AWS Secure Network Builder automates the creation of production-ready VPCs, tiered subnets, and hardened Security Groups based on YAML configuration files. Built with infrastructure-as-code principles, this tool eliminates manual AWS console clicks and enforces consistent security standards across deployments.

🏗️ VPC Automation
One-click deployment of VPCs with custom CIDR blocks and comprehensive tagging strategies.

🏛️ Tiered Architecture
Automatically creates Public (DMZ) and Private (App/Data) subnets across multiple Availability Zones for high availability.

🔒 Security First
Deploys "Zero Trust" Security Groups and strict Network ACLs by default, following AWS Well-Architected Framework principles.

🌐 Gateway Management
Intelligently provisions and configures Internet Gateways (IGW) and NAT Gateways with proper routing.

📊 State Tracking
Exports deployment state to JSON for comprehensive auditing, compliance reporting, or infrastructure teardown.

Ensure you have the following installed and configured:

• Python 3.9 or higher
• AWS CLI configured with appropriate credentials
• Boto3 library for AWS API interactions
• Active AWS account with VPC creation permissions

Clone the repository and install dependencies:

git clone https://github.com/yourusername/aws-secure-net.git
cd aws-secure-net
pip install -r requirements.txt

Or install dependencies manually:

pip install boto3 pyyaml

aws configure

Provide your AWS Access Key ID, Secret Access Key, default region, and output format when prompted.

aws-secure-net/
├── configs/                 # YAML configuration files
│   ├── prod-vpc.yaml       # Production environment config
│   ├── dev-vpc.yaml        # Development environment config
│   └── staging-vpc.yaml    # Staging environment config
├── logs/                   # Deployment and error logs
│   └── builder.log         # Main application log
├── modules/                # Modular Python components
│   ├── __init__.py
│   ├── vpc.py             # VPC creation and management
│   ├── security.py        # Security Groups and NACLs
│   ├── gateways.py        # IGW and NAT Gateway logic
│   └── utils.py           # Helper functions
├── output/                 # State files and deployment artifacts
│   └── vpc-state.json     # Resource ID mappings
├── tests/                  # Unit and integration tests
├── builder.py             # Main execution script
├── requirements.txt       # Python dependencies
├── .gitignore
├── LICENSE
└── README.md

The following diagram illustrates the complete automation flow from configuration loading to AWS resource provisioning:

%%{init: {'theme':'base', 'themeVariables': { 'primaryColor':'#FF9900','primaryTextColor':'#232F3E','primaryBorderColor':'#232F3E','lineColor':'#545B64','secondaryColor':'#146EB4','tertiaryColor':'#fff','fontSize':'16px'}}}%%
graph TD
    Start([🚀 Start Builder]) --> LoadConfig[/📄 Load config.yaml/]
    LoadConfig --> ValidateCreds{🔐 Validate AWS<br/>Credentials}
    
    ValidateCreds -->|❌ Failed| LogError[⚠️ Log Error & Exit]
    ValidateCreds -->|✅ Success| InitSession[Initialize Boto3 Session]
    
    InitSession --> CreateVPC[Create VPC & Apply Tags]
    CreateVPC --> CreateIGW[Create Internet Gateway]
    CreateIGW --> CreateRT[Create Route Tables<br/>Public & Private]
    
    CreateRT --> LoopSubnets[🔄 Loop Through Subnets]
    LoopSubnets --> CheckType{Subnet Type?}
    
    CheckType -->|🌐 Public| AssocIGW[Associate with IGW<br/>Route Table]
    CheckType -->|🔒 Private| AssocNAT[Associate with NAT<br/>Route Table]
    
    AssocIGW --> ApplySecurity[Apply NACLs &<br/>Security Groups]
    AssocNAT --> ApplySecurity
    
    ApplySecurity --> LogResources[📝 Log Resource IDs]
    LogResources --> MoreResources{More Subnets<br/>to Create?}
    
    MoreResources -->|Yes| LoopSubnets
    MoreResources -->|No| ExportState[💾 Export State to JSON<br/>output/ directory]
    ExportState --> End([✅ Deployment Complete])
    
    LogError --> End

    classDef startEnd fill:#FF9900,stroke:#232F3E,stroke-width:3px,color:#fff
    classDef process fill:#146EB4,stroke:#232F3E,stroke-width:2px,color:#fff
    classDef decision fill:#EC7211,stroke:#232F3E,stroke-width:2px,color:#fff
    classDef input fill:#527FFF,stroke:#232F3E,stroke-width:2px,color:#fff
    classDef critical fill:#D13212,stroke:#232F3E,stroke-width:2px,color:#fff
    classDef success fill:#1D8102,stroke:#232F3E,stroke-width:2px,color:#fff
    
    class Start,End startEnd
    class InitSession,CreateVPC,CreateIGW,CreateRT,AssocIGW,AssocNAT,ApplySecurity,LogResources,ExportState process
    class ValidateCreds,CheckType,MoreResources decision
    class LoadConfig input
    class LogError critical
    class LoopSubnets success

Create a YAML configuration file in the configs/ directory. Here's a comprehensive example:

# configs/prod-secure-vpc.yaml
vpc_name: "prod-secure-network"
cidr: "10.0.0.0/16"
region: "us-east-1"
enable_dns_hostnames: true
enable_dns_support: true

tags:
  Environment: "Production"
  ManagedBy: "AWS-Secure-Builder"
  CostCenter: "Engineering"

subnets:
  # Public Subnets (DMZ Layer)
  - name: "public-web-1a"
    cidr: "10.0.1.0/24"
    type: "public"
    az: "us-east-1a"
    
  - name: "public-web-1b"
    cidr: "10.0.2.0/24"
    type: "public"
    az: "us-east-1b"
  
  # Private Subnets (Application Layer)
  - name: "private-app-1a"
    cidr: "10.0.10.0/24"
    type: "private"
    az: "us-east-1a"
    
  - name: "private-app-1b"
    cidr: "10.0.11.0/24"
    type: "private"
    az: "us-east-1b"
  
  # Private Subnets (Database Layer)
  - name: "private-db-1a"
    cidr: "10.0.20.0/24"
    type: "private"
    az: "us-east-1a"
    
  - name: "private-db-1b"
    cidr: "10.0.21.0/24"
    type: "private"
    az: "us-east-1b"

nat_gateway:
  enabled: true
  availability_zone: "us-east-1a"

security_groups:
  web_tier:
    - protocol: "tcp"
      from_port: 443
      to_port: 443
      cidr: "0.0.0.0/0"
    - protocol: "tcp"
      from_port: 80
      to_port: 80
      cidr: "0.0.0.0/0"

Run the deployment script with your configuration file:

python3 builder.py --config configs/prod-secure-vpc.yaml

Advanced Options:

# Dry-run mode (validate without deploying)
python3 builder.py --config configs/prod-secure-vpc.yaml --dry-run

# Verbose logging
python3 builder.py --config configs/prod-secure-vpc.yaml --verbose

# Specify custom output directory
python3 builder.py --config configs/prod-secure-vpc.yaml --output-dir ./custom-output

Check the output state file:

cat output/prod-secure-network-state.json

Verify in AWS Console:

Navigate to AWS Console → VPC Dashboard to inspect your newly created infrastructure components.

Using AWS CLI:

aws ec2 describe-vpcs --filters "Name=tag:Name,Values=prod-secure-network"

Remove all created resources using the state file:

python3 builder.py --teardown --state-file output/prod-secure-network-state.json

Deploy the same architecture across multiple regions:

python3 builder.py --config configs/prod-secure-vpc.yaml --regions us-east-1,us-west-2,eu-west-1

Example GitHub Actions workflow:

name: Deploy AWS Network

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'
      - name: Install dependencies
        run: pip install -r requirements.txt
      - name: Deploy VPC
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: python3 builder.py --config configs/prod-secure-vpc.yaml

This tool implements several security-hardening measures:

• Principle of Least Privilege: Security Groups deny all traffic by default
• Network Segmentation: Clear separation between public, application, and data tiers
• Encrypted Communications: VPC Flow Logs enabled by default
• Audit Trail: All resource creation logged with timestamps and user context
• Immutable Infrastructure: State files enable consistent, repeatable deployments

Your AWS user/role needs the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpc",
        "ec2:CreateSubnet",
        "ec2:CreateInternetGateway",
        "ec2:CreateNatGateway",
        "ec2:CreateRouteTable",
        "ec2:CreateSecurityGroup",
        "ec2:CreateNetworkAcl",
        "ec2:CreateTags",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:AllocateAddress"
      ],
      "Resource": "*"
    }
  ]
}

We welcome contributions from the community! Whether it's bug fixes, feature enhancements, or documentation improvements, your help makes this tool better for everyone.

1. Fork the repository on GitHub
2. Create a feature branch from main:

   git checkout -b feature/add-vpn-support

3. Make your changes with clear, descriptive commits
4. Add tests for new functionality
5. Update documentation as needed
6. Push your branch and open a Pull Request

# Clone your fork
git clone https://github.com/yourusername/aws-secure-net.git
cd aws-secure-net

# Create virtual environment
python3 -m venv venv
source venv/bin/activate

# Install development dependencies
pip install -r requirements-dev.txt

# Run tests
pytest tests/

We follow PEP 8 guidelines. Please run linting before submitting:

flake8 modules/ builder.py
black modules/ builder.py

Found a bug? Open an issue on GitHub Issues

Have questions? Start a discussion in GitHub Discussions

Need enterprise support? Contact us at [email protected]

Planned features for future releases:

• ⬜ VPN Gateway support
• ⬜ Transit Gateway integration
• ⬜ VPC Peering automation
• ⬜ AWS Organizations support
• ⬜ Terraform state file export
• ⬜ CloudFormation template generation
• ⬜ Cost estimation before deployment
• ⬜ Compliance scanning (CIS, PCI-DSS)

Built with ❤️ using:

• Boto3 - AWS SDK for Python
• PyYAML - YAML parser and emitter
• Click - Command-line interface creation kit

Special thanks to all contributors who have helped shape this project!