Skip to content

Set up networking

All applications in an environment share a common network (VPC).

The default VPC for your environment set up by this guide is: {Environment}

Step 1: Add and configure the networking package

repo-iac/environments/dev/
ok pkg add networking

This creates networking/package-config.yml, which holds the settings for the package:

repo-iac/environments/dev/networking/package-config.yml
# yaml-language-server: $schema=...
StackName: "networking" # (1)!
networking-data.StackName: "networking-data"

VpcFlowLogs:
  Enable: true # (2)!
  1. The directory base name of the two stacks that ok pkg install creates. Leave them as they are.
  2. Records metadata about the IP traffic in the VPC and keeps it for 90 days. The logs help you troubleshoot connectivity and investigate security incidents.

The first line points to the file's schema, so editors with YAML support can autocomplete and check the settings.

The defaults work for a new environment. You can leave the file unchanged and go to Step 2.

Optional VPC endpoints

By default, traffic from your applications to AWS services such as ECR and CloudWatch goes through the NAT gateway and the internet. VPC endpoints keep that traffic inside the VPC. Some setups need them, such as a database bastion without internet access.

Add VpcEndpoints, set Enable to true, and turn on one endpoint per service. This example lets ECS tasks pull images from ECR and send logs to CloudWatch:

repo-iac/environments/dev/networking/package-config.yml
VpcEndpoints:
  Enable: true
  Ecr: true
  Dkr: true
  S3: true
  Logs: true

Every endpoint except S3 adds to your AWS bill. The networking template reference lists all the endpoints you can turn on.

Step 2: Install the package

repo-iac/environments/dev/networking/
ok pkg install

Step 3: Configure CIDR range

You must claim a range and document this in the Google doc created for this purpose. Each VPC must have a unique CIDR range within the Origo AWS organization.

Once you've claimed a range, edit config_override.tf and set the CIDR range:

repo-iac/environments/dev/networking/config_override.tf
vpc_cidr_block = "{value-chosen}"

Release CIDR block

The CIDR block must be released (removed from the Google doc) once the VPC is no longer in use.

Step 4: Apply in this order (required)

Order matters: Apply data first, then networking. The networking stack depends on resources created by the data stack.

1) Apply the data stack (required first)

Creates S3 buckets and other data resources.

repo-iac/environments/dev/networking-data/
terraform init
terraform apply

2) Apply the networking stack (run second)

Creates the VPC and networking resources.

repo-iac/environments/dev/networking/
terraform init
terraform apply

Step 5: Verify

Run the following command:

aws ec2 describe-vpcs | jq '.Vpcs[].Tags[]? | select(.Key == "Name") | .Value'

The output list should contain the name of the VPC you just created.

Login to the AWS console and navigate to VPC. Select Your VPCs in the left-hand menu.

The list should contain the name of the VPC you just created.

Commit your files

At this stage it is a good idea to commit your files.

One step of the Networking setup remains: the load balancer.

Next step

Set up load balancing.