{"id":15679439,"url":"https://github.com/moritzheiber/terraform-aws-core-modules","last_synced_at":"2025-05-07T09:47:46.834Z","repository":{"id":42378722,"uuid":"197843618","full_name":"moritzheiber/terraform-aws-core-modules","owner":"moritzheiber","description":"A collection of Terraform \"core\" modules I would consider to be building blocks of any reasonable AWS account setup","archived":false,"fork":false,"pushed_at":"2023-02-22T09:57:39.000Z","size":672,"stargazers_count":12,"open_issues_count":3,"forks_count":5,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-31T08:51:15.417Z","etag":null,"topics":["aws","aws-config","aws-iam","aws-vpc","iam","terraform","terraform-module","terraform-modules"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/moritzheiber.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-19T21:20:49.000Z","updated_at":"2023-02-14T17:31:13.000Z","dependencies_parsed_at":"2025-03-10T23:33:37.748Z","dependency_job_id":"10c8d5b1-c351-46da-a681-a04072b2d41f","html_url":"https://github.com/moritzheiber/terraform-aws-core-modules","commit_stats":null,"previous_names":[],"tags_count":20,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moritzheiber%2Fterraform-aws-core-modules","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moritzheiber%2Fterraform-aws-core-modules/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moritzheiber%2Fterraform-aws-core-modules/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moritzheiber%2Fterraform-aws-core-modules/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/moritzheiber","download_url":"https://codeload.github.com/moritzheiber/terraform-aws-core-modules/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252854579,"owners_count":21814707,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-config","aws-iam","aws-vpc","iam","terraform","terraform-module","terraform-modules"],"created_at":"2024-10-03T16:30:56.433Z","updated_at":"2025-05-07T09:47:46.815Z","avatar_url":"https://github.com/moritzheiber.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- BEGIN_TF_DOCS --\u003e\n# AWS Core Modules\n\nThis is a collection of Terraform \"core\" modules I would consider to be building blocks of every reasonable AWS account setup.\nPlease refer to to the [AWS Kickstarter](https://github.com/moritzheiber/aws-kickstarter) to see their application.\n\nContributions are more than welcome and encouraged!\n\n## Available modules\n- [config](#config)\n- [iam-resources](#iam-resources)\n- [iam-users](#iam-users)\n- [vpc](#vpc)\n\n## Config\n\nThe module configures AWS Config to monitor your account for non-compliant resources.\nYou can freely choose which checks to use or discard by modifying the `enable_config_rules`, `disable_config_rules` and `complex_config_rules` variables.\n\nAs an example, if you'd wish to enable `AUTOSCALING_CAPACITY_REBALANCING` and disable the `INSTANCES_IN_VPC` check, which is enabled by default, you could use the following code:\n\n```hcl\nmodule \"aws_config\" {\n    source = \"git::https://github.com/moritzheiber/terraform-aws-core-modules//config\"\n\n    enable_simple_rules = [\"AUTOSCALING_CAPACITY_REBALANCING\"]\n    disable_simple_rules = [\"INSTANCE_IN_VPC\"]\n}\n```\n\nIf you wanted to change parameters on the `CLOUDWATCH_ALARM_ACTION_CHECK` complex rule you could pass it to the `complex_config_rules` variable:\n\n```hcl\nmodule \"aws_config\" {\n  source = \"git::https://github.com/moritzheiber/terraform-aws-core-modules//config\"\n\n  complex_config_rules = {\n    CLOUDWATCH_ALARM_ACTION_CHECK = {\n      alarmActionRequired            = \"false\"\n      insufficientDataActionRequired = \"true\"\n      okActionRequired               = \"true\"\n    }\n  }\n}\n```\n\nFor a list of available managed rules you can refer [to the AWS Config documentation](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html).\nAs a rule of thumb:\n- **if they require no parameters** you can use either `enable_config_rules` or `disable_config_rules` to manage them.\n- **if they require parameters** you can use the `complex_config_rules` map to add them and their input parameters as a `identifier = { parameter = value }` map.\n\nFor both cases you need to use their _uppercase, snake case identifier_ (e.g. `autoscaling-capacity-rebalancing` becomes `AUTOSCALING_CAPACITY_REBALANCING`)\n\n### Special cases\n\nFor a few rules there is special treatment using variables:\n\n- `IAM_PASSWORD_POLICY`: See the `password_policy` variable\n- `IAM_USER_GROUP_MEMBERSHIP_CHECK`: See the `iam_user_groups` variable\n- `APPROVED_AMIS_BY_TAG`: See the `amis_by_tag_key_and_value_list` variable\n- `ACCESS_KEYS_ROTATED`: See the `max_access_key_age` variable\n- `DESIRED_INSTANCE_TYPE`: See the `desired_instance_types` variable (\\_Note: the identifier says `type` but this is **a list**\\_)\n\nYou can disable any of these complex rules by simply unsetting the corresponding variable.\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | ~\u003e 4 |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_amis_by_tag_key_and_value_list\"\u003e\u003c/a\u003e [amis\\_by\\_tag\\_key\\_and\\_value\\_list](#input\\_amis\\_by\\_tag\\_key\\_and\\_value\\_list) | Required AMI tags for EC2 instances | `list(string)` | `[]` | no |\n| \u003ca name=\"input_bucket_account_id\"\u003e\u003c/a\u003e [bucket\\_account\\_id](#input\\_bucket\\_account\\_id) | The AWS account ID the S3 bucket lives in that AWS Config is writing its records to. Defaults to the ID of the current account | `string` | `\"\"` | no |\n| \u003ca name=\"input_bucket_key_prefix\"\u003e\u003c/a\u003e [bucket\\_key\\_prefix](#input\\_bucket\\_key\\_prefix) | The prefix of the keys AWS Config writes to | `string` | `\"aws_config\"` | no |\n| \u003ca name=\"input_bucket_prefix\"\u003e\u003c/a\u003e [bucket\\_prefix](#input\\_bucket\\_prefix) | The prefix for the S3 bucket AWS Config Recorder writes to | `string` | `\"aws-config\"` | no |\n| \u003ca name=\"input_complex_config_rules\"\u003e\u003c/a\u003e [complex\\_config\\_rules](#input\\_complex\\_config\\_rules) | A range of more complex Config rules you wish to have applied. They usually carry input parameters. | `map(map(string))` | \u003cpre\u003e{\u003cbr\u003e  \"CLOUDWATCH_ALARM_ACTION_CHECK\": {\u003cbr\u003e    \"alarmActionRequired\": \"true\",\u003cbr\u003e    \"insufficientDataActionRequired\": \"false\",\u003cbr\u003e    \"okActionRequired\": \"false\"\u003cbr\u003e  }\u003cbr\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_config_delivery_channel_name\"\u003e\u003c/a\u003e [config\\_delivery\\_channel\\_name](#input\\_config\\_delivery\\_channel\\_name) | The name of the delivery channel for AWS Config | `string` | `\"config\"` | no |\n| \u003ca name=\"input_config_recorder_name\"\u003e\u003c/a\u003e [config\\_recorder\\_name](#input\\_config\\_recorder\\_name) | The name of the recorder for AWS Config | `string` | `\"config\"` | no |\n| \u003ca name=\"input_delivery_frequency\"\u003e\u003c/a\u003e [delivery\\_frequency](#input\\_delivery\\_frequency) | The frequency at which AWS Config delivers its recorded findings to S3 | `string` | `\"Three_Hours\"` | no |\n| \u003ca name=\"input_desired_instance_types\"\u003e\u003c/a\u003e [desired\\_instance\\_types](#input\\_desired\\_instance\\_types) | A string of comma-delimited instance types | `set(string)` | `[]` | no |\n| \u003ca name=\"input_disable_config_rules\"\u003e\u003c/a\u003e [disable\\_config\\_rules](#input\\_disable\\_config\\_rules) | A set with simple rules you wish to disable. Otherwise all the rules are applied by default. | `set(string)` | `[]` | no |\n| \u003ca name=\"input_enable_config_rules\"\u003e\u003c/a\u003e [enable\\_config\\_rules](#input\\_enable\\_config\\_rules) | A set with simple rules you wish to enable. The defaults are pretty solid. If you wish to only disable a few rules take a look at the 