🔹 1.
Standard Real-Time CIDR Block Strategy
Environment VPC CIDR Block Notes
Production 10.0.0.0/16 Reserved for mission-critical workloads. Split into /20 or /24 subnets.
Staging 10.1.0.0/16 Near-production-like environment for QA.
Development 10.2.0.0/16 Used by engineers for testing features.
UAT 10.3.0.0/16 User acceptance testing. Often used by clients/business teams.
Shared Services 10.10.0.0/16 Centralized logging, monitoring, CI/CD tools.
🔹 2. Availability Zone Subnetting Example (Within a Production VPC: 10.0.0.0/16)
Subnet Purpose AZ CIDR Block
Public Subnet 1 us-east-1a 10.0.0.0/20
Public Subnet 2 us-east-1b 10.0.16.0/20
Private Subnet 1 us-east-1a 10.0.32.0/20
Private Subnet 2 us-east-1b 10.0.48.0/20
DB Subnet 1 us-east-1a 10.0.64.0/24
DB Subnet 2 us-east-1b 10.0.65.0/24
Reserved for future 10.0.128.0/17
🔹 3. Multi-Account / Multi-VPC Strategy with Peering
VPC Name CIDR Block Comments
Prod-VPC (App Tier) 10.0.0.0/16 Main production app services
Prod-VPC (DB Tier) 10.4.0.0/16 Dedicated DB VPC, peered with App
DevOps VPC 10.8.0.0/16 Jenkins, monitoring, logging
Analytics VPC 10.12.0.0/16 EMR, Glue, Databricks workloads
Sandbox VPC 10.16.0.0/16 Internal experiments and tests
🔹 Tips for CIDR Planning in Production
Avoid overlapping CIDRs across VPCs if you plan to use VPC peering or Transit Gateway.
Use /16 for VPCs if you expect high scalability.
Subnet by /20 or /24, depending on traffic patterns and instance density.
Use different IP ranges for Dev/Staging/Prod to isolate and minimize blast radius.
Consider RFC1918 ranges:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
Terraform: VPC for Microservices (Production)
📁 File Structure (Modular)
css
Copy
Edit
terraform/
│
├── main.tf
├── variables.tf
├── outputs.tf
└── vpc/
├── main.tf
├── variables.tf
└── outputs.tf
🔹 terraform/main.tf
hcl
Copy
Edit
provider "aws" {
region = var.aws_region
module "vpc" {
source = "./vpc"
name = "microservices-prod"
cidr = "10.0.0.0/16"
azs = ["us-east-1a", "us-east-1b", "us-east-1c"]
public_subnets = ["10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24"]
private_subnets = ["10.0.10.0/24", "10.0.11.0/24", "10.0.12.0/24"]
database_subnets = ["10.0.20.0/24", "10.0.21.0/24", "10.0.22.0/24"]
}
🔹 terraform/variables.tf
hcl
Copy
Edit
variable "aws_region" {
default = "us-east-1"
🔹 vpc/main.tf
hcl
Copy
Edit
resource "aws_vpc" "this" {
cidr_block = var.cidr
enable_dns_support = true
enable_dns_hostnames = true
tags = {
Name = "${var.name}-vpc"
resource "aws_internet_gateway" "igw" {
vpc_id = aws_vpc.this.id
tags = {
Name = "${var.name}-igw"
}
resource "aws_subnet" "public" {
for_each = toset(var.public_subnets)
vpc_id = aws_vpc.this.id
cidr_block = each.value
availability_zone = element(var.azs, index(var.public_subnets, each.value))
map_public_ip_on_launch = true
tags = {
Name = "${var.name}-public-${each.key}"
resource "aws_subnet" "private" {
for_each = toset(var.private_subnets)
vpc_id = aws_vpc.this.id
cidr_block = each.value
availability_zone = element(var.azs, index(var.private_subnets, each.value))
tags = {
Name = "${var.name}-private-${each.key}"
resource "aws_subnet" "database" {
for_each = toset(var.database_subnets)
vpc_id = aws_vpc.this.id
cidr_block = each.value
availability_zone = element(var.azs, index(var.database_subnets, each.value))
tags = {
Name = "${var.name}-db-${each.key}"
🔹 vpc/variables.tf
hcl
Copy
Edit
variable "name" {}
variable "cidr" {}
variable "azs" {
type = list(string)
variable "public_subnets" {
type = list(string)
variable "private_subnets" {
type = list(string)
variable "database_subnets" {
type = list(string)
🔹 vpc/outputs.tf
hcl
Copy
Edit
output "vpc_id" {
value = aws_vpc.this.id
output "public_subnet_ids" {
value = [for s in aws_subnet.public : s.id]
output "private_subnet_ids" {
value = [for s in aws_subnet.private : s.id]
output "db_subnet_ids" {
value = [for s in aws_subnet.database : s.id]
🚀 Next Steps
Add Route Tables for public and private subnets.
Add NAT Gateway to allow outbound internet access from private subnets.
Add Security Groups for ECS, ALB, DB, etc.
Use terraform apply to deploy after initializing.
