Chapter 5: VPC Module - Complete Analysis

A deep dive into a production-ready Terraform VPC module for AWS: networking primitives, hardened defaults, and EKS-ready configuration. Learn how subnets, routing, NAT gateways, flow logs, and security boundaries are implemented so you can standardize your AWS network foundation across dev/stage/prod without drift.

Purpose

The VPC module provides a complete, production-ready networking foundation for AWS infrastructure. It creates:

The VPC module provides a complete, production-ready networking foundation for AWS infrastructure.

Design Philosophy

File:modules/vpc/main.tf

Let's analyze this file line by line:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.0"

Lines 1-3: Module Declaration

• module "vpc" : Declares a module named "vpc" (local name)
• source : Uses the community VPC module from Terraform Registry
• version : Pins to version 5.0.0 for stability

Why Version 5.0.0?:

• Support for latest AWS features
• Security patches
• Bug fixes
• Backward compatibility

  name = "${var.env}-vpc"
  cidr = var.vpc_cidr

Lines 5-6: Basic VPC Configuration

• name : Dynamic VPC name using environment ( dev-vpc , prod-vpc )
• cidr : VPC CIDR block from variable (e.g., 10.10.0.0/16 )

Naming Convention:

• Clear identification in AWS Console
• Easy filtering and searching
• Consistent naming across environments

  azs             = var.azs
  private_subnets = var.private_subnets
  public_subnets  = var.public_subnets

Lines 8-10: Subnet Configuration

• azs : List of availability zones (e.g., ["us-east-1a", "us-east-1b"] )
• private_subnets : CIDR blocks for private subnets (workloads)
• public_subnets : CIDR blocks for public subnets (load balancers, NAT)

Subnet Design:

• Private Subnets: No direct internet access, NAT Gateway required
• Public Subnets: Direct internet access via Internet Gateway
• Best Practice: Workloads in private, only gateways in public

  enable_nat_gateway     = true
  single_nat_gateway     = var.single_nat_gateway
  one_nat_gateway_per_az = var.one_nat_gateway_per_az
  enable_vpn_gateway     = false

Lines 12-15: NAT Gateway Configuration

• enable_nat_gateway = true : Always enable NAT (required for private subnet internet access)
• single_nat_gateway : Single NAT for cost savings (default: true )
• one_nat_gateway_per_az : One NAT per AZ for HA (default: false )
• enable_vpn_gateway = false : VPN disabled (no site-to-site VPN)

Cost Consideration:

• Single NAT: ~$32/month + data transfer
• One per AZ: ~$96/month + data transfer (3 AZs)
• Recommendation: Start with single NAT, add per-AZ if needed

  # Flow Logs
  enable_flow_log                      = var.enable_flow_log
  create_flow_log_cloudwatch_log_group = var.enable_flow_log
  create_flow_log_cloudwatch_iam_role  = var.enable_flow_log
  flow_log_max_aggregation_interval    = 60
  flow_log_destination_type            = var.flow_log_destination_type

Lines 17-22: VPC Flow Logs

• enable_flow_log : Master switch for flow logs (default: false )
• create_flow_log_cloudwatch_log_group : Auto-create CloudWatch log group
• create_flow_log_cloudwatch_iam_role : Auto-create IAM role for flow logs
• flow_log_max_aggregation_interval = 60 : Aggregate logs every 60 seconds
• flow_log_destination_type : CloudWatch Logs or S3 (default: CloudWatch)

Flow Logs Purpose:

• Network traffic auditing
• Security incident investigation
• Compliance requirements (SOC 2, PCI-DSS)
• Performance analysis

⚠️ Cost Note: Flow logs generate significant CloudWatch costs at scale. Consider S3 for long-term storage.

