VPC and Subnets with for_each

1. 1

   Try the math in terraform console first

   terraform console evaluates expressions interactively, using your configuration's variables and state. Use it whenever you're unsure what a function or for expression returns; it's much quicker than finding out from a plan.

   terminalcopy cmd

   $ cd infra && terraform console

   ── expected output ──

   > cidrsubnet("10.20.0.0/16", 8, 0)

   "10.20.0.0/24"

   > cidrsubnet("10.20.0.0/16", 8, 10)

   "10.20.10.0/24"

   > { for i, az in ["ap-south-1a", "ap-south-1b"] : az => cidrsubnet("10.20.0.0/16", 8, i + 10) }

   {

   "ap-south-1a" = "10.20.10.0/24"

   "ap-south-1b" = "10.20.11.0/24"

   }

   > exit

2. 2

   Add network variables

   can(cidrhost(...)) is a validation trick: cidrhost fails on anything that isn't a valid CIDR, and can turns that failure into false.

   variable "vpc_cidr" {
     description = "CIDR block for the VPC. Must not overlap other environments."
     type        = string
     default     = "10.20.0.0/16"
   
     validation {
       condition     = can(cidrhost(var.vpc_cidr, 0))
       error_message = "vpc_cidr must be a valid IPv4 CIDR, e.g. 10.20.0.0/16."
     }
   }
   
   variable "az_count" {
     description = "How many Availability Zones to spread subnets across."
     type        = number
     default     = 2
   
     validation {
       condition     = var.az_count >= 2 && var.az_count <= 3
       error_message = "Use 2 or 3 AZs."
     }
   }

3. 3

   Write the VPC and the subnet maps

   The locals build three maps keyed by AZ. Each subnet resource uses for_each over its map, with each.key as the AZ and each.value as the CIDR. merge() combines a common tag map with per-resource tags.

   Only public subnets get the Tier = public tag; Stage 3's load balancer looks subnets up by tier, so tags here are functional, not decoration.

   data "aws_availability_zones" "available" {
     state = "available"
   }
   
   locals {
     azs = slice(data.aws_availability_zones.available.names, 0, var.az_count)
   
     public_subnets   = { for i, az in local.azs : az => cidrsubnet(var.vpc_cidr, 8, i) }
     private_subnets  = { for i, az in local.azs : az => cidrsubnet(var.vpc_cidr, 8, i + 10) }
     database_subnets = { for i, az in local.azs : az => cidrsubnet(var.vpc_cidr, 8, i + 20) }
   }
   
   resource "aws_vpc" "main" {
     cidr_block           = var.vpc_cidr
     enable_dns_support   = true
     enable_dns_hostnames = true
   
     tags = { Name = "${local.name_prefix}-vpc" }
   }
   
   resource "aws_subnet" "public" {
     for_each = local.public_subnets
   
     vpc_id            = aws_vpc.main.id
     availability_zone = each.key
     cidr_block        = each.value
   
     tags = { Name = "${local.name_prefix}-public-${each.key}", Tier = "public" }
   }
   
   resource "aws_subnet" "private" {
     for_each = local.private_subnets
   
     vpc_id            = aws_vpc.main.id
     availability_zone = each.key
     cidr_block        = each.value
   
     tags = { Name = "${local.name_prefix}-private-${each.key}", Tier = "private" }
   }
   
   resource "aws_subnet" "database" {
     for_each = local.database_subnets
   
     vpc_id            = aws_vpc.main.id
     availability_zone = each.key
     cidr_block        = each.value
   
     tags = { Name = "${local.name_prefix}-database-${each.key}", Tier = "database" }
   }

4. 4

   Expose the IDs with for expressions

   Subnet resources with for_each are MAPS of objects, so aws_subnet.private.id doesn't exist. A for expression turns them into the list of IDs that other resources (the ALB, ECS, RDS) expect. Map iteration is sorted by key, so the order is stable.

   output "vpc_id" {
     value = aws_vpc.main.id
   }
   
   output "public_subnet_ids" {
     value = [for s in aws_subnet.public : s.id]
   }
   
   output "private_subnet_ids" {
     value = [for s in aws_subnet.private : s.id]
   }
   
   output "database_subnet_ids" {
     value = [for s in aws_subnet.database : s.id]
   }

5. 5

   Plan — notice the instance keys

   Each subnet appears with its key in brackets: aws_subnet.private["ap-south-1a"]. That string is the instance's permanent identity in state.

   terminalcopy cmd

   $ terraform plan

   ── expected output ──

   data.aws_availability_zones.available: Reading...

   data.aws_availability_zones.available: Read complete after 0s [id=ap-south-1]

    

   # aws_subnet.database["ap-south-1a"] will be created

   + resource "aws_subnet" "database" {

   + availability_zone = "ap-south-1a"

   + cidr_block = "10.20.20.0/24"

   + vpc_id = (known after apply)

   ...

   # aws_subnet.private["ap-south-1a"] will be created

   + resource "aws_subnet" "private" {

   + availability_zone = "ap-south-1a"

   + cidr_block = "10.20.10.0/24"

   ...

   # aws_vpc.main will be created

   + resource "aws_vpc" "main" {

   + cidr_block = "10.20.0.0/16"

   + enable_dns_hostnames = true

   ...

    

   Plan: 7 to add, 0 to change, 0 to destroy.

    

   Changes to Outputs:

   + database_subnet_ids = [

   + (known after apply),

   + (known after apply),

   ]

   ...

6. 6

   Apply and check

   The VPC is created first, then all six subnets in parallel, because they all depend on the VPC and not on each other.

   terminalcopy cmd

   $ terraform apply

   terraform output private_subnet_ids

   ── expected output ──

   aws_vpc.main: Creating...

   aws_vpc.main: Creation complete after 2s [id=vpc-0c1d2e3f4a5b6c7d8]

   aws_subnet.private["ap-south-1b"]: Creating...

   aws_subnet.public["ap-south-1a"]: Creating...

   ...

   Apply complete! Resources: 7 added, 0 changed, 0 destroyed.

    

   [

   "subnet-0aa11bb22cc33dd44",

   "subnet-0ee55ff66aa77bb88",

   ]

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.

resource "aws_subnet" "private" {
  count             = length(local.azs)
  vpc_id            = aws_vpc.main.id
  availability_zone = local.azs[count.index]
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + 10)
}