VPC Network

Type: rvn-aws-network · Latest version: 0.2.2

Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

Readme

Production-ready AWS VPC with public and private subnets, NAT gateways, and compliance-ready flow logs.

Overview

A VPC (Virtual Private Cloud) is the foundational networking layer for your AWS infrastructure. This module creates an isolated virtual network with public and private subnets spanning multiple availability zones, giving you complete control over your networking environment. The VPC module provides:

Public and private subnets across multiple availability zones for high availability
NAT Gateway options for outbound internet access from private subnets
VPC Flow Logs for network traffic monitoring and SOC 2 compliance
VPC Peering to connect with existing VPCs across accounts or regions

Terraform source: flightcontrolhq/modules/networking/vpc

Use cases

Scenario	VPC helps by…
Running production workloads	Isolating resources in private subnets with NAT egress
Deploying ECS/EKS clusters	Providing subnet IDs and security groups for services
Connecting to RDS databases	Hosting databases in private subnets without public access
SOC 2 compliance	Enabling flow logs for network traffic auditing
Multi-region architecture	Peering VPCs across regions for low-latency communication
Partner IP allowlisting	Using stable NAT Gateway IPs with pre-allocated EIPs

Subnet types

Public subnets

Public subnets have direct internet access via a free Internet Gateway. Resources in public subnets do not receive public IP addresses automatically; attach public IPs explicitly when needed. Use these for:

Load balancers (ALB, NLB)
Bastion hosts
NAT Gateways

Private subnets

Private subnets have no direct internet access. Outbound traffic routes through NAT Gateway(s) when enabled. Use these for:

Application servers (ECS tasks, EKS pods)
RDS databases
ElastiCache clusters
Lambda functions with VPC access

NAT Gateway

NAT Gateway gives your private subnets two things:

Internet access — Resources can reach the internet for updates, API calls, and external services
Static public IP — All outbound traffic exits through the same IP, so partners can allowlist your IP address

Mode	Description	Cost
Disabled	No outbound internet from private subnets	$0
Single (default)	One NAT Gateway serves all availability zones	~$32/mo
High availability	One NAT Gateway per AZ, avoids cross-AZ data charges	~$96/mo

Keeping your IP stable

By default, the module creates a new Elastic IP for each NAT Gateway. If you ever reprovision the VPC, that IP changes. To keep the same IP permanently, create your Elastic IPs separately and pass in the allocation IDs. This way, even if you destroy and recreate the entire VPC, your NAT Gateway will use the same public IP — no need to update partner allowlists or firewall rules.

Configuration

Field	Required	Default	Description
AWS Account	Yes	—	AWS account to deploy the VPC
Region	Yes	—	AWS region (recommend avoiding us-east-1 for reliability)
Name	Yes	`{project}-{env}`	Name prefix for all resources (1-36 chars, lowercase, hyphens allowed)
VPC CIDR	No	`10.0.0.0/16`	IPv4 address range for the VPC
Subnet pairs	No	Auto	Up to 3 public/private subnet pairs, capped by available AZs
NAT Gateway	No	`true`	Enable outbound internet from private subnets
NAT Gateway High Availability	No	`false`	Deploy one NAT per AZ instead of a single shared NAT
NAT Gateway EIP Allocation IDs	No	—	Pre-allocated EIPs for stable NAT public IPs
Flow Logs	No	`false`	Enable VPC Flow Logs (required for SOC 2)
Tags	No	Environment, Project	Custom tags applied to all resources

VPC Peering

Connect this VPC to existing VPCs for private communication without traversing the internet. Peering supports:

Same-account, same-region: Auto-accepts and configures routes in both directions
Cross-account or cross-region: Creates the peering request; peer must accept and configure return routes

Field	Description
Peer VPC ID	The VPC ID to peer with
Peer CIDR Blocks	CIDR blocks of the peer VPC (routes are added automatically)
Peer Owner ID	AWS account ID for cross-account peering
Peer Region	AWS region for cross-region peering
Add to Public/Private Routes	Whether to add routes in this VPC’s route tables
Peer Route Table IDs	Route tables in the peer VPC to add return routes (same-account only)

SOC 2 compliance

Enable Flow Logs to capture network traffic metadata for security auditing. Flow logs record:

Source and destination IP addresses
Ports and protocols
Packet and byte counts
Accept/reject actions

Logs are stored in CloudWatch Logs with configurable retention. This satisfies SOC 2 requirements for network traffic monitoring and audit trails.

Design decisions

This VPC follows AWS VPC best practices:

Availability zone spread: Subnets are provisioned across up to 3 AZs by default, capped by the AZs available in the selected region and AWS account
Automatic CIDR allocation: Subnets are /24 blocks carved from your VPC CIDR. With the default 10.0.0.0/16, the first three public subnets get 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24 and private subnets get 10.0.11.0/24, 10.0.12.0/24, 10.0.13.0/24.
DNS enabled: DNS support and hostnames are enabled for service discovery
Single route table for public: All public subnets share one route table with an Internet Gateway route
Per-AZ route tables when HA NAT: Each private subnet gets its own route table pointing to the NAT in its AZ

Learn more

AWS VPC

AWS VPC User Guide — Official documentation
VPC Design Best Practices — Security recommendations
NAT Gateway Pricing — Cost breakdown for NAT Gateways

Network Architecture

Plan your VPC — AWS guide to VPC planning
Building Scalable and Secure Multi-VPC Infrastructure — AWS whitepaper on VPC design patterns
Availability Zones — Understanding AZ redundancy

Inputs reference

All inputs for rvn-aws-network version 0.2.2. Use the name shown for each field as the input key in module config.

