AWS VPC

Deploys a thin AWS Virtual Private Cloud: an isolated IP address space (primary IPv4 CIDR, optional secondary IPv4 CIDRs, and optional IPv6) with configurable tenancy and DNS settings. Subnets, gateways, and route tables are separate, composable components that reference this VPC.

What Gets Created

When you deploy an AwsVpc resource, Planton provisions:

• VPC — an aws_vpc / ec2.Vpc with the primary IPv4 CIDR (specified directly or allocated from an IPAM pool), tenancy, DNS, and optional IPv6.
• Secondary IPv4 CIDR associations — one aws_vpc_ipv4_cidr_block_association / ec2.VpcIpv4CidrBlockAssociation per entry in secondaryIpv4CidrBlocks, each independently associated so it can be added or removed without recreating the VPC.

Subnets, internet gateways, NAT gateways, and route tables are not created here — deploy AwsSubnet, AwsInternetGateway, and AwsNatGateway components that reference this VPC's vpc_id output.

Prerequisites

• AWS credentials configured via the Planton provider config (keyless SSO/OIDC).
• A primary IPv4 source: either a cidrBlock (e.g. 10.0.0.0/16) or an ipv4IpamPoolId.

Quick Start

Create a file vpc.yaml:

apiVersion: aws.planton.dev/v1
kind: AwsVpc
metadata:
  name: my-vpc
spec:
  region: us-west-2
  cidrBlock: "10.0.0.0/16"
  enableDnsHostnames: true

Deploy:

planton apply -f vpc.yaml

Configuration Reference

Required Fields

Optional Fields

Examples

Dual-stack VPC with a secondary CIDR

apiVersion: aws.planton.dev/v1
kind: AwsVpc
metadata:
  name: dual-stack-vpc
spec:
  region: us-west-2
  cidrBlock: "10.0.0.0/16"
  secondaryIpv4CidrBlocks:
    - "100.64.0.0/16"
  assignGeneratedIpv6CidrBlock: true
  enableDnsHostnames: true

IPAM-allocated VPC

apiVersion: aws.planton.dev/v1
kind: AwsVpc
metadata:
  name: ipam-vpc
spec:
  region: us-west-2
  ipv4IpamPoolId: "ipam-pool-0abc123"
  ipv4NetmaskLength: 16
  enableDnsHostnames: true

Stack Outputs

After deployment, the following outputs are available in status.outputs:

Related Components

• AwsSubnet — a subnet within the VPC (with routing folded in)
• AwsInternetGateway — internet access for public subnets
• AwsNatGateway — outbound internet access for private subnets
• AwsSecurityGroup — controls network traffic for resources in the VPC