AWS Virtual Private Cloud

This module deploys a dual-stack (IPv4 + Amazon-provided IPv6) AWS VPC with:

• one private and one public subnets per availability zone of the region.
• an internet gateway for the public subnet, and an egress only internet gateway for the private subnets (for IPv6 egress).
• optionally var.nat_gateways NAT gateways for private subnets IPv4 egress. Every private route table gets a default route through the nat gateway of its own zone when it exists, otherwise balanced over the available nat gateways.
• an emptied default security group and default route table.

Usage example

module "vpc" {
  source = "git@adyxax.org:adyxax.org/tofu-module-aws-vpc?depth=1&ref=1.0.0"

  cidr_block       = "10.0.0.0/16"
  name             = "main"
  nat_gateways     = 2
}

Addressing

var.cidr_block is expected to be a /16, but anything up to /20 works:

• private subnets are carved out of the upper half of the block as /21 (e.g. 10.0.128.0/21, 10.0.136.0/21, ...).
• public subnets are carved out of the lower half of the block as /24 (e.g. 10.0.0.0/24, 10.0.1.0/24, ...).
• all subnets (private AND public) each receive a /64 from the Amazon-provided /56 IPv6 block.

Kubernetes

Subnets are tagged with kubernetes.io/role/elb (public) and kubernetes.io/role/internal-elb (private) for EKS load balancer discovery.