after.tf

module "foo_vpc" {
  source         = "./vpc"
  region         = "ap-southeast-2"
  partner        = "foo"
  environment    = "production"
  cidr           = "10.0.0.0/16"
  public_offset  = 0
  private_offset = 2

  availability_zones = [
    "ap-southeast-2a",
    "ap-southeast-2b",
  ]
}

before.tf

resource "aws_vpc" "production" {
  provider             = "aws.sydney"
  cidr_block           = "10.0.0.0/16"
  instance_tenancy     = "default"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags {
    Name        = "production"
    Environment = "production"
    Partner     = "foo"
  }
}

resource "aws_subnet" "production-public-a" {
  provider          = "aws.sydney"
  vpc_id            = "${aws_vpc.production.id}"
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-southeast-2a"

  tags {
    Name        = "production-public-a"
    Environment = "production"
    Partner     = "foo"
  }
}

resource "aws_subnet" "production-public-b" {
  provider          = "aws.sydney"
  vpc_id            = "${aws_vpc.production.id}"
  cidr_block        = "10.0.2.0/24"
  availability_zone = "ap-southeast-2b"

  tags {
    Name        = "production-public-b"
    Environment = "production"
    Partner     = "foo"
  }
}

resource "aws_subnet" "production-private-a" {
  provider          = "aws.sydney"
  vpc_id            = "${aws_vpc.production.id}"
  cidr_block        = "10.0.3.0/24"
  availability_zone = "ap-southeast-2a"

  tags {
    Name        = "production-private-a"
    Environment = "production"
    Partner     = "foo"
  }
}

resource "aws_subnet" "production-private-b" {
  provider          = "aws.sydney"
  vpc_id            = "${aws_vpc.production.id}"
  cidr_block        = "10.0.4.0/24"
  availability_zone = "ap-southeast-2b"

  tags {
    Name        = "production-private-b"
    Environment = "production"
    Partner     = "foo"
  }
}

resource "aws_internet_gateway" "production" {
  provider = "aws.sydney"
  vpc_id   = "${aws_vpc.production.id}"

  tags {
    Name        = "production"
    Environment = "production"
    Partner     = "foo"
  }
}

resource "aws_route_table" "production-public" {
  provider = "aws.sydney"
  vpc_id   = "${aws_vpc.production.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.production.id}"
  }

  tags {
    Name        = "production-public"
    Environment = "production"
  }
}

resource "aws_route_table" "production-private" {
  provider = "aws.sydney"
  vpc_id   = "${aws_vpc.production.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.production.id}"
  }

  tags {
    Name        = "production-private"
    Environment = "production"
    Partner     = "foo"
  }
}

resource "aws_route_table_association" "production-public-a" {
  provider       = "aws.sydney"
  subnet_id      = "${aws_subnet.production-public-a.id}"
  route_table_id = "${aws_route_table.production-public.id}"
}

resource "aws_route_table_association" "production-public-b" {
  provider       = "aws.sydney"
  subnet_id      = "${aws_subnet.production-public-b.id}"
  route_table_id = "${aws_route_table.production-public.id}"
}

resource "aws_route_table_association" "production-private-a" {
  provider       = "aws.sydney"
  subnet_id      = "${aws_subnet.production-private-a.id}"
  route_table_id = "${aws_route_table.production-private.id}"
}

resource "aws_route_table_association" "production-private-b" {
  provider       = "aws.sydney"
  subnet_id      = "${aws_subnet.production-private-b.id}"
  route_table_id = "${aws_route_table.production-private.id}"
}

moves.sh

terraform state mv aws_vpc.production module.foo_vpc.aws_vpc.main
terraform state mv aws_subnet.production-public-a module.foo_vpc.aws_subnet.public[0]
terraform state mv aws_subnet.production-public-b module.foo_vpc.aws_subnet.public[1]
terraform state mv aws_subnet.production-private-a module.foo_vpc.aws_subnet.private[0]
terraform state mv aws_subnet.production-private-b module.foo_vpc.aws_subnet.private[1]
terraform state mv aws_internet_gateway.production module.foo_vpc.aws_internet_gateway.main
terraform state mv aws_route_table.production-public module.foo_vpc.aws_route_table.public
terraform state mv aws_route_table.production-private module.foo_vpc.aws_route_table.private
terraform state mv aws_route_table_association.production-public-a module.foo_vpc.aws_route_table_association.public[0]
terraform state mv aws_route_table_association.production-public-b module.foo_vpc.aws_route_table_association.public[1]
terraform state mv aws_route_table_association.production-private-a module.foo_vpc.aws_route_table_association.private[0]
terraform state mv aws_route_table_association.production-private-b module.foo_vpc.aws_route_table_association.private[1]

