXi host IPs ─────────────────────────────────────────────────────────────
# Must be in the Host Management VLAN (default 10.0.10.x).
# Add or remove entries to match your host count (minimum 4 for EVS).
variable "esxi_hosts" {
  default = {
    "esxi-01" = "10.0.10.21"
    "esxi-02" = "10.0.10.22"
    "esxi-03" = "10.0.10.23"
    "esxi-04" = "10.0.10.24"
  }
}

# ── Reverse DNS zone names ────────────────────────────────────────────────────
# Must match the /24 prefix of the IPs in esxi_hosts and vcf_components.
# Format: third-octet.second-octet.first-octet.in-addr.arpa
# If you change the host or management VM subnet, update these too.
variable "host_mgmt_reverse_zone" { default = "10.0.10.in-addr.arpa" }  # matches 10.0.10.0/24
variable "mgmt_vm_reverse_zone"   { default = "11.0.10.in-addr.arpa" }  # matches 10.0.11.0/24

# ── NSX Edge uplink IPs ───────────────────────────────────────────────────────
# IPs assigned to NSX Edge uplink interfaces during EVS bring-up.
# Must be within the NSX Uplink VLAN (default 10.0.16.x).
# These are configured as Route Server BGP peer addresses.
variable "nsx_edge_peer_ips" {
  default = {
    "edge-01" = "10.0.16.10"
    "edge-02" = "10.0.16.11"
  }
}

# 1. Clone and enter the repo
git clone https://github.com/gitvcloudone/EVS-PreREQ-Terraform.git
cd EVS-PreREQ-Terraform

# 2. Edit variables.tf with your region, AZ, CIDRs, IPs, and hostnames
#    (see table above — at minimum update aws_region, az, and domain_name)

# 3. Initialize providers (downloads hashicorp/aws ~= 5.84)
terraform init

# 4. Preview what will be created — review before applying
terraform plan

# 5. Deploy (~45 resources, typically completes in 3-5 minutes)
terraform apply

# 6. Review outputs — all resource IDs and IPs are printed
terraform output

# Phase 4 — VPC & Service Access Subnet
resource "aws_vpc" "evs_vpc" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true
  tags = { Name = "evs-vpc" }
}

# Phase 4 — Service Access Subnet + explicit route table association
# Explicit association is required — propagated route tables without it
# silently fail to receive BGP routes from the Route Server.
resource "aws_subnet" "service_access" {
  vpc_id            = aws_vpc.evs_vpc.id
  cidr_block        = var.service_access_cidr
  availability_zone = var.az
}
resource "aws_route_table" "service_access" {
  vpc_id = aws_vpc.evs_vpc.id
  tags   = { Name = "evs-service-access-rt" }
}
resource "aws_route_table_association" "service_access" {
  subnet_id      = aws_subnet.service_access.id
  route_table_id = aws_route_table.service_access.id
}

# Phase 5 — Route 53 Inbound Resolver Endpoint
# AWS requires a minimum of 2 IPs per resolver endpoint.
# Explicit IPs (not dynamic lookup) ensure stable ordering in DHCP options.
resource "aws_route53_resolver_endpoint" "evs_dns" {
  name               = "evs-dns-resolver"
  direction          = "INBOUND"
  security_group_ids = [aws_security_group.dns_sg.id]
  ip_address { subnet_id = aws_subnet.service_access.id; ip = var.resolver_ip_1 }
  ip_address { subnet_id = aws_subnet.service_access.id; ip = var.resolver_ip_2 }
  tags = { Name = "evs-dns-resolver" }
}

# Phase 6 — DHCP Options Set
# domain_name must match the Route 53 private hosted zone exactly.
# NTP uses AWS Time Sync Service (169.254.169.123) — no internet required.
resource "aws_vpc_dhcp_options" "evs_dhcp" {
  domain_name         = var.domain_name
  domain_name_servers = [var.resolver_ip_1, var.resolver_ip_2]
  ntp_servers         = ["169.254.169.123"]
}
resource "aws_vpc_dhcp_options_association" "evs" {
  vpc_id          = aws_vpc.evs_vpc.id
  dhcp_options_id = aws_vpc_dhcp_options.evs_dhcp.id
}

