AWS Elastic IP Provisioning with Terraform

Creating and managing an Elastic IP in AWS using Terraform provides deterministic infrastructure as code for public IP addressing. An Elastic IP is a static IPv4 address designed for dynamic cloud computing. It is primarily used to provide a fixed, public IP address to an AWS resource, such as an EC2 instance, NAT gateway, or a Network Load Balancer. Unlike the standard public IP addresses assigned to EC2 instances, which may change if the instance is stopped and restarted, an Elastic IP remains associated with the account until it is explicitly released.

Using Terraform, creating an Elastic IP on AWS entails specifying the resources required in a Terraform configuration file in order to create the EIP. A static IPv4 address intended for dynamic cloud computing is called an elastic IP. It is helpful in situations when you require a public IP address that is reliable and simple to link to or disconnect from instances within your AWS infrastructure.

Core Concepts of AWS Elastic IP

An Elastic IP in Amazon Web Services is a static IPv4 address designed for dynamic cloud computing. It is primarily used to provide a fixed, public IP address to an AWS resource, such as an EC2 instance, NAT gateway, or a Network Load Balancer.

Key characteristics derived from reference usage are:

Persistence across instance stop/start
Association with VPC resources via domain = vpc
Optional association to an EC2 instance at creation time or via a separate association resource
Support for import by Allocation ID for VPC EIPs and by Public IP for EC2 Classic

Terraform AWS Provider Configuration

The AWS provider configuration declares that you're using the AWS provider for this Terraform configuration.

```hcl
required_providers {
aws = {
source = "hashicorp/aws"
}
}

provider "aws" {
region = "us-east-1"
accesskey = " secretkey = "Provide Ypur Key"
}
```

Region = "us-east-1" specifies the AWS region where the resources will be provisioned. Change this to your desired region.

Accesskey and secretkey are AWS access and secret keys respectively. Replace with your actual AWS access and secret keys. Note that it's generally recommended to use IAM roles or AWS credentials file instead of hardcoding access and secret keys in Terraform configurations for security reasons.

A basic EC2 and networking foundation for Elastic IP association can be built as follows:

```hcl
resource "awsvpc" "main" {
cidrblock = "10.0.0.0/16"
enablednshostnames = true
tags = {
Name = "main-vpc"
}
}

resource "awssubnet" "public" {
vpcid = awsvpc.main.id
cidrblock = "10.0.1.0/24"
availabilityzone = "us-east-1a"
mappublicipon_launch = false
tags = {
Name = "public-subnet"
}
}

resource "awsinternetgateway" "main" {
vpcid = awsvpc.main.id
tags = {
Name = "main-igw"
}
}

resource "awsroutetable" "public" {
vpcid = awsvpc.main.id
route {
cidrblock = "0.0.0.0/0"
gatewayid = awsinternetgateway.main.id
}
tags = {
Name = "public-rt"
}
}

resource "awsroutetableassociation" "public" {
subnetid = awssubnet.public.id
routetableid = awsroute_table.public.id
}
```

Security group allowing SSH and HTTP is commonly added:

hcl resource "aws_security_group" "web" { name_prefix = "web-" vpc_id = aws_vpc.main.id ingress { from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = } }

Creating an Elastic IP Resource

Step 1: As seen in the image below, create a file with the name eip.tf and paste the following code into it.

hcl resource "aws_eip" "lb" { instance = "172.31.40.250" domain = "vpc" }

Script Explanation:

provider "aws" declare that you're using the AWS provider for this Terraform configuration.
region = "us-east-1" specifies the AWS region where the resources will be provisioned. Change this to your desired region.
accesskey and secretkey are AWS access and secret keys respectively. Replace with your actual AWS access and secret keys. Note that it's generally recommended to use IAM roles or AWS credentials file instead of hardcoding access and secret keys in Terraform configurations for security reasons.
resource "aws_eip" "lb" declares an Elastic IP resource named "lb".
instance = "172.31.40.250" specifies the instance ID to associate the Elastic IP with

A minimal allocation without immediate association uses:

hcl resource "aws_eip" "demo-eip" { vpc = true }

Vpc = true indicates that this EIP is for use in VPC.

Association Patterns

There are two ways in which you can do it.