'disable\\_config\\_rules' variable. | `set(string)` | \u003cpre\u003e[\u003cbr\u003e  \"INSTANCES_IN_VPC\",\u003cbr\u003e  \"EC2_VOLUME_INUSE_CHECK\",\u003cbr\u003e  \"EIP_ATTACHED\",\u003cbr\u003e  \"ENCRYPTED_VOLUMES\",\u003cbr\u003e  \"INCOMING_SSH_DISABLED\",\u003cbr\u003e  \"CLOUD_TRAIL_ENABLED\",\u003cbr\u003e  \"IAM_GROUP_HAS_USERS_CHECK\",\u003cbr\u003e  \"IAM_USER_NO_POLICIES_CHECK\",\u003cbr\u003e  \"ROOT_ACCOUNT_MFA_ENABLED\",\u003cbr\u003e  \"S3_BUCKET_PUBLIC_READ_PROHIBITED\",\u003cbr\u003e  \"S3_BUCKET_PUBLIC_WRITE_PROHIBITED\",\u003cbr\u003e  \"S3_BUCKET_SSL_REQUESTS_ONLY\",\u003cbr\u003e  \"S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED\",\u003cbr\u003e  \"S3_BUCKET_VERSIONING_ENABLED\",\u003cbr\u003e  \"EBS_OPTIMIZED_INSTANCE\",\u003cbr\u003e  \"AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED\",\u003cbr\u003e  \"RDS_INSTANCE_PUBLIC_ACCESS_CHECK\",\u003cbr\u003e  \"RDS_SNAPSHOTS_PUBLIC_PROHIBITED\",\u003cbr\u003e  \"IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS\",\u003cbr\u003e  \"IAM_ROOT_ACCESS_KEY_CHECK\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_enable_lifecycle_management_for_s3\"\u003e\u003c/a\u003e [enable\\_lifecycle\\_management\\_for\\_s3](#input\\_enable\\_lifecycle\\_management\\_for\\_s3) | Whether or not to enable lifecycle management for the S3 bucket AWS Config writes to | `bool` | `false` | no |\n| \u003ca name=\"input_iam_role_name\"\u003e\u003c/a\u003e [iam\\_role\\_name](#input\\_iam\\_role\\_name) | The name of the IAM role created for delegating permissions to AWS Config | `string` | `\"config\"` | no |\n| \u003ca name=\"input_iam_user_groups\"\u003e\u003c/a\u003e [iam\\_user\\_groups](#input\\_iam\\_user\\_groups) | A list of mandatory groups for IAM users | `list(string)` | `[]` | no |\n| \u003ca name=\"input_lifecycle_bucket_expiration\"\u003e\u003c/a\u003e [lifecycle\\_bucket\\_expiration](#input\\_lifecycle\\_bucket\\_expiration) | The number of days after which artifacts in the Config S3 bucket are expiring | `number` | `365` | no |\n| \u003ca name=\"input_max_access_key_age\"\u003e\u003c/a\u003e [max\\_access\\_key\\_age](#input\\_max\\_access\\_key\\_age) | The maximum amount of days an access key can live without being rotated | `string` | `\"90\"` | no |\n| \u003ca name=\"input_password_policy\"\u003e\u003c/a\u003e [password\\_policy](#input\\_password\\_policy) | A map of values describing the password policy parameters AWS Config is looking for | `map(string)` | \u003cpre\u003e{\u003cbr\u003e  \"max_password_age\": \"90\",\u003cbr\u003e  \"minimum_password_length\": \"32\",\u003cbr\u003e  \"password_reuse_prevention\": \"5\",\u003cbr\u003e  \"require_lowercase_chars\": \"true\",\u003cbr\u003e  \"require_numbers\": \"true\",\u003cbr\u003e  \"require_symbols\": \"true\",\u003cbr\u003e  \"require_uppercase_chars\": \"true\"\u003cbr\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_s3_kms_sse_encryption_key_arn\"\u003e\u003c/a\u003e [s3\\_kms\\_sse\\_encryption\\_key\\_arn](#input\\_s3\\_kms\\_sse\\_encryption\\_key\\_arn) | The ARN for the KMS key to use for S3 server-side bucket encryption. If none if specified the module creates a KMS key for customer managed encryption. | `string` | `\"\"` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_config_s3_bucket_arn\"\u003e\u003c/a\u003e [config\\_s3\\_bucket\\_arn](#output\\_config\\_s3\\_bucket\\_arn) | The ARN of the S3 bucket AWS Config writes its findings into |\n\n\n## iam-users\n\nA module to configure the \"users\" account modeled after a common security principle of separating users from resource accounts through a MFA-enabled role-assumption bridge:\n\n![AWS IAM setup illustration](https://raw.githubusercontent.com/moritzheiber/terraform-aws-core-modules/main/files/aws_iam_setup.png)\n\nThese strict separation of privileges follow [an article I wrote a while ago](https://www.thoughtworks.com/insights/blog/using-aws-security-first-class-citizen).