# Phase 2 — EVS Service-Linked Role
resource "aws_iam_service_linked_role" "evs" {
  aws_service_name = "evs.amazonaws.com"
}

# Phase 9 — On-Demand Capacity Reservation (ODCR) — uncomment to enable
# Requires EC2 vCPU quota ≥ 512 (4 × i4i.metal × 128 vCPUs).
# instance_match_criteria = "targeted" means only launches that explicitly
# reference this reservation ID will consume capacity.
#
# resource "aws_ec2_capacity_reservation" "evs_hosts" {
#   instance_type           = "i4i.metal"
#   instance_platform       = "Linux/UNIX"
#   availability_zone       = var.az
#   instance_count          = 4
#   instance_match_criteria = "targeted"
#   tags                    = { Name = "evs-odcr" }
# }

# Route Server ASN must differ from NSX Tier-0 ASN (default 65000).
# persist_routes prevents route flaps during brief BGP session drops.
resource "aws_vpc_route_server" "evs_rs" {
  amazon_side_asn         = var.route_server_asn  # default 65100
  persist_routes          = "enable"
  persist_routes_duration = 2
}
resource "aws_vpc_route_server_vpc_association" "evs_rs_vpc" {
  route_server_id = aws_vpc_route_server.evs_rs.route_server_id
  vpc_id          = aws_vpc.evs_vpc.id
}

# Two endpoints in the Service Access Subnet.
# EVS reads these endpoint IPs and auto-configures NSX Tier-0 BGP neighbors
# during bring-up — no manual NSX configuration required.
resource "aws_vpc_route_server_endpoint" "ep1" {
  route_server_id = aws_vpc_route_server.evs_rs.route_server_id
  subnet_id       = aws_subnet.service_access.id
  depends_on      = [aws_vpc_route_server_vpc_association.evs_rs_vpc]
}
resource "aws_vpc_route_server_endpoint" "ep2" {
  route_server_id = aws_vpc_route_server.evs_rs.route_server_id
  subnet_id       = aws_subnet.service_access.id
  depends_on      = [aws_vpc_route_server_vpc_association.evs_rs_vpc]
}

# Peer IPs are NSX Edge uplink IPs from the NSX Uplink VLAN (10.0.16.x).
# BFD is not supported for EVS — always use bgp-keepalive.
resource "aws_vpc_route_server_peer" "edge_01" {
  route_server_endpoint_id = aws_vpc_route_server_endpoint.ep1.route_server_endpoint_id
  peer_address             = var.nsx_edge_peer_ips["edge-01"]  # 10.0.16.10
  bgp_options {
    peer_asn                = var.nsx_peer_asn  # 65000
    peer_liveness_detection = "bgp-keepalive"
  }
}
resource "aws_vpc_route_server_peer" "edge_02" {
  route_server_endpoint_id = aws_vpc_route_server_endpoint.ep2.route_server_endpoint_id
  peer_address             = var.nsx_edge_peer_ips["edge-02"]  # 10.0.16.11
  bgp_options {
    peer_asn                = var.nsx_peer_asn
    peer_liveness_detection = "bgp-keepalive"
  }
}

# Propagate NSX overlay routes into the explicitly-associated route table.
resource "aws_vpc_route_server_propagation" "service_access_rt" {
  route_server_id = aws_vpc_route_server.evs_rs.route_server_id
  route_table_id  = aws_route_table.service_access.id
  depends_on      = [aws_route_table_association.service_access]
}

resource "aws_route53_zone" "forward" {
  name = var.domain_name
  vpc { vpc_id = aws_vpc.evs_vpc.id }
}
# Host Management VLAN reverse zone (ESXi hosts — 10.0.10.x)
# Driven by var.host_mgmt_reverse_zone — update if you change esxi_hosts subnet.
resource "aws_route53_zone" "host_mgmt_reverse" {
  name = var.host_mgmt_reverse_zone
  vpc { vpc_id = aws_vpc.evs_vpc.id }
}
# Management VM VLAN reverse zone (appliances — 10.0.11.x)
# Driven by var.mgmt_vm_reverse_zone — update if you change vcf_components subnet.
resource "aws_route53_zone" "mgmt_vm_reverse" {
  name = var.mgmt_vm_reverse_zone
  vpc { vpc_id = aws_vpc.evs_vpc.id }
}

