diff --git a/demo-17/elasticbeanstalk.tf b/demo-17/elasticbeanstalk.tf
index 7ef7cb7..0aad060 100644
--- a/demo-17/elasticbeanstalk.tf
+++ b/demo-17/elasticbeanstalk.tf
@@ -25,7 +25,7 @@ resource "aws_elastic_beanstalk_environment" "app-prod" {
   setting {
     namespace = "aws:autoscaling:launchconfiguration"
     name = "IamInstanceProfile"
-    value = "app-ec2-role"
+    value = "${aws_iam_instance_profile.app-ec2-role.name}"
   }
   setting {
     namespace = "aws:autoscaling:launchconfiguration"
@@ -45,7 +45,7 @@ resource "aws_elastic_beanstalk_environment" "app-prod" {
   setting {
     namespace = "aws:elasticbeanstalk:environment"
     name = "ServiceRole"
-    value = "aws-elasticbeanstalk-service-role"
+    value = "${aws_iam_role.elasticbeanstalk-service-role.name}"
   }
   setting {
     namespace = "aws:ec2:vpc"
diff --git a/demo-17/iam.tf b/demo-17/iam.tf
new file mode 100644
index 0000000..0113051
--- /dev/null
+++ b/demo-17/iam.tf
@@ -0,0 +1,65 @@
+# iam roles
+resource "aws_iam_role" "app-ec2-role" {
+    name = "app-ec2-role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+resource "aws_iam_instance_profile" "app-ec2-role" {
+    name = "app-ec2-role"
+    roles = ["${aws_iam_role.app-ec2-role.name}"]
+}
+
+# service
+resource "aws_iam_role" "elasticbeanstalk-service-role" {
+    name = "elasticbeanstalk-service-role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "elasticbeanstalk.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+# policies
+resource "aws_iam_policy_attachment" "app-attach1" {
+    name = "app-attach1"
+    roles = ["${aws_iam_role.app-ec2-role.name}"]
+    policy_arn = "arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier"
+}
+resource "aws_iam_policy_attachment" "app-attach2" {
+    name = "app-attach2"
+    roles = ["${aws_iam_role.app-ec2-role.name}"]
+    policy_arn = "arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker"
+}
+resource "aws_iam_policy_attachment" "app-attach3" {
+    name = "app-attach3"
+    roles = ["${aws_iam_role.app-ec2-role.name}"]
+    policy_arn = "arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier"
+}
+resource "aws_iam_policy_attachment" "app-attach4" {
+    name = "app-attach4"
+    roles = ["${aws_iam_role.elasticbeanstalk-service-role.name}"]
+    policy_arn = "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth"
+}
diff --git a/demo-17/output.tf b/demo-17/output.tf
index e69de29..18ee1cd 100644
--- a/demo-17/output.tf
+++ b/demo-17/output.tf
@@ -0,0 +1,3 @@
+output "eb" {
+	value = "${aws_elastic_beanstalk_environment.app-prod.cname}"
+}
diff --git a/demo-17/rds.tf b/demo-17/rds.tf
index 12e2958..bef7dc9 100644
--- a/demo-17/rds.tf
+++ b/demo-17/rds.tf
@@ -5,7 +5,7 @@ resource "aws_db_subnet_group" "mariadb-subnet" {
 }
 
 resource "aws_db_parameter_group" "mariadb-parameters" {
-    name = "mariadb-parameters"
+    name = "mariadb-params"
     family = "mariadb10.1"
     description = "MariaDB parameter group"
 
@@ -23,11 +23,11 @@ resource "aws_db_instance" "mariadb" {
   engine_version       = "10.1.14"
   instance_class       = "db.t2.small"    # use micro if you want to use the free tier
   identifier           = "mariadb"
-  name                 = "mariadb"
+  name                 = "mydatabase" # database name
   username             = "root"   # username
   password             = "${var.RDS_PASSWORD}" # password
   db_subnet_group_name = "${aws_db_subnet_group.mariadb-subnet.name}"
-  parameter_group_name = "mariadb-parameters"
+  parameter_group_name = "${aws_db_parameter_group.mariadb-parameters.name}"
   multi_az             = "false"     # set to true to have high availability: 2 instances synchronized with each other
   vpc_security_group_ids = ["${aws_security_group.allow-mariadb.id}"]
   storage_type         = "gp2"
diff --git a/demo-17/vpc.tf b/demo-17/vpc.tf
index 1325feb..89e4700 100644
--- a/demo-17/vpc.tf
+++ b/demo-17/vpc.tf
@@ -108,3 +108,36 @@ resource "aws_route_table_association" "main-public-3-a" {
     subnet_id = "${aws_subnet.main-public-3.id}"
     route_table_id = "${aws_route_table.main-public.id}"
 }
+resource "aws_route_table" "main-private" {
+    vpc_id = "${aws_vpc.main.id}"
+    route {
+        cidr_block = "0.0.0.0/0"
+        nat_gateway_id = "${aws_nat_gateway.nat-gw.id}"
+    }
+
+    tags {
+        Name = "main-private-1"
+    }
+}
+# route associations private
+resource "aws_route_table_association" "main-private-1-a" {
+    subnet_id = "${aws_subnet.main-private-1.id}"
+    route_table_id = "${aws_route_table.main-private.id}"
+}
+resource "aws_route_table_association" "main-private-2-a" {
+    subnet_id = "${aws_subnet.main-private-2.id}"
+    route_table_id = "${aws_route_table.main-private.id}"
+}
+resource "aws_route_table_association" "main-private-3-a" {
+    subnet_id = "${aws_subnet.main-private-3.id}"
+    route_table_id = "${aws_route_table.main-private.id}"
+}
+# nat gw
+resource "aws_eip" "nat" {
+  vpc      = true
+}
+resource "aws_nat_gateway" "nat-gw" {
+  allocation_id = "${aws_eip.nat.id}"
+  subnet_id = "${aws_subnet.main-public-1.id}"
+  depends_on = ["aws_internet_gateway.main-gw"]
+}