\nYou can also create IAM users and IAM groups with this module and assign the users to specific groups. The module will create two default groups, one for admins and users, which you can disable by setting the `admin_group_name` and `user_group_name` to an empty string.\n\nCreating additional users is done by passing a map called `users` to the module, with a group mapping attached to them (the best practice is to never have users live \"outside\" of groups).\n\n```hcl\nvariable \"iam_users\" {\n  type = map(map(set(string)))\n  default = {\n    my_user = {\n      groups = [\"admins\"]\n    }\n  }\n}\n\nmodule \"iam_users\" {\n  source            = \"git::https://github.com/moritzheiber/terraform-aws-core-modules.git//iam-users\"\n\n  iam_users = var.iam_users\n}\n```\n\nThis will run the module and create all the necessary permissions along with a user belonging to the `admins` groups.\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | ~\u003e 4 |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_additional_admin_groups\"\u003e\u003c/a\u003e [additional\\_admin\\_groups](#input\\_additional\\_admin\\_groups) | A list of additional groups to create associated with administrative privileges | `list(string)` | `[]` | no |\n| \u003ca name=\"input_additional_user_groups\"\u003e\u003c/a\u003e [additional\\_user\\_groups](#input\\_additional\\_user\\_groups) | A list of additional groups to create associated with regular users | `list(string)` | `[]` | no |\n| \u003ca name=\"input_admin_group_name\"\u003e\u003c/a\u003e [admin\\_group\\_name](#input\\_admin\\_group\\_name) | The name of the initial group created for administrators | `string` | `\"admins\"` | no |\n| \u003ca name=\"input_admin_multi_factor_auth_age\"\u003e\u003c/a\u003e [admin\\_multi\\_factor\\_auth\\_age](#input\\_admin\\_multi\\_factor\\_auth\\_age) | The amount of time (in minutes) for a admin session to be valid | `number` | `60` | no |\n| \u003ca name=\"input_iam_account_alias\"\u003e\u003c/a\u003e [iam\\_account\\_alias](#input\\_iam\\_account\\_alias) | A globally unique, human-readable identifier for your AWS account | `string` | `null` | no |\n| \u003ca name=\"input_iam_users\"\u003e\u003c/a\u003e [iam\\_users](#input\\_iam\\_users) | A list of maps of users and their groups. Default is to create no users. | `map(map(list(string)))` | `{}` | no |\n| \u003ca name=\"input_password_policy\"\u003e\u003c/a\u003e [password\\_policy](#input\\_password\\_policy) | A map of password policy parameters you want to set differently from the defaults | `map(string)` | \u003cpre\u003e{\u003cbr\u003e  \"max_password_age\": \"90\",\u003cbr\u003e  \"minimum_password_length\": \"32\",\u003cbr\u003e  \"password_reuse_prevention\": \"5\",\u003cbr\u003e  \"require_lowercase_chars\": \"true\",\u003cbr\u003e  \"require_numbers\": \"true\",\u003cbr\u003e  \"require_symbols\": \"true\",\u003cbr\u003e  \"require_uppercase_chars\": \"true\"\u003cbr\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_resource_admin_role_name\"\u003e\u003c/a\u003e [resource\\_admin\\_role\\_name](#input\\_resource\\_admin\\_role\\_name) | The name of the administrator role one is supposed to assume in the resource account | `string` | `\"resource-admin\"` | no |\n| \u003ca name=\"input_resource_user_role_name\"\u003e\u003c/a\u003e [resource\\_user\\_role\\_name](#input\\_resource\\_user\\_role\\_name) | The name of the user role one is supposed to assume in the resource account | `string` | `\"resource-user\"` | no |\n| \u003ca name=\"input_resources_account_id\"\u003e\u003c/a\u003e [resources\\_account\\_id](#input\\_resources\\_account\\_id) | The account ID of the AWS account you want to start resources in | `string` | `\"\"` | no |\n| \u003ca name=\"input_user_group_name\"\u003e\u003c/a\u003e [user\\_group\\_name](#input\\_user\\_group\\_name) | The name of the initial group created for users | `string` | `\"users\"` | no |\n| \u003ca name=\"input_user_multi_factor_auth_age\"\u003e\u003c/a\u003e [user\\_multi\\_factor\\_auth\\_age](#input\\_user\\_multi\\_factor\\_auth\\_age) | The amount of time (in minutes) for a user session to be valid | `number` | `240` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_admin_group_names\"\u003e\u003c/a\u003e [admin\\_group\\_names](#output\\_admin\\_group\\_names) | The names of the admin groups |\n| \u003ca name=\"output_user_group_names\"\u003e\u003c/a\u003e [user\\_group\\_names](#output\\_user\\_group\\_names) | The name of the user groups |\n\n\n## iam-resources\n\nA module to configure the \"resources\" account modelled after the common security principle of separating users from resource accounts through a MFA-enabled role-assumption bridge.\nPlease see the [iam-users](https://github.com/moritzheiber/terraform-aws-core-modules/tree/main/iam-users) module for further explanation. It is generally assumed that this module isn't deployed on its own.\n\n### Usage example\n```hcl\nmodule \"iam_resources\" {\n  source            = \"git::https://github.com/moritzheiber/terraform-aws-core-modules.git//iam-resources\"\n```\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | ~\u003e 4 |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_admin_access_role_name\"\u003e\u003c/a\u003e [admin\\_access\\_role\\_name](#input\\_admin\\_access\\_role\\_name) | Name of the admin role | `string` | `\"resource-admin\"` | no |\n| \u003ca name=\"input_admin_multi_factor_auth_age\"\u003e\u003c/a\u003e [admin\\_multi\\_factor\\_auth\\_age](#input\\_admin\\_multi\\_factor\\_auth\\_age) | The amount of time (in minutes) for a admin session to be valid | `number` | `60` | no |\n| \u003ca name=\"input_iam_account_alias\"\u003e\u003c/a\u003e [iam\\_account\\_alias](#input\\_iam\\_account\\_alias) | A globally unique identifier, human-readable for your AWS account | `string` | `null` | no |\n| \u003ca name=\"input_user_access_role_name\"\u003e\u003c/a\u003e [user\\_access\\_role\\_name](#input\\_user\\_access\\_role\\_name) | Name of the user role | `string` | `\"resource-user\"` | no |\n| \u003ca name=\"input_user_multi_factor_auth_age\"\u003e\u003c/a\u003e [user\\_multi\\_factor\\_auth\\_age](#input\\_user\\_multi\\_factor\\_auth\\_age) | The amount of time (in minutes) for a user session to be valid | `number` | `240` | no |\n| \u003ca name=\"input_users_account_id\"\u003e\u003c/a\u003e [users\\_account\\_id](#input\\_users\\_account\\_id) | The account ID of where the users are living in | `string` | `null` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_resource_admin_role_arn\"\u003e\u003c/a\u003e [resource\\_admin\\_role\\_arn](#output\\_resource\\_admin\\_role\\_arn) | The ARN of the role users are able to assume to attain admin privileges |\n| \u003ca name=\"output_resource_admin_role_name\"\u003e\u003c/a\u003e [resource\\_admin\\_role\\_name](#output\\_resource\\_admin\\_role\\_name) | The name of the role users are able to assume to attain admin privileges |\n| \u003ca name=\"output_resource_user_role_arn\"\u003e\u003c/a\u003e [resource\\_user\\_role\\_arn](#output\\_resource\\_user\\_role\\_arn) | The ARN of the role users are able to assume to attain user privileges |\n| \u003ca name=\"output_resource_user_role_name\"\u003e\u003c/a\u003e [resource\\_user\\_role\\_name](#output\\_resource\\_user\\_role\\_name) | The name of the role users are able to assume to attain user privileges |\n\n\n## vpc\n\nThis module builds a VPC with the default CIDR range of `10.0.0.0/16`, three subnets in a \"public\" configuration (attached to and routed through an AWS Internet Gateway) and three subnets in a \"private\" configuration (attached to and routed through three separate AWS NAT Gateways):\n\n![AWS VPC illustration](https://raw.githubusercontent.com/moritzheiber/terraform-aws-core-modules/main/files/aws_vpc.png)\n\n### Usage example\n\nAdd the following statement to your `variables.tf` to use the `vpc` module:\n\n```hcl\nmodule \"core_vpc\" {\n  source = \"git::https://github.com/moritzheiber/terraform-aws-core-modules.git//vpc\"\n\n  tags = {\n    Resource    = \"my_team_name\"\n    Cost_Center = \"my_billing_tag\"\n  }\n}\n```\n\nand run `terraform init` to download the required module files.