All products Terraform AWS aws
tf-aws-vpc

The module creates AWS VPC with flexible number of subnets and configures routing for them. It is meant to handle various network combinations based on the common presets following best practices of AWS networking:

  • simple - creates a single public subnet in the VPC. With High Availability option, this produces one public subnet per availability zone
  • canonical - follows a typical scheme for secure AWS VPC: one private, one public subnet per AZ, with NAT GW for egress traffic from the private subnet. With HA, creates a canonical multi-AZ AWS VPC
  • advanced - allows to create a fully custom network configuration

Supports converting a single-zone setup to multi-zonal one by toggling High Availability (ha_enabled variable). Subnet definitions in presets preserve existing networks and only append new CIDRs.

Log in to Corewide IaC registry

Once you have a Corewide Solutions Portal account, this one-time action will use your browser session to retrieve credentials:

 shellterraform login solutions.corewide.com
Provision instructions

Initialize mandatory providers:

Copy and paste into your Terraform configuration and insert the variables:

 hclmodule "tf_aws_vpc" {
  source  = "solutions.corewide.com/aws/tf-aws-vpc/aws"
  version = "~> 5.1.0"

  # specify module inputs here or try one of the examples below
  ...
}

Initialize the setup:

 shellterraform init
Define update strategy

Corewide DevOps team strictly follows Semantic Versioning Specification to provide our clients with products that have predictable upgrades between versions. We recommend pinning patch versions of our modules using pessimistic constraint operator (~>) to prevent breaking changes during upgrades.

To get new features during the upgrades (without breaking compatibility), use ~> 5.1 and run terraform init -upgrade

For the safest setup, use strict pinning with version = "5.1.0"

AWS VPC Setup

Flexible VPC setup in AWS
$500
Version:
5.1.0
3
83
v5.2.0
25
v5.1.1
3
v5.1.0
18
v5.0.0
2
v4.1.0
3
v4.0.0
149
v3.1.0
0
v3.0.0
2
v2.0.1
0
v2.0.0
0
v1.3.0
0
v1.2.0
0
v1.1.0
0
v1.0.0
BUY
285
License
v5.1.0 released 1 year, 3 months ago
New version approx. every 12 weeks
Upgrade Notes
Changelog

The module creates AWS VPC with flexible number of subnets and configures routing for them. It is meant to handle various network combinations based on the common presets following best practices of AWS networking:

  • simple - creates a single public subnet in the VPC. With High Availability option, this produces one public subnet per availability zone
  • canonical - follows a typical scheme for secure AWS VPC: one private, one public subnet per AZ, with NAT GW for egress traffic from the private subnet. With HA, creates a canonical multi-AZ AWS VPC
  • advanced - allows to create a fully custom network configuration

Supports converting a single-zone setup to multi-zonal one by toggling High Availability (ha_enabled variable). Subnet definitions in presets preserve existing networks and only append new CIDRs.

Single-zone VPC setup with custom subnet CIDRs in a custom AZ:

 hclmodule "vpc" {
  source  = "solutions.corewide.com/aws/tf-aws-vpc/aws"
  version = "~> 5.1"

  name_prefix = "foo"
  cidr_block  = "20.20.0.0/16"
  preset      = "advanced"

  subnets = {
    private-1 = {
      availability_zone         = "us-east-1b"
      private_subnet_cidr_block = "20.20.6.0/24"
      # allow outgoing access to the Internet with NAT gateway
      nat_via = "public-1"

      tags = {
        "foo" = "bar"
      }
    }
    public-1 = {
      availability_zone        = "us-east-1b"
      public_subnet_cidr_block = "20.20.5.0/24"
    }
  }

  tags = {
    Project = "bar"
  }
}

Non-canonical VPC setup with a single public subnet and an isolated private subnet (no NAT GW gets created - suitable for a web server and database instance):

 hclmodule "vpc" {
  source  = "solutions.corewide.com/aws/tf-aws-vpc/aws"
  version = "~> 5.1"

  name_prefix = "foo"
  cidr_block  = "20.20.0.0/16"
  preset      = "advanced"

  subnets = {
    private-1 = {
      availability_zone         = "us-east-1b"
      private_subnet_cidr_block = "20.20.6.0/24"
    }
    public-1 = {
      availability_zone        = "us-east-1b"
      public_subnet_cidr_block = "20.20.5.0/24"
    }
  }

  tags = {
    Project = "bar"
  }
}

Subnet-specific CIDR blocks are calculated automatically in this preset.