  # Harden Default Security Group
  manage_default_security_group  = true
  default_security_group_ingress = [] # Deny all
  default_security_group_egress  = [] # Deny all

Lines 24-27: Security Group Hardening

• manage_default_security_group = true : Take control of default SG
• default_security_group_ingress = [] : No inbound rules (deny all)
• default_security_group_egress = [] : No outbound rules (deny all)

Security Best Practice:

• Default security groups often allow all traffic
• This hardening prevents accidental exposure
• Explicit security groups must be created for workloads
• Follows "deny by default" security model

  # Tags required for EKS
  public_subnet_tags = {
    "kubernetes.io/role/elb" = "1"
    "kubernetes.io/cluster/${var.cluster_name}" = "shared"
  }

  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = "1"
    "kubernetes.io/cluster/${var.cluster_name}" = "shared"
  }

Lines 29-38: EKS Subnet Tags

Public Subnet Tags:

• kubernetes.io/role/elb = "1": Allow ELB to use these subnets
• kubernetes.io/cluster/<name> = "shared": Mark for EKS cluster discovery

Private Subnet Tags:

• kubernetes.io/role/internal-elb = "1": Allow internal ELB to use these subnets
• kubernetes.io/cluster/<name> = "shared": Mark for EKS cluster discovery

Why These Tags?:

• Kubernetes needs subnet tags to discover network topology
• ELB controller uses tags to choose subnets
• "shared" allows multiple clusters (if needed)

Tag Values:

• "1" = Enable this role for the subnet
• "shared" = Subnet can be shared across clusters (vs. "owned")

  tags = {
    Environment = var.env
    Terraform   = "true"
  }
}

Lines 40-43: Default Tags

• Environment = var.env : Tag with environment name
• Terraform = "true" : Mark as Terraform-managed

Note:

• Project = "Production-Grade-IaC"
• ManagedBy = "Terragrunt"
• Owner = "PlatformTeam"

Complete Variable Reference

variable "env" {
  description = "Environment name"
  type        = string
}

variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
}

variable "azs" {
  description = "Availability Zones"
  type        = list(string)
}

variable "private_subnets" {
  description = "Private Subnet CIDRs"
  type        = list(string)
}

variable "public_subnets" {
  description = "Public Subnet CIDRs"
  type        = list(string)
}

variable "cluster_name" {
  description = "EKS Cluster Name (for tagging)"
  type        = string
  default     = ""
}

variable "enable_flow_log" {
  description = "Enable VPC Flow Logs"
  type        = bool
  default     = false
}

variable "flow_log_destination_type" {
  description = "Type of flow log destination (cloud-watch-logs or s3)"
  type        = string
  default     = "cloud-watch-logs"
}

variable "single_nat_gateway" {
  description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
  type        = bool
  default     = true
}

variable "one_nat_gateway_per_az" {
  description = "Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`."
  type        = bool
  default     = false
}

Complete Output Reference

output "vpc_id" {
  description = "The ID of the VPC"
  value       = module.vpc.vpc_id
}

output "private_subnets" {
  description = "List of IDs of private subnets"
  value       = module.vpc.private_subnets
}

output "public_subnets" {
  description = "List of IDs of public subnets"
  value       = module.vpc.public_subnets
}

Example 1: Basic Dev Environment

Configuration (values.yaml):

vpc:
  cidr: "10.10.0.0/16"
  azs: ["us-east-1a", "us-east-1b"]
  private_subnets: ["10.10.1.0/24", "10.10.2.0/24"]
  public_subnets: ["10.10.101.0/24", "10.10.102.0/24"]
  enable_flow_log: false
  single_nat_gateway: true

Result:

• VPC: 10.10.0.0/16 (65,536 IPs)
• 2 AZs for cost savings
• Private subnets: /24 each (256 IPs each)
• Public subnets: /24 each (256 IPs each)
• Single NAT Gateway (~$32/month)
• Flow logs disabled (cost savings)

