Terraform Module Builder
Build reusable, production-ready Terraform modules for cloud infrastructure.
Core Workflow
- Define module structure: Organize files properly
- Declare variables: Input parameters with validation
- Create resources: Infrastructure definitions
- Configure outputs: Export useful values
- Setup state: Remote backend configuration
- Document: README and examples
Module Structure
modules/
└── vpc/
├── main.tf # Primary resources
├── variables.tf # Input variables
├── outputs.tf # Output values
├── versions.tf # Provider versions
├── locals.tf # Local values
├── data.tf # Data sources
├── README.md # Documentation
└── examples/
└── complete/
├── main.tf
└── outputs.tfVPC Module Example
Main Configuration
# modules/vpc/main.tf
resource "aws_vpc" "main" {
cidr_block = var.cidr_block
enable_dns_hostnames = var.enable_dns_hostnames
enable_dns_support = var.enable_dns_support
tags = merge(
var.tags,
{
Name = var.name
}
)
}
resource "aws_internet_gateway" "main" {
count = var.create_igw ? 1 : 0
vpc_id = aws_vpc.main.id
tags = merge(
var.tags,
{
Name = "${var.name}-igw"
}
)
}
resource "aws_subnet" "public" {
count = length(var.public_subnets)
vpc_id = aws_vpc.main.id
cidr_block = var.public_subnets[count.index]
availability_zone = var.availability_zones[count.index]
map_public_ip_on_launch = true
tags = merge(
var.tags,
{
Name = "${var.name}-public-${var.availability_zones[count.index]}"
Tier = "public"
}
)
}
resource "aws_subnet" "private" {
count = length(var.private_subnets)
vpc_id = aws_vpc.main.id
cidr_block = var.private_subnets[count.index]
availability_zone = var.availability_zones[count.index]
tags = merge(
var.tags,
{
Name = "${var.name}-private-${var.availability_zones[count.index]}"
Tier = "private"
}
)
}
resource "aws_eip" "nat" {
count = var.enable_nat_gateway ? (var.single_nat_gateway ? 1 : length(var.public_subnets)) : 0
domain = "vpc"
tags = merge(
var.tags,
{
Name = "${var.name}-nat-${count.index + 1}"
}
)
depends_on = [aws_internet_gateway.main]
}
resource "aws_nat_gateway" "main" {
count = var.enable_nat_gateway ? (var.single_nat_gateway ? 1 : length(var.public_subnets)) : 0
allocation_id = aws_eip.nat[count.index].id
subnet_id = aws_subnet.public[count.index].id
tags = merge(
var.tags,
{
Name = "${var.name}-nat-${count.index + 1}"
}
)
depends_on = [aws_internet_gateway.main]
}
resource "aws_route_table" "public" {
vpc_id = aws_vpc.main.id
tags = merge(
var.tags,
{
Name = "${var.name}-public-rt"
}
)
}
resource "aws_route" "public_internet" {
count = var.create_igw ? 1 : 0
route_table_id = aws_route_table.public.id
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.main[0].id
}
resource "aws_route_table_association" "public" {
count = length(var.public_subnets)
subnet_id = aws_subnet.public[count.index].id
route_table_id = aws_route_table.public.id
}
resource "aws_route_table" "private" {
count = var.enable_nat_gateway ? (var.single_nat_gateway ? 1 : length(var.private_subnets)) : 0
vpc_id = aws_vpc.main.id
tags = merge(
var.tags,
{
Name = "${var.name}-private-rt-${count.index + 1}"
}
)
}
resource "aws_route" "private_nat" {
count = var.enable_nat_gateway ? (var.single_nat_gateway ? 1 : length(var.private_subnets)) : 0
route_table_id = aws_route_table.private[count.index].id
destination_cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.main[var.single_nat_gateway ? 0 : count.index].id
}
resource "aws_route_table_association" "private" {
count = length(var.private_subnets)
subnet_id = aws_subnet.private[count.index].id
route_table_id = aws_route_table.private[var.single_nat_gateway ? 0 : count.index].id
}Variables
# modules/vpc/variables.tf
variable "name" {
description = "Name prefix for all resources"
type = string
validation {
condition = length(var.name) <= 32
error_message = "Name must be 32 characters or less."