# VCF appliance A + PTR records (cloud-builder, sddc-manager, vcenter,
# nsx-mgr-01/02/03, nsx-edge-01/02) — all in Management VM VLAN (10.0.11.x)
resource "aws_route53_record" "vcf_a" {
  for_each = var.vcf_components
  zone_id  = aws_route53_zone.forward.zone_id
  name     = "${each.key}.${var.domain_name}"
  type     = "A"; ttl = 300; records = [each.value]
}
resource "aws_route53_record" "vcf_ptr" {
  for_each = var.vcf_components
  zone_id  = aws_route53_zone.mgmt_vm_reverse.zone_id
  name     = element(split(".", each.value), 3)  # last octet only
  type     = "PTR"; ttl = 300
  records  = ["${each.key}.${var.domain_name}."]
}

# ESXi host A + PTR records — Host Management VLAN (10.0.10.x)
resource "aws_route53_record" "esxi_a" {
  for_each = var.esxi_hosts
  zone_id  = aws_route53_zone.forward.zone_id
  name     = "${each.key}.${var.domain_name}"
  type     = "A"; ttl = 300; records = [each.value]
}
resource "aws_route53_record" "esxi_ptr" {
  for_each = var.esxi_hosts
  zone_id  = aws_route53_zone.host_mgmt_reverse.zone_id
  name     = element(split(".", each.value), 3)
  type     = "PTR"; ttl = 300
  records  = ["${each.key}.${var.domain_name}."]
}

# Install boto3 if not already installed
pip install boto3

# Clone the validator
git clone https://github.com/gitvcloudone/EVS-PreREQ-Validate.git
cd EVS-PreREQ-Validate

# Run against default region (from AWS config / environment)
python evs_validate.py

# Run against a specific region
python evs_validate.py --region us-east-1
python evs_validate.py --region eu-west-1

================================================================
  Amazon EVS Prerequisite Validator
  Region : us-east-1   Account : 123456789012
================================================================

── Phase 2: IAM
  ✓ PASS  AWSServiceRoleForEVS service-linked role exists
  ✓ PASS  EVSDeploymentPolicy found (arn:aws:iam::123456789012:policy/EVSDeploymentPolicy)
  # FAIL here means the SLR or policy was never created — run the Terraform kit
  # or create them manually before calling CreateEnvironment.

── EC2 vCPU Service Quota
  ✓ PASS  vCPU quota = 512  — meets minimum for 4 × i4i.metal
  # FAIL: quota = 256 — request increase at Service Quotas > Amazon EC2 >
  # "Running On-Demand Standard instances" before deploying EVS.

── AWS Support Plan
  ✓ PASS  Support plan is Business or higher
  # FAIL: Basic/Developer plan — EVS CreateEnvironment will be rejected.
  # Upgrade to Business, Enterprise On-Ramp, or Enterprise.

── VPC Auto-Discovery
    INFO  Found 1 non-default VPC(s)
  # The script skips the default VPC. If you see 0, your VPC hasn't been created.

================================================================
VPC: evs-vpc  (vpc-0f75dd807fc01abb9)  CIDR: 10.0.0.0/16
================================================================

── Phase 4: VPC
  ✓ PASS  CIDR 10.0.0.0/16 meets minimum /22 requirement
  ✓ PASS  DNS hostnames enabled
  ✓ PASS  DNS support enabled

── Phase 6: DHCP Options Set
  ✓ PASS  Domain name = 'evs.vcloudone.local'
  ✓ PASS  DNS servers: 10.0.0.10, 10.0.0.11
  ✓ PASS  NTP = 169.254.169.123 (AWS Time Sync Service)
  # FAIL on domain_name: DHCP domain must match the Route 53 zone exactly.
  # FAIL on DNS servers: printed IPs must match resolver endpoint IPs (see below).
  # FAIL on NTP: 169.254.169.123 must be in the list — no internet required.