\n\n**All created subnets will have a tag attached to them which specifies their scope** (i.e. \"public\" for public subnets and \"private\" for private subnets) which you can use to filter for the right networks using Terraform data sources:\n\n```hcl\ndata \"aws_vpc\" \"core\" {\ntags = {\n    # `core_vpc` is the default, the variable is `vpc_name`\n    Name = \"core_vpc\"\n  }\n}\n\ndata \"aws_subnets\" \"public\" {\n  filter {\n    name   = \"vpc-id\"\n    values = [data.aws_vpc.core.id]\n  }\n\n  tags = {\n    Scope = \"Public\"\n  }\n}\n\ndata \"aws_subnets\" \"public\" {\n  filter {\n    name   = \"vpc-id\"\n    values = [data.aws_vpc.core.id]\n  }\n\n  tags = {\n    Scope = \"Private\"\n  }\n}\n```\n\nThe result is a list of subnet IDs, either in the public or private VPC zone, you can use to create other resources such as Load Balancers or AutoScalingGroups.\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | ~\u003e 4 |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_enable_dns_hostnames\"\u003e\u003c/a\u003e [enable\\_dns\\_hostnames](#input\\_enable\\_dns\\_hostnames) | Whether or not to enable VPC DNS hostname support | `bool` | `true` | no |\n| \u003ca name=\"input_enable_dns_support\"\u003e\u003c/a\u003e [enable\\_dns\\_support](#input\\_enable\\_dns\\_support) | Whether or not to enable VPC DNS support | `bool` | `true` | no |\n| \u003ca name=\"input_private_subnet_offset\"\u003e\u003c/a\u003e [private\\_subnet\\_offset](#input\\_private\\_subnet\\_offset) | The amount of IP space between the public and the private subnet | `number` | `2` | no |\n| \u003ca name=\"input_private_subnet_prefix\"\u003e\u003c/a\u003e [private\\_subnet\\_prefix](#input\\_private\\_subnet\\_prefix) | The prefix to attach to the name of the private subnets | `string` | `\"\"` | no |\n| \u003ca name=\"input_private_subnet_size\"\u003e\u003c/a\u003e [private\\_subnet\\_size](#input\\_private\\_subnet\\_size) | The size of the private subnet (default: 1022 usable addresses) | `number` | `6` | no |\n| \u003ca name=\"input_public_subnet_prefix\"\u003e\u003c/a\u003e [public\\_subnet\\_prefix](#input\\_public\\_subnet\\_prefix) | The prefix to attach to the name of the public subnets | `string` | `\"\"` | no |\n| \u003ca name=\"input_public_subnet_size\"\u003e\u003c/a\u003e [public\\_subnet\\_size](#input\\_public\\_subnet\\_size) | The size of the public subnet (default: 1022 usable addresses) | `number` | `6` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | A map of tags to apply to all VPC resources | `map(string)` | `{}` | no |\n| \u003ca name=\"input_vpc_cidr_range\"\u003e\u003c/a\u003e [vpc\\_cidr\\_range](#input\\_vpc\\_cidr\\_range) | The IP address space to use for the VPC | `string` | `\"10.0.0.0/16\"` | no |\n| \u003ca name=\"input_vpc_name\"\u003e\u003c/a\u003e [vpc\\_name](#input\\_vpc\\_name) | The name of the VPC | `string` | `\"core_vpc\"` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_private_subnet_ids\"\u003e\u003c/a\u003e [private\\_subnet\\_ids](#output\\_private\\_subnet\\_ids) | A list of private subnet IDs |\n| \u003ca name=\"output_public_subnet_ids\"\u003e\u003c/a\u003e [public\\_subnet\\_ids](#output\\_public\\_subnet\\_ids) | A list of public subnet IDs |\n| \u003ca name=\"output_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#output\\_vpc\\_id) | The ID of the created VPC |\n\u003c!-- END_TF_DOCS --\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoritzheiber%2Fterraform-aws-core-modules","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmoritzheiber%2Fterraform-aws-core-modules","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoritzheiber%2Fterraform-aws-core-modules/lists"}