VPC Network

Production-ready AWS VPC with public and private subnets, NAT gateways, and compliance-ready flow logs.

Type: rvn-aws-network · Latest version: 1.1.0

Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

Readme

Production-ready AWS VPC with public and private subnets, NAT gateways, and compliance-ready flow logs.

Overview

A VPC (Virtual Private Cloud) is the foundational networking layer for your AWS infrastructure. This module creates an isolated virtual network with public and private subnets spanning multiple availability zones, giving you complete control over your networking environment.

The VPC module provides:

• Public and private subnets across multiple availability zones for high availability
• NAT Gateway options for outbound internet access from private subnets
• VPC endpoints for private access to S3, DynamoDB, and other AWS services
• VPC Flow Logs for network traffic monitoring and SOC 2 compliance
• VPC Peering to connect with existing VPCs across accounts or regions

Terraform source: ravionhq/modules/networking/vpc

Use cases

Scenario	VPC helps by…
Running production workloads	Isolating resources in private subnets with NAT egress
Deploying ECS/EKS clusters	Providing subnet IDs and security groups for services
Connecting to RDS databases	Hosting databases in private subnets without public access
SOC 2 compliance	Enabling flow logs for network traffic auditing
Multi-region architecture	Peering VPCs across regions for low-latency communication
Partner IP allowlisting	Using stable NAT Gateway IPs with pre-allocated EIPs
Reducing NAT data charges	Routing S3/DynamoDB traffic through free gateway endpoints

Subnet types

Public subnets

Public subnets have direct internet access via a free Internet Gateway. Resources in public subnets do not receive public IP addresses automatically; attach public IPs explicitly when needed. Use these for:

• Load balancers (ALB, NLB)
• Bastion hosts
• NAT Gateways

Private subnets

Private subnets have no direct internet access. Outbound traffic routes through NAT Gateway(s) when enabled. Use these for:

• Application servers (ECS tasks, EKS pods)
• RDS databases
• ElastiCache clusters
• Lambda functions with VPC access

NAT Gateway

NAT Gateway gives your private subnets two things:

1. Internet access — Resources can reach the internet for updates, API calls, and external services
2. Static public IP — All outbound traffic exits through the same IP, so partners can allowlist your IP address

Mode	Description	Cost
Disabled	No outbound internet from private subnets	$0
Single (default)	One NAT Gateway serves all availability zones	~$32/mo
High availability	One NAT Gateway per AZ, avoids cross-AZ data charges	~$96/mo

Keeping your IP stable

By default, the module creates a new Elastic IP for each NAT Gateway. If you ever reprovision the VPC, that IP changes.

To keep the same IP permanently, create your Elastic IPs separately and pass in the allocation IDs. This way, even if you destroy and recreate the entire VPC, your NAT Gateway will use the same public IP — no need to update partner allowlists or firewall rules.

VPC endpoints

VPC endpoints let resources in the VPC reach AWS services without traversing the internet or the NAT gateway.

Gateway endpoints (free)

Gateway endpoints for S3 and DynamoDB are free and simply add routes to the VPC’s route tables. The S3 gateway endpoint is enabled by default for new VPCs: it keeps S3 traffic — including ECR image layer downloads — off the NAT gateway, cutting NAT data processing charges.

One caveat: S3 traffic no longer exits through the NAT gateway’s public IP, so S3 bucket policies that allowlist your NAT IP need to be updated (for example to match the endpoint via aws:SourceVpce).

Interface endpoints (PrivateLink)

Interface endpoints provide private connectivity to most other AWS services (ECR, CloudWatch Logs, Secrets Manager, Systems Manager, and more). The module places each endpoint in every private subnet with private DNS enabled and a shared security group allowing HTTPS from within the VPC, so AWS SDKs work without configuration changes.

Consideration	Detail
Cost	~$8/month per endpoint per AZ, plus$0.01/GB processed
ECR without NAT	Requires ECR API + ECR Docker registry + the S3 gateway endpoint
Region scope	Endpoints connect to services in the VPC’s own region only

A typical ECS bundle (ECR API, ECR Docker registry, CloudWatch Logs, Secrets Manager) across 3 AZs runs ~$96/month — more than a single NAT gateway (~$32/month). Choose interface endpoints for private networking and compliance requirements rather than cost savings.

