Production-ready Terraform lab environments — Infrastructure as Code for learning, demonstrating, and testing the Aviatrix Cloud Native Security Fabric: Distributed Cloud Firewall, workload segmentation, and Zero Trust enforcement across AWS, Azure, and GCP.
Tip
🤖 Aviatrix Blueprints are Optimized for AI Coding Agents
Works great with Claude Code and Cursor — get AI-assisted deployment with prerequisite checks, cost estimates, and automated orchestration. The repo ships ready-to-use config for both (.claude/ and .cursor/), and every agent reads AGENTS.md / CLAUDE.md for project conventions.
Claude Code adds these guided skills:
| Skill | Description |
|---|---|
/deploy-blueprint |
Guided deployment with prerequisite validation |
/analyze-blueprint |
Resource inventory and cost estimates |
/validate-blueprint |
Pre-QA quality gate (Tier 1/2/3 checks) |
git clone https://github.com/AviatrixSystems/aviatrix-blueprints.git
cd aviatrix-blueprintsWith Claude Code: run claude in the repo, then use the guided skills:
/deploy-blueprint aws-eks-multicluster— Deploy with guided assistance/analyze-blueprint aws-eks-multicluster— Preview resources and costs before deploying/validate-blueprint aws-eks-multicluster— Run the pre-QA validation gate locally
With Cursor: open the folder in Cursor. It picks up .cursor/mcp.json and AGENTS.md automatically — just ask the agent to deploy, analyze, or validate a blueprint.
New contributor? See CONTRIBUTING.md for agent setup (MCP servers) and the clone-vs-fork workflow.
Blueprints are complete, deployable lab environments that demonstrate Aviatrix capabilities in real-world scenarios. Unlike reusable Terraform modules, blueprints are designed to be:
- Self-contained: Everything needed to deploy a working environment
- Educational: Clear documentation explaining what's being built and why
- Demonstrable: Built-in test scenarios for showcasing functionality
- Ephemeral: Designed for temporary use with easy cleanup
| Tier | Description | Requirements |
|---|---|---|
| Verified | Validated by Aviatrix QA team, tested against specific controller versions | Full QA and SE review, version compatibility matrix |
| Community | Contributed by the community, functional but not officially validated | Validated by an Aviatrix SE or Professional Services |
| Blueprint | Description | Cloud(s) | Tier | Status |
|---|---|---|---|---|
| aws-eks-multicluster | Multi-cluster EKS with Aviatrix transit and Distributed Cloud Firewall | AWS | Verified | ✅ Available |
| aws-eks-singlecluster | Single-cluster EKS spoke-in-a-box with DCF egress filtering; attach to any transit | AWS | Community | ✅ Available |
| azure-aks-multicluster | Multi-cluster AKS with Aviatrix transit and DCF (Cilium overlay, AppGW + NGINX two-tier ingress) | Azure | Verified | ✅ Available |
| azure-aks-singlecluster | Single AKS cluster spoke-in-a-box with DCF egress + threat prevention (Aviatrix 9.0 Single IP SNAT route-table selection) | Azure | Community | ✅ Available |
| prevent-lateral-movement-vm-tags | Zero Trust segmentation using DCF and VM tags to prevent lateral movement | AWS | Community | ✅ Available |
| zero-trust-segmentation | Zero Trust workload segmentation with DCF SmartGroups | AWS | Community | ✅ Available |
| k8s-cluster-aas | Pattern A — dedicated cluster per team (VPC-level isolation) | AWS, Azure, GCP | — | 🚧 Work in progress |
| k8s-namespace-aas | Pattern B — single shared cluster, namespace per team (DCF + RBAC isolation) | AWS, Azure, GCP | — | 🚧 Work in progress |
| k8s-prod-nonprod-hybrid | Pattern C — separate prod and nonprod clusters, namespace-as-a-service inside each | AWS, Azure, GCP | — | 🚧 Work in progress |
| agentcore-aws | AWS Bedrock AgentCore Runtime fronted by Aviatrix DCF | AWS | — | 🚧 Work in progress |
| azure-ai-foundry-security | Multi-layer blueprint: Azure AI Foundry agent environment with Aviatrix spoke gateway, DCF Zero Trust egress, private endpoints, optional P2S VPN, and rogue-agent DCF demo | Azure | Verified | ✅ Available |
| gh-actions-security | Multi-flavor blueprint: GitHub Actions self-hosted runners (VM and ARC/Kubernetes) on AWS and Azure secured by Aviatrix egress control and DCF FQDN allow-list | AWS, Azure | Verified | ✅ Available |
Before deploying any blueprint, ensure you have:
- An Aviatrix Enterprise or Aviatrix Cloud Control Plane deployed and accessible
- Terraform installed (v1.5+)
- Cloud provider CLI configured for your target cloud:
- Additional tools as required by specific blueprints (e.g., kubectl)
See the Prerequisites Overview for detailed setup instructions.
# Clone the repository
git clone https://github.com/AviatrixSystems/aviatrix-blueprints.git
cd aviatrix-blueprints
# Navigate to your chosen blueprint
cd blueprints/aws-eks-multicluster
# Review the README for specific requirements
cat README.md
# Copy and configure variables
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your values
# Deploy
terraform init
terraform plan
terraform applyMulti-layer blueprints (the k8s-* patterns and the *-multicluster blueprints) document their per-layer deploy and destroy order in the blueprint's own README.md.
Each blueprint includes:
- Architecture diagrams
- Step-by-step deployment instructions
- Test scenarios to validate functionality
- Demo walkthroughs for presentations
# Destroy all resources when done
terraform destroyaviatrix-blueprints/
├── docs/ # Documentation and guides
│ ├── prerequisites/ # Setup guides for required tools
│ ├── getting-started.md # Quick start guide
│ └── blueprint-standards.md
├── modules/ # Shared Terraform modules
├── blueprints/ # Deployable lab environments
│ ├── _template/ # Template for new blueprints
│ ├── aws-eks-multicluster/
│ ├── azure-aks-multicluster/
│ ├── k8s-cluster-aas/ # Multi-cloud Pattern A
│ ├── k8s-namespace-aas/ # Multi-cloud Pattern B
│ ├── k8s-prod-nonprod-hybrid/ # Multi-cloud Pattern C
│ └── ... # Additional blueprints
└── .github/ # CI/CD and templates
We welcome contributions! Whether you're fixing a bug, improving documentation, or adding a new blueprint, please see our Contributing Guide.
- Copy the blueprint template
- Follow the Blueprint Standards
- Run
/validate-blueprint <name>(or.github/scripts/validate-blueprint.sh blueprints/<name>) to confirm Tier 1/2 checks pass - Submit a PR for review
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Aviatrix Documentation: docs.aviatrix.com
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.