Guide: Managing Networking (VPC)
Relevant source files
The following files were used as context for generating this wiki page:
This guide provides a technical overview of how to define and manage core AWS networking components using the Terraform AWS provider. The primary focus is on creating a Virtual Private Cloud (VPC) and its related resources, such as subnets, internet gateways, and route tables. The information is based on the provider's internal schema definitions and practical examples found within the repository. The EC2 package is the primary location for these networking resources.
Sources: internal/service/ec2/README.md
Networking Architecture Overview
The fundamental networking components managed by the provider work together to create an isolated network environment in AWS. A typical setup involves a VPC that acts as a container, subnets that partition the VPC's IP address range, an Internet Gateway to provide access to the public internet, and Route Tables that direct traffic from the subnets.
The following diagram illustrates the relationship between these resources as defined in the example configurations.
This diagram shows a central VPC containing multiple Subnets. The VPC is attached to an Internet Gateway, and a Route Table directs traffic to this gateway. Subnets are then explicitly associated with the Route Table to gain internet access.
Sources: examples/ecs-alb/main.tf:16-44
Core Resources
The following sections detail the primary Terraform resources used to construct a VPC environment.
aws_vpc
This resource is the top-level container for your network. It is defined by a CIDR block, which specifies the private IP address range for the network.
Key Arguments & Attributes
| Argument | Type | Description |
|---|---|---|
cidr_block | TypeString | The IPv4 CIDR block for the VPC. |
instance_tenancy | TypeString | A tenancy option for instances launched into the VPC. |
enable_dns_support | TypeBool | A boolean to enable/disable DNS support in the VPC. |
enable_dns_hostnames | TypeBool | A boolean to enable/disable DNS hostnames in the VPC. |
tags | TypeMap | A map of tags to assign to the resource. |
Sources: internal/service/ec2/vpc.go:34-106
Example Usage
resource "aws_vpc" "main" {
cidr_block = "10.10.0.0/16"
}
Sources: examples/ecs-alb/main.tf:16-18
aws_subnet
Subnets are created within a VPC and partition its IP address range. Each subnet must reside in a single Availability Zone and is where resources like EC2 instances are launched.
Key Arguments & Attributes
| Argument | Type | Description |
|---|---|---|
vpc_id | TypeString | The VPC ID to create the subnet in. |
cidr_block | TypeString | The IPv4 CIDR block for the subnet. |
availability_zone | TypeString | The AZ for the subnet. |
map_public_ip_on_launch | TypeBool | Specify true to indicate that instances launched into the subnet should be assigned a public IPv4 address. |
tags | TypeMap | A map of tags to assign to the resource. |
Sources: internal/service/ec2/subnet.go:34-103
Example Usage
This example demonstrates creating multiple subnets across different Availability Zones using the count meta-argument.
data "aws_availability_zones" "available" {}
resource "aws_subnet" "main" {
count = var.az_count
cidr_block = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)
availability_zone = data.aws_availability_zones.available.names[count.index]
vpc_id = aws_vpc.main.id
}
Sources: examples/ecs-alb/main.tf:14-25
aws_internet_gateway
An Internet Gateway (IGW) allows communication between your VPC and the internet. It must be created and then attached to a VPC.
Key Arguments & Attributes
| Argument | Type | Description |
|---|---|---|
vpc_id | TypeString | The VPC ID to attach the Internet Gateway to. |
tags | TypeMap | A map of tags to assign to the resource. |
Sources: examples/networking/region/vpc.tf:15-18
Example Usage
resource "aws_internet_gateway" "gw" {
vpc_id = aws_vpc.main.id
}
Sources: examples/ecs-alb/main.tf:27-29
aws_route_table & aws_route_table_association
A route table contains a set of rules, called routes, that determine where network traffic is directed. The aws_route_table resource creates the table, and the aws_route_table_association resource links it to a subnet.
Key Arguments & Attributes (aws_route_table)
| Argument | Type | Description |
|---|---|---|
vpc_id | TypeString | The VPC ID. |
route | TypeSet | A set of route rules. Each route specifies a destination CIDR block and a target (e.g., an internet gateway). |
tags | TypeMap | A map of tags to assign to the resource. |
Sources: internal/service/ec2/route_table.go:34-100
Example Usage
The following example creates a route table with a default route (0.0.0.0/0) pointing to an internet gateway, and then associates that table with a subnet.
# Create the route table with a default route to the IGW
resource "aws_route_table" "r" {
vpc_id = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.gw.id
}
}
# Associate the route table with the subnets
resource "aws_route_table_association" "a" {
count = var.az_count
subnet_id = element(aws_subnet.main.*.id, count.index)
route_table_id = aws_route_table.r.id
}
Sources: examples/ecs-alb/main.tf:31-44
Summary
The Terraform AWS provider offers a declarative way to manage a complete VPC networking stack. By defining resources such as aws_vpc, aws_subnet, aws_internet_gateway, and aws_route_table, developers can codify their network infrastructure, ensuring it is version-controlled, repeatable, and easily integrated with other cloud resources. The examples demonstrate how these components are linked together to form a functional, internet-connected network.