── Phase 5: Route 53 Private Zones
  ✓ PASS  Forward zone(s): ['evs.vcloudone.local']
  ✓ PASS  Reverse PTR zone(s): ['11.0.10.in-addr.arpa', '10.0.10.in-addr.arpa']
    INFO  Zone: evs.vcloudone.local  (Z04587343LEL3Z83E8QNP)  records: 14
  ✓ PASS  DHCP domain 'evs.vcloudone.local' matches Route 53 zone
  # FAIL if no forward zone: create the private hosted zone and associate with the VPC.
  # FAIL if no reverse zones: EVS requires PTR zones for both ESXi and Mgmt VLANs.
  # records: 14 = 4 ESXi A/PTR + 8 VCF component A/PTR records — verify count matches.

── Phase 5: Route 53 Inbound Resolver Endpoint
  ✓ PASS  Inbound resolver endpoint(s): ['evs-dns-resolver']
  ✓ PASS    'evs-dns-resolver' — IPs: 10.0.0.11, 10.0.0.10  (status: OPERATIONAL)
  ✓ PASS    Resolver IPs ['10.0.0.11', '10.0.0.10'] are present in DHCP DNS servers
  # FAIL on resolver: create an INBOUND resolver endpoint with ≥ 2 IPs in the VPC.
  # FAIL on cross-check: DHCP domain-name-servers must exactly match resolver IPs.
  # FAIL if status is not OPERATIONAL: resolver endpoint is still provisioning.

── Phase 4: Service Access Subnet & Route Tables
  ✓ PASS  1 subnet(s) across AZs: us-east-1a(1)
  ✓ PASS  Explicit route table(s): ['rtb-0b7c5516a85491e95']
  ✓ PASS  Explicit subnet association(s): ['subnet-003763d6fb9af8fca']
  # FAIL on explicit route table: the main (implicit) VPC route table does not count.
  # A dedicated route table with an explicit subnet association is required so BGP
  # routes propagated by the Route Server are received by this subnet.

── Phase 7: NACL & Security Groups
  ✓ PASS  Custom NACL(s): ['acl-06980e7ddc52a53cb']
  ✓ PASS  Security group(s) with port 53 rule: ['evs-dns-sg', 'default']
  ✓ PASS  Security group(s) with port 179 rule: ['VPCRouteServer-rse-...', 'default']
  # FAIL on port 179: the Route Server auto-creates its own SGs but verify they exist.
  # FAIL on custom NACL: the default VPC NACL does not count — create one explicitly.

── Phase 7: VPC Route Server & BGP
  ✓ PASS  Route Server(s): ['rs-0e8e3f3e2278e29fa']
  ✓ PASS    Route Server rs-0e8e3f3e2278e29fa  ASN 65100  state: available
  ✓ PASS    Endpoints: 2  IPs: ['10.0.0.47', '10.0.0.90']
  ✓ PASS    2 BGP peer(s) configured with bgp-keepalive liveness
  ✓ PASS    Route propagation: 1 route table(s)  ['rtb-0b7c5516a85491e95']
  ✓ PASS    Propagation -> rtb-0b7c5516a85491e95 (explicit route table — correct)
  # FAIL on BGP peers: expected before EVS bring-up — NSX Edge IPs are configured
  #   during CreateEnvironment. This FAIL is normal at pre-deployment time.
  # FAIL on propagation targeting main RT: BGP routes would be silently dropped.
  #   Propagation must point to the explicit route table, not the VPC main table.

── Phase 9: On-Demand Capacity Reservation (ODCR)
  ⚠ WARN  No active i4i.metal ODCR in us-east-1a — create before deploying EVS
  # WARN (not FAIL) — optional until CreateEnvironment is called.
  # Create an ODCR for i4i.metal with instance_match_criteria = "targeted"
  # before deploying to guarantee capacity.

================================================================
SUMMARY  (29 checks across 1 VPC(s))
   27 PASS    0 FAIL    1 WARN

Exit code 0 — environment is ready for EVS deployment.
================================================================