Cloud architecture ยท 12 min read

Terraform VPC and subnet example

A virtual network gives resources an address space. Subnets divide that space into smaller areas so workloads have clearer boundaries. The subnet references the VPC ID, so Terraform establishes the correct dependency automatically.

A minimal network foundation

This configuration creates one VPC and two subnets. The CIDR ranges and VPC reference are the important relationships to inspect.

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "public" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_subnet" "private" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
}

Address space comes before service placement

CIDR ranges describe available network addresses. A /16 VPC contains much smaller ranges such as /24 subnets. Choose ranges that leave room for future environments and do not overlap with networks you may connect through a VPN or peering link.

The labels public and private express intent only. Routes, gateways, public addressing, and network policies determine whether a workload can actually communicate with the internet.

Separate workload roles deliberately

A common web architecture has a public entry point such as a load balancer, application compute in private subnets, and a database in a more restricted area. It is a useful starting pattern, not a universal rule.

For each resource, ask who needs to reach it and why. Subnets create boundaries, while security groups, route tables, and identity policies provide additional layers of control.

Grow the example carefully

Add compute after the network foundation, then connect it with real resource references. Add a load balancer only when you can explain its target and traffic path.

Use descriptive Terraform names and keep related resources grouped by purpose. Clear names make plans, diagrams, and incident investigation easier to understand.

Put it into practice

Add a data subnet to the example. Explain which resources should reach it, which should not, and what would make it genuinely private.

  1. Choose a private VPC range with room to grow.
  2. Keep subnet ranges non-overlapping and inside the VPC range.
  3. Reference the VPC rather than copying its cloud ID.
  4. Decide routing and security before calling a subnet public or private.