{"id":49339747,"url":"https://github.com/citadel-cloud-management/terraform-aws-vpc-complete","last_synced_at":"2026-04-27T03:04:29.512Z","repository":{"id":343203476,"uuid":"1175243094","full_name":"Citadel-Cloud-Management/terraform-aws-vpc-complete","owner":"Citadel-Cloud-Management","description":"Production-grade AWS VPC Terraform module with multi-tier subnets, NAT Gateways, Flow Logs, VPC Endpoints, IPv6, IPAM, and VPC Peering","archived":false,"fork":false,"pushed_at":"2026-04-11T22:19:13.000Z","size":48,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-12T00:27:32.685Z","etag":null,"topics":["aws","devops","infrastructure-as-code","networking","production-ready","terraform","terraform-module","vpc"],"latest_commit_sha":null,"homepage":"https://citadel-cloud-management.github.io/terraform-aws-vpc-complete/","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Citadel-Cloud-Management.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-07T12:44:47.000Z","updated_at":"2026-04-11T22:40:11.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Citadel-Cloud-Management/terraform-aws-vpc-complete","commit_stats":null,"previous_names":["kogunlowo123/terraform-aws-vpc-complete"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/Citadel-Cloud-Management/terraform-aws-vpc-complete","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Citadel-Cloud-Management%2Fterraform-aws-vpc-complete","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Citadel-Cloud-Management%2Fterraform-aws-vpc-complete/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Citadel-Cloud-Management%2Fterraform-aws-vpc-complete/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Citadel-Cloud-Management%2Fterraform-aws-vpc-complete/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Citadel-Cloud-Management","download_url":"https://codeload.github.com/Citadel-Cloud-Management/terraform-aws-vpc-complete/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Citadel-Cloud-Management%2Fterraform-aws-vpc-complete/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32320688,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T23:26:28.701Z","status":"online","status_checked_at":"2026-04-27T02:00:06.769Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","devops","infrastructure-as-code","networking","production-ready","terraform","terraform-module","vpc"],"created_at":"2026-04-27T03:04:10.744Z","updated_at":"2026-04-27T03:04:29.497Z","avatar_url":"https://github.com/Citadel-Cloud-Management.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-aws-vpc-complete\n\n![Terraform](https://img.shields.io/badge/Terraform-%3E%3D1.5-blueviolet?logo=terraform)\n![AWS](https://img.shields.io/badge/AWS-FF9900?logo=amazonaws\u0026logoColor=white)\n![License](https://img.shields.io/badge/License-MIT-green)\n![CI](https://img.shields.io/github/actions/workflow/status/kogunlowo123/terraform-aws-vpc-complete/terraform-ci.yml?label=CI)\n![GitHub release](https://img.shields.io/github/v/release/kogunlowo123/terraform-aws-vpc-complete)\n\nA production-grade Terraform module for deploying a fully-featured AWS VPC with multi-tier subnets, NAT Gateways, VPC Flow Logs, VPC Endpoints, DHCP Options, and IPv6 dual-stack support. Designed for enterprise workloads running EKS, ECS, RDS, ElastiCache, and serverless applications.