diff --git a/demo-9/instance.tf b/demo-9/instance.tf
index 9d41118..e615b01 100644
--- a/demo-9/instance.tf
+++ b/demo-9/instance.tf
@@ -2,6 +2,12 @@ resource "aws_instance" "example" {
   ami           = "${lookup(var.AMIS, var.AWS_REGION)}"
   instance_type = "t2.micro"
 
+  # the VPC subnet
+  subnet_id = "${aws_subnet.main-public-1.id}"
+
+  # the security group
+  vpc_security_group_ids = ["${aws_security_group.allow-ssh.id}"]
+
   # the public SSH key
   key_name = "${aws_key_pair.mykeypair.key_name}"
 }
diff --git a/demo-9/securitygroup.tf b/demo-9/securitygroup.tf
new file mode 100644
index 0000000..05c0e12
--- /dev/null
+++ b/demo-9/securitygroup.tf
@@ -0,0 +1,21 @@
+resource "aws_security_group" "allow-ssh" {
+  vpc_id = "${aws_vpc.main.id}"
+  name = "allow-ssh"
+  description = "security group that allows ssh and all egress traffic"
+  egress {
+      from_port = 0
+      to_port = 0
+      protocol = "-1"
+      cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+      from_port = 22
+      to_port = 22
+      protocol = "tcp"
+      cidr_blocks = ["0.0.0.0/0"]
+  } 
+tags {
+    Name = "allow-ssh"
+  }
+}
diff --git a/demo-9/vpc.tf b/demo-9/vpc.tf
new file mode 100644
index 0000000..1325feb
--- /dev/null
+++ b/demo-9/vpc.tf
@@ -0,0 +1,110 @@
+# Internet VPC
+resource "aws_vpc" "main" {
+    cidr_block = "10.0.0.0/16"
+    instance_tenancy = "default"
+    enable_dns_support = "true"
+    enable_dns_hostnames = "true"
+    enable_classiclink = "false"
+    tags {
+        Name = "main"
+    }
+}
+
+
+# Subnets
+resource "aws_subnet" "main-public-1" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.1.0/24"
+    map_public_ip_on_launch = "true"
+    availability_zone = "eu-west-1a"
+
+    tags {
+        Name = "main-public-1"
+    }
+}
+resource "aws_subnet" "main-public-2" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.2.0/24"
+    map_public_ip_on_launch = "true"
+    availability_zone = "eu-west-1b"
+
+    tags {
+        Name = "main-public-2"
+    }
+}
+resource "aws_subnet" "main-public-3" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.3.0/24"
+    map_public_ip_on_launch = "true"
+    availability_zone = "eu-west-1c"
+
+    tags {
+        Name = "main-public-3"
+    }
+}
+resource "aws_subnet" "main-private-1" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.4.0/24"
+    map_public_ip_on_launch = "false"
+    availability_zone = "eu-west-1a"
+
+    tags {
+        Name = "main-private-1"
+    }
+}
+resource "aws_subnet" "main-private-2" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.5.0/24"
+    map_public_ip_on_launch = "false"
+    availability_zone = "eu-west-1b"
+
+    tags {
+        Name = "main-private-2"
+    }
+}
+resource "aws_subnet" "main-private-3" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.6.0/24"
+    map_public_ip_on_launch = "false"
+    availability_zone = "eu-west-1c"
+
+    tags {
+        Name = "main-private-3"
+    }
+}
+
+# Internet GW
+resource "aws_internet_gateway" "main-gw" {
+    vpc_id = "${aws_vpc.main.id}"
+
+    tags {
+        Name = "main"
+    }
+}
+
+# route tables
+resource "aws_route_table" "main-public" {
+    vpc_id = "${aws_vpc.main.id}"
+    route {
+        cidr_block = "0.0.0.0/0"
+        gateway_id = "${aws_internet_gateway.main-gw.id}"
+    }
+
+    tags {
+        Name = "main-public-1"
+    }
+}
+
+# route associations public
+resource "aws_route_table_association" "main-public-1-a" {
+    subnet_id = "${aws_subnet.main-public-1.id}"
+    route_table_id = "${aws_route_table.main-public.id}"
+}
+resource "aws_route_table_association" "main-public-2-a" {
+    subnet_id = "${aws_subnet.main-public-2.id}"
+    route_table_id = "${aws_route_table.main-public.id}"
+}
+resource "aws_route_table_association" "main-public-3-a" {
+    subnet_id = "${aws_subnet.main-public-3.id}"
+    route_table_id = "${aws_route_table.main-public.id}"
+}