by Nidin Shah
https://github.com/nidinshah/aws-vpc-terraform
I started this project as someone completely new to AWS and cloud infrastructure. Before this, I had never written a single line of Terraform, and the idea of "provisioning infrastructure with code" felt abstract and intimidating.
"Instead of manually creating resources one by one in AWS, I wrote code that does it all in seconds and can tear it all down just as fast via CLI”
The goal was to build a Virtual Private Cloud (VPC) the foundational networking layer that every AWS application lives inside. By the end, I had a working network with public and private subnets, an internet gateway, a NAT gateway, and proper routing — all provisioned automatically a the same time to understand the how terraform works in real life.
Think of AWS as a massive apartment building with thousands of rooms. A VPC is your own private floor nobody else can get in unless you specifically let them. Inside your floor, you can have rooms (subnets) that face the street (public), and rooms that are tucked away inside (private).
Everything you build on AWS web servers, databases, applications lives inside a VPC. Getting comfortable with VPC design is one of the most important skills in cloud, and it is heavily tested in the AWS Solutions Architect exam.
The architecture follows a standard two-tier network pattern used by real companies running on AWS. Here is a breakdown of every component and what it does.
| Component | What It Does |
|---|---|
| VPC (10.0.0.0/16) | The private network container — like renting your own floor in the AWS building |
| Public Subnet (10.0.1.0/24) | The internet-facing section — web servers and load balancers live here |
| Private Subnet (10.0.2.0/24) | The hidden section — databases and sensitive services live here |
| Internet Gateway | The front door — lets the public subnet talk to the internet |
| Elastic IP | A fixed public IP address reserved for the NAT Gateway |
| NAT Gateway | The back door — lets the private subnet reach the internet, but nothing gets in |
| Public Route Table | The signboard for public traffic: all internet traffic goes via the Internet Gateway |
| Private Route Table | The signboard for private traffic: all outbound traffic goes via the NAT Gateway |
| Route Table Associations (x2) | Connects each route table to the correct subnet |
Before writing any code, I set up my local environment from scratch. Here is what I used and why.
| Tool | Version & Purpose |
|---|---|
| Terraform CLI | v1.15.3 - writes and runs the infrastructure code |
| AWS CLI | v2.34.48 - connects my machine to my AWS account |
| VS Code | Code editor with the HashiCorp Terraform extension installed |
| AWS Account | Free tier account — Singapore region (ap-southeast-1) |
Terraform uses a simple concept: you describe the infrastructure you want in code (.tf files), and Terraform figures out how to create it. The workflow is always three steps: