Terraform AWS Elastic IP Allocation and Association Patterns

Creating a stable public identity for AWS resources is a common infrastructure requirement. An Elastic IP in AWS is a static IPv4 address designed for dynamic cloud computing. It is primarily used to provide a fixed, public IP address to an AWS resource, such as an EC2 instance, NAT gateway, or a Network Load Balancer. Unlike the standard public IP addresses assigned to EC2 instances, which may change if the instance is stopped and restarted, an Elastic IP remains associated with the account until it is explicitly released. Using Terraform, creating an Elastic IP entails specifying the resources required in a Terraform configuration file in order to create the EIP. A static IPv4 address intended for dynamic cloud computing is called an elastic IP. It is helpful in situations when you require a public IP address that is reliable and simple to link to or disconnect from instances within your AWS infrastructure.

What Elastic IP Is In AWS

An Elastic IP is a static IPv4 address designed for dynamic cloud computing. In Amazon Web Services, an Elastic IP is a static IPv4 address designed for dynamic cloud computing. It is primarily used to provide a fixed, public IP address to an AWS resource, such as an EC2 instance, NAT gateway, or a Network Load Balancer.

The address is portable within the AWS account. Association can be moved from one instance to another without reprovisioning. The address persists beyond instance stop start cycles. This makes it suitable for workloads that require consistent inbound connectivity, public facing services, and situations where DNS records should point to a stable IP.

Core Terraform Resources And Attributes

Terraform makes it simple to allocate EIPs and associate them with your instances.

The primary resource is aws_eip. The resource supports the following attributes:

• associatewithprivate_ip
• instance
• name
• network_interface
• publicipv4pool
• tags

The attribute table from module documentation shows:

The resource aws_eip.this is the typical name used in module outputs.

Provider Configuration And Security Considerations

The AWS provider declares that you're using the AWS provider for this Terraform configuration.

A minimal provider block is:

hcl provider "aws" { region = "us-east-1" }

The region specifies the AWS region where the resources will be provisioned. Change this to your desired region.

Access credentials can be provided via provider arguments:

hcl provider "aws" { region = "us-east-1" access_key = "<Provide Your Key" secret_key = "Provide Ypur Key" }

The accesskey and secretkey are AWS access and secret keys respectively. Replace with your actual AWS access and secret keys. Note that it's generally recommended to use IAM roles or AWS credentials file instead of hardcoding access and secret keys in Terraform configurations for security reasons.

The required providers block is often declared first:

hcl terraform { required_providers { aws = { source = "hashicorp/aws" } } }

Allocating An EIP With VPC Scope

Step 1: As seen in the image below, create a file with the name eip.tf and paste the following code into it.

A basic allocation for VPC use sets vpc = true.

hcl resource "aws_eip" "demo-eip" { vpc = true }

vpc = true indicates that this EIP is for use in VPC.

A more explicit example from reference material is:

hcl resource "aws_eip" "lb" { instance = "172.31.40.250" domain = "vpc" }

Script explanation:

• provider "aws" declare that you're using the AWS provider for this Terraform configuration.
• region = "us-east-1" specifies the AWS region where the resources will be provisioned. Change this to your desired region.
• accesskey and secretkey are AWS access and secret keys respectively. Replace with your actual AWS access and secret keys. Note that it's generally recommended to use IAM roles or AWS credentials file instead of hardcoding access and secret keys in Terraform configurations for security reasons.
• resource "aws_eip" "lb" declares an Elastic IP resource named "lb".
• instance = "172.31.40.250" specifies the instance ID to associate the Elastic IP with

The domain argument controls whether the allocation is for VPC or EC2 Classic.

Associating EIP With EC2 Instances

There are two ways in which you can do it.

Using the instance property of the awseip resource or by using the awseip_association resource.

1. Using the instance attribute of aws_eip

hcl resource "aws_eip" "demo-eip" { instance = aws_instance.demo-instance.id vpc = true }

For example, as you can see in the screenshot below, once we have added the instance property to aws_eip, the resource is modified and EIP is associated to the mentioned instance.

2. By using awseipassociation resource

hcl resource "aws_eip_association" "demo-eip-association" { instance_id = aws_instance.demo-instance.id allocation_id = aws_eip.demo-eip.id }

aws_eip_association is useful in scenarios where EIPs are either pre-existing or distributed to customers or users and therefore cannot be changed.

