AWS Amazon EC2 VPC

aws_default_vpc (Terraform)

The VPC in Amazon EC2 can be configured in Terraform with the resource name aws_default_vpc. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

BetaMedina/terraform-test-ecs

resource "aws_default_vpc" "default_vpc" {

}

resource "aws_default_subnet" "subnet_a" {
  availability_zone = "us-east-1a"

manvithis/Terraform

resource "aws_default_vpc" "default" {
  tags = {
    Name = "Default VPC"
  }
}

hugoalbertoramirez/tf-masterclass-demo

resource "aws_default_vpc" "default" {}

resource "aws_security_group" "http" {
  vpc_id = aws_default_vpc.default.id

  ingress {

femiwiki/infra

resource "aws_default_vpc" "default" {}

resource "aws_default_subnet" "default" {
  for_each = local.availability_zones

  availability_zone = each.value

sirkells/terraform-ec2-prometheus-with-keypair

resource "aws_default_vpc" "default" {
    tags = {
      "Name" = "Default vpc"
    }

}

Security Best Practices for aws_default_vpc

There is 1 setting in aws_default_vpc that should be taken care of for security reasons. The following section explain an overview and example code.

Ensure to avoid using default VPC

It is better to define the own VPC and use it.

Parameters

• arn optional computed - string
• assign_generated_ipv6_cidr_block optional computed - bool
• cidr_block optional computed - string
• default_network_acl_id optional computed - string
• default_route_table_id optional computed - string
• default_security_group_id optional computed - string
• dhcp_options_id optional computed - string
• enable_classiclink optional computed - bool
• enable_classiclink_dns_support optional computed - bool
• enable_dns_hostnames optional computed - bool
• enable_dns_support optional - bool
• id optional computed - string
• instance_tenancy optional computed - string
• ipv6_association_id optional computed - string
• ipv6_cidr_block optional computed - string
• main_route_table_id optional computed - string
• owner_id optional computed - string
• tags optional - map from string to string
• tags_all optional computed - map from string to string

Explanation in Terraform Registry

Provides a resource to manage the default AWS VPC in the current region. For AWS accounts created after 2013-12-04, each region comes with a Default VPC. This is an advanced resource, and has special caveats to be aware of when using it. Please read this document in its entirety before using this resource. The aws_default_vpc behaves differently from normal resources, in that Terraform does not create this resource, but instead "adopts" it into management.

Tips: Best Practices for The Other AWS Amazon EC2 Resources

In addition to the aws_network_acl_rule, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_network_acl_rule

Ensure your network ACL rule blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.

aws_ebs_volume

Ensure to use a customer-managed key for EBS volume encryption

It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).

aws_instance

Ensure to avoid storing AWS access keys in user data

It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.

aws_security_group

Ensure your security group blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.