AWS VPC

Deploys an AWS Virtual Private Cloud with automatic subnet calculation, public and private subnet creation across specified Availability Zones, an Internet Gateway for public routing, and optional NAT Gateways for private subnet internet access.

What Gets Created

When you deploy an AwsVpc resource, OpenMCF provisions:

• VPC — an ec2.Vpc resource with the specified CIDR block, DNS support, and DNS hostname settings
• Internet Gateway — an ec2.InternetGateway attached to the VPC for public internet access
• Public Route Table — an ec2.RouteTable with a default route (0.0.0.0/0) pointing to the Internet Gateway
• Public Subnets — one or more ec2.Subnet resources per Availability Zone with MapPublicIpOnLaunch enabled, each associated with the public route table via ec2.RouteTableAssociation
• Private Subnets — one or more ec2.Subnet resources per Availability Zone with MapPublicIpOnLaunch disabled
• Elastic IPs (NAT only) — one ec2.Eip per Availability Zone, created only when isNatGatewayEnabled is true
• NAT Gateways (NAT only) — one ec2.NatGateway per Availability Zone placed in the first public subnet, created only when isNatGatewayEnabled is true
• Private Route Tables (NAT only) — one ec2.RouteTable per private subnet routing 0.0.0.0/0 through the AZ's NAT Gateway, each associated via ec2.RouteTableAssociation

Prerequisites

• AWS credentials configured via environment variables or OpenMCF provider config
• A valid CIDR block for the VPC (e.g., 10.0.0.0/16)
• At least one Availability Zone in the target AWS region

Quick Start

Create a file vpc.yaml:

apiVersion: aws.openmcf.org/v1
kind: AwsVpc
metadata:
  name: my-vpc
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.AwsVpc.my-vpc
spec:
  region: us-west-2
  vpcCidr: "10.0.0.0/16"
  subnetsPerAvailabilityZone: 1
  subnetSize: 24

Deploy:

openmcf apply -f vpc.yaml

This creates a VPC with the 10.0.0.0/16 CIDR block. No subnets are created until you also specify availabilityZones.

Configuration Reference

Required Fields

Optional Fields

Examples

Two-AZ VPC with Public and Private Subnets

A typical VPC spanning two Availability Zones with one public and one private subnet per AZ:

apiVersion: aws.openmcf.org/v1
kind: AwsVpc
metadata:
  name: two-az-vpc
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.AwsVpc.two-az-vpc
spec:
  region: us-east-1
  vpcCidr: "10.0.0.0/16"
  availabilityZones:
    - us-east-1a
    - us-east-1b
  subnetsPerAvailabilityZone: 1
  subnetSize: 24

VPC with NAT Gateway

Private subnets that can reach the internet through NAT Gateways, with DNS support enabled:

apiVersion: aws.openmcf.org/v1
kind: AwsVpc
metadata:
  name: nat-vpc
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: staging.AwsVpc.nat-vpc
spec:
  region: us-west-2
  vpcCidr: "10.1.0.0/16"
  availabilityZones:
    - us-west-2a
    - us-west-2b
  subnetsPerAvailabilityZone: 1
  subnetSize: 24
  isNatGatewayEnabled: true
  isDnsSupportEnabled: true
  isDnsHostnamesEnabled: true

Three-AZ Production VPC

A production VPC spanning three Availability Zones with multiple subnets per AZ, NAT Gateways, and full DNS support:

apiVersion: aws.openmcf.org/v1
kind: AwsVpc
metadata:
  name: prod-vpc
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.AwsVpc.prod-vpc
spec:
  region: eu-west-1
  vpcCidr: "10.10.0.0/16"
  availabilityZones:
    - eu-west-1a
    - eu-west-1b
    - eu-west-1c
  subnetsPerAvailabilityZone: 2
  subnetSize: 24
  isNatGatewayEnabled: true
  isDnsSupportEnabled: true
  isDnsHostnamesEnabled: true

Large VPC with Small Subnets

A VPC with a /20 address space divided into /28 subnets (16 addresses each) for fine-grained network segmentation:

apiVersion: aws.openmcf.org/v1
kind: AwsVpc
metadata:
  name: segmented-vpc
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.AwsVpc.segmented-vpc
spec:
  region: ap-southeast-1
  vpcCidr: "172.16.0.0/20"
  availabilityZones:
    - ap-southeast-1a
    - ap-southeast-1b
  subnetsPerAvailabilityZone: 3
  subnetSize: 28

Stack Outputs

After deployment, the following outputs are available in status.outputs:

Each subnet entry in public_subnets and private_subnets contains:

Related Components

• AwsSecurityGroup — controls network traffic for resources deployed in the VPC
• AwsAlb — deploys an Application Load Balancer in the VPC's subnets
• AwsEksCluster — deploys a Kubernetes cluster in the VPC
• AwsClientVpn — provides VPN access into the VPC
• AwsEc2Instance — launches EC2 instances in the VPC's subnets