A full EC2 with EIP pattern:

```hcl
provider "aws" {
region = "us-east-1"
}

resource "awsvpc" "main" {
cidrblock = "10.0.0.0/16"
enablednshostnames = true
tags = {
Name = "main-vpc"
}
}

resource "awssubnet" "public" {
vpcid = awsvpc.main.id
cidrblock = "10.0.1.0/24"
availabilityzone = "us-east-1a"
mappublicipon_launch = false
tags = {
Name = "public-subnet"
}
}

resource "awsinternetgateway" "main" {
vpcid = awsvpc.main.id
tags = {
Name = "main-igw"
}
}

resource "awsroutetable" "public" {
vpcid = awsvpc.main.id
route {
cidrblock = "0.0.0.0/0"
gatewayid = awsinternetgateway.main.id
}
tags = {
Name = "public-rt"
}
}

resource "awsroutetableassociation" "public" {
subnetid = awssubnet.public.id
routetableid = awsroute_table.public.id
}

resource "awssecuritygroup" "web" {
nameprefix = "web-"
vpcid = awsvpc.main.id
ingress {
fromport = 22
toport = 22
protocol = "tcp"
cidrblocks = ["0.0.0.0/0"]
}
ingress {
fromport = 80
toport = 80
protocol = "tcp"
cidrblocks = ["0.0.0.0/0"]
}
egress {
fromport = 0
toport = 0
protocol = "-1"
cidrblocks = ["0.0.0.0/0"]
}
tags = {
Name = ""
}
}
```

Terraform makes it simple to allocate EIPs and associate them with your instances.

Basic EIP Association is the most straightforward setup is creating an EC2 instance and an Elastic IP, then associating them.

Terraform Module Interface For EIP

Terraform module to provisiong AWS Elastic IP.

The MIT License.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files, to deal in the Software without restriction.

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.

No modules.

Timeouts Import And Lifecycle Behavior

aws_eip provides the following Timeouts configuration options:

read

• Default 15 minutes
• How long to wait querying for information about EIPs.

update

• Default 5 minutes
• How long to wait for an EIP to be updated.

delete

• Default 3 minutes
• How long to wait for an EIP to be deleted.

EIPs in a VPC can be imported using their Allocation ID, e.g.

$ terraform import aws_eip.bar eipalloc-00a10e96

EIPs in EC2 Classic can be imported using their Public IP, e.g.

$ terraform import aws_eip.bar 52.0.0.0

Example End-To-End Configuration

The eip example launches a web server, installs nginx. It also creates security group.

To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html

Running the example

run terraform apply -var 'keyname={yourkey_name}'

Alternatively to using -var with each command, the terraform.template.tfvars file can be copied to terraform.tfvars and updated.

Give couple of mins for userdata to install nginx, and then type the Elastic IP from outputs in your browser and see the nginx welcome page

We will gradually add other resources to our configuration file.

Run terraform apply to create the EC2 resource. Enter yes when prompted as shown below and an EC2 resource is created for you as can be seen in the screenshot.

Step 3: Create an EIP

Add a resource to allocate an EIP for your AWS account.

hcl resource "aws_eip" "demo-eip" { vpc = true }

After adding an EIP resource and running terraform apply you can see that an EIP resource is created.

Step 4: Associate EIP to EC2 Instance

There are two ways in which you can do it.

Using the instance property of the awseip resource or by using the awseip_association resource.

You can change it based on your need. You can find AMI for your region by going to the AWS EC2 dashboard.

Conclusion

Elastic IP management in Terraform centers on allocation and association. Allocation creates a static public address in the account with aws_eip and scope control via vpc or domain. Association can be expressed inline via the instance argument or decoupled via aws_eip_association for pre-existing allocations. Provider configuration should avoid hardcoding credentials and prefer IAM roles. Timeouts for read, update and delete operations provide predictable wait behavior during state refreshes. Import workflows allow adoption of existing allocations by Allocation ID for VPC or Public IP for EC2 Classic. Module interfaces expose name, associatewithprivateip, instance, networkinterface, publicipv4pool and tags for reusable patterns. End-to-end examples combine VPC, subnet, internet gateway, route tables and security groups with EC2 and EIP to deliver a stable public endpoint.

Sources

1. https://www.geeksforgeeks.org/devops/how-to-create-elastic-ip-in-aws-using-terraform/
2. https://oneuptime.com/blog/post/2026-02-23-create-ec2-with-elastic-ip-in-terraform/view
3. https://github.com/Infrastrukturait/terraform-aws-eip
4. https://docs.w3cub.com/terraform/providers/aws/r/eip.html
5. https://github.com/hashicorp/terraform-provider-aws/blob/main/examples/eip/README.md
6. https://cloudkatha.com/how-to-attach-elastic-ip-to-ec2-instance-using-terraform/