Terraform modules for AWS
Thirty-two modules for building on AWS with Terraform, published on the Terraform Registry and GitHub under the Apache License 2.0.
They are meant to be studied as much as used. Secure settings are the default: storage is encrypted and private, and network access is closed until you open it. Each module’s README explains its inputs, outputs, and examples, and why each default was chosen.
Using one
Every module is on the Registry under AutomateTheCloud/<name>/aws. For
example, a private, encrypted S3 bucket:
module "s3_bucket" {
source = "AutomateTheCloud/s3_bucket/aws"
version = "~> 1.0"
details = {
scope = "Automate the Cloud"
purpose = "Course Materials"
environment = "Production"
}
name = "example-course-materials"
}
The inputs differ from module to module; the README on each module’s Registry page lists them. Modules create real resources that cost real money, so read the plan before you apply it, and try a module somewhere disposable first.
Networking
- vpcA VPC with private, restricted, and public subnets across three Availability Zones.Source: terraform-aws-vpc on GitHub
- vpc_dhcp_optionsA DHCP option set, with defaults that match the Region's own.Source: terraform-aws-vpc_dhcp_options on GitHub
- vpc_peeringA VPC peering connection, accepted and routed across Regions and accounts.Source: terraform-aws-vpc_peering on GitHub
- nat_gatewayPublic or private NAT gateways and the routes to them.Source: terraform-aws-nat_gateway on GitHub
- eipAn Elastic IP address for use in a VPC.Source: terraform-aws-eip on GitHub
- transit_gatewayA transit gateway and route table, optionally shared through AWS RAM.Source: terraform-aws-transit_gateway on GitHub
- transit_gateway_attachmentA VPC attachment to a transit gateway, with routes from the VPC.Source: terraform-aws-transit_gateway_attachment on GitHub
- security_groupA security group with inbound and outbound rules.Source: terraform-aws-security_group on GitHub
DNS and certificates
- route53_zoneA Route 53 hosted zone, public or private.Source: terraform-aws-route53_zone on GitHub
- route53_resolver_endpointA Route 53 Resolver inbound or outbound endpoint.Source: terraform-aws-route53_resolver_endpoint on GitHub
- route53_resolver_ruleA Route 53 Resolver rule, optionally shared with other accounts.Source: terraform-aws-route53_resolver_rule on GitHub
- acmAn ACM certificate validated through Route 53, including across accounts.Source: terraform-aws-acm on GitHub
Data and storage
- rdsAn encrypted, private RDS instance with read replicas, logs, and monitoring.Source: terraform-aws-rds on GitHub
- rds_auroraAn Aurora PostgreSQL or MySQL cluster.Source: terraform-aws-rds_aurora on GitHub
- rds_aurora_global_clusterAn Aurora global cluster, encrypted and protected from deletion.Source: terraform-aws-rds_aurora_global_cluster on GitHub
- dynamodb_tableA DynamoDB table with indexes, autoscaling, streams, TTL, and replicas.Source: terraform-aws-dynamodb_table on GitHub
- keyspaces-keyspaceAn Amazon Keyspaces keyspace, in one Region or replicated across several.Source: terraform-aws-keyspaces-keyspace on GitHub
- elasticache_redisAn ElastiCache replication group running Redis OSS or Valkey, encrypted and private.Source: terraform-aws-elasticache_redis on GitHub
- s3_bucketS3 buckets that are private, encrypted, and HTTPS-only.Source: terraform-aws-s3_bucket on GitHub
- s3_bucket-logsS3 buckets for security and audit logs, with each AWS service limited to the accounts and prefix you name.Source: terraform-aws-s3_bucket-logs on GitHub
- efsAn EFS file system with encryption, TLS, and mount targets.Source: terraform-aws-efs on GitHub
- influxA Timestream for InfluxDB instance, private and encrypted, with a security group for its clients.Source: terraform-aws-influx on GitHub
- redshiftA Redshift cluster, encrypted and private, with TLS required and its password in Secrets Manager.Source: terraform-aws-redshift on GitHub
- redshift_serverlessA Redshift Serverless namespace and workgroup, encrypted and private, with TLS required.Source: terraform-aws-redshift_serverless on GitHub
Security and keys
- kms_keyA KMS key and alias, with a policy for administrators and users.Source: terraform-aws-kms_key on GitHub
- ssh_key_pairAn EC2 key pair from an SSH public key.Source: terraform-aws-ssh_key_pair on GitHub
Delivery and operations
- ecrAn ECR repository with lifecycle rules and a repository policy.Source: terraform-aws-ecr on GitHub
- ecs_cluster-fargateAn ECS cluster for Fargate tasks, with Container Insights and ECS Exec settings.Source: terraform-aws-ecs_cluster-fargate on GitHub
- autoscaling_group-linuxLinux EC2 instances in an Auto Scaling group, set up at boot and replaced in rolling batches.Source: terraform-aws-autoscaling_group-linux on GitHub
- codedeployA CodeDeploy application and its service role.Source: terraform-aws-codedeploy on GitHub
- sqsAn SQS queue with an optional dead-letter queue.Source: terraform-aws-sqs on GitHub
- ssm_documentA Systems Manager document, such as a Run Command document or Automation runbook.Source: terraform-aws-ssm_document on GitHub