AWS VPC and network migration to STACKIT

Subnets keep their prefixes

A small estate written for this page and assessed by StackToIT on 4 November 2026. Left: the input. Right: the resource blocks of the STACKIT Terraform the engine wrote; the review comments that sit above each block in the file are left out here.

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private_a" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "eu-central-1a"
}

resource "aws_subnet" "private_b" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "eu-central-1b"
}

resource "stackit_network" "private_a" {
  project_id       = var.project_id
  name             = "private-a"
  ipv4_prefix      = "10.0.1.0/24"
  ipv4_nameservers = var.default_ipv4_nameservers
}

resource "stackit_network" "private_b" {
  project_id       = var.project_id
  name             = "private-b"
  ipv4_prefix      = "10.0.2.0/24"
  ipv4_nameservers = var.default_ipv4_nameservers
}

The community VPC module, converted

From the published AWS Retail Store run. Its subnets are computed from the availability zones, so their number and prefixes become variables you set once. The review comments above each block in the file are left out here.

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.21.0"

  name = var.environment_name
  cidr = var.vpc_cidr

  azs             = local.azs
  public_subnets  = local.public_subnets
  private_subnets = local.private_subnets

  enable_nat_gateway   = true
  create_igw           = true
  enable_dns_hostnames = true
  single_nat_gateway   = true

  # Manage so we can name
  manage_default_network_acl    = true
  default_network_acl_tags      = { Name = "${var.environment_name}-default" }
  manage_default_route_table    = true
  default_route_table_tags      = { Name = "${var.environment_name}-default" }
  manage_default_security_group = true
  default_security_group_tags   = { Name = "${var.environment_name}-default" }

  public_subnet_tags  = merge(var.tags, var.public_subnet_tags)
  private_subnet_tags = merge(var.tags, var.private_subnet_tags)

  tags = var.tags
}

resource "stackit_network" "vpc_vpc_private" {
  count            = var.private_count
  project_id       = var.project_id
  name             = "vpc-vpc-private-${count.index}"
  ipv4_prefix      = var.private_ipv4_prefixes[count.index]
  ipv4_nameservers = var.default_ipv4_nameservers
}

resource "stackit_network" "vpc_vpc_public" {
  count            = var.public_count
  project_id       = var.project_id
  name             = "vpc-vpc-public-${count.index}"
  ipv4_prefix      = var.public_ipv4_prefixes[count.index]
  ipv4_nameservers = var.default_ipv4_nameservers
}

How the network maps

Classes as the AWS Retail Store run decided them.

Decisions the run raises for your network team

• Egress address

  A NAT gateway gives a fixed egress address. On STACKIT the address is the network’s own, so StackToIT asks whether servers on allow lists get STACKIT public IPs.

• Private DNS

  Names that only the AWS VPC resolver answers need a DNS server of your own. StackToIT points out where the source relies on it.

• Project or Network Area

  Whether the target project sits in a Network Area changes routing and cluster placement, so the run records it as a decision before the pilot.

What the Retail Store network became

The community VPC module of the published run, resource group by resource group.

Counts from the published AWS Retail Store run; switched off means the source configuration does not create the resource.

More network decisions the run opens

All of them are due before the pilot and carry an owner.

• Workload placement (Network Architect)

  A Kubernetes Engine cluster is deployed into one network, and a database, cache or broker takes an access list and no network id. The options are one network for cluster and services, the source networks with placement by tier, a redesign, or consumers outside the network.

• Pod segmentation (Security Architect)

  The five service security groups cannot be proven to mean one thing on Kubernetes. The options are NetworkPolicy written from the group rules, a security group on the nodes, or no segmentation.

• Load balancer path (Network Architect)

  A target pool reaches targets by private IP, and the cluster exports no node address to Terraform. A workload is reachable through a node port or through an Ingress controller.

• Which network instance (Platform Architect)

  The load balancer refers to a repeated public network. Nothing in the source says which instance is meant, so no instance is assumed.

Questions network teams ask

Sources

• AWS Docs: What is Amazon VPC?
• STACKIT Docs: Core Networking
• STACKIT Docs: Network security