}
}
variable "cidr_block" {
description = "CIDR block for the VPC"
type = string
default = "10.0.0.0/16"
validation {
condition = can(cidrhost(var.cidr_block, 0))
error_message = "Must be a valid CIDR block."
}
}
variable "availability_zones" {
description = "List of availability zones"
type = list(string)
}
variable "public_subnets" {
description = "List of public subnet CIDR blocks"
type = list(string)
default = []
validation {
condition = alltrue([for cidr in var.public_subnets : can(cidrhost(cidr, 0))])
error_message = "All public subnets must be valid CIDR blocks."
}
}
variable "private_subnets" {
description = "List of private subnet CIDR blocks"
type = list(string)
default = []
}
variable "enable_dns_hostnames" {
description = "Enable DNS hostnames in the VPC"
type = bool
default = true
}
variable "enable_dns_support" {
description = "Enable DNS support in the VPC"
type = bool
default = true
}
variable "create_igw" {
description = "Create Internet Gateway"
type = bool
default = true
}
variable "enable_nat_gateway" {
description = "Enable NAT Gateway for private subnets"
type = bool
default = true
}
variable "single_nat_gateway" {
description = "Use a single NAT Gateway (cost savings)"
type = bool
default = false
}
variable "tags" {
description = "Tags to apply to all resources"
type = map(string)
default = {}
}Outputs
# modules/vpc/outputs.tf
output "vpc_id" {
description = "The ID of the VPC"
value = aws_vpc.main.id
}
output "vpc_cidr_block" {
description = "The CIDR block of the VPC"
value = aws_vpc.main.cidr_block
}
output "public_subnet_ids" {
description = "List of public subnet IDs"
value = aws_subnet.public[*].id
}
output "private_subnet_ids" {
description = "List of private subnet IDs"
value = aws_subnet.private[*].id
}
output "public_subnet_cidr_blocks" {
description = "List of public subnet CIDR blocks"
value = aws_subnet.public[*].cidr_block
}
output "private_subnet_cidr_blocks" {
description = "List of private subnet CIDR blocks"
value = aws_subnet.private[*].cidr_block
}
output "nat_gateway_ids" {
description = "List of NAT Gateway IDs"
value = aws_nat_gateway.main[*].id
}
output "internet_gateway_id" {
description = "The ID of the Internet Gateway"
value = try(aws_internet_gateway.main[0].id, null)
}Versions
# modules/vpc/versions.tf
terraform {
required_version = ">= 1.0"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}Remote State Configuration
# backend.tf
terraform {
backend "s3" {
bucket = "my-terraform-state"
key = "production/vpc/terraform.tfstate"
region = "us-east-1"
encrypt = true
dynamodb_table = "terraform-locks"
}
}
# State locking table
resource "aws_dynamodb_table" "terraform_locks" {
name = "terraform-locks"
billing_mode = "PAY_PER_REQUEST"
hash_key = "LockID"
attribute {
name = "LockID"
type = "S"
}
}EKS Module Example
# modules/eks/main.tf
resource "aws_eks_cluster" "main" {
name = var.cluster_name
version = var.cluster_version
role_arn = aws_iam_role.cluster.arn
vpc_config {
subnet_ids = var.subnet_ids
endpoint_private_access = var.endpoint_private_access
endpoint_public_access = var.endpoint_public_access
security_group_ids = [aws_security_group.cluster.id]
}
encryption_config {
provider {
key_arn = var.kms_key_arn
}
resources = ["secrets"]
}
enabled_cluster_log_types = var.enabled_log_types
depends_on = [
aws_iam_role_policy_attachment.cluster_policy,
aws_iam_role_policy_attachment.vpc_resource_controller,
]
tags = var.tags
}
resource "aws_eks_node_group" "main" {
for_each = var.node_groups
cluster_name = aws_eks_cluster.main.name
node_group_name = each.key
node_role_arn = aws_iam_role.node.arn
subnet_ids = var.subnet_ids
instance_types = each.value.instance_types
capacity_type = each.value.capacity_type
disk_size = each.value.disk_size
scaling_config {
desired_size = each.value.desired_size
