frostmoln_vpc (Resource)

Manages a VPC in the Frostmoln Cloud Platform.

A VPC created through Terraform is an ISOLATED network until a frostmoln_gateway is declared for it. This resource deliberately carries no connectivity choice: in Terraform the choice IS the presence, absence and mode of that separate resource, so a VPC with no frostmoln_gateway has no outbound internet path — and no inbound one either.

Platform DNS resolution and managed-service control-plane connectivity are reached over routes that exist only while the gateway does, so they are absent too. Instances in a gateway-less VPC cannot resolve names and cannot fetch anything from the internet — which is what makes a user_data cloud-init step that installs packages or calls an external endpoint fail on first boot. A managed database, cache or message broker that is deployed INTO this VPC still answers on its private address: that traffic stays inside the VPC and never crosses the gateway, though reaching it by name does need DNS. This is not a fault to diagnose; it is what a VPC is before its outbound path is declared.

Declare a frostmoln_gateway with vpc_id set to this VPC to give it that path — see the example below and the frostmoln_gateway resource. Connectivity is a stated choice, never one a VPC acquires because a field was omitted.

One thing to know before you conclude the gateway is missing: associating a public IP with an instance in the VPC makes the platform attach a gateway implicitly, because a public IP cannot work without one. Egress then starts working for the WHOLE VPC, not just that instance, and the gateway reports origin = "implicit_public_ip". It is a real gateway that Terraform did not declare — so prefer declaring frostmoln_gateway explicitly, and see that resource for how an implicit gateway and an explicit one interact.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Enacted and reconciled — every configurable attribute not listed below: the platform applies it, and a refresh reads the truth back.

Create-immutable — cidr: the platform does not renumber a VPC in place.

Observed, not enacted — tags_all: keys set outside Terraform — in the portal, by the fm CLI, or stamped by the platform — appear only here and are kept on every apply, never removed.

Platform-invented default — the tenant's default VPC (is_default): keep-with-docs. Readable as the computed is_default; no default_* resource exists to adopt it today.

Example Usage

# An ISOLATED VPC. This is what a VPC is on its own: no outbound internet, no
# inbound, and — because they are reached over the same path — no platform DNS
# resolution and no managed-service connectivity either. Nothing is missing from
# this configuration; a VPC simply has no connectivity until one is declared for
# it, and there is no argument here that turns it on.
resource "frostmoln_vpc" "isolated" {
  name        = "isolated-vpc"
  description = "Backend VPC with no internet path"
  cidr        = "10.1.0.0/16"

  tags = {
    environment = "production"
  }
}

# A CONNECTED VPC. The outbound path is its own resource, frostmoln_gateway,
# pointed at the VPC. Declare it and instances in the VPC get internet egress,
# platform DNS resolution and managed-service connectivity; leave it out and they
# get none of the three — which is what makes a cloud-init step that installs
# packages or calls an external endpoint fail on first boot.
resource "frostmoln_vpc" "example" {
  name        = "production-vpc"
  description = "Production VPC"
  cidr        = "10.0.0.0/16"

  tags = {
    environment = "production"
  }
}

resource "frostmoln_gateway" "example" {
  vpc_id = frostmoln_vpc.example.id
  mode   = "public_ip"
}

# With no public_ip_id the platform draws the gateway an address itself — fine
# when nothing outside the VPC needs to know what its traffic comes from. Name a
# frostmoln_public_ip instead when a partner allow-list or a DNS record does.
# See the frostmoln_gateway resource for that, and for the
# acknowledge_connectivity_loss guard that removing a gateway requires.

# tags holds only what this configuration sets; tags_all adds the provider's
# default_tags and any tag set outside this configuration.
output "production_vpc_tags" {
  value = frostmoln_vpc.example.tags_all
}

Schema

Required

• cidr (String) The CIDR block for the VPC.
• name (String) The name of the VPC.

Optional

• description (String) A description of the VPC.
• tags (Map of String) Tags for the VPC. Merged with the provider's default_tags on every write (a key set here wins). Holds only the keys this configuration sets; the full set is in tags_all.
• timeouts (Block, Optional) (see below for nested schema)

Read-Only

• created_at (String) The creation timestamp.
• id (String) The unique identifier of the VPC.
• is_default (Boolean) Whether this is the default VPC.
• status (String) The status of the VPC.
• subnet_count (Number) The number of subnets in the VPC.
• tags_all (Map of String) Every tag the platform holds on this resource: the provider's default_tags, this resource's own tags (which win on a shared key), and any key set outside Terraform — in the portal, by the fm CLI, or stamped by the platform. Keys set outside Terraform appear only here and are kept on every apply, never removed.
• updated_at (String) The last update timestamp.

Nested Schema for timeouts

Optional:

• create (String) How long the provider waits for the create operation to converge before giving up (e.g. "45m", "2h").
• delete (String) How long the provider waits for the delete to complete before giving up (e.g. "30m").
• update (String) How long the provider waits for an update (resize, in-place change) to converge before giving up (e.g. "30m").