\n\n## Architecture Diagram\n\n```mermaid\nflowchart TB\n    subgraph VPC[\"VPC (10.x.0.0/16)\"]\n        IGW[\"Internet Gateway\"]\n        subgraph Public[\"Public Subnets (Multi-AZ)\"]\n            PUB1[\"Public Subnet AZ-a\\n(NAT GW + ALB)\"]\n            PUB2[\"Public Subnet AZ-b\\n(NAT GW)\"]\n            PUB3[\"Public Subnet AZ-c\\n(NAT GW)\"]\n        end\n        subgraph Private[\"Private Subnets (Multi-AZ)\"]\n            PRIV1[\"Private Subnet AZ-a\\n(EKS / ECS)\"]\n            PRIV2[\"Private Subnet AZ-b\\n(EKS / ECS)\"]\n            PRIV3[\"Private Subnet AZ-c\\n(EKS / ECS)\"]\n        end\n        subgraph Database[\"Database Subnets\"]\n            DB1[\"DB Subnet AZ-a\\n(RDS / Aurora)\"]\n            DB2[\"DB Subnet AZ-b\"]\n            DB3[\"DB Subnet AZ-c\"]\n        end\n        subgraph Intra[\"Intra Subnets (No Internet)\"]\n            INTRA1[\"Intra AZ-a\"]\n            INTRA2[\"Intra AZ-b\"]\n            INTRA3[\"Intra AZ-c\"]\n        end\n        subgraph ElastiCacheSub[\"ElastiCache Subnets\"]\n            EC1[\"Cache AZ-a\"]\n            EC2[\"Cache AZ-b\"]\n        end\n        subgraph Endpoints[\"VPC Endpoints\"]\n            S3EP[\"S3 Gateway\"]\n            DDBEP[\"DynamoDB Gateway\"]\n            SSMEP[\"SSM / ECR / STS\\n(Interface)\"]\n        end\n    end\n\n    subgraph Connectivity[\"Connectivity\"]\n        VPNGW[\"VPN Gateway\\n(BGP ASN)\"]\n        FLOWLOGS[\"VPC Flow Logs\\n(CloudWatch / S3 + KMS)\"]\n    end\n\n    IGW --\u003e Public\n    PUB1 --\u003e PRIV1\n    PUB2 --\u003e PRIV2\n    PUB3 --\u003e PRIV3\n\n    style VPC fill:#0078D4,color:#fff\n    style Public fill:#FF9900,color:#fff\n    style Private fill:#3F8624,color:#fff\n    style Database fill:#DD344C,color:#fff\n    style Intra fill:#8C4FFF,color:#fff\n    style ElastiCacheSub fill:#FF9900,color:#fff\n    style Endpoints fill:#3F8624,color:#fff\n    style Connectivity fill:#DD344C,color:#fff\n```\n\n## Overview\n\nThis module provisions a complete AWS Virtual Private Cloud (VPC) network topology suitable for production environments. It implements AWS Well-Architected Framework networking best practices including defense-in-depth subnet isolation, encrypted flow logging, least-privilege endpoint access, and high-availability NAT Gateway deployment.\n\nUnlike basic VPC modules, this implementation provides five distinct subnet tiers (public, private, database, intra, and elasticache), enabling true network segmentation for multi-tier application architectures. The module supports IPv6 dual-stack networking, IPAM-based CIDR management, cross-account VPC peering, and granular flow log configuration with KMS encryption.\n\nEvery resource created by this module is tagged consistently, supports full customization via input variables, and follows the naming convention `{name}-{resource}-{identifier}` for easy identification in the AWS Console and cost allocation reports.\n\n## Architecture\n\n```\n┌──────────────────────────────────────────────────────────────────────────────┐\n│                              AWS Region                                      │\n│  ┌────────────────────────────────────────────────────────────────────────┐  │\n│  │                         VPC (10.x.0.0/16)                             │  │\n│  │                                                                        │  │\n│  │  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐       │  │\n│  │  │   Public Sub 1a │  │   Public Sub 1b │  │   Public Sub 1c │       │  │\n│  │  │   10.x.1.0/24   │  │   10.x.2.0/24   │  │   10.x.3.0/24   │       │  │\n│  │  │  ┌───┐  ┌───┐   │  │  ┌───┐          │  │  ┌───┐          │       │  │\n│  │  │  │NAT│  │ALB│   │  │  │NAT│          │  │  │NAT│          │       │  │\n│  │  └──┴───┴──┴───┴───┘  └──┴───┴──────────┘  └──┴───┴──────────┘       │  │\n│  │       │                    │                     │                     │  │\n│  │  ┌────▼────────────┐  ┌───▼─────────────┐  ┌───▼─────────────┐       │  │\n│  │  │  Private Sub 1a │  │  Private Sub 1b │  │  Private Sub 1c │       │  │\n│  │  │  10.x.11.0/24   │  │  10.x.12.0/24   │  │  10.x.13.0/24   │       │  │\n│  │  │  ┌───┐  ┌───┐   │  │  ┌───┐  ┌───┐  │  │  ┌───┐  ┌───┐  │       │  │\n│  │  │  │EKS│  │ECS│   │  │  │EKS│  │ECS│  │  │  │EKS│  │ECS│  │       │  │\n│  │  └──┴───┴──┴───┴───┘  └──┴───┴──┴───┴──┘  └──┴───┴──┴───┴──┘       │  │\n│  │                                                                        │  │\n│  │  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐       │  │\n│  │  │ Database Sub 1a │  │ Database Sub 1b │  │ Database Sub 1c │       │  │\n│  │  │  10.x.21.0/24   │  │  10.x.22.0/24   │  │  10.x.23.0/24   │       │  │\n│  │  │  ┌───┐  ┌───┐   │  │  ┌───────────┐  │  │  ┌───────────┐  │       │  │\n│  │  │  │RDS│  │RDS│   │  │  │  Aurora    │  │  │  │  Aurora    │  │       │  │\n│  │  └──┴───┴──┴───┴───┘  └──┴───────────┴──┘  └──┴───────────┴──┘       │  │\n│  │                                                                        │  │\n│  │  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐       │  │\n│  │  │  Intra Sub 1a   │  │  Intra Sub 1b   │  │  Intra Sub 1c   │       │  │\n│  │  │  10.x.41.0/24   │  │  10.x.42.0/24   │  │  10.x.43.0/24   │       │  │\n│  │  │  (No Internet)  │  │  (No Internet)  │  │  (No Internet)  │       │  │\n│  │  └─────────────────┘  └─────────────────┘  └─────────────────┘       │  │\n│  │                                                                        │  │\n│  │  ┌──────────────────────────────────────────────────────────────┐     │  │\n│  │  │  VPC Endpoints: S3 (GW) │ DynamoDB (GW) │ SSM │ ECR │ STS  │     │  │\n│  │  └──────────────────────────────────────────────────────────────┘     │  │\n│  │                                                                        │  │\n│  │  ┌───────────────┐  ┌─────────────┐  ┌──────────────────────┐        │  │\n│  │  │  Flow Logs     │  │  VPN GW     │  │  Internet GW         │        │  │\n│  │  │  (CW/S3+KMS)  │  │  (BGP ASN)  │  │  + Egress-Only IGW   │        │  │\n│  │  └───────────────┘  └─────────────┘  └──────────────────────┘        │  │\n│  └────────────────────────────────────────────────────────────────────────┘  │\n└──────────────────────────────────────────────────────────────────────────────┘\n```\n\n## Features\n\n- **Multi-Tier Subnets** — Five isolated subnet tiers (public, private, database, intra, elasticache) with dedicated route tables per tier, enabling defense-in-depth network segmentation.\n- **High-Availability NAT** — Deploy one NAT Gateway per AZ for fault isolation or a single shared NAT Gateway for cost optimization in non-production environments.\n- **IPv6 Dual-Stack** — Amazon-provided IPv6 CIDR with auto-assignment on public subnets and Egress-Only Internet Gateway for private IPv6 outbound traffic.\n- **Encrypted Flow Logs** — VPC Flow Logs to CloudWatch Logs (KMS-encrypted) or S3 (with lifecycle policies and Parquet format) with enhanced log format including traffic path and AWS service fields.\n- **VPC Endpoints** — Gateway endpoints for S3 and DynamoDB (free) and interface endpoints for any AWS service with a dedicated security group allowing HTTPS from the VPC CIDR only.\n- **Custom DHCP Options** — Configure internal DNS domain, custom name servers, and NTP servers for hybrid environments.