Example 2: Production Environment

Configuration (values.yaml):

vpc:
  cidr: "10.30.0.0/16"
  azs: ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets: ["10.30.1.0/24", "10.30.2.0/24", "10.30.3.0/24"]
  public_subnets: ["10.30.101.0/24", "10.30.102.0/24", "10.30.103.0/24"]
  enable_flow_log: true
  flow_log_destination_type: "cloud-watch-logs"
  single_nat_gateway: false
  one_nat_gateway_per_az: true

Result:

• VPC: 10.30.0.0/16 (production CIDR range)
• 3 AZs for high availability
• Private subnets: /24 each (256 IPs each, 3 subnets)
• Public subnets: /24 each (256 IPs each, 3 subnets)
• NAT Gateway per AZ (~$96/month, high availability)
• Flow logs enabled (auditing and compliance)

Example 3: Large Scale Environment

Configuration (values.yaml):

vpc:
  cidr: "10.40.0.0/16"
  azs: ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets: ["10.40.1.0/22", "10.40.5.0/22", "10.40.9.0/22"]
  public_subnets: ["10.40.13.0/24", "10.40.14.0/24", "10.40.15.0/24"]
  enable_flow_log: true
  flow_log_destination_type: "s3"
  single_nat_gateway: false
  one_nat_gateway_per_az: true

Result:

• VPC: 10.40.0.0/16 (large CIDR range)
• 3 AZs for high availability
• Private subnets: /22 each (1,024 IPs each, for large node groups)
• Public subnets: /24 each (256 IPs each, sufficient for gateways)
• NAT Gateway per AZ (high availability)
• Flow logs to S3 (cost-effective for long-term storage)

Adding VPC Endpoints

To add VPC endpoints (for private access to AWS services), customize the module:

Option 1: Extend the Module

Create modules/vpc/endpoints.tf:

resource "aws_vpc_endpoint" "s3" {
  vpc_id       = module.vpc.vpc_id
  service_name = "com.amazonaws.us-east-1.s3"
  route_table_ids = module.vpc.private_route_table_ids
}

Option 2: Add to Existing Module

Edit modules/vpc/main.tf:

module "vpc" {
  # ... existing config ...

  enable_s3_endpoint = true
  # ... other endpoints ...
}

Custom Security Groups

The module hardens the default security group, but you can add custom security groups:

resource "aws_security_group" "eks_nodes" {
  name        = "${var.env}-eks-nodes"
  description = "Security group for EKS nodes"
  vpc_id      = module.vpc.vpc_id

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.env}-eks-nodes"
  }
}

Custom Route Tables

The module creates route tables automatically, but you can add custom ones:

resource "aws_route_table" "custom" {
  vpc_id = module.vpc.vpc_id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = module.vpc.internet_gateway_id
  }

  tags = {
    Name = "${var.env}-custom-rt"
  }
}

Pattern 1: Multi-Region

# live/us-east-1/dev-1/values.yaml
vpc:
  cidr: "10.10.0.0/16"
  azs: ["us-east-1a", "us-east-1b"]

# live/us-west-2/dev-1/values.yaml
vpc:
  cidr: "10.11.0.0/16"  # Different CIDR to avoid conflicts
  azs: ["us-west-2a", "us-west-2b"]

Pattern 2: Environment Isolation

# Dev uses smaller CIDR ranges
vpc:
  cidr: "10.10.0.0/16"

# Prod uses separate CIDR ranges
vpc:
  cidr: "10.30.0.0/16"

Issue: Subnet Overlap

Error:

Error: overlapping subnet CIDR blocks

Solution:

• Ensure private_subnets and public_subnets don't overlap
• Ensure all subnets are within vpc_cidr range
• Verify CIDR calculations

Issue: Insufficient IP Addresses

Error:

Error: subnet doesn't have enough IPs

Solution:

• Increase subnet size (e.g., /24 → /22)
• Use larger VPC CIDR block
• Verify subnet sizes match workload requirements

Issue: EKS Tags Missing

Error:

Error: EKS can't discover subnets

Solution:

• Verify cluster_name variable is set
• Check subnet tags include kubernetes.io/cluster/<name>
• Ensure tags match cluster name