Using the instance property of the awseip resource or by using the awseip_association resource.

Using the instance attribute of aws_eip

hcl resource "aws_eip" "demo-eip" { instance = aws_instance.demo-instance.id vpc = true }

By using awseipassociation resource

hcl resource "aws_eip_association" "demo-eip-association" { instance_id = aws_instance.demo-instance.id allocation_id = aws_eip.demo-eip.id }

For example, as you can see in the screenshot below, once we have added the instance property to aws_eip, the resource is modified and EIP is associated to the mentioned instance.

Note: awseipassociation is useful in scenarios where EIPs are either pre-existing or distributed to customers or users and therefore cannot be changed

Terraform makes it simple to allocate EIPs and associate them with your instances.

Basic EIP Association is the most straightforward setup is creating an EC2 instance and an Elastic IP, then associating them.

Resource Attributes and Module Interface

A community module for provisioning AWS Elastic IP uses the following interface.

Name	Version
terraform	>= 0.14
aws	>= 2.0.0

No modules.

Name	Type
aws_eip.this	resource

Name	Description	Type	Default	Required
associatewithprivate_ip	A user specified primary or secondary private IP address to associate with the Elastic IP address. If no private IP address is specified, the Elastic IP address is associated with the primary private IP address.	string	null	no
instance	EC2 instance ID	string	null	no
name	Name of the EIP resource	string	n/a	yes
network_interface	Network interface ID to associate with	string	null	no
publicipv4pool	EC2 IPv4 address pool identifier or amazon. This option is only available for VPC EIPs.	string	null	no
tags	Map of tags to assign to bucket

The MIT License permits usage with the above conditions.

Timeouts and Import

aws_eip provides the following Timeouts configuration options:

Read

Default 15 minutes
How long to wait querying for information about EIPs.

Update

Default 5 minutes
How long to wait for an EIP to be updated.

Delete

Default 3 minutes
How long to wait for an EIP to be deleted.

EIPs in a VPC can be imported using their Allocation ID, e.g.

bash $ terraform import aws_eip.bar eipalloc-00a10e96

EIPs in EC2 Classic can be imported using their Public IP, e.g.

bash $ terraform import aws_eip.bar 52.0.0.0

Example Workflows

The eip example launches a web server, installs nginx. It also creates security group.

To run, configure your AWS provider as described in documentation.

Running the example

Run terraform apply -var 'keyname={yourkey_name}'

Alternatively to using -var with each command, the terraform.template.tfvars file can be copied to terraform.tfvars and updated.

Give couple of mins for userdata to install nginx, and then type the Elastic IP from outputs in your browser and see the nginx welcome page

You can change it based on your need. You can find AMI for your region by going to the AWS EC2 dashboard.

We will gradually add other resources to our configuration file.

Run terraform apply to create the EC2 resource. Enter yes when prompted as shown below and an EC2 resource is created for you as can be seen in the screenshot.

Step 3: Create an EIP

Add a resource to allocate an EIP for your AWS account.

Step 4: Associate EIP to EC2 Instance

There are two ways in which you can do it.

Conclusion

Provisioning an Elastic IP with Terraform is a deterministic process that replaces manual console allocation with versioned, repeatable configuration. The awseip resource captures allocation for VPC use with vpc = true or domain = "vpc", and supports direct association via instance or networkinterface at creation time. When separation of allocation and association is required, awseipassociation provides a decoupled approach for pre-existing EIPs or multi-tenant scenarios.

The provider configuration anchors the workflow with region selection and credential handling. Networking foundations such as VPC, subnet, internet gateway, route table, and security group enable reachable instances that benefit from a fixed public address. Timeouts for read, update, and delete operations ensure resilient state management during AWS API latency, and import commands allow adoption of existing EIPs into Terraform state via Allocation ID or Public IP.

Using a module interface standardizes parameters such as associatewithprivateip, instance, name, networkinterface, publicipv4pool, and tags, with Terraform >= 0.14 and AWS >= 2.0.0 as baseline requirements. The pattern of allocate then associate, optionally after EC2 provisioning and userdata installation, delivers a stable entry point for web servers, NAT gateways, and load balancer frontends while keeping IP stability independent of instance lifecycle.