Terraform module to build multi-VPC Network(Complex Network Interconnection Scenario - Single-Plane Networking) for Alibaba Cloud

English | 简体中文

This Well-Architecture design emphasizes how to use VPC peering or transit routers in the Alibaba Cloud to build an efficient, secure, and highly available multi-VPC network architecture within the same region, tailored to different customer scenarios and needs.
In the complex network interconnection scenario with a single-plane network, multiple business VPCs within an enterprise can achieve large-scale interconnection through Transit Router (TR) to enable on-demand communication between VPCs. Additionally, a DMZ VPC is constructed to centrally manage all public traffic ingress and egress. The production, development, and DMZ zones are divided into multiple planes according to the TR routing tables. Each business module's VPC is bound to an independent TR routing table, where the routing configuration and policy in the TR routing table determine inter-VPC communication. Furthermore, a public routing table can be constructed solely for managing the routing and forwarding of the DMZ VPC, serving as the unified entry and exit point for north-south traffic management in various production and development environments.
The process overview is as follows:

1. Divide distinct environments for production, testing, and DMZ areas.
2. Create multiple VPCs and corresponding Virtual Switches (VSW) within each environment.
3. Create a Cloud Enterprise Network (CEN) and a Transit Router (TR).
4. Add VPCs to the CEN using TR-attachment.
5. Create separate TR routing tables for different environments.
6. Establish corresponding routing entries within each routing table to achieve routing isolation and connectivity.
7. Associate the TR routing tables with their respective VPC-attachments.

Architecture Diagram:

create one VPC in DMZ, one VPC in Dev and two VPCs in Prod.

provider "alicloud" {
  region = "cn-hangzhou"
}

module "complete" {
  source = "alibabacloud-automation/multiple-vpc-networks-cen/alicloud"

  vpcs = {
    dmz = {
      cidr_block = "10.1.0.0/16"
      vswitches = [
        {
          subnet  = "10.1.0.0/24"
          zone_id = "cn-hangzhou-h"
          }, {
          subnet  = "10.1.1.0/24"
          zone_id = "cn-hangzhou-i"
          }, {
          subnet  = "10.1.2.0/24"
          zone_id = "cn-hangzhou-j"
        }
      ]
    }
    prod = [{
      cidr_block = "10.2.0.0/16"
      vswitches = [
        {
          subnet  = "10.2.0.0/24"
          zone_id = "cn-hangzhou-h"
          }, {
          subnet  = "10.2.1.0/24"
          zone_id = "cn-hangzhou-i"
          }, {
          subnet  = "10.2.2.0/24"
          zone_id = "cn-hangzhou-j"
        }
      ]
      }, {
      cidr_block = "10.3.0.0/16"
      vswitches = [
        {
          subnet  = "10.3.0.0/24"
          zone_id = "cn-hangzhou-h"
          }, {
          subnet  = "10.3.1.0/24"
          zone_id = "cn-hangzhou-i"
          }, {
          subnet  = "10.3.2.0/24"
          zone_id = "cn-hangzhou-j"
        }
      ]
    }]
    dev = [{
      cidr_block = "10.4.0.0/16"
      vswitches = [
        {
          subnet  = "10.4.0.0/24"
          zone_id = "cn-hangzhou-h"
          }, {
          subnet  = "10.4.1.0/24"
          zone_id = "cn-hangzhou-i"
          }, {
          subnet  = "10.4.2.0/24"
          zone_id = "cn-hangzhou-j"
        }
      ]
    }]
  }

  tags = {
    "Createdby" = "terraform"
  }
}

• Complete Example
• Complete With Inner VPC Example

object({
    dmz = object({
      cidr_block = string
      vswitches = list(object({
        subnet  = string
        zone_id = string
      }))
    })
    prod = list(object({
      cidr_block = string
      vswitches = list(object({
        subnet  = string
        zone_id = string
      }))
    }))
    dev = list(object({
      cidr_block = string
      vswitches = list(object({
        subnet  = string
        zone_id = string
      }))
    }))
    prod_inner = optional(list(object({
      cidr_block = string
      vswitches = list(object({
        subnet  = string
        zone_id = string
      }))
    })), [])
    dev_inner = optional(list(object({
      cidr_block = string
      vswitches = list(object({
        subnet  = string
        zone_id = string
      }))
    })), [])
  })

{
  "dev": [],
  "dmz": {
    "cidr_block": null,
    "vswitches": []
  },
  "prod": []
}

If you have any problems when using this module, please opening a provider issue and let us know.

Note: There does not recommend opening an issue on this repo.

Created and maintained by Alibaba Cloud Terraform Team(terraform@alibabacloud.com).

MIT Licensed. See LICENSE for full details.

• Terraform-Provider-Alicloud Github
• Terraform-Provider-Alicloud Release
• Terraform-Provider-Alicloud Docs