> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Networks with the Aviatrix Cloud Terraform Provider

> Bring an existing AWS VPC or Azure or GCP VNet under Aviatrix Cloud management and enable egress inspection with the aviatrixsystems/avxcloud provider.

After you onboard a cloud account, register an existing VPC or VNet with
Aviatrix Cloud to bring it under management. You can then enable egress traffic
inspection on that network.

<Note>
  Complete [Configure the Aviatrix Cloud Terraform
  Provider](/docs/cloud/platform-administration/terraform/terraform-getting-started)
  and [Onboard Cloud Accounts to Aviatrix Cloud with
  Terraform](/docs/cloud/platform-administration/terraform/terraform-cloud-account)
  before following this guide.
</Note>

For all `avxcloud_network` and `avxcloud_network_inspection` arguments, see the
[provider documentation on the Terraform Registry](https://registry.terraform.io/providers/AviatrixSystems/avxcloud/latest/docs/resources/network).

## Prerequisites

Before you begin, confirm the following:

* You onboarded a cloud account as described in
  [Onboard Cloud Accounts to Aviatrix Cloud with Terraform](/docs/cloud/platform-administration/terraform/terraform-cloud-account).
* You have at least one existing VPC or VNet in that cloud account with a
  **public subnet** Aviatrix can use for gateway deployment.
* Your Terraform configuration includes `fabric_name` and references the
  onboarded cloud account by its computed `name` (for example,
  `avxcloud_cloud_account.account.name`).

<Tip>
  Deploy each VPC or VNet with subnets in at least two availability zones for
  high availability. Add one entry per subnet in the `subnets` list. See
  [Onboard VPCs or
  VNets](/docs/cloud/platform-administration/onboard-offboard/vpc-vnet-onboard)
  for console onboarding requirements.
</Tip>

## Step 1: Add Variables and Define the Network

Select your cloud provider. Add its variables to `variables.tf` with defaults
for your environment, and add the resource to `main.tf`. Reserve
`terraform.tfvars` for confidential values such as `api_access_key` as described
in
[Configure the Aviatrix Cloud Terraform Provider](/docs/cloud/platform-administration/terraform/terraform-getting-started).

<Tabs>
  <Tab title="AWS">
    Add to `variables.tf`:

    ```hcl theme={null}
    variable "network_display_name" {
      description = "Display name for the managed network in Aviatrix Cloud."
      type        = string
      default     = "prod-network"
    }

    variable "aws_vpc_id" {
      description = "ID of the AWS VPC to manage."
      type        = string
      default     = "vpc-0123456789abcdef0"
    }

    variable "aws_public_subnet_id" {
      description = "ID of a public subnet in the VPC."
      type        = string
      default     = "subnet-0123456789abcdef0"
    }
    ```

    Add to `main.tf`:

    ```hcl theme={null}
    resource "avxcloud_network" "this" {
      fabric            = var.fabric_name
      cloud_account     = avxcloud_cloud_account.account.name
      display_name      = var.network_display_name
      performance_class = "NETWORK_PERFORMANCE_CLASS_MEDIUM"

      aws = {
        vpc_id = var.aws_vpc_id

        subnets = [
          {
            public_subnet_id = var.aws_public_subnet_id
          }
        ]
      }
    }
    ```
  </Tab>

  <Tab title="Azure">
    Add to `variables.tf`:

    ```hcl theme={null}
    variable "network_display_name" {
      description = "Display name for the managed network in Aviatrix Cloud."
      type        = string
      default     = "prod-network"
    }

    variable "azure_vnet_id" {
      description = "Resource ID of the Azure VNet to manage."
      type        = string
      default     = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/prod-rg/providers/Microsoft.Network/virtualNetworks/prod-vnet"
    }

    variable "azure_subnet_id" {
      description = "Resource ID of a subnet in the VNet."
      type        = string
      default     = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/prod-rg/providers/Microsoft.Network/virtualNetworks/prod-vnet/subnets/subnet-1"
    }

    variable "azure_availability_zone" {
      description = "Availability zone for the subnet."
      type        = string
      default     = "1"
    }
    ```

    Add to `main.tf`:

    ```hcl theme={null}
    resource "avxcloud_network" "this" {
      fabric            = var.fabric_name
      cloud_account     = avxcloud_cloud_account.account.name
      display_name      = var.network_display_name
      performance_class = "NETWORK_PERFORMANCE_CLASS_MEDIUM"

      azure = {
        vnet_id = var.azure_vnet_id

        subnets = [
          {
            public_subnet_id  = var.azure_subnet_id
            availability_zone = var.azure_availability_zone
          }
        ]
      }
    }
    ```
  </Tab>

  <Tab title="GCP">
    Add to `variables.tf`:

    ```hcl theme={null}
    variable "network_display_name" {
      description = "Display name for the managed network in Aviatrix Cloud."
      type        = string
      default     = "prod-network"
    }

    variable "gcp_vpc_id" {
      description = "Self-link or ID of the GCP VPC network to manage."
      type        = string
      default     = "projects/my-gcp-project/global/networks/prod-vpc"
    }

    variable "gcp_subnet_id" {
      description = "Self-link or ID of a subnet in the VPC network."
      type        = string
      default     = "projects/my-gcp-project/regions/us-central1/subnetworks/subnet-1"
    }

    variable "gcp_zone" {
      description = "Availability zone for the subnet."
      type        = string
      default     = "us-central1-a"
    }
    ```

    Add to `main.tf`:

    ```hcl theme={null}
    resource "avxcloud_network" "this" {
      fabric            = var.fabric_name
      cloud_account     = avxcloud_cloud_account.account.name
      display_name      = var.network_display_name
      performance_class = "NETWORK_PERFORMANCE_CLASS_MEDIUM"

      gcp = {
        vpc_id = var.gcp_vpc_id

        subnets = [
          {
            public_subnet_id  = var.gcp_subnet_id
            availability_zone = var.gcp_zone
          }
        ]
      }
    }
    ```
  </Tab>
</Tabs>

