Skip to content

Terraform Level 1, Task 5: Building a Dual-Stack (IPv4/IPv6) VPC

Today's task was a fantastic step into modern cloud networking. I went beyond creating a standard IPv4-only network and learned how to build a dual-stack VPC that supports both IPv4 and the newer IPv6 protocol. This is a critical skill, as the world is gradually transitioning to IPv6.

The most interesting part was learning how to leverage AWS to do the heavy lifting. Instead of choosing my own IPv6 range, I learned how to instruct AWS to automatically assign a globally unique IPv6 block to my VPC. This document is my detailed, beginner-friendly explanation of the entire process, breaking down the concepts and every line of code.

Table of Contents

The Task

My objective was to use Terraform to create a new AWS VPC that was enabled for IPv6. The specific requirements were: 1. All code had to be in a single main.tf file. 2. The VPC's name in AWS had to be xfusion-vpc. 3. It needed to be created in the us-east-1 region. 4. Crucially, it had to use the Amazon-provided IPv6 CIDR block.

My Step-by-Step Solution

The process followed the standard Terraform workflow, with one key addition to the code.

Phase 1: Writing the Code

In the /home/bob/terraform directory, I created my main.tf file. I wrote the following declarative code to define my dual-stack VPC.

# 1. Configure the AWS Provider to set the region
provider "aws" {
  region = "us-east-1"
}

# 2. Define the VPC Resource with both IPv4 and IPv6 enabled
resource "aws_vpc" "xfusion_vpc_resource" {
  # A VPC must always have a primary IPv4 CIDR block.
  cidr_block = "10.0.0.0/16"

  # This is the key argument for this task. It tells AWS to automatically
  # allocate and associate a unique /56 IPv6 CIDR block.
  assign_generated_ipv6_cidr_block = true

  # Tag the VPC with a human-readable name.
  tags = {
    Name = "xfusion-vpc"
  }
}

Phase 2: The Terraform Workflow

From my terminal in the same directory, I executed the three core commands.

  1. Initialize: This downloaded the AWS provider plugin. 

    terraform init

  2. Plan: The "dry run" output showed that Terraform intended to create one aws_vpc resource with the argument assign_generated_ipv6_cidr_block = true, which was exactly what I wanted. 

    terraform plan

  3. Apply: This command executed the plan. After I confirmed with yes, Terraform built my VPC in the cloud. 

    terraform apply
    The success message, Apply complete! Resources: 1 added, 0 changed, 0 destroyed., was my confirmation that the task was done.

Why Did I Do This? (The "What & Why")

- VPC (Virtual Private Cloud): This is my private network in the cloud, providing a secure and isolated environment for my resources. - IPv4 vs. IPv6: - IPv4: The original internet protocol. Its addresses are 32-bit (e.g., 172.16.238.10), and the world has essentially run out of available public IPv4 addresses. - IPv6: The next-generation protocol. Its addresses are 128-bit (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334) and provide a virtually limitless number of unique addresses. - Dual-Stack Networking: A "dual-stack" network is one that can handle both IPv4 and IPv6 traffic simultaneously. This is the modern standard, allowing for a smooth transition as the world slowly adopts IPv6. My task was to create such a network. - Amazon-Provided IPv6 CIDR: While I have to choose my private IPv4 range, AWS simplifies IPv6 by offering to assign a globally unique /56 IPv6 CIDR block from its own massive pool. This is the recommended approach for most use cases. - assign_generated_ipv6_cidr_block = true: This is the specific Terraform argument that enables this feature. It's a simple boolean flag that instructs Terraform to tell the AWS API to perform the automatic IPv6 allocation when creating the VPC.

Deep Dive: Decoding the aws_vpc Resource for Dual-Stack Networking

The code for this task was very similar to the last one, with the addition of one crucial line.

# The provider block configures the "aws" provider to work in the correct region.
provider "aws" {
  region = "us-east-1"
}

# This is the resource block that defines my VPC.
resource "aws_vpc" "xfusion_vpc_resource" {

  # The IPv4 CIDR block is still MANDATORY. An AWS VPC cannot be IPv6-only.
  # It must have a primary IPv4 range. I chose a standard private range.
  cidr_block = "10.0.0.0/16"

  # This is the new and most important argument for this task.
  # Setting this boolean flag to 'true' is the declarative way of saying:
  # "I want this VPC to have an IPv6 CIDR block, and I want AWS to pick one for me."
  assign_generated_ipv6_cidr_block = true

  # Standard tagging to give the VPC a recognizable name in the AWS Console.
  tags = {
    Name = "xfusion-vpc"
  }
}

Common Pitfalls

  • Forgetting the IPv4 CIDR Block: A very common mistake would be to assume that since the task is about IPv6, the IPv4 cidr_block is no longer needed. The AWS API requires every VPC to have a primary IPv4 CIDR, so leaving it out would cause Terraform to fail.

  • Typo in the Argument: The argument name assign_generated_ipv6_cidr_block is long and specific. A typo would cause a syntax error during the terraform plan phase.

  • Trying to Specify an IPv6 CIDR Manually: While possible, the task specifically asked for the "Amazon-provided" block. Trying to set an ipv6_cidr_block argument manually would have been incorrect for this specific task.

Exploring the Commands Used The workflow was the standard, three-step Terraform process:

  • terraform init: The first command to run. It prepared my working directory by downloading the aws provider plugin.

  • terraform plan: The "dry run" command. It read my code and showed me a detailed plan of what it would create: one aws_vpc resource with both the cidr_block and assign_generated_ipv6_cidr_block arguments set.

  • terraform apply: The command that executed the plan. It built the dual-stack VPC in my AWS account after I confirmed with yes.