Configuration

Field	Required	Default	Description
AWS Account	Yes	—	AWS account to deploy the VPC
Region	Yes	—	AWS region (recommend avoiding us-east-1 for reliability)
Name	Yes	{project}-{env}	Name prefix for all resources (1-36 chars, lowercase, hyphens allowed)
VPC CIDR	No	10.0.0.0/16	IPv4 address range for the VPC
Subnet pairs	No	Auto	Up to 3 public/private subnet pairs, capped by available AZs
NAT Gateway	No	true	Enable outbound internet from private subnets
NAT Gateway High Availability	No	false	Deploy one NAT per AZ instead of a single shared NAT
NAT Gateway EIP Allocation IDs	No	—	Pre-allocated EIPs for stable NAT public IPs
S3 gateway endpoint	No	true	Free gateway endpoint keeping S3 traffic off the NAT gateway
DynamoDB gateway endpoint	No	false	Free gateway endpoint keeping DynamoDB traffic off the NAT gateway
Interface endpoints	No	—	Interface VPC endpoints (PrivateLink) for private AWS service access
Flow Logs	No	false	Enable VPC Flow Logs (required for SOC 2)
Tags	No	Environment, Project	Custom tags applied to all resources

VPC Peering

Connect this VPC to existing VPCs for private communication without traversing the internet. Peering supports:

• Same-account, same-region: Auto-accepts and configures routes in both directions
• Cross-account or cross-region: Creates the peering request; peer must accept and configure return routes

Field	Description
Peer VPC ID	The VPC ID to peer with
Peer CIDR Blocks	CIDR blocks of the peer VPC (routes are added automatically)
Peer Owner ID	AWS account ID for cross-account peering
Peer Region	AWS region for cross-region peering
Add to Public/Private Routes	Whether to add routes in this VPC’s route tables
Peer Route Table IDs	Route tables in the peer VPC to add return routes (same-account only)

SOC 2 compliance

Enable Flow Logs to capture network traffic metadata for security auditing. Flow logs record:

• Source and destination IP addresses
• Ports and protocols
• Packet and byte counts
• Accept/reject actions

Logs are stored in CloudWatch Logs with configurable retention. This satisfies SOC 2 requirements for network traffic monitoring and audit trails.

Design decisions

This VPC follows AWS VPC best practices:

• Availability zone spread: Subnets are provisioned across up to 3 AZs by default, capped by the AZs available in the selected region and AWS account
• Automatic CIDR allocation: Subnets are /24 blocks carved from your VPC CIDR. With the default 10.0.0.0/16, the first three public subnets get 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24 and private subnets get 10.0.11.0/24, 10.0.12.0/24, 10.0.13.0/24.
• DNS enabled: DNS support and hostnames are enabled for service discovery
• Single route table for public: All public subnets share one route table with an Internet Gateway route
• Per-AZ route tables when HA NAT: Each private subnet gets its own route table pointing to the NAT in its AZ

Learn more

AWS VPC

• AWS VPC User Guide — Official documentation
• VPC Design Best Practices — Security recommendations
• NAT Gateway Pricing — Cost breakdown for NAT Gateways

Network Architecture

• Plan your VPC — AWS guide to VPC planning
• Building Scalable and Secure Multi-VPC Infrastructure — AWS whitepaper on VPC design patterns
• Availability Zones — Understanding AZ redundancy

Inputs reference

All inputs for rvn-aws-network version 1.1.0. Use the name shown for each field as the input key in module config.

AWS account & region

aws_account_id · string · required

AWS account.

• Immutable after creation

aws_region · string · required

Region. Recommend anything but us-east-1 as it has the most outages.

• Immutable after creation

VPC config

name · string · required

Name slug. Name prefix for all resources created by this module.

• Default: <<project.given_id>>-<<environment.given_id>>
• Immutable after creation
• Pattern: ^[a-z0-9]([a-z0-9-]{0,34}[a-z0-9])?$ — The name must be 1-36 characters, contain only lowercase letters, numbers, and hyphens, and start and end with a letter or number.

vpc_cidr · string

VPC CIDR. The IPv4 CIDR block for the VPC.

• Default: 10.0.0.0/16
• Immutable after creation

subnet_count · number

Subnet pairs. Leave empty to create up to 3 public/private subnet pairs, capped by the availability zones available in the selected region and AWS account.