\n- **Default Resource Lockdown** — Default security group is managed with no ingress/egress rules, preventing accidental use.\n- **IPAM Integration** — Sub-module for AWS VPC IPAM to centrally plan and allocate IP addresses across your organization.\n- **VPC Peering** — Sub-module for same-region, cross-region, and cross-account VPC peering with automatic route table updates and DNS resolution.\n- **DB and Cache Subnet Groups** — Automatically creates `aws_db_subnet_group` and `aws_elasticache_subnet_group` for RDS/Aurora and ElastiCache deployments.\n\n## Prerequisites\n\n- Terraform \u003e= 1.5.0\n- AWS Provider \u003e= 5.20.0\n- An AWS account with permissions to create VPC, subnet, NAT Gateway, VPN Gateway, KMS, IAM, S3, CloudWatch, and VPC Endpoint resources.\n\n### Required IAM Permissions\n\nThe IAM principal running Terraform needs the following permissions (or use `AdministratorAccess` for initial setup):\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:*Vpc*\", \"ec2:*Subnet*\", \"ec2:*RouteTable*\", \"ec2:*Route*\",\n        \"ec2:*InternetGateway*\", \"ec2:*NatGateway*\", \"ec2:*Address*\",\n        \"ec2:*SecurityGroup*\", \"ec2:*NetworkAcl*\", \"ec2:*FlowLog*\",\n        \"ec2:*VpnGateway*\", \"ec2:*DhcpOptions*\", \"ec2:*VpcEndpoint*\",\n        \"ec2:CreateTags\", \"ec2:DeleteTags\", \"ec2:Describe*\",\n        \"logs:*\", \"s3:*\", \"kms:*\", \"iam:*Role*\", \"iam:*Policy*\",\n        \"elasticache:*SubnetGroup*\", \"rds:*SubnetGroup*\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n## Usage\n\n### Minimal Configuration\n\n```hcl\nmodule \"vpc\" {\n  source = \"github.com/kogunlowo123/terraform-aws-vpc-complete\"\n\n  name       = \"my-vpc\"\n  cidr_block = \"10.0.0.0/16\"\n\n  availability_zones   = [\"us-east-1a\", \"us-east-1b\"]\n  public_subnet_cidrs  = [\"10.0.1.0/24\", \"10.0.2.0/24\"]\n  private_subnet_cidrs = [\"10.0.11.0/24\", \"10.0.12.0/24\"]\n\n  tags = {\n    Environment = \"dev\"\n  }\n}\n```\n\n### Production Configuration\n\n```hcl\nmodule \"vpc\" {\n  source = \"github.com/kogunlowo123/terraform-aws-vpc-complete\"\n\n  name        = \"prod-vpc\"\n  cidr_block  = \"10.100.0.0/16\"\n  enable_ipv6 = true\n\n  availability_zones       = [\"us-east-1a\", \"us-east-1b\", \"us-east-1c\"]\n  public_subnet_cidrs      = [\"10.100.1.0/24\", \"10.100.2.0/24\", \"10.100.3.0/24\"]\n  private_subnet_cidrs     = [\"10.100.11.0/24\", \"10.100.12.0/24\", \"10.100.13.0/24\"]\n  database_subnet_cidrs    = [\"10.100.21.0/24\", \"10.100.22.0/24\", \"10.100.23.0/24\"]\n  intra_subnet_cidrs       = [\"10.100.41.0/24\", \"10.100.42.0/24\", \"10.100.43.0/24\"]\n\n  enable_nat_gateway = true\n  single_nat_gateway = false\n\n  enable_flow_logs          = true\n  flow_log_destination_type = \"s3\"\n  flow_log_retention_days   = 365\n\n  enable_s3_endpoint       = true\n  enable_dynamodb_endpoint = true\n\n  private_subnet_tags = {\n    \"kubernetes.io/role/internal-elb\" = \"1\"\n  }\n\n  tags = {\n    Environment = \"production\"\n    ManagedBy   = \"terraform\"\n  }\n}\n```\n\n## Module Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|----------|\n| `name` | Name prefix for all resources | `string` | n/a | yes |\n| `cidr_block` | Primary IPv4 CIDR block for the VPC | `string` | n/a | yes |\n| `availability_zones` | List of AZs to deploy subnets into | `list(string)` | n/a | yes |\n| `secondary_cidr_blocks` | Additional IPv4 CIDR blocks | `list(string)` | `[]` | no |\n| `enable_ipv6` | Enable IPv6 dual-stack | `bool` | `false` | no |\n| `instance_tenancy` | VPC instance tenancy (default/dedicated) | `string` | `\"default\"` | no |\n| `enable_dns_support` | Enable DNS resolution | `bool` | `true` | no |\n| `enable_dns_hostnames` | Enable DNS hostnames | `bool` | `true` | no |\n| `public_subnet_cidrs` | CIDR blocks for public subnets | `list(string)` | `[]` | no |\n| `private_subnet_cidrs` | CIDR blocks for private subnets | `list(string)` | `[]` | no |\n| `database_subnet_cidrs` | CIDR blocks for database subnets | `list(string)` | `[]` | no |\n| `intra_subnet_cidrs` | CIDR blocks for intra subnets (no internet) | `list(string)` | `[]` | no |\n| `elasticache_subnet_cidrs` | CIDR blocks for ElastiCache subnets | `list(string)` | `[]` | no |\n| `enable_nat_gateway` | Enable NAT Gateway(s) | `bool` | `true` | no |\n| `single_nat_gateway` | Use single NAT Gateway for all AZs | `bool` | `false` | no |\n| `enable_vpn_gateway` | Create VPN Gateway | `bool` | `false` | no |\n| `vpn_gateway_asn` | Amazon-side ASN for VPN Gateway | `number` | `64512` | no |\n| `enable_flow_logs` | Enable VPC Flow Logs | `bool` | `true` | no |\n| `flow_log_destination_type` | Flow log destination (cloud-watch-logs/s3) | `string` | `\"cloud-watch-logs\"` | no |\n| `flow_log_retention_days` | Flow log retention in days | `number` | `30` | no |\n| `flow_log_max_aggregation_interval` | Aggregation interval (60/600 seconds) | `number` | `600` | no |\n| `enable_s3_endpoint` | Create S3 Gateway Endpoint | `bool` | `true` | no |\n| `enable_dynamodb_endpoint` | Create DynamoDB Gateway Endpoint | `bool` | `false` | no |\n| `interface_endpoints` | Map of interface VPC endpoints to create | `map(object)` | `{}` | no |\n| `enable_dhcp_options` | Create custom DHCP options | `bool` | `false` | no |\n| `dhcp_domain_name` | DNS domain for DHCP options | `string` | `\"\"` | no |\n| `dhcp_domain_name_servers` | DNS servers for DHCP options | `list(string)` | `[\"AmazonProvidedDNS\"]` | no |\n| `dhcp_ntp_servers` | NTP servers for DHCP options | `list(string)` | `[]` | no |\n| `manage_default_security_group` | Lock down default security group | `bool` | `true` | no |\n| `manage_default_network_acl` | Manage default network ACL | `bool` | `true` | no |\n| `create_database_subnet_group` | Create DB subnet group | `bool` | `true` | no |\n| `public_subnet_tags` | Additional tags for public subnets | `map(string)` | `{}` | no |\n| `private_subnet_tags` | Additional tags for private subnets | `map(string)` | `{}` | no |\n| `database_subnet_tags` | Additional tags for database subnets | `map(string)` | `{}` | no |\n| `tags` | Tags to apply to all resources | `map(string)` | `{}` | no |\n\n## Module Outputs\n\n| Name | Description |\n|------|-------------|\n| `vpc_id` | The ID of the VPC |\n| `vpc_arn` | The ARN of the VPC |\n| `vpc_cidr_block` | The primary CIDR block of the VPC |\n| `vpc_ipv6_cidr_block` | The IPv6 CIDR block of the VPC |\n| `public_subnet_ids` | List of public subnet IDs |\n| `public_subnet_cidr_blocks` | List of public subnet CIDR blocks |\n| `private_subnet_ids` | List of private subnet IDs |\n| `private_subnet_cidr_blocks` | List of private subnet CIDR blocks |\n| `database_subnet_ids` | List of database subnet IDs |\n| `database_subnet_group_name` | Name of the DB subnet group |\n| `intra_subnet_ids` | List of intra subnet IDs |\n| `elasticache_subnet_ids` | List of ElastiCache subnet IDs |\n| `elasticache_subnet_group_name` | Name of the ElastiCache subnet group |\n| `public_route_table_id` | ID of the public route table |\n| `private_route_table_ids` | List of private route table IDs |\n| `nat_gateway_ids` | List of NAT Gateway IDs |\n| `nat_gateway_public_ips` | List of NAT