AWS account & region

aws_account_id

string

required

AWS account.

Immutable after creation

aws_region

string

required

Region. Recommend anything but us-east-1 as it has the most outages.

Immutable after creation

VPC config

name

string

required

Name slug. Name prefix for all resources created by this module.

Default: <<project.given_id>>-<<environment.given_id>>
Immutable after creation
Pattern: ^[a-z0-9]([a-z0-9-]{0,34}[a-z0-9])?$ — The name must be 1-36 characters, contain only lowercase letters, numbers, and hyphens, and start and end with a letter or number.

vpc_cidr

string

VPC CIDR. The IPv4 CIDR block for the VPC.

Default: 10.0.0.0/16
Immutable after creation

subnet_count

number

Subnet pairs. Leave empty to create up to 3 public/private subnet pairs, capped by the availability zones available in the selected region and AWS account.

Min: 1
Max: 6

NAT gateway

nat_gateway_enabled

boolean

NAT gateway. Needed if you want to access the internet from within private subnets

Default: true

nat_gateway_high_availability_enabled

boolean

NAT gateway high availability. High availability adds NAT Gateway to every AZ. Otherwise single NAT gateway serves all AZs.

Default: false

nat_gateway_eip_allocation_ids

string_array

NAT gateway Elastic IP allocation IDs. A list of pre-allocated Elastic IP allocation IDs (for example from the networking/eips module) to associate with the NAT Gateway(s). When null or empty (default), the module allocates new EIPs internally.The list length must match the number of NAT Gateways the module will create:

1 when nat_gateway_high_availability_enabled = false
the resolved subnet pair count when nat_gateway_high_availability_enabled = true

Supplied EIPs must already exist with domain = “vpc”. This is useful for keeping NAT public IPs stable across VPC replacements (e.g. for partner allowlists or firewall rules).

SOC 2

flow_logs_enabled

boolean

Flow logs. Enable VPC Flow Logs for network traffic monitoring. Required for SOC 2.

Default: false

Misc

VPC peering

vpc_peering_connections

object_map

Peering connections. Connect this VPC to other VPCsNOTE: For cross-account or cross-region peerings, this module cannot manage the peer VPC’s route tables. The owner of the peer VPC is responsible for adding return routes pointing at the peering connection.

Show item fields

peer_vpc_id

string

required

Peer VPC ID. The ID of the existing VPC to peer with.

peer_cidr_blocks

string_array

required

Peer CIDR blocks. CIDR blocks of the peer VPC. Routes will be added in this VPC’s route tables for each CIDR pointing at the peering connection.

peer_owner_id

string

Peer AWS account ID number. AWS account ID that owns the peer VPC. Defaults to the current account. Required for cross-account peering.

peer_region

string

Peer region. AWS region of the peer VPC. Defaults to the current region. Required for cross-region peering.

remote_vpc_dns_resolution_enabled

boolean

Remote VPC DNS resolution. Allow DNS resolution of private hostnames in the peer VPC from this VPC. Only valid for same-account, same-region peerings.

Default: false

public_route_table_routes_enabled

boolean

Public route table routes. Add routes for peer_cidr_blocks to this VPC’s public route table.

Default: true

private_route_table_routes_enabled

boolean

Private route table routes. Add routes for peer_cidr_blocks to this VPC’s private route table(s).

Default: true

peer_route_table_ids

string_array

Peer route table IDs. Optional list of route table IDs in the peer VPC to add return routes to (destination = this VPC’s CIDR, target = the peering connection). Only supported for same-account, same-region peerings, since the AWS provider used by this module must have access to the peer’s route tables. For cross-account or cross-region peerings, manage the return routes from the peer side instead.

Terraform settings

opentofu_version

string

OpenTofu version override. Override the environment’s default version for this module

ravion_state_backend_workspace

string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

Immutable after creation

advanced_terraform_variables

object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

Default: {}

execution_environment_id

string

Terraform execution environment. Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.

Introduction

Use cases

Concepts

Config as code

Migrate

Modules

Pipelines

Guides

Module definitions

Dependencies and consumers

Readme

Overview

Use cases

Subnet types

Public subnets

Private subnets

NAT Gateway

Keeping your IP stable

Configuration

VPC Peering

SOC 2 compliance

Design decisions

Learn more

Inputs reference

AWS account & region

VPC config

NAT gateway

SOC 2

Misc

VPC peering

Terraform settings

​Dependencies and consumers

​Readme

​Overview

​Use cases

​Subnet types

​Public subnets

​Private subnets

​NAT Gateway

​Keeping your IP stable

​Configuration

​VPC Peering

​SOC 2 compliance

​Design decisions

​Learn more

​Inputs reference

​AWS account & region

​VPC config

​NAT gateway

​SOC 2

​Misc

​VPC peering

​Terraform settings

Dependencies and consumers

Readme

Overview

Use cases

Subnet types

Public subnets

Private subnets

NAT Gateway

Keeping your IP stable

Configuration

VPC Peering

SOC 2 compliance

Design decisions

Learn more

Inputs reference

AWS account & region

VPC config

NAT gateway

SOC 2

Misc

VPC peering

Terraform settings