Manage Networks with the Aviatrix Cloud Terraform Provider

After you onboard a cloud account, register an existing VPC or VNet with Aviatrix Cloud to bring it under management. You can then enable egress traffic inspection on that network.

Complete Configure the Aviatrix Cloud Terraform Provider and Onboard Cloud Accounts to Aviatrix Cloud with Terraform before following this guide.

For all avxcloud_network and avxcloud_network_inspection arguments, see the provider documentation on the Terraform Registry.

Prerequisites

Before you begin, confirm the following:

You onboarded a cloud account as described in Onboard Cloud Accounts to Aviatrix Cloud with Terraform.
You have at least one existing VPC or VNet in that cloud account with a public subnet Aviatrix can use for gateway deployment.
Your Terraform configuration includes fabric_name and references the onboarded cloud account by its computed name (for example, avxcloud_cloud_account.account.name).

Deploy each VPC or VNet with subnets in at least two availability zones for high availability. Add one entry per subnet in the subnets list. See Onboard VPCs or VNets for console onboarding requirements.

Step 1: Add Variables and Define the Network

Select your cloud provider. Add its variables to variables.tf with defaults for your environment, and add the resource to main.tf. Reserve terraform.tfvars for confidential values such as api_access_key as described in Configure the Aviatrix Cloud Terraform Provider.

AWS
Azure
GCP

Add to variables.tf:

variable "network_display_name" {
  description = "Display name for the managed network in Aviatrix Cloud."
  type        = string
  default     = "prod-network"
}

variable "aws_vpc_id" {
  description = "ID of the AWS VPC to manage."
  type        = string
  default     = "vpc-0123456789abcdef0"
}

variable "aws_public_subnet_id" {
  description = "ID of a public subnet in the VPC."
  type        = string
  default     = "subnet-0123456789abcdef0"
}

Add to main.tf:

resource "avxcloud_network" "this" {
  fabric            = var.fabric_name
  cloud_account     = avxcloud_cloud_account.account.name
  display_name      = var.network_display_name
  performance_class = "NETWORK_PERFORMANCE_CLASS_MEDIUM"

  aws = {
    vpc_id = var.aws_vpc_id

    subnets = [
      {
        public_subnet_id = var.aws_public_subnet_id
      }
    ]
  }
}

Add to variables.tf:

variable "network_display_name" {
  description = "Display name for the managed network in Aviatrix Cloud."
  type        = string
  default     = "prod-network"
}

variable "azure_vnet_id" {
  description = "Resource ID of the Azure VNet to manage."
  type        = string
  default     = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/prod-rg/providers/Microsoft.Network/virtualNetworks/prod-vnet"
}

variable "azure_subnet_id" {
  description = "Resource ID of a subnet in the VNet."
  type        = string
  default     = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/prod-rg/providers/Microsoft.Network/virtualNetworks/prod-vnet/subnets/subnet-1"
}

variable "azure_availability_zone" {
  description = "Availability zone for the subnet."
  type        = string
  default     = "1"
}

Add to main.tf:

resource "avxcloud_network" "this" {
  fabric            = var.fabric_name
  cloud_account     = avxcloud_cloud_account.account.name
  display_name      = var.network_display_name
  performance_class = "NETWORK_PERFORMANCE_CLASS_MEDIUM"

  azure = {
    vnet_id = var.azure_vnet_id

    subnets = [
      {
        public_subnet_id  = var.azure_subnet_id
        availability_zone = var.azure_availability_zone
      }
    ]
  }
}

Add to variables.tf:

variable "network_display_name" {
  description = "Display name for the managed network in Aviatrix Cloud."
  type        = string
  default     = "prod-network"
}

variable "gcp_vpc_id" {
  description = "Self-link or ID of the GCP VPC network to manage."
  type        = string
  default     = "projects/my-gcp-project/global/networks/prod-vpc"
}

variable "gcp_subnet_id" {
  description = "Self-link or ID of a subnet in the VPC network."
  type        = string
  default     = "projects/my-gcp-project/regions/us-central1/subnetworks/subnet-1"
}

variable "gcp_zone" {
  description = "Availability zone for the subnet."
  type        = string
  default     = "us-central1-a"
}

Add to main.tf:

resource "avxcloud_network" "this" {
  fabric            = var.fabric_name
  cloud_account     = avxcloud_cloud_account.account.name
  display_name      = var.network_display_name
  performance_class = "NETWORK_PERFORMANCE_CLASS_MEDIUM"

  gcp = {
    vpc_id = var.gcp_vpc_id

    subnets = [
      {
        public_subnet_id  = var.gcp_subnet_id
        availability_zone = var.gcp_zone
      }
    ]
  }
}

performance_class sets the gateway instance size for the managed network. The example uses NETWORK_PERFORMANCE_CLASS_MEDIUM, which matches the recommended default in the Aviatrix Cloud console. See the network resource schema for other supported values.

