title: Cannot create an Elastic Beanstalk application in a custom VPC using Terraform
body: <p>I am trying to create an Elastic Beanstalk application in a private subnet of a custom VPC using Terraform. The problem I have is that the creation hits a time-out.</p>
  <blockquote>
  <p>Error:</p>
  <p>Error waiting for Elastic Beanstalk Environment (e-xxxxxxxxx) to become ready: 2 errors occurred:</p>
  <ul>
  <li>2021-01-22 16:37:56.664 +0000 UTC (e-xxxxxxxxx) : Stack named 'awseb-e-xxxxxxxxx-stack' aborted operation. Current state: 'CREATE_FAILED'  Reason: The following resource(s) failed to create: [AWSEBInstanceLaunchWaitCondition].</li>
  <li>2021-01-22 16:37:56.791 +0000 UTC (e-xxxxxxxxx) : The EC2 instances failed to communicate with AWS Elastic Beanstalk, either because of configuration problems with the VPC or a failed EC2 instance. Check your VPC configuration and try launching the environment again.</li>
  </ul>
  </blockquote>
  <p>I think I am missing a connection from the VPC to the outside, but I'm not sure what.</p>
  <p>I have tried to add some <code>aws_vpc_endpoint</code> resources:</p>
  <pre><code>resource &quot;aws_vpc&quot; &quot;main&quot; {
    cidr_block = &quot;10.16.0.0/16&quot;
  
    enable_dns_support   = true
    enable_dns_hostnames = true
  }
  
  resource &quot;aws_security_group&quot; &quot;elasticbeanstalk_vpc_endpoint&quot; {
    name   = &quot;elasticbeanstalk-vpc-endpoint&quot;
    vpc_id = aws_vpc.main.id
  
    ingress {
      from_port   = 0
      to_port     = 65535
      protocol    = &quot;tcp&quot;
      cidr_blocks = [ &quot;0.0.0.0/0&quot; ]
    }
  
    egress {
      from_port   = 0
      to_port     = 65535
      protocol    = &quot;tcp&quot;
      cidr_blocks = [ &quot;0.0.0.0/0&quot; ]
    }
  }
  
  resource &quot;aws_vpc_endpoint&quot; &quot;elasticbeanstalk&quot; {
    vpc_id       = aws_vpc.main.id
    service_name = &quot;com.amazonaws.${var.aws_region}.elasticbeanstalk&quot;
  
    security_group_ids = [
      aws_security_group.elasticbeanstalk_vpc_endpoint.id,
    ]
  
    vpc_endpoint_type = &quot;Interface&quot;
  }
  
  resource &quot;aws_security_group&quot; &quot;ec2_vpc_endpoint&quot; {
    name   = &quot;ec2-vpc-endpoint&quot;
    vpc_id = aws_vpc.main.id
  
    ingress {
      from_port   = 0
      to_port     = 65535
      protocol    = &quot;tcp&quot;
      cidr_blocks = [ &quot;0.0.0.0/0&quot; ]
    }
  
    egress {
      from_port   = 0
      to_port     = 65535
      protocol    = &quot;tcp&quot;
      cidr_blocks = [ &quot;0.0.0.0/0&quot; ]
    }
  }
  
  resource &quot;aws_vpc_endpoint&quot; &quot;ec2&quot; {
    vpc_id       = aws_vpc.main.id
    service_name = &quot;com.amazonaws.${var.aws_region}.ec2&quot;
  
    security_group_ids = [
      aws_security_group.ec2_vpc_endpoint.id,
    ]
  
    vpc_endpoint_type = &quot;Interface&quot;
  }
  </code></pre>
  <p>EB instance:</p>
  <pre><code>resource &quot;aws_elastic_beanstalk_environment&quot; &quot;endpoint&quot; {
    name                = &quot;foo-env&quot;
  
    setting {
      namespace = &quot;aws:ec2:vpc&quot;
      name      = &quot;VPCId&quot;
      value     = aws_vpc.main.vpc_id
      resource  = &quot;&quot;
    }
  
    setting {
      namespace = &quot;aws:ec2:vpc&quot;
      name      = &quot;Subnets&quot;
      value     = join(&quot;,&quot;, [ aws_subnet.private_a.id, aws_subnet.private_b.id ])
      resource  = &quot;&quot;
    }
  
    setting {
      namespace = &quot;aws:ec2:vpc&quot;
      name      = &quot;ELBScheme&quot;
      value     = &quot;internal&quot;
      resource  = &quot;&quot;
    }
  
    setting {
      namespace = &quot;aws:elasticbeanstalk:environment&quot;
      name      = &quot;EnvironmentType&quot;
      value     = &quot;LoadBalanced&quot;
      resource  = &quot;&quot;
    }
  
    setting {
      namespace = &quot;aws:elasticbeanstalk:environment&quot;
      name      = &quot;LoadBalancerType&quot;
      value     = &quot;application&quot;
      resource  = &quot;&quot;
    }
  
    setting {
      namespace = &quot;aws:elasticbeanstalk:application:environment&quot;
      name      = &quot;AWS_REGION&quot;
      value     = var.aws_region
      resource  = &quot;&quot;
    }
  
    # ...
  
    depends_on = [
      aws_vpc_endpoint.ec2,
      aws_vpc_endpoint.elasticbeanstalk,
    ]
  }
  </code></pre>
  <hr />
  <p>Subnets created like this:</p>
  <pre><code>resource &quot;aws_subnet&quot; &quot;public&quot; {
    vpc_id     = aws_vpc.main.id
    cidr_block = &quot;10.16.0.0/24&quot;
  
    availability_zone       = &quot;${var.aws_region}c&quot;
    map_public_ip_on_launch = true
  }
  
  resource &quot;aws_subnet&quot; &quot;private_a&quot; {
    vpc_id     = aws_vpc.main.id
    cidr_block = &quot;10.16.192.0/24&quot;
  
    availability_zone = &quot;${var.aws_region}a&quot;
  }
  
  resource &quot;aws_subnet&quot; &quot;private_b&quot; {
    vpc_id     = aws_vpc.main.id
    cidr_block = &quot;10.16.224.0/24&quot;
  
    availability_zone = &quot;${var.aws_region}b&quot;
  }
  </code></pre>
  <p>Route tables:</p>
  <pre><code>resource &quot;aws_route_table&quot; &quot;private&quot; {
    vpc_id = aws_vpc.main.id
  }
  
  resource &quot;aws_route_table_association&quot; &quot;private_a&quot; {
    route_table_id = aws_route_table.private.id
    subnet_id      = aws_subnet.private_a.id
  }
  
  resource &quot;aws_route_table_association&quot; &quot;private_b&quot; {
    route_table_id = aws_route_table.private.id
    subnet_id      = aws_subnet.private_b.id
  }
  
  resource &quot;aws_route_table&quot; &quot;public&quot; {
    vpc_id = aws_vpc.main.id
  }
  
  resource &quot;aws_route_table_association&quot; &quot;public&quot; {
    route_table_id = aws_route_table.public.id
    subnet_id      = aws_subnet.public.id
  }
  
  resource &quot;aws_internet_gateway&quot; &quot;public&quot; {
    vpc_id = aws_vpc.main.id
  }
  
  resource &quot;aws_route&quot; &quot;public_internet&quot; {
    route_table_id = aws_route_table.public.id
    gateway_id     = aws_internet_gateway.public.id
  
    destination_cidr_block = &quot;0.0.0.0/0&quot;
  }
  </code></pre>