> **Page index:** https://km.oslo.systems/llms.txt lists every page on this site, with a link to its Markdown version.

# Set up networking

All applications in an environment share a common network (VPC).

The default VPC for your environment set up by this guide is: `{Environment}`

## Step 1: Add and configure the `networking` package

repo-iac/environments/dev/

```
ok pkg add networking
```

This creates `networking/package-config.yml`, which holds the settings for the package:

repo-iac/environments/dev/networking/package-config.yml

```
# yaml-language-server: $schema=...
StackName: "networking" # (1)!
networking-data.StackName: "networking-data"

VpcFlowLogs:
  Enable: true # (2)!
```

1. The directory base name of the two stacks that `ok pkg install` creates. Leave them as they are.
2. Records metadata about the IP traffic in the VPC and keeps it for 90 days. The logs help you troubleshoot connectivity and investigate security incidents.

The first line points to the file's schema, so editors with YAML support can autocomplete and check the settings.

The defaults work for a new environment. You can leave the file unchanged and go to Step 2.

> [!TIP]
>
> **Optional VPC endpoints**
>
> By default, traffic from your applications to AWS services such as ECR and CloudWatch goes through the NAT gateway and the internet. VPC endpoints keep that traffic inside the VPC. Some setups need them, such as [a database bastion without internet access](<https://km.oslo.systems/database/connect-to-a-database-from-your-computer/#step-2-harden-container-security-with-vpc-endpoints-optional>).
>
> Add `VpcEndpoints`, set `Enable` to `true`, and turn on one endpoint per service. This example lets ECS tasks pull images from ECR and send logs to CloudWatch:
>
> repo-iac/environments/dev/networking/package-config.yml
>
> ```
> VpcEndpoints:
>   Enable: true
>   Ecr: true
>   Dkr: true
>   S3: true
>   Logs: true
> ```
>
> Every endpoint except `S3` adds to your AWS bill. The [`networking` template reference](<https://km.oslo.systems/networking/templates/networking/index.md>) lists all the endpoints you can turn on.

## Step 2: Install the package

repo-iac/environments/dev/networking/

```
ok pkg install
```

## Step 3: Configure CIDR range

You must claim a range and document this in the [Google doc](<https://docs.google.com/spreadsheets/d/1Ly-gVkakvZ2ZtcS3aDb0E2ZYOMEFUb6fE3Ma7mVsVKI/edit?gid=0#gid=0>) created for this purpose. Each VPC must have a unique CIDR range within the Origo AWS organization.

Once you've claimed a range, edit `config_override.tf` and set the CIDR range:

repo-iac/environments/dev/networking/config\_override.tf

```
vpc_cidr_block = "{value-chosen}"
```

> [!NOTE]
>
> **Release CIDR block**
>
> The CIDR block must be released (removed from the Google doc) once the VPC is no longer in use.

## Step 4: Apply in this order (required)

**Order matters:** Apply **data first**, then **networking**. The **networking stack depends on resources** created by the data stack.

### 1\) Apply the data stack (required first)

Creates S3 buckets and other data resources.

repo-iac/environments/dev/networking-data/

```
terraform init
terraform apply
```

### 2\) Apply the networking stack (run second)

Creates the VPC and networking resources.

repo-iac/environments/dev/networking/

```
terraform init
terraform apply
```

## Step 5: Verify

Run the following command:

```
aws ec2 describe-vpcs | jq '.Vpcs[].Tags[]? | select(.Key == "Name") | .Value'
```

The output list should contain the name of the VPC you just created.

Login to the AWS console and navigate to **VPC**. Select **Your VPCs** in the left-hand menu.

The list should contain the name of the VPC you just created.

---

> [!TIP]
>
> **Commit your files**
>
> At this stage it is a good idea to commit your files.

One step of the Networking setup remains: the load balancer.

## Next step

Set up [load balancing](<https://km.oslo.systems/initial-setup-of-your-aws-environment/set-up-load-balancing/index.md>).