This module can be used to deploy a pragmatic VPC with various subnets types in # AZs. Common deployment examples can be found in examples/. Subnet CIDRs can be explicitly set via list of string argument cidrs or set via a number netmask argument.
The example below builds a VPC with public and private subnets in 3 AZs. Each subnet calulates a CIDR based on the netmask argument passed. The public subnets build nat gateways in each AZ but optionally can be switched to single_az.
module "vpc" {
source = "aws-ia/vpc/aws"
version = ">= 1.0.0"
name = "multi-az-vpc"
cidr_block = "10.0.0.0/20"
az_count = 3
subnets = {
public = {
name_prefix = "my-public" # omit to prefix with "public"
netmask = 24
nat_gateway_configuration = "all_azs" # options: "single_az", "none"
}
private = {
# omitting name_prefix defaults value to "private"
# name_prefix = "private"
netmask = 24
route_to_nat = true
}
}
vpc_flow_logs = {
log_destination_type = "cloud-watch-logs"
retention_in_days = 180
}
}If using netmask to calculate subnets and you wish to either add or remove subnets (ex: adding / removing an AZ), you may have to change from using netmask for some subnets and set to explicit instead. Private subnets are always calculated before public.
When changing to explicit cidrs, subnets are always ordered by AZ. 0 -> a, 1 -> b, etc.
Example: Changing from 2 azs to 3
Before:
cidr_block = "10.0.0.0/16"
az_count = 2
subnets = {
public = {
netmask = 24
}
private = {
netmask = 24
}
}After:
cidr_block = "10.0.0.0/16"
az_count = 3
subnets = {
public = {
cidrs = ["10.0.0.0/24", "10.0.1.0/24", "10.0.4.0/24"]
}
private = {
cidrs = ["10.0.2.0/24", "10.0.3.0/24", "10.0.5.0/24"]
}
}The above example will cause only creating 2 new subnets in az c of the region being used.
| Name | Version |
|---|---|
| terraform | >= 0.15.0 |
| aws | >= 3.72.0 |
| awscc | >= 0.15.0 |
| Name | Version |
|---|---|
| aws | >= 3.72.0 |
| awscc | >= 0.15.0 |
| Name | Source | Version |
|---|---|---|
| calculate_subnets | ./modules/calculate_subnets | n/a |
| flow_logs | ./modules/flow_logs | n/a |
| tags | aws-ia/label/aws | 0.0.4 |
| Name | Type |
|---|---|
| aws_eip.nat | resource |
| aws_internet_gateway.main | resource |
| aws_nat_gateway.main | resource |
| aws_route.private_to_nat | resource |
| aws_route.public_to_igw | resource |
| aws_subnet.private | resource |
| aws_subnet.public | resource |
| aws_vpc.main | resource |
| aws_vpc_ipv4_cidr_block_association.secondary | resource |
| awscc_ec2_route_table.private | resource |
| awscc_ec2_route_table.public | resource |
| awscc_ec2_subnet_route_table_association.private | resource |
| awscc_ec2_subnet_route_table_association.public | resource |
| aws_availability_zones.current | data source |
| aws_vpc_ipam_preview_next_cidr.main | data source |
| awscc_ec2_vpc.main | data source |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| az_count | Searches region for # of AZs to use and takes a slice based on count. Assume slice is sorted a-z. | number |
n/a | yes |
| name | Name to give VPC. Note: does not effect subnet names, which get assigned name based on name_prefix. | string |
n/a | yes |
| subnets | Configuration of subnets to build in VPC. Valid key restriction information found in variables.tf. | any |
n/a | yes |
| cidr_block | CIDR range to assign to VPC if creating VPC or to associte as a secondary CIDR. Overridden by var.vpc_id output from data.aws_vpc. | string |
null |
no |
| tags | Tags to apply to all resources. | map(string) |
{} |
no |
| vpc_enable_dns_hostnames | Indicates whether the instances launched in the VPC get DNS hostnames. If enabled, instances in the VPC get DNS hostnames; otherwise, they do not. Disabled by default for nondefault VPCs. | bool |
true |
no |
| vpc_enable_dns_support | Indicates whether the DNS resolution is supported for the VPC. If enabled, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC network range "plus two" succeed. If disabled, the Amazon provided DNS service in the VPC that resolves public DNS hostnames to IP addresses is not enabled. Enabled by default. | bool |
true |
no |
| vpc_flow_logs | Whether or not to create VPC flow logs and which type. Options: "cloudwatch", "s3", "none". By default creates flow logs to cloudwatch. Variable overrides null value types for some keys, defined in defaults.tf. |
object({ |
{ |
no |
| vpc_id | VPC ID to use if not creating VPC. | string |
null |
no |
| vpc_instance_tenancy | The allowed tenancy of instances launched into the VPC. | string |
"default" |
no |
| vpc_ipv4_ipam_pool_id | Set to use IPAM to get CIDR block. | string |
null |
no |
| vpc_ipv4_netmask_length | Set to use IPAM to get CIDR block using a specified netmask. Must be set with var.vpc_ipv4_ipam_pool_id. | string |
null |
no |
| vpc_secondary_cidr | If true the module will create a aws_vpc_ipv4_cidr_block_association and subnets for that secondary cidr. If using IPAM for both primary and secondary CIDRs, you may only call this module serially (aka using -target, etc). |
bool |
false |
no |
| Name | Description |
|---|---|
| subnets | Subnets grouped by type. |
| vpc | VPC Resource Information. Full output of aws_vpc. |