Repository files navigation

Terraform module to provision public and privatesubnets in an existingVPC

Note: This module is intended for use with an existing VPC and existing Internet Gateway.To create a new VPC, useterraform-aws-vpc module.

Note: Due to Terraformlimitations,many optional inputs to this module are specified as alist(string) that can have zero or one element, rather thanas astring that could be empty ornull. The designation of an input as alist type does not necessarilymean that you can supply more than one value in the list, so check the input's description before supplying more than one value.

The core function of this module is to create 2 sets of subnets, a "public" set with bidirectional access to thepublic internet, and a "private" set behind a firewall with egress-only access to the public internet. Thisincludes dividing up a given CIDR range so that a each subnet gets its owndistinct CIDR range within that range, and then creating those subnets in the appropriate availability zones.The intention is to keep this module relatively simple and easy to use for the most popular use cases.In its default configuration, this module creates 1 public subnet and 1 private subnet in eachof the specified availability zones. The public subnets are configured for bi-directional traffic to thepublic internet, while the private subnets are configured for egress-only traffic to the public internet.Rather than provide a wealth of configuration options allowing for numerous special cases, this moduleprovides some common options and further provides the ability to suppress the creation of resources, allowingyou to create and configure them as you like from outside this module. For example, rather than give you theoption to customize the Network ACL, the module gives you the option to create a completely open one (and controlaccess via Security Groups and other means) or not create one at all, allowing you to create and configure one yourself.

This module defines a public subnet as one that has direct access to an internet gateway and can accept incoming connection requests.In the simplest configuration, the module creates a single route table with a default route targeted to theVPC's internet gateway, and associates all the public subnets with that single route table.

Likewise it creates a single Network ACL with associated rules allowing all ingress and all egress,and associates that ACL with all the public subnets.

A private subnet may be able to initiate traffic to the public internet through a NAT gateway,a NAT instance, or an egress-only internet gateway, or it might only have direct access to otherprivate subnets. In the simple configuration, for IPv4 and/or IPv6 with NAT64 enabled viapublic_dns64_enabledorprivate_dns64_enabled, the module creates 1 NAT Gateway or NAT Instance for eachprivate subnet (in the public subnet in the same availability zone), creates 1 route table for each private subnet,and adds to that route table a default route from the subnet to its NAT Gateway or Instance. For IPv6,the module adds a route to the Egress-Only Internet Gateway configured via input.

As with the Public subnets, the module creates a single Network ACL with associated rules allowing all ingress andall egress, and associates that ACL with all the private subnets.

Various features are controlled bybool inputs with names ending in_enabled. By changing the defaultvalues, you can enable or disable creation of public subnets, private subnets, route tables,NAT gateways, NAT instances, or Network ACLs. So for example, you could use this module to create onlyprivate subnets and the open Network ACL, and then add your own route table associations to the subnetsand route all non-local traffic to a Transit Gateway or VPN.

For IPv4, you provide a CIDR and the module divides the address space into the largest CIDRs possible that are stillsmall enough to accommodatemax_subnet_count subnets of each enabled type (public or private). Whenmax_subnet_countis left at the default0, it is set to the total number of availability zones in the region. Private subnetsare allocated out of the first half of the reserved range, and public subnets are allocated out of the second half.

For IPv6, you provide a/56 CIDR and the module assigns/64 subnets of that CIDR in consecutive order startingat zero. (You have the option of specifying a list of CIDRs instead.) As with IPv4, enough CIDRs are allocated tocovermax_subnet_count private and public subnets (when both are enabled, which is the default), with the privatesubnets being allocated out of the lower half of the reservation and the public subnets allocated out of the upper half.

Tip

👽 Use Atmos with Terraform

Cloud Posse usesatmos to easily orchestrate multiple environments using Terraform.
Works withGithub Actions,Atlantis, orSpacelift.

Watch demo of using Atmos with Terraform

Example of runningatmos to manage infrastructure from ourQuick Start tutorial.

module"subnets" {source="cloudposse/dynamic-subnets/aws"# Cloud Posse recommends pinning every module to a specific version# version = "x.x.x"namespace="eg"stage="prod"name="app"vpc_id="vpc-XXXXXXXX"igw_id=["igw-XXXXXXXX"]ipv4_cidr_block=["10.0.0.0/16"]availability_zones=["us-east-1a","us-east-1b"]}

Create only private subnets, route to transit gateway:

module"private_tgw_subnets" {source="cloudposse/dynamic-subnets/aws"# Cloud Posse recommends pinning every module to a specific version# version = "x.x.x"namespace="eg"stage="prod"name="app"vpc_id="vpc-XXXXXXXX"igw_id=["igw-XXXXXXXX"]ipv4_cidr_block=["10.0.0.0/16"]availability_zones=["us-east-1a","us-east-1b"]nat_gateway_enabled=falsepublic_subnets_enabled=false}resource"aws_route""private" {count=length(module.private_tgw_subnets.private_route_table_ids)route_table_id=module.private_tgw_subnets.private_route_table_ids[count.index]destination_cidr_block="0.0.0.0/0"transit_gateway_id="tgw-XXXXXXXXX"}

Seeexamples for working examples. In particular, seeexamples/naclsfor an example of how to create custom Network Access Control Lists (NACLs) outside ofbut in conjunction with this module.

