Configuring VPC and Networking
Provision an AWS Virtual Private Cloud, subnets, and security groups with Terraform to give your infrastructure a secure, isolated network foundation.
Configuring VPC and Networking is a free DevOps Bootcamp lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why a Custom VPC?
Every AWS account ships with a default VPC, but production infrastructure deserves a network you design yourself. A VPC (Virtual Private Cloud) is an isolated section of the AWS cloud where you control IP ranges, subnets, routing, and firewalls.
With Terraform you describe the entire network as code, so it is reproducible across regions and accounts.
Declaring the VPC Resource
The aws_vpc resource is the root of your network. The CIDR block defines the private IP range. A /16 block gives you roughly 65,000 addresses to carve into subnets.
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
enable_dns_support = true
enable_dns_hostnames = true
tags = {
Name = "main-vpc"
}
}Public vs Private Subnets
Subnets split the VPC range into smaller blocks tied to an Availability Zone.
- Public subnet — routes to an internet gateway, used for load balancers and bastion hosts.
- Private subnet — no direct internet route, ideal for databases and app servers.
Creating a Public Subnet
Each subnet needs its own CIDR (a slice of the VPC range) and an Availability Zone. Setting map_public_ip_on_launch to true auto-assigns public IPs to instances launched here.
resource "aws_subnet" "public" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.1.0/24"
availability_zone = "us-east-1a"
map_public_ip_on_launch = true
tags = {
Name = "public-subnet"
}
}The Internet Gateway
An internet gateway (IGW) is what lets resources in a public subnet reach the internet. You attach it directly to the VPC.
resource "aws_internet_gateway" "gw" {
vpc_id = aws_vpc.main.id
tags = {
Name = "main-igw"
}
}Route Tables
A subnet only becomes truly public once a route table sends 0.0.0.0/0 traffic to the internet gateway. Route tables map destination CIDRs to targets.
resource "aws_route_table" "public" {
vpc_id = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.gw.id
}
}Associating Routes with Subnets
Route tables do nothing until associated with a subnet. The aws_route_table_association resource links them together.
resource "aws_route_table_association" "public" {
subnet_id = aws_subnet.public.id
route_table_id = aws_route_table.public.id
}Security Groups as Firewalls
A security group is a stateful virtual firewall around an instance. Stateful means return traffic for an allowed inbound request is automatically permitted, so you usually only specify the inbound rules you care about.
Defining a Web Security Group
Below we allow inbound HTTP from anywhere and allow all outbound traffic. In real deployments narrow the source CIDR as much as possible.
resource "aws_security_group" "web" {
name = "web-sg"
vpc_id = aws_vpc.main.id
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}Wiring an Instance into the Network
Attach the subnet and security group to an EC2 instance via subnet_id and vpc_security_group_ids. This places the server inside your custom network.
resource "aws_instance" "app" {
ami = "ami-0abcd1234"
instance_type = "t3.micro"
subnet_id = aws_subnet.public.id
vpc_security_group_ids = [aws_security_group.web.id]
}Outputting Network IDs
Expose key IDs as outputs so other modules or your team can reference them after apply.
output "vpc_id" {
value = aws_vpc.main.id
}
output "public_subnet_id" {
value = aws_subnet.public.id
}Quick Check
Test your understanding of VPC routing.
Recap: Your Network Foundation
You built a complete network in Terraform:
- aws_vpc with a CIDR range.
- Subnets across Availability Zones, public or private.
- Internet gateway plus route tables for public reach.
- Security groups as stateful firewalls.
This network is the backbone every other AWS resource plugs into.
Frequently asked questions
Is the “Configuring VPC and Networking” lesson free?
Yes — the full text of “Configuring VPC and Networking” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.
What will I learn in “Configuring VPC and Networking”?
Provision an AWS Virtual Private Cloud, subnets, and security groups with Terraform to give your infrastructure a secure, isolated network foundation. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start DevOps Bootcamp?
No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Configuring VPC and Networking” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this DevOps Bootcamp lesson?
Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- AWS Provider Configuration
- Provisioning EC2 Instances
- Managing S3 Buckets and IAM
- Configuring VPC and Networking