Network
Build ShopLite's VPC in code: subnets generated with for_each and cidrsubnet, internet and NAT routing, tiered security groups, and a probe instance that proves it all works.
In the AWS course you built a VPC step by step with the CLI (Phase 3). Here you build the same design as code. Along the way you'll pick up the Terraform features that make it maintainable: data sources, `for_each` over maps, `for` expressions, conditional resources, and network math with `cidrsubnet`. By the end, one variable change switches between a cheap dev network and a highly available prod one.
+ ShopLite gains: a two-AZ VPC with public, private, and database subnets, an internet gateway, toggleable NAT, an S3 gateway endpoint, and ALB → app → DB security groups
- 2.1
VPC and Subnets with for_each
A VPC with public, private, and database subnets in two Availability Zones, generated from one CIDR and an AZ list, never hand-typed.
40 minFree — VPCs and subnets have no hourly charge2 break-its - 2.2
Internet Gateway, NAT, and Routing
Public subnets reach the internet through an internet gateway; private subnets reach out through NAT that you can switch between one gateway (dev), one per AZ (prod), or none (to stop paying); database subnets have no internet route at all.
45 min~$0.06/hour per NAT gateway (~$1.35/day) — this mission shows how to switch it off2 break-its - 2.3
Tiered Security Groups
Three security groups — load balancer, app, database — where each tier only accepts traffic from the tier in front of it, written with standalone rule resources.
30 minFree2 break-its - 2.4
Prove It Works: A Throwaway Probe Instance
A tiny instance in a private subnet, reachable through Session Manager with no SSH, that proves NAT egress and the S3 endpoint work — then switched off with one variable.
35 min~$0.005/hour for a t4g.nano, plus NAT2 break-its