// terraform-aws-vpc-complete

Executive Summary

This module provisions a fully-featured AWS VPC with five distinct subnet tiers (public, private, database, intra, and elasticache), enabling defense-in-depth network segmentation. It supports high-availability NAT Gateway deployment (per-AZ or single), IPv6 dual-stack networking, VPC Flow Logs with KMS encryption, gateway endpoints (S3, DynamoDB), interface endpoints for private AWS service access, custom DHCP options, VPN Gateway, and default security group lockdown. Sub-modules provide IPAM integration, VPC peering, and standalone flow log configuration. All resources follow consistent naming and tagging conventions.

Overview

Architecture Diagram

Component Breakdown

Data Flow

Inbound traffic hits the ALB in public subnets, routes to application workloads in private subnets, which query databases in isolated DB subnets. Private subnets access the internet via NAT Gateways for outbound only. Intra subnets have zero internet access. VPC endpoints provide private access to S3 and DynamoDB without traversing the internet.

Security Controls

Industry Adaptation

Production Readiness Checklist

• Deploy in 3 AZs for high availability
• Use per-AZ NAT Gateways (single_nat_gateway = false) in production
• Enable VPC Flow Logs with enable_flow_logs = true
• Set flow_log_max_aggregation_interval = 60 for security-sensitive environments
• Enable S3 gateway endpoint to reduce data transfer costs
• Use interface endpoints for services accessed from private subnets (SSM, ECR, STS)
• Keep default security group locked down with no rules
• Use database subnets for RDS/Aurora with no direct internet route
• Use intra subnets for highly sensitive workloads requiring zero internet
• Tag subnets with Tier label for cost allocation and identification
• Plan CIDR blocks carefully -- consider secondary CIDRs for future growth

Configuration Reference

Required Variables

Key Optional Variables

Cost Estimate (us-east-1)

Deployment

module "vpc" {
  source = "github.com/kogunlowo123/terraform-aws-vpc-complete"

  name       = "prod-vpc"
  cidr_block = "10.100.0.0/16"

  availability_zones    = ["us-east-1a", "us-east-1b", "us-east-1c"]
  public_subnet_cidrs   = ["10.100.1.0/24", "10.100.2.0/24", "10.100.3.0/24"]
  private_subnet_cidrs  = ["10.100.11.0/24", "10.100.12.0/24", "10.100.13.0/24"]
  database_subnet_cidrs = ["10.100.21.0/24", "10.100.22.0/24", "10.100.23.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = false

  tags = { Environment = "production" }
}

Links