Internet Gateway, NAT, and Routing

1. 1

   Add the NAT switches

   enable_nat_gateway = false removes NAT entirely, useful when you stop for the day, since NAT is the most expensive thing in this stage. single_nat_gateway picks between cheap dev and highly available prod.

   variable "enable_nat_gateway" {
     description = "Give private subnets outbound internet access through NAT."
     type        = bool
     default     = true
   }
   
   variable "single_nat_gateway" {
     description = "true = one shared NAT (cheap, dev). false = one NAT per AZ (HA, prod)."
     type        = bool
     default     = true
   }

2. 2

   Internet gateway and public routing

   One public route table shared by all public subnets. The association uses for_each = aws_subnet.public, keyed by AZ.

   resource "aws_internet_gateway" "main" {
     vpc_id = aws_vpc.main.id
     tags   = { Name = "${local.name_prefix}-igw" }
   }
   
   resource "aws_route_table" "public" {
     vpc_id = aws_vpc.main.id
     tags   = { Name = "${local.name_prefix}-public" }
   }
   
   resource "aws_route" "public_internet" {
     route_table_id         = aws_route_table.public.id
     destination_cidr_block = "0.0.0.0/0"
     gateway_id             = aws_internet_gateway.main.id
   }
   
   resource "aws_route_table_association" "public" {
     for_each = aws_subnet.public
   
     subnet_id      = each.value.id
     route_table_id = aws_route_table.public.id
   }

3. 3

   Conditional NAT gateways and private routing

   local.nat_azs is the whole switch. Each private route table (one per AZ) routes to its own AZ's NAT when there's one per AZ, or to the single shared one otherwise. Routes live in separate aws_route resources (not inline in the route table), so they can be conditional.

   locals {
     nat_azs = !var.enable_nat_gateway ? [] : (
       var.single_nat_gateway ? [local.azs[0]] : local.azs
     )
   }
   
   resource "aws_eip" "nat" {
     for_each = toset(local.nat_azs)
   
     domain = "vpc"
     tags   = { Name = "${local.name_prefix}-nat-${each.key}" }
   }
   
   resource "aws_nat_gateway" "main" {
     for_each = toset(local.nat_azs)
   
     allocation_id = aws_eip.nat[each.key].id
     subnet_id     = aws_subnet.public[each.key].id
     tags          = { Name = "${local.name_prefix}-nat-${each.key}" }
   
     # NAT needs the IGW attached before it can route, but references nothing on it.
     depends_on = [aws_internet_gateway.main]
   }
   
   resource "aws_route_table" "private" {
     for_each = toset(local.azs)
   
     vpc_id = aws_vpc.main.id
     tags   = { Name = "${local.name_prefix}-private-${each.key}" }
   }
   
   resource "aws_route" "private_nat" {
     for_each = var.enable_nat_gateway ? toset(local.azs) : toset([])
   
     route_table_id         = aws_route_table.private[each.key].id
     destination_cidr_block = "0.0.0.0/0"
     nat_gateway_id         = aws_nat_gateway.main[var.single_nat_gateway ? local.azs[0] : each.key].id
   }
   
   resource "aws_route_table_association" "private" {
     for_each = aws_subnet.private
   
     subnet_id      = each.value.id
     route_table_id = aws_route_table.private[each.key].id
   }

4. 4

   Keep S3 traffic off the NAT

   An S3 gateway endpoint is free and removes NAT data-processing charges for every image layer, upload, and log shipped to S3. The for expression collects all private route table IDs.

   Database subnets get no association at all, so they use the VPC's main route table, which only has the local route and therefore no path to the internet. That's intentional.

   resource "aws_vpc_endpoint" "s3" {
     vpc_id            = aws_vpc.main.id
     service_name      = "com.amazonaws.${var.aws_region}.s3"
     vpc_endpoint_type = "Gateway"
     route_table_ids   = [for rt in aws_route_table.private : rt.id]
   
     tags = { Name = "${local.name_prefix}-s3-endpoint" }
   }

5. 5

   Plan and apply

   With the defaults (NAT on, single), the summary is: IGW, public route table plus route plus 2 associations, 1 EIP, 1 NAT, 2 private route tables, 2 private routes, 2 private associations, and the endpoint. The NAT gateway takes a minute or two to create.

   terminalcopy cmd

   $ terraform apply

   ── expected output ──

   ...

   Plan: 15 to add, 0 to change, 0 to destroy.

   ...

   aws_nat_gateway.main["ap-south-1a"]: Still creating... [1m20s elapsed]

   aws_nat_gateway.main["ap-south-1a"]: Creation complete after 1m34s [id=nat-0f1e2d3c4b5a69788]

   aws_route.private_nat["ap-south-1a"]: Creating...

   aws_route.private_nat["ap-south-1b"]: Creating...

   ...

   Apply complete! Resources: 15 added, 0 changed, 0 destroyed.

6. 6

   Flip to prod-style HA, then read the plan (don't apply)

   Setting single_nat_gateway = false shows exactly what HA costs in resources: one more EIP and NAT, and the AZ-b route re-pointed to its own NAT. The plan is the cost review.

   terminalcopy cmd

   $ terraform plan -var single_nat_gateway=false

   ── expected output ──

   # aws_eip.nat["ap-south-1b"] will be created

   # aws_nat_gateway.main["ap-south-1b"] will be created

   # aws_route.private_nat["ap-south-1b"] will be updated in-place

   ~ resource "aws_route" "private_nat" {

   ~ nat_gateway_id = "nat-0f1e2d3c4b5a69788" -> (known after apply)

   ...

   }

    

   Plan: 2 to add, 1 to change, 0 to destroy.

7. 7

   Know how to stop paying between sessions

   Put the switch in terraform.tfvars and turn it off whenever you stop working. Only the NAT, its EIP, and the private default routes are destroyed; the VPC, subnets, and everything else stay. Turn it back on (true) at the start of your next session.

   environment        = "dev"
   enable_nat_gateway = true # set to false when you stop for the day

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.