Gateway public IPs |\n| `internet_gateway_id` | ID of the Internet Gateway |\n| `vpn_gateway_id` | ID of the VPN Gateway |\n| `s3_endpoint_id` | ID of the S3 VPC Endpoint |\n| `flow_log_id` | ID of the VPC Flow Log |\n\n## Examples\n\n- [Basic](./examples/basic) — Simple 2-tier VPC with single NAT Gateway\n- [Advanced](./examples/advanced) — 3-AZ VPC with all subnet tiers, multi-AZ NAT, and VPC endpoints\n- [Complete](./examples/complete) — Enterprise VPC with IPv6, VPN, interface endpoints, and full security controls\n- [IPv6 Dual-Stack](./examples/ipv6-dual-stack) — IPv6-enabled VPC\n\n## Sub-modules\n\n| Module | Description |\n|--------|-------------|\n| [ipam](./modules/ipam) | AWS VPC IPAM for centralized IP address management |\n| [vpc-peering](./modules/vpc-peering) | VPC peering with cross-account and cross-region support |\n| [flow-logs](./modules/flow-logs) | Standalone flow log configuration for VPC, subnet, or ENI |\n\n## Security Considerations\n\n- **Default Security Group**: Managed with no rules to prevent accidental use. Create explicit security groups for all workloads.\n- **Flow Logs**: Enabled by default with KMS encryption. Use 60-second aggregation for security-sensitive environments.\n- **NAT Gateway**: Deploy one per AZ in production for fault isolation. Single NAT is acceptable for dev/staging.\n- **VPC Endpoints**: Use gateway endpoints (S3, DynamoDB) to avoid data transfer charges. Use interface endpoints for services accessed from private subnets.\n- **IMDSv2**: This module does not create EC2 instances, but subnets are configured to support IMDSv2-enforced instances.\n- **IPv6**: When enabled, public subnets auto-assign IPv6 addresses. Ensure security groups and NACLs account for IPv6 traffic.\n\n## Cost Estimation\n\n| Resource | Approximate Monthly Cost (us-east-1) |\n|----------|--------------------------------------|\n| VPC | Free |\n| Public Subnets | Free |\n| NAT Gateway (per AZ) | ~$32 + $0.045/GB processed |\n| VPN Gateway | ~$36 |\n| S3 Gateway Endpoint | Free |\n| DynamoDB Gateway Endpoint | Free |\n| Interface VPC Endpoint (per AZ) | ~$7.20 |\n| VPC Flow Logs (CloudWatch) | $0.50/GB ingested |\n| VPC Flow Logs (S3) | S3 storage costs |\n| KMS Key | $1/month + $0.03/10K requests |\n\n## References\n\n- [AWS VPC Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/)\n- [VPC Subnet Sizing](https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html)\n- [NAT Gateway Best Practices](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html)\n- [VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html)\n- [VPC Endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html)\n- [AWS IPAM](https://docs.aws.amazon.com/vpc/latest/ipam/what-it-is-ipam.html)\n- [Terraform AWS Provider - VPC Resources](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc)\n\n## Contributing\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/my-feature`)\n3. Commit your changes (`git commit -m 'feat: add new feature'`)\n4. Push to the branch (`git push origin feature/my-feature`)\n5. Open a Pull Request\n\nPlease ensure all Terraform code passes `terraform fmt`, `terraform validate`, and `tflint` before submitting.\n\n## License\n\nMIT License - see [LICENSE](./LICENSE) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcitadel-cloud-management%2Fterraform-aws-vpc-complete","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcitadel-cloud-management%2Fterraform-aws-vpc-complete","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcitadel-cloud-management%2Fterraform-aws-vpc-complete/lists"}