max_size = each.value.max_size
min_size = each.value.min_size
}
update_config {
max_unavailable_percentage = 25
}
labels = each.value.labels
dynamic "taint" {
for_each = each.value.taints
content {
key = taint.value.key
value = taint.value.value
effect = taint.value.effect
}
}
tags = merge(var.tags, each.value.tags)
depends_on = [
aws_iam_role_policy_attachment.node_policy,
aws_iam_role_policy_attachment.cni_policy,
aws_iam_role_policy_attachment.ecr_policy,
]
lifecycle {
ignore_changes = [scaling_config[0].desired_size]
}
}
# modules/eks/variables.tf
variable "cluster_name" {
description = "Name of the EKS cluster"
type = string
}
variable "cluster_version" {
description = "Kubernetes version"
type = string
default = "1.28"
}
variable "node_groups" {
description = "Map of node group configurations"
type = map(object({
instance_types = list(string)
capacity_type = string
disk_size = number
desired_size = number
max_size = number
min_size = number
labels = map(string)
taints = list(object({
key = string
value = string
effect = string
}))
tags = map(string)
}))
}Environment Configuration
# environments/production/main.tf
terraform {
required_version = ">= 1.0"
backend "s3" {
bucket = "company-terraform-state"
key = "production/main.tfstate"
region = "us-east-1"
encrypt = true
dynamodb_table = "terraform-locks"
}
}
provider "aws" {
region = var.region
default_tags {
tags = {
Environment = "production"
ManagedBy = "terraform"
Project = var.project_name
}
}
}
module "vpc" {
source = "../../modules/vpc"
name = "${var.project_name}-production"
cidr_block = "10.0.0.0/16"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
public_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
private_subnets = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
enable_nat_gateway = true
single_nat_gateway = false
tags = var.tags
}
module "eks" {
source = "../../modules/eks"
cluster_name = "${var.project_name}-production"
cluster_version = "1.28"
subnet_ids = module.vpc.private_subnet_ids
node_groups = {
general = {
instance_types = ["m6i.xlarge"]
capacity_type = "ON_DEMAND"
disk_size = 100
desired_size = 3
max_size = 10
min_size = 2
labels = { workload = "general" }
taints = []
tags = {}
}
spot = {
instance_types = ["m6i.xlarge", "m5.xlarge"]
capacity_type = "SPOT"
disk_size = 50
desired_size = 2
max_size = 20
min_size = 0
labels = { workload = "batch" }
taints = [{
key = "spot"
value = "true"
effect = "NO_SCHEDULE"
}]
tags = {}
}
}
tags = var.tags
}Locals and Data Sources
# modules/vpc/locals.tf
locals {
az_count = length(var.availability_zones)
subnet_bits = ceil(log(local.az_count * 2, 2))
public_subnet_cidrs = [
for i in range(local.az_count) :
cidrsubnet(var.cidr_block, local.subnet_bits, i)
]
private_subnet_cidrs = [
for i in range(local.az_count) :
cidrsubnet(var.cidr_block, local.subnet_bits, i + local.az_count)
]
common_tags = merge(
var.tags,
{
Module = "vpc"
CreatedBy = "terraform"
}
)
}
# modules/vpc/data.tf
data "aws_region" "current" {}
data "aws_availability_zones" "available" {
state = "available"
}
data "aws_caller_identity" "current" {}Best Practices
- Version constraints: Pin provider versions
- Variable validation: Add validation rules
- Consistent naming: Use name prefixes
- Default tags: Apply common tags
- Remote state: Use S3 + DynamoDB locking
- Module composition: Small, focused modules
- Documentation: README with examples
- Output everything: Useful values for consumers
Output Checklist
Every Terraform module should include:
- Proper file structure (main, variables, outputs, versions)
- Variable validation rules
- Meaningful default values
- Comprehensive outputs
- Version constraints
- Remote state configuration
- Tags for all resources
- README with examples
- Locals for computed values
- Data sources for dynamic values