• Min: 1
• Max: 6

NAT gateway

nat_gateway_enabled · boolean

NAT gateway. Needed if you want to access the internet from within private subnets

• Default: true

nat_gateway_high_availability_enabled · boolean

NAT gateway high availability. High availability adds NAT Gateway to every AZ. Otherwise single NAT gateway serves all AZs.

• Default: false

nat_gateway_eip_allocation_ids · string_array

NAT gateway Elastic IP allocation IDs. A list of pre-allocated Elastic IP allocation IDs (for example from the networking/eips module) to associate with the NAT Gateway(s). When null or empty (default), the module allocates new EIPs internally.

The list length must match the number of NAT Gateways the module will create:

• 1 when nat_gateway_high_availability_enabled = false
• the resolved subnet pair count when nat_gateway_high_availability_enabled = true

Supplied EIPs must already exist with domain = “vpc”. This is useful for keeping NAT public IPs stable across VPC replacements (e.g. for partner allowlists or firewall rules).

VPC endpoints

vpc_endpoint_s3_gateway_enabled · boolean

S3 gateway endpoint. Route S3 traffic through a free gateway VPC endpoint instead of the NAT gateway. Avoids NAT data processing charges (including ECR image layer pulls) and keeps S3 traffic inside AWS.

• Default: true

vpc_endpoint_dynamodb_gateway_enabled · boolean

DynamoDB gateway endpoint. Route DynamoDB traffic through a free gateway VPC endpoint instead of the NAT gateway.

• Default: false

vpc_endpoint_interface_services · string_array

Interface endpoints. Create interface VPC endpoints (AWS PrivateLink) in the private subnets for private access to AWS services without a NAT gateway.

Each endpoint costs about $8/month per AZ plus data processing charges, so a multi-service set can cost more than a NAT gateway. Pulling ECR images privately requires ECR API, ECR Docker registry, and the S3 gateway endpoint together.

• Allowed values: ecr.api (ECR API), ecr.dkr (ECR Docker registry), logs (CloudWatch Logs), monitoring (CloudWatch metrics), secretsmanager (Secrets Manager), ssm (Systems Manager), ssmmessages (Systems Manager Session Manager), ec2messages (EC2 messages), kms (KMS), sts (STS), sqs (SQS), sns (SNS), events (EventBridge)

SOC 2

flow_logs_enabled · boolean

Flow logs. Enable VPC Flow Logs for network traffic monitoring. Required for SOC 2.

• Default: false

Misc

tags · keyvalue

Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

VPC peering

vpc_peering_connections · object_map

Peering connections. Connect this VPC to other VPCs

NOTE: For cross-account or cross-region peerings, this module cannot manage the peer VPC’s route tables. The owner of the peer VPC is responsible for adding return routes pointing at the peering connection.

Show item fields

peer_vpc_id · string · required

Peer VPC ID. The ID of the existing VPC to peer with.

peer_cidr_blocks · string_array · required

Peer CIDR blocks. CIDR blocks of the peer VPC. Routes will be added in this VPC’s route tables for each CIDR pointing at the peering connection.

peer_owner_id · string

Peer AWS account ID number. AWS account ID that owns the peer VPC. Defaults to the current account. Required for cross-account peering.

peer_region · string

Peer region. AWS region of the peer VPC. Defaults to the current region. Required for cross-region peering.

remote_vpc_dns_resolution_enabled · boolean

Remote VPC DNS resolution. Allow DNS resolution of private hostnames in the peer VPC from this VPC. Only valid for same-account, same-region peerings.

• Default: false

public_route_table_routes_enabled · boolean

Public route table routes. Add routes for peer_cidr_blocks to this VPC’s public route table.

• Default: true

private_route_table_routes_enabled · boolean

Private route table routes. Add routes for peer_cidr_blocks to this VPC’s private route table(s).

• Default: true

peer_route_table_ids · string_array

Peer route table IDs. Optional list of route table IDs in the peer VPC to add return routes to (destination = this VPC’s CIDR, target = the peering connection). Only supported for same-account, same-region peerings, since the AWS provider used by this module must have access to the peer’s route tables. For cross-account or cross-region peerings, manage the return routes from the peer side instead.

Terraform settings

opentofu_version · string

OpenTofu version override. Override the environment’s default version for this module

ravion_state_backend_workspace · string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

• Immutable after creation

advanced_terraform_variables · object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

• Default: {}

execution_environment_id · string

Terraform execution environment. Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.