# AWS with Terraform Tutorial: AWS Internet Gateway (6) > How to configure and use the Terraform aws_internet_gateway resource block to create an AWS Internet Gateway that gives a VPC access to the Internet. - Source: https://www.itwonderlab.com/aws-terraform-tutorial-aws-internet-gateway/ - Published: 2024-01-22 - Updated: 2026-10-05 - Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/) - Site: IT Wonder Lab (https://www.itwonderlab.com/) --- ## How to Create, and Manage AWS Internet Gateway with Terraform **How to configure and use the Terraform `aws_internet_gateway` resource block to create and manage AWS Internet Gateway inside a VPC to enable Internet access to and from instances.** Welcome to our tutorial series where we dive into cloud infrastructure deployment using **[Terraform or OpenTofu on AWS](https://www.itwonderlab.com/tag/aws-terraform-essential-guide/)**. In this series, the fundamentals are shown, guiding you through the process of minimizing resource usage and simplifying the deployment complexities associated with cloud infrastructure. This comprehensive **OpenTofu and Terraform tutorial** guides you step-by-step through creating infrastructure in AWS using Terraform. ![Terraform Basics, AWS Basics, Terraform AWS Provider, AWS VPC, AWS Subnets, AWS Internet Gateway, AWS NAT Gateway, AWS Routing Tables, AWS Security Groups, AWS Key Pairs, AWS AMIs, AWS EC2 Instances, AWS RDS, AWS Route 53 (DNS), AWS Auto Scaling, AWS Load Balancers, Terraform AWS & Ansible, Terraform Modules, Terraform Backends, Terraform Tools, Terraform CI/CD.](https://www.itwonderlab.com/media/tutorials/AWS-Terraform-Essentials/ITWL-Tutorials-AWS-Terraform-Essentials-Steps.svg) Infrastructure as Code (IaC) helps maintain consistency, enables version control, enhances collaboration among teams, allows for easier replication of environments, streamlines the deployment and management of infrastructure boosting efficiency, and reducing errors in managing complex systems. ### Prerequisites Read the previous sections of the tutorial, listed in the [series index](#series) at the end of this page. ### AWS Internet Gateway ![AWS Internet Gateway](https://www.itwonderlab.com/media/AWS/2023/AWS_Internet_Gateway.svg) An [AWS Internet Gateway](https://www.itwonderlab.com/aws-internet-gateway/) is a component that facilitates communication between instances that have a public IP address within an Amazon Virtual Private Cloud (VPC) and the Internet. It acts as a gateway for internet-bound traffic, allowing resources within a VPC, like EC2 instances, to access the Internet and receive responses from Internet resources. AWS Instances that have been assigned a public IP are only aware of their private IP and require the Internet Gateway to do one-to-one NAT in case of IPV4 IPs. For IPV6, NAT is not needed but the Internet Gateway is still required. The Internet Gateway is assigned at the VPC level and AWS takes care of providing redundancy across availability zones. ![AWS Internet Gateway](https://www.itwonderlab.com/media/tutorials/AWS-Terraform-Essentials/ITWL-Tutorials-AWS-Terraform-Essentials-IG.svg) ### Terraform AWS Configuration Plan Definition Previous sections of this [AWS with Terraform guide](https://www.itwonderlab.com/tag/aws-terraform-essential-guide/) have covered basic information about Terraform and AWS and have configured and used the AWS Terraform provider to create a VPC and four subnets. It is time to create the **Internet Gateway**. Keep adding Terraform blocks to the `terraform-aws-tutorial.tf` created in previous sections. ### How to Create an AWS Internet Gateway with Terraform Internet Gateway definition using Terraform, add the following block to the file `terraform-aws-tutorial.tf`: ```yaml # Internet Gateway resource "aws_internet_gateway" "ditwl-ig" { vpc_id = aws_vpc.ditlw-vpc.id tags = { Name = "ditwl-ig" } } ``` The Terraform **aws\_internet\_gateway** resource block creates an Internet Gateway, named `ditwl-ig`, inside the VPC created in the previous tutorial, using its Terraform reference `aws_vpc.ditlw-vpc.id`. The aws\_internet\_gateway will be used as **a target** for the traffic leaving the VPC private network in the routing table for the Subnets. ### Run the Terraform Plan Open a command line shell in the directory where the file `terraform-aws-tutorial.tf` is located, and run the Terraform or OpenTofu `plan` and `apply` commands. #### Plan using OpenTofu Run `tofu plan` to generate and review the execution plan. Check each line and value to make sure that it corresponds to the desired change. The VPC and the Subnets were already created in the previous Terraform execution so now only the new Internet Gateway will be created. Terraform or OpenTofu show `Refreshing state` for each of the existing elements and the planned actions for the changes. ```shell $ tofu plan aws_vpc.ditlw-vpc: Refreshing state... [id=vpc-0bed1f6c715e9a909] aws_subnet.ditwl-sn-za-pro-pri-02: Refreshing state... [id=subnet-096bf79e4bab2e1c4] aws_subnet.ditwl-sn-zb-pro-pub-04: Refreshing state... [id=subnet-0d34cee7300e9fa45] aws_subnet.ditwl-sn-za-pro-pub-00: Refreshing state... [id=subnet-07753bf540026684d] aws_subnet.ditwl-sn-zb-pro-pri-06: Refreshing state... [id=subnet-0f5662bd40a070e55] OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # aws_internet_gateway.ditwl-ig will be created + resource "aws_internet_gateway" "ditwl-ig" { + arn = (known after apply) + id = (known after apply) + owner_id = (known after apply) + tags = { + "Name" = "ditwl-ig" } + tags_all = { + "Name" = "ditwl-ig" + "cost_center" = "marketing-department" + "environment" = "pro" + "owner" = "IT Wonder Lab" } + vpc_id = "vpc-0bed1f6c715e9a909" } Plan: 1 to add, 0 to change, 0 to destroy. ``` #### Apply the changes using OpenTofu Run `tofu apply` to generate and **apply** the execution plan. OpenTofu will generate a new plan and ask for confirmation before applying the changes. Review again the changes and answer yes or no to apply the changes in AWS. ```shell $ tofu apply aws_vpc.ditlw-vpc: Refreshing state... [id=vpc-0bed1f6c715e9a909] aws_subnet.ditwl-sn-zb-pro-pub-04: Refreshing state... [id=subnet-0d34cee7300e9fa45] aws_subnet.ditwl-sn-zb-pro-pri-06: Refreshing state... [id=subnet-0f5662bd40a070e55] aws_subnet.ditwl-sn-za-pro-pub-00: Refreshing state... [id=subnet-07753bf540026684d] aws_subnet.ditwl-sn-za-pro-pri-02: Refreshing state... [id=subnet-096bf79e4bab2e1c4] OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # aws_internet_gateway.ditwl-ig will be created + resource "aws_internet_gateway" "ditwl-ig" { + arn = (known after apply) + id = (known after apply) + owner_id = (known after apply) + tags = { + "Name" = "ditwl-ig" } + tags_all = { + "Name" = "ditwl-ig" + "cost_center" = "marketing-department" + "environment" = "pro" + "owner" = "IT Wonder Lab" } + vpc_id = "vpc-0bed1f6c715e9a909" } Plan: 1 to add, 0 to change, 0 to destroy. Do you want to perform these actions? OpenTofu will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes aws_internet_gateway.ditwl-ig: Creating... aws_internet_gateway.ditwl-ig: Creation complete after 3s [id=igw-033b206763b59357e] Apply complete! Resources: 1 added, 0 changed, 0 destroyed. ``` Review the result, it should be `1 (resource) added, 0 changed, 0 destroyed`. You can now run `tofu plan` or `tofu apply` again to check that OpenTofu has not found any new changes to apply. Check using the AWS web Console that the Internet Gateway has been created: - Navigate to [AWS Console: VPC – Internet gateways](https://us-east-1.console.aws.amazon.com/vpcconsole/home?region=us-east-1#igws:): If you don’t see the Internet gateway check on the right top corner that the Region is N. Virginia that corresponds to us-east-1. ### Common Questions About AWS Internet Gateways #### How many Internet Gateways should be created in each VPC? One, having one internet gateway per Virtual Private Cloud (VPC) is a common and effective setup. This design simplifies network management and ensures a clear point of entry and exit for Internet traffic. #### What are the Alternatives to the Internet Gateway for EC2 instances? The internet gateway is only needed to allow access in these scenarios: - Public Instances that require access from the instance to the Internet - Private Instances that require access from the instance to the Internet (an additional [NAT Gateway](https://www.itwonderlab.com/aws-nat-gateway/) is needed). - Public Instances that require to be accessed from the Internet directly (without using an Application Load Balancer). Other network topology options are available including hybrid cloud setups using VPNs or hub-and-spoke architecture for Internet access. #### Should Servers be directly exposed to the Internet using an Internet Gateway? Directly exposing servers, such as EC2 instances, to the internet poses several security risks: - **Security Vulnerabilities**: Exposed servers may have vulnerabilities that could be exploited by attackers. Without proper security measures, malicious actors can target these vulnerabilities to gain unauthorized access, potentially leading to data breaches or service disruptions. - **Increased Attack Surface**: Direct exposure expands the attack surface of your servers. Any service, application, or open port becomes a potential entry point for attackers. This increases the likelihood of successful attacks and compromises the overall security posture. - **Brute Force Attacks**: Exposed servers are susceptible to brute force attacks where attackers repeatedly attempt to guess usernames and passwords. If strong authentication measures are not in place, this can lead to unauthorized access. - **Lack of Network Segmentation**: Directly exposing servers may bypass network segmentation measures. Proper network segmentation is crucial for containing potential breaches and limiting the lateral movement of attackers within the network. - **Unprotected Services**: Services running on servers may not be properly protected or secured. Exposing these services directly to the internet increases the risk of exploitation, especially if default configurations or weak security practices are in place. - **Limited Visibility and Control**: Without a proper network architecture, monitoring, and control become challenging. Directly exposed servers may lack visibility into network traffic, making it harder to detect and respond to suspicious activities. - **Denial-of-Service (DoS) Attacks**: Exposed servers are more vulnerable to DoS attacks, where attackers flood the server with traffic to overwhelm and disrupt its normal operation. This can lead to service downtime and impact business operations. Alternatives for exposing servers to the Internet, like an [AWS Load Balancer](https://www.itwonderlab.com/aws-terraform-tutorial-aws-load-balancers/), are used in the next sections. See also [AWS Internet Gateway](https://www.itwonderlab.com/aws-internet-gateway/) and [AWS Route Tables](https://www.itwonderlab.com/aws-route-tables/). ### Next Steps Continue with [AWS NAT Gateway](https://www.itwonderlab.com/aws-terraform-tutorial-aws-nat-gateway/), or see the [full series index](#series).