can't access my instances by public IP in a VPC (aka: what is wrong with my terraform)?
Your default security groups and newly created security groups include default rules that do not enable you to access your instance from the Internet.
Add this:


resource "aws_security_group" "allow-ssh" {
  vpc_id = "${aws_vpc.vpc.id}"

  ingress {
    from_port = 0
    to_port = 22
    protocol = "tcp"
  }
}


Then add the line vpc_security_group_ids = [aws_security_group.allow-ssh.id] to the instance definitions.