vpc

Creates a VPC with public, private, and isolated subnet tiers, NAT gateways, route tables, and VPC flow logs.

Provisions a production-grade three-tier VPC with an internet gateway, Elastic IPs and NAT gateways per AZ (or a single shared NAT), separate route tables for each tier, and optional VPC flow logs to CloudWatch Logs or S3.

Usage

module "vpc" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__networking/vpc/aws"
  version = "0.1.0"

  name       = "prod"
  cidr_block = "10.0.0.0/16"

  public_subnets = {
    a = { cidr_block = "10.0.0.0/24", availability_zone = "us-east-1a" }
    b = { cidr_block = "10.0.1.0/24", availability_zone = "us-east-1b" }
  }

  private_subnets = {
    a = { cidr_block = "10.0.10.0/24", availability_zone = "us-east-1a" }
    b = { cidr_block = "10.0.11.0/24", availability_zone = "us-east-1b" }
  }

  isolated_subnets = {
    a = { cidr_block = "10.0.20.0/24", availability_zone = "us-east-1a" }
    b = { cidr_block = "10.0.21.0/24", availability_zone = "us-east-1b" }
  }

  flow_log_destination_arn = module.cloudwatch.log_group_arns["vpc"]
}

Requirements

Name	Version
terraform	>= 1.15.0, < 2.0.0
aws	>= 6.0, < 7.0

Providers

Name	Version
aws	>= 6.0, < 7.0

Resources

Name	Type
aws_ec2_transit_gateway_route_table_association.this	resource
aws_ec2_transit_gateway_route_table_propagation.this	resource
aws_ec2_transit_gateway_vpc_attachment.this	resource
aws_eip.nat	resource
aws_flow_log.this	resource
aws_iam_role.flow_log	resource
aws_iam_role_policy.flow_log	resource
aws_internet_gateway.this	resource
aws_nat_gateway.this	resource
aws_route.isolated_tgw	resource
aws_route.private_nat	resource
aws_route_table.isolated	resource
aws_route_table.private	resource
aws_route_table.public	resource
aws_route_table_association.isolated	resource
aws_route_table_association.private	resource
aws_route_table_association.public	resource
aws_subnet.isolated	resource
aws_subnet.private	resource
aws_subnet.public	resource
aws_vpc.this	resource
aws_vpc_ipv4_cidr_block_association.this	resource

Inputs

Name	Description	Type	Default	Required
cidr_block	Primary IPv4 CIDR block for the VPC	string	n/a	yes
name_prefix	Prefix prepended to resource names created by this module	string	n/a	yes
enable_dns_hostnames	Enable DNS hostnames in the VPC	bool	true	no
enable_dns_support	Enable DNS resolution in the VPC	bool	true	no
enable_flow_logs	Enable VPC flow logs. Requires flow_log_destination_arn to be set.	bool	false	no
enable_nat_gateway	Create NAT gateways for private subnet internet access	bool	false	no
flow_log_destination_arn	CloudWatch log group ARN or S3 bucket ARN for VPC flow logs	string	null	no
flow_log_role_permissions_boundary_arn	Optional permissions boundary ARN for the flow log IAM role.Leave it 'null' if this role is exempted from boundaryrequirements by organizational governance standards.	string	null	no
flow_log_traffic_type	VPC flow log traffic type. ALL, ACCEPT, or REJECT	string	"ALL"	no
isolated_subnets	Map of isolated (no NAT/IGW) subnet logical key to configuration	map(object({ cidr_block = string availability_zone = string }))	{}	no
private_subnets	Map of private subnet logical key to configuration	map(object({ cidr_block = string availability_zone = string }))	{}	no
public_subnets	Map of public subnet logical key to configuration	map(object({ cidr_block = string availability_zone = string map_public_ip = optional(bool, false) }))	{}	no
secondary_cidr_blocks	List of secondary IPv4 CIDR blocks to associate with the VPC	list(string)	[]	no
single_nat_gateway	Use a single NAT gateway instead of one per AZ	bool	false	no
tags	Resource tags to apply to all resources	map(string)	{}	no
tgw_default_route_table_association	Whether the VPC attachment should be associated with the TGW default route table	bool	true	no
tgw_default_route_table_propagation	Whether the VPC attachment should propagate routes to the TGW default route table	bool	true	no
tgw_subnet_keys	Isolated subnet keys used as TGW attachment subnets, excluded from the default TGW route to avoid routing loops	list(string)	[]	no
transit_gateway_id	TGW ID to use as next hop for isolated subnet routes. Routes only created when set.	string	null	no
transit_gateway_route_table_id	TGW route table ID to associate and propagate. Uses TGW default route table when null.	string	null	no

Outputs

Name	Description
arn	VPC ARN
cidr_block	Primary VPC CIDR block
id	VPC ID
internet_gateway_id	Internet gateway ID (null when no public subnets)
isolated_route_table_ids	Map of isolated subnet key to route table ID
isolated_subnet_id_list	Flat list of isolated subnet IDs
isolated_subnet_ids	Map of isolated subnet logical key to subnet ID
nat_gateway_ids	Map of NAT gateway key to NAT gateway ID
private_route_table_ids	Map of private subnet key to route table ID
private_subnet_id_list	Flat list of private subnet IDs
private_subnet_ids	Map of private subnet logical key to subnet ID
public_route_table_id	Public route table ID (null when no public subnets)
public_subnet_id_list	Flat list of public subnet IDs
public_subnet_ids	Map of public subnet logical key to subnet ID
secondary_cidr_blocks	List of secondary CIDR blocks associated with the VPC
tgw_attachment_id	TGW VPC attachment ID, null when transit_gateway_id is not set