TerraformPilot

Guides

Terraform AWS VPC - Complete Example With Subnets, NAT, and Security Groups

Production-ready Terraform AWS VPC with public/private subnets, NAT gateway, and security groups. Complete copy-paste configuration with code examples.

LLuca Berton1 min read
Terraform AWS VPC - Complete Example With Subnets, NAT, and Security Groups

Production-Ready AWS VPC With Terraform

#

This is a complete, production-ready VPC configuration that you can use as a starting point for any AWS project.

Architecture

#
  • 1 VPC with DNS support
  • 2 public subnets (across 2 AZs)
  • 2 private subnets (across 2 AZs)
  • 1 Internet Gateway
  • 1 NAT Gateway (single AZ for cost savings)
  • Route tables for public and private subnets

Complete Configuration

# 
# variables.tf
variable "vpc_cidr" {
  default = "10.0.0.0/16"
}
 
variable "environment" {
  default = "prod"
}
 
variable "region" {
  default = "us-east-1"
}
 
# main.tf
data "aws_availability_zones" "available" {
  state = "available"
}
 
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true
 
  tags = {
    Name        = "${var.environment}-vpc"
    Environment = var.environment
  }
}
 
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags   = { Name = "${var.environment}-igw" }
}
 
resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone       = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true
  tags                    = { Name = "${var.environment}-public-${count.index + 1}" }
}
 
resource "aws_subnet" "private" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + 10)
  availability_zone = data.aws_availability_zones.available.names[count.index]
  tags              = { Name = "${var.environment}-private-${count.index + 1}" }
}
 
resource "aws_eip" "nat" {
  domain = "vpc"
  tags   = { Name = "${var.environment}-nat-eip" }
}
 
resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  tags          = { Name = "${var.environment}-nat" }
  depends_on    = [aws_internet_gateway.main]
}
 
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
  tags = { Name = "${var.environment}-public-rt" }
}
 
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main.id
  }
  tags = { Name = "${var.environment}-private-rt" }
}
 
resource "aws_route_table_association" "public" {
  count          = 2
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}
 
resource "aws_route_table_association" "private" {
  count          = 2
  subnet_id      = aws_subnet.private[count.index].id
  route_table_id = aws_route_table.private.id
}
 
# outputs.tf
output "vpc_id" { value = aws_vpc.main.id }
output "public_subnet_ids" { value = aws_subnet.public[*].id }
output "private_subnet_ids" { value = aws_subnet.private[*].id }

Cost Considerations

#
  • NAT Gateway: ~$32/month + data transfer
  • For dev/staging: consider NAT instance (t3.nano ~$3/month) instead
  • Multi-AZ NAT: add one per AZ for production HA (~$32/month each)

Frequently asked questions

#

How do I create a VPC with Terraform?

#

Define an aws_vpc resource with a cidr_block, then add aws_subnet, aws_internet_gateway, aws_route_table, and (for private subnets) an aws_nat_gateway. The complete configuration above is production-ready — copy it and adjust the CIDR ranges.

Should I build my own VPC or use the terraform-aws-modules/vpc module?

#

The official terraform-aws-modules/vpc module is great for getting started fast. Writing your own (as shown here) gives you full control and a clearer understanding of subnets, route tables, and NAT — useful when you need to customise or debug.

How many subnets should a VPC have?

#

A common production pattern is two subnets per Availability Zone (one public, one private) across at least two AZs for high availability — four subnets minimum. Put load balancers in public subnets and applications/databases in private subnets.

How do I reduce NAT Gateway costs?

#

NAT Gateways cost ~$32/month each plus data processing. For dev/staging, use a single NAT Gateway or a NAT instance (t3.nano ~$3/month). For production HA, run one NAT Gateway per AZ and accept the cost for resilience.

Learn More

#
#aws#vpc#networking#example

Share this article

Related articles