vpc-slash-main.tf

variable "region" {}

variable "partner" {}

variable "environment" {}

variable "availability_zones" {
  type = "list"
}

variable "cidr" {}

variable "public_offset" {
  default = 10
}

variable "private_offset" {
  default = 20
}

variable "az_letter_map" {
  default = {
    "0" = "a"
    "1" = "b"
    "2" = "c"
    "3" = "d"
    "4" = "e"
    "5" = "f"
    "6" = "g"
    "7" = "h"
    "8" = "i"
    "9" = "j"
  }
}

provider "aws" {
  alias  = "module"
  region = "${var.region}"
}

resource "aws_vpc" "main" {
  provider             = "aws.module"
  cidr_block           = "${var.cidr}"
  instance_tenancy     = "default"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags {
    Name        = "${var.partner}-${var.environment}"
    Partner     = "${var.partner}"
    Environment = "${var.environment}"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_dhcp_options" "main" {
  provider    = "aws.module"
  domain_name = "service.consul"

  domain_name_servers = [
    "${cidrhost(var.cidr, 2)}",
  ]

  tags {
    Name        = "${var.partner}-${var.environment}"
    Partner     = "${var.partner}"
    Environment = "${var.environment}"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_dhcp_options_association" "main" {
  provider        = "aws.module"
  vpc_id          = "${aws_vpc.main.id}"
  dhcp_options_id = "${aws_vpc_dhcp_options.main.id}"
}

resource "aws_subnet" "public" {
  provider          = "aws.module"
  vpc_id            = "${aws_vpc.main.id}"
  count             = "${length(var.availability_zones)}"
  cidr_block        = "${cidrsubnet(var.cidr, 8, count.index + var.public_offset + 1)}"
  availability_zone = "${element(var.availability_zones, count.index)}"

  tags {
    Name        = "${var.partner}-${var.environment}-public-${lookup(var.az_letter_map, count.index)}"
    Partner     = "${var.partner}"
    Environment = "${var.environment}"
    Type        = "public-${lookup(var.az_letter_map, count.index)}"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_subnet" "private" {
  provider          = "aws.module"
  vpc_id            = "${aws_vpc.main.id}"
  count             = "${length(var.availability_zones)}"
  cidr_block        = "${cidrsubnet(var.cidr, 8, count.index + var.private_offset + 1)}"
  availability_zone = "${element(var.availability_zones, count.index)}"

  tags {
    Name        = "${var.partner}-${var.environment}-private-${lookup(var.az_letter_map, count.index)}"
    Partner     = "${var.partner}"
    Environment = "${var.environment}"
    Type        = "private-${lookup(var.az_letter_map, count.index)}"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_internet_gateway" "main" {
  provider = "aws.module"
  vpc_id   = "${aws_vpc.main.id}"

  tags {
    Name        = "${var.partner}-${var.environment}"
    Partner     = "${var.partner}"
    Environment = "${var.environment}"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route_table" "public" {
  provider = "aws.module"
  vpc_id   = "${aws_vpc.main.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.main.id}"
  }

  tags {
    Name        = "${var.partner}-${var.environment}-public"
    Partner     = "${var.partner}"
    Environment = "${var.environment}"
    Type        = "public"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route_table" "private" {
  provider = "aws.module"
  vpc_id   = "${aws_vpc.main.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.main.id}"
  }

  tags {
    Name        = "${var.partner}-${var.environment}-private"
    Partner     = "${var.partner}"
    Environment = "${var.environment}"
    Type        = "private"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route_table_association" "public" {
  provider       = "aws.module"
  subnet_id      = "${element(aws_subnet.public.*.id, count.index)}"
  route_table_id = "${aws_route_table.public.id}"
  count          = "${length(var.availability_zones)}"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route_table_association" "private" {
  provider       = "aws.module"
  subnet_id      = "${element(aws_subnet.private.*.id, count.index)}"
  route_table_id = "${aws_route_table.private.id}"
  count          = "${length(var.availability_zones)}"

  lifecycle {
    create_before_destroy = true
  }
}

output "vpc_id" {
  value = "${aws_vpc.main.id}"
}

output "public_cidr_blocks" {
  value = ["${aws_subnet.public.*.cidr_block}"]
}

output "private_cidr_blocks" {
  value = ["${aws_subnet.private.*.cidr_block}"]
}

output "public_ids" {
  value = ["${aws_subnet.public.*.id}"]
}

output "private_ids" {
  value = ["${aws_subnet.private.*.id}"]
}