Step 2: Enable Egress Inspection

To monitor and protect outbound internet traffic, add an avxcloud_network_inspection resource to main.tf. Reference the network by its computed name from avxcloud_network.

resource "avxcloud_network_inspection" "this" {
  fabric  = var.fabric_name
  network = avxcloud_network.this.name

  egress = {
    enabled = true
  }
}

For AWS east-west traffic inspection, you can optionally configure the aws_east_west block. See the network_inspection resource schema.

Step 3: Apply Your Configuration

To preview and apply your configuration, follow these steps:

Open a terminal window and navigate to your working directory.
Optionally, format and validate your configuration:
terraform fmt terraform validate
If you have not initialized Terraform in this directory, run the following command:
terraform init
To preview the changes, run the following command:
terraform plan
To apply the changes, run the following command:
terraform apply
After the apply completes, verify that the network appears in the Aviatrix Cloud console under Cloud Resources > Cloud Assets > VPC/VNets & Subnets. If you enabled egress inspection, confirm the network appears under Security > Egress > Protected VPC/VNets.

Outputs (Optional)

To print the name assigned to the network after apply, add the following to outputs.tf:

output "network_name" {
  description = "Name assigned to the managed network."
  value       = avxcloud_network.this.name
}

output "network_inspection_name" {
  description = "Name assigned to the network inspection policy."
  value       = avxcloud_network_inspection.this.name
}

Troubleshooting

Show Provider and API connectivity

Symptom	Resolution
`terraform init` cannot find or download the provider	Confirm the `source` is `aviatrixsystems/avxcloud` and that your workstation can reach the public Terraform Registry.
Authentication fails or the API access key is rejected	Confirm `api_access_key` is set and current. Regenerate the key in the Aviatrix Cloud console if needed.
Cannot reach `https://api.cloud.aviatrix.com`	Check connectivity, proxy, and firewall rules from the machine running Terraform.

For provider errors, TLS problems, or other production issues, contact Aviatrix support.

Show avxcloud_network apply failures

Symptom	Resolution
`terraform validate` or `terraform plan` reports an undefined variable	Confirm every `var.<name>` reference has a matching `variable` block in `variables.tf`. Set `default` values for non-confidential variables, or supply confidential values through `terraform.tfvars`.
Error referencing `fabric`, `cloud_account`, or invalid Fabric	Set `fabric` to the exact Fabric name in your Aviatrix Cloud account. Set `cloud_account` to the `name` output from `avxcloud_cloud_account`, not the display name.
`terraform apply` succeeds but the network does not appear in the console	Confirm you are signed in to the correct Fabric. Check Cloud Resources > Cloud Assets > VPC/VNets & Subnets. Wait a few minutes and refresh the page.
Subnet or VPC not eligible for onboarding	Aviatrix can manage only VPCs or VNets with public subnets. Confirm subnet IDs and that the resources exist in the onboarded cloud account. See Onboard VPCs or VNets.
Azure apply fails on subnet arguments	Each Azure subnet entry requires `public_subnet_id`. `availability_zone` is optional.
GCP apply fails on subnet arguments	Each GCP subnet entry requires `public_subnet_id` and `availability_zone` (zone).

Show avxcloud_network_inspection apply failures

Symptom	Resolution
Error referencing `network`	Set `network` to the computed `name` from `avxcloud_network`, not `display_name`. Apply the network resource before the inspection resource.
Egress inspection not visible in the console	Confirm `egress.enabled` is `true`. Check Security > Egress > Protected VPC/VNets after apply completes.
East-west inspection fails on AWS	Confirm `aws_east_west` arguments match your route tables and scope requirements. See the network_inspection resource schema.

Getting Started

Security

Monitoring

Resource Groups

Best Practices

Platform Administration

Manage Networks with the Aviatrix Cloud Terraform Provider

Prerequisites

Step 1: Add Variables and Define the Network

Step 2: Enable Egress Inspection

Step 3: Apply Your Configuration

Outputs (Optional)

Troubleshooting

​Prerequisites

​Step 1: Add Variables and Define the Network

​Step 2: Enable Egress Inspection

​Step 3: Apply Your Configuration

​Outputs (Optional)

​Troubleshooting

​Related Topics

Prerequisites

Step 1: Add Variables and Define the Network

Step 2: Enable Egress Inspection

Step 3: Apply Your Configuration

Outputs (Optional)

Troubleshooting

Related Topics