VPC with a single-zone public subnet; in this example, a public subnet public-1 (20.20.0.0/24) will be created in us-east-1a zone (first available one in the region).

 hclprovider "aws" {
  region = "us-east-1"
}

module "vpc" {
  source  = "solutions.corewide.com/aws/tf-aws-vpc/aws"
  version = "~> 5.1"

  name_prefix = "foo"
  cidr_block  = "20.20.0.0/16"
  preset      = "simple"

  tags = {
    Project = "bar"
  }
}

A highly available version of this example produces a VPC with three public subnets (20.20.0.0/24, 20.20.1.0/24 and 20.20.2.0/24), one per AZ in the region (us-east-1a, us-east-1b, us-east-1c):

 hclprovider "aws" {
  region = "us-east-1"
}

module "vpc" {
  source  = "solutions.corewide.com/aws/tf-aws-vpc/aws"
  version = "~> 5.1"

  name_prefix = "web"
  cidr_block  = "20.20.0.0/16"
  preset      = "simple"
  ha_enabled  = true

  tags = {
    Purpose = "website"
  }
}

Subnet-specific CIDR blocks are calculated automatically in this preset.

VPC with a single-zone public and private subnets, with a NAT GW for outgoing connections from the private network. This example implicitly defines a public subnet public-1 (20.20.0.0/24) and private subnet (20.20.1.0/24) in the first AZ of the region (us-east-1a) along with NAT GW with a dedicated IP:

 hclprovider "aws" {
  region = "us-east-1"
}

module "vpc" {
  source  = "solutions.corewide.com/aws/tf-aws-vpc/aws"
  version = "~> 5.1"

  name_prefix = "foo"
  cidr_block  = "20.20.0.0/16"
  preset      = "canonical"

  tags = {
    Project = "bar"
  }
}

With ha_enabled = true, the number of subnets is multiplied by the number of AZ (public CIDRs are 20.20.0.0/24, 20.20.2.0/24, 20.20.4.0/24, private ones get 20.20.1.0/24, 20.20.3.0/24, 20.20.5.0/24).

The same example, but simplified, can be used to create a generic networking setup with a single public subnet and a single fully isolated private subnet commonly used for website hosting:

 hclprovider "aws" {
  region = "us-east-1"
}

module "vpc" {
  source  = "solutions.corewide.com/aws/tf-aws-vpc/aws"
  version = "~> 5.1"

  name_prefix = "foo-ha"
  cidr_block  = "20.20.0.0/16"
  preset      = "canonical"
  ha_enabled  = true

  tags = {
    Project = "bar"
  }
}
Variable Description Type Default Required Sensitive
cidr_block The CIDR block for the VPC string yes no
name_prefix Naming prefix for all the resources created by the module string yes no
subnets[<key>] Subnet name string yes no
tags Tags that must be assigned to resources map(string) yes no
dns_hostnames_enabled Enable/disable DNS hostnames for VPC bool true no no
ha_enabled Whether networking must be highly available (multi-zonal) bool false no no
nat_enabled Whether NAT resources must be created bool true no no
preset Preconfigured networking setup string advanced no no
private_subnet_destination_cidr_block Allowed destination CIDR block for access from the public VPC segment string 0.0.0.0/0 no no
public_subnet_destination_cidr_block Allowed destination CIDR block for access from the public VPC segment string 0.0.0.0/0 no no
subnets Specific definitions for the subnets creation. Map keys are used as subnet names and values with further defined elements map(object) {} no no
subnets[<key>].availability_zone Availability zone of the subnet string yes no
subnets[<key>].enable_auto_assigning_ips Defines that instances launched into the public subnet should be assigned a public IP address bool true no no
subnets[<key>].nat_via Name of public subnet to create NAT GW in. Private network will use it for outgoing Internet traffic string no no
subnets[<key>].private_subnet_cidr_block The IPv4 CIDR block for the private subnet string no no
subnets[<key>].public_subnet_cidr_block The IPv4 CIDR block for the public subnet string no no
subnets[<key>].tags Map of additional subnet-specific tags map(string) no no
Output Description Type Sensitive
nat_gw_ips List of elastic IPs used for outgoing traffic list(attribute) no
private_subnets Contains attributes of private VPC segment resource no
public_subnets Contains attributes of public VPC segment resource no
vpc Contains attributes of aws_vpc resource resource no
Dependency Version Kind
terraform >= 1.3 CLI
hashicorp/aws ~> 5.0 provider

References

Not sure where to start?
Let's find your perfect match.