{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}

list(object({
    private = list(string)
    public  = list(string)
  }))

list(object({
    private = list(string)
    public  = list(string)
  }))

[
  "default"
]

[
  "common"
]

terraform-aws-dynamic-subnets creates a set of subnets based on various CIDR inputs andthe maximum possible number of subnets, which ismax_subnet_count when specified orthe number of Availability Zones in the region whenmax_subnet_count is left atits default value of zero.

You can explicitly provide CIDRs for subnets viaipv4_cidrs andipv6_cidrs inputs if you want,but the usual use case is to provide a single CIDR which this module will subdivide into a setof CIDRs as follows:

1. Get number of available AZ in the region:

existing_az_count = length(data.aws_availability_zones.available.names)

2. Determine how many sets of subnets are being created. (Usually it is2:public andprivate):subnet_type_count.
3. Multiply the results of (1) and (2) to determine how many CIDRs to reserve:

cidr_count = existing_az_count * subnet_type_count

4. Calculate the number of bits needed to enumerate all the CIDRs:

subnet_bits = ceil(log(cidr_count, 2))

5. Reserve CIDRs for private subnets usingcidrsubnet:

private_subnet_cidrs = [ for netnumber in range(0, existing_az_count): cidrsubnet(cidr_block, subnet_bits, netnumber) ]

6. Reserve CIDRs for public subnets in the second half of the CIDR block:

public_subnet_cidrs = [ for netnumber in range(existing_az_count, existing_az_count * 2): cidrsubnet(cidr_block, subnet_bits, netnumber) ]

Note that this means that, for example, in a region with 4 availability zones, if you specify only 3 availability zonesinvar.availability_zones, this module will still reserve CIDRs for the 4th zone. This is so that if you laterwant to expand into that zone, the existing subnet CIDR assignments will not be disturbed. If you do not wantto reserve these CIDRs, setmax_subnet_count to the number of zones you are actually using.

Check out these related projects.

• terraform-aws-vpc - Terraform Module that defines a VPC with public/private subnets across multiple AZs with Internet Gateways
• terraform-aws-vpc-peering - Terraform module to create a peering connection between two VPCs
• terraform-aws-kops-vpc-peering - Terraform module to create a peering connection between a backing services VPC and a VPC created by Kops
• terraform-aws-named-subnets - Terraform module for named subnets provisioning.

This project is under active development, and we encourage contributions from our community.

Many thanks to our outstanding contributors:

For 🐛 bug reports & feature requests, please use theissue tracker.

In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.

1. Review ourCode of Conduct andContributor Guidelines.
2. Fork the repo on GitHub
3. Clone the project to your own machine
4. Commit changes to your own branch
5. Push your work back up to your fork
6. Submit aPull Request so that we can review your changes

NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!

We useAtmos to streamline how Terraform tests are run. It centralizes configuration and wraps common test workflows with easy-to-use commands.

All tests are located in thetest/ folder.

Under the hood, tests are powered by Terratest together with our internalTest Helpers library, providing robust infrastructure validation.

Setup dependencies:

• Install Atmos (installation guide)
• Install Go1.24+ or newer
• Install Terraform or OpenTofu

To run tests:

• Run all tests:

  atmostest run

• Clean up test artifacts:

  atmostest clean

• Explore additional test options:

  atmostest --help

The configuration for test commands is centrally managed. To review what's being imported, see theatmos.yaml file.

Learn more about ourautomated testing in our documentation or implementingcustom commands with atmos.

Join ourOpen Source Community on Slack. It'sFREE for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totallysweet infrastructure.

Sign up forour newsletter and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know.Dropped straight into your Inbox every week — and usually a 5-minute read.

Join us every Wednesday via Zoom for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus alive Q&A that you can’t find anywhere else.It'sFREE for everyone!

Licensed to the Apache Software Foundation (ASF) under oneor more contributor license agreements.  See the NOTICE filedistributed with this work for additional informationregarding copyright ownership.  The ASF licenses this fileto you under the Apache License, Version 2.0 (the"License"); you may not use this file except in compliancewith the License.  You may obtain a copy of the License at  https://www.apache.org/licenses/LICENSE-2.0Unless required by applicable law or agreed to in writing,software distributed under the License is distributed on an"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANYKIND, either express or implied.  See the License for thespecific language governing permissions and limitationsunder the License.

All other trademarks referenced herein are the property of their respective owners.

Copyright © 2017-2025Cloud Posse, LLC