Zero-trust cloud, in four to six weeks.

# sonofgraig Cloud Architecture & DevOps engagement
# Network module — production VPC for af-south-1
# Terraform >= 1.6 · AWS provider >= 5.0

terraform {
  required_version = ">= 1.6"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

module "vpc" {
  source             = "terraform-aws-modules/vpc/aws"
  version            = "~> 5.5"

  name               = "${var.org}-${var.env}-vpc"
  cidr               = "10.0.0.0/16"
  azs                = ["af-south-1a", "af-south-1b", "af-south-1c"]

  private_subnets    = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets     = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
  database_subnets   = ["10.0.21.0/24", "10.0.22.0/24", "10.0.23.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = false   # multi-AZ NAT — production
  enable_vpn_gateway = false

  # POPIA s.72 — flow logs to detect cross-region egress
  enable_flow_log                       = true
  flow_log_destination_type             = "s3"
  flow_log_destination_arn              = aws_s3_bucket.flow_logs.arn
  flow_log_traffic_type                 = "ALL"
  flow_log_log_format                   = null

  tags = var.tags
}

# Region-lock SCP — applied at the org level via separate
# identity module. Prevents accidental provisioning in
# any region except af-south-1. Override requires explicit
# approval through the security team's IAM role.