<Note>
  `performance_class` sets the gateway instance size for the managed network.
  The example uses `NETWORK_PERFORMANCE_CLASS_MEDIUM`, which matches the
  recommended default in the Aviatrix Cloud console. See the [network resource
  schema](https://registry.terraform.io/providers/AviatrixSystems/avxcloud/latest/docs/resources/network)
  for other supported values.
</Note>

## Step 2: Enable Egress Inspection

To monitor and protect outbound internet traffic, add an
`avxcloud_network_inspection` resource to `main.tf`. Reference the network by
its computed `name` from `avxcloud_network`.

```hcl theme={null}
resource "avxcloud_network_inspection" "this" {
  fabric  = var.fabric_name
  network = avxcloud_network.this.name

  egress = {
    enabled = true
  }
}
```

For AWS east-west traffic inspection, you can optionally configure the
`aws_east_west` block. See the
[network\_inspection resource schema](https://registry.terraform.io/providers/AviatrixSystems/avxcloud/latest/docs/resources/network_inspection).

## Step 3: Apply Your Configuration

To preview and apply your configuration, follow these steps:

1. Open a terminal window and navigate to your working directory.

2. Optionally, format and validate your configuration:

   ```bash theme={null}
   terraform fmt
   terraform validate
   ```

3. If you have not initialized Terraform in this directory, run the following
   command:

   ```bash theme={null}
   terraform init
   ```

4. To preview the changes, run the following command:

   ```bash theme={null}
   terraform plan
   ```

5. To apply the changes, run the following command:

   ```bash theme={null}
   terraform apply
   ```

6. After the apply completes, verify that the network appears in the Aviatrix
   Cloud console under **Cloud Resources > Cloud Assets > VPC/VNets & Subnets**.
   If you enabled egress inspection, confirm the network appears under
   **Security > Egress > Protected VPC/VNets**.

## Outputs (Optional)

To print the name assigned to the network after apply, add the following to
`outputs.tf`:

```hcl theme={null}
output "network_name" {
  description = "Name assigned to the managed network."
  value       = avxcloud_network.this.name
}

output "network_inspection_name" {
  description = "Name assigned to the network inspection policy."
  value       = avxcloud_network_inspection.this.name
}
```

## Troubleshooting

<Expandable title="Provider and API connectivity">
  | Symptom | Resolution |
  | - | - |
  | `terraform init` cannot find or download the provider | Confirm the `source` is `aviatrixsystems/avxcloud` and that your workstation can reach the public Terraform Registry. |
  | Authentication fails or the API access key is rejected | Confirm `api_access_key` is set and current. Regenerate the key in the Aviatrix Cloud console if needed. |
  | Cannot reach `https://api.cloud.aviatrix.com` | Check connectivity, proxy, and firewall rules from the machine running Terraform. |

  <Warning>
    For provider errors, TLS problems, or other production issues, contact
    Aviatrix support.
  </Warning>
</Expandable>

<Expandable title="avxcloud_network apply failures">
  | Symptom | Resolution |
  | - | - |
  | `terraform validate` or `terraform plan` reports an undefined variable | Confirm every `var.<name>` reference has a matching `variable` block in `variables.tf`. Set `default` values for non-confidential variables, or supply confidential values through `terraform.tfvars`. |
  | Error referencing `fabric`, `cloud_account`, or invalid Fabric | Set `fabric` to the exact Fabric name in your Aviatrix Cloud account. Set `cloud_account` to the `name` output from `avxcloud_cloud_account`, not the display name. |
  | `terraform apply` succeeds but the network does not appear in the console | Confirm you are signed in to the correct Fabric. Check **Cloud Resources > Cloud Assets > VPC/VNets & Subnets**. Wait a few minutes and refresh the page. |
  | Subnet or VPC not eligible for onboarding | Aviatrix can manage only VPCs or VNets with public subnets. Confirm subnet IDs and that the resources exist in the onboarded cloud account. See [Onboard VPCs or VNets](/docs/cloud/platform-administration/onboard-offboard/vpc-vnet-onboard). |
  | Azure apply fails on subnet arguments | Each Azure subnet entry requires `public_subnet_id`. `availability_zone` is optional. |
  | GCP apply fails on subnet arguments | Each GCP subnet entry requires `public_subnet_id` and `availability_zone` (zone). |
</Expandable>

<Expandable title="avxcloud_network_inspection apply failures">
  | Symptom | Resolution |
  | - | - |
  | Error referencing `network` | Set `network` to the computed `name` from `avxcloud_network`, not `display_name`. Apply the network resource before the inspection resource. |
  | Egress inspection not visible in the console | Confirm `egress.enabled` is `true`. Check **Security > Egress > Protected VPC/VNets** after apply completes. |
  | East-west inspection fails on AWS | Confirm `aws_east_west` arguments match your route tables and scope requirements. See the [network\_inspection resource schema](https://registry.terraform.io/providers/AviatrixSystems/avxcloud/latest/docs/resources/network_inspection). |
</Expandable>

## Related Topics

* [Configure the Aviatrix Cloud Terraform Provider](/docs/cloud/platform-administration/terraform/terraform-getting-started)
* [Onboard Cloud Accounts to Aviatrix Cloud with Terraform](/docs/cloud/platform-administration/terraform/terraform-cloud-account)
* [Onboard VPCs or VNets](/docs/cloud/platform-administration/onboard-offboard/vpc-vnet-onboard)
* [Protect Your Traffic with Egress Security](/docs/cloud/security/egress-nat/about-egress-security)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.