diff --git a/demo-14/iam.tf b/demo-14/iam.tf
new file mode 100644
index 0000000..4b84be3
--- /dev/null
+++ b/demo-14/iam.tf
@@ -0,0 +1,46 @@
+resource "aws_iam_role" "s3-mybucket-role" {
+    name = "s3-mybucket-role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_instance_profile" "s3-mybucket-role-instanceprofile" {
+    name = "s3-mybucket-role"
+    roles = ["${aws_iam_role.s3-mybucket-role.name}"]
+}
+
+resource "aws_iam_role_policy" "s3-mybucket-role-policy" {
+    name = "s3-mybucket-role-policy"
+    role = "${aws_iam_role.s3-mybucket-role.id}"
+    policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+              "s3:*"
+            ],
+            "Resource": [
+              "arn:aws:s3:::mybucket-c29df1",
+              "arn:aws:s3:::mybucket-c29df1/*"
+            ]
+        }
+    ]
+}
+EOF
+}
+
diff --git a/demo-14/instance.tf b/demo-14/instance.tf
new file mode 100644
index 0000000..2e19649
--- /dev/null
+++ b/demo-14/instance.tf
@@ -0,0 +1,17 @@
+resource "aws_instance" "example" {
+  ami           = "${lookup(var.AMIS, var.AWS_REGION)}"
+  instance_type = "t2.micro"
+
+  # the VPC subnet
+  subnet_id = "${aws_subnet.main-public-1.id}"
+
+  # the security group
+  vpc_security_group_ids = ["${aws_security_group.example-instance.id}"]
+
+  # the public SSH key
+  key_name = "${aws_key_pair.mykeypair.key_name}"
+
+  # role:
+  iam_instance_profile = "${aws_iam_instance_profile.s3-mybucket-role-instanceprofile.name}"
+
+}
diff --git a/demo-14/key.tf b/demo-14/key.tf
new file mode 100644
index 0000000..0d3c220
--- /dev/null
+++ b/demo-14/key.tf
@@ -0,0 +1,4 @@
+resource "aws_key_pair" "mykeypair" {
+  key_name = "mykeypair"
+  public_key = "${file("${var.PATH_TO_PUBLIC_KEY}")}"
+}
diff --git a/demo-14/output.tf b/demo-14/output.tf
new file mode 100644
index 0000000..c95dddd
--- /dev/null
+++ b/demo-14/output.tf
@@ -0,0 +1,3 @@
+output "instance" {
+  value = "${aws_instance.example.public_ip}"
+}
diff --git a/demo-14/provider.tf b/demo-14/provider.tf
new file mode 100644
index 0000000..ded6d8c
--- /dev/null
+++ b/demo-14/provider.tf
@@ -0,0 +1,3 @@
+provider "aws" { 
+    region = "${var.AWS_REGION}"
+}
diff --git a/demo-14/s3.tf b/demo-14/s3.tf
new file mode 100644
index 0000000..ce5f0c3
--- /dev/null
+++ b/demo-14/s3.tf
@@ -0,0 +1,8 @@
+resource "aws_s3_bucket" "b" {
+    bucket = "mybucket-c29df1"
+    acl = "private"
+
+    tags {
+        Name = "mybucket-c29df1"
+    }
+}
diff --git a/demo-14/securitygroup.tf b/demo-14/securitygroup.tf
new file mode 100644
index 0000000..b796e18
--- /dev/null
+++ b/demo-14/securitygroup.tf
@@ -0,0 +1,22 @@
+resource "aws_security_group" "example-instance" {
+  vpc_id = "${aws_vpc.main.id}"
+  name = "allow-ssh"
+  description = "security group that allows ssh and all egress traffic"
+  egress {
+      from_port = 0
+      to_port = 0
+      protocol = "-1"
+      cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+      from_port = 22
+      to_port = 22
+      protocol = "tcp"
+      cidr_blocks = ["0.0.0.0/0"]
+  } 
+tags {
+    Name = "example-instance"
+  }
+}
+
diff --git a/demo-14/vars.tf b/demo-14/vars.tf
new file mode 100644
index 0000000..d880ef6
--- /dev/null
+++ b/demo-14/vars.tf
@@ -0,0 +1,17 @@
+variable "AWS_REGION" {
+  default = "eu-west-1"
+}
+variable "PATH_TO_PRIVATE_KEY" {
+  default = "mykey"
+}
+variable "PATH_TO_PUBLIC_KEY" {
+  default = "mykey.pub"
+}
+variable "AMIS" {
+  type = "map"
+  default = {
+    us-east-1 = "ami-13be557e"
+    us-west-2 = "ami-06b94666"
+    eu-west-1 = "ami-844e0bf7"
+  }
+}
diff --git a/demo-14/vpc.tf b/demo-14/vpc.tf
new file mode 100644
index 0000000..1325feb
--- /dev/null
+++ b/demo-14/vpc.tf
@@ -0,0 +1,110 @@
+# Internet VPC
+resource "aws_vpc" "main" {
+    cidr_block = "10.0.0.0/16"
+    instance_tenancy = "default"
+    enable_dns_support = "true"
+    enable_dns_hostnames = "true"
+    enable_classiclink = "false"
+    tags {
+        Name = "main"
+    }
+}
+
+
+# Subnets
+resource "aws_subnet" "main-public-1" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.1.0/24"
+    map_public_ip_on_launch = "true"
+    availability_zone = "eu-west-1a"
+
+    tags {
+        Name = "main-public-1"
+    }
+}
+resource "aws_subnet" "main-public-2" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.2.0/24"
+    map_public_ip_on_launch = "true"
+    availability_zone = "eu-west-1b"
+
+    tags {
+        Name = "main-public-2"
+    }
+}
+resource "aws_subnet" "main-public-3" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.3.0/24"
+    map_public_ip_on_launch = "true"
+    availability_zone = "eu-west-1c"
+
+    tags {
+        Name = "main-public-3"
+    }
+}
+resource "aws_subnet" "main-private-1" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.4.0/24"
+    map_public_ip_on_launch = "false"
+    availability_zone = "eu-west-1a"
+
+    tags {
+        Name = "main-private-1"
+    }
+}
+resource "aws_subnet" "main-private-2" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.5.0/24"
+    map_public_ip_on_launch = "false"
+    availability_zone = "eu-west-1b"
+
+    tags {
+        Name = "main-private-2"
+    }
+}
+resource "aws_subnet" "main-private-3" {
+    vpc_id = "${aws_vpc.main.id}"
+    cidr_block = "10.0.6.0/24"
+    map_public_ip_on_launch = "false"
+    availability_zone = "eu-west-1c"
+
+    tags {
+        Name = "main-private-3"
+    }
+}
+
+# Internet GW
+resource "aws_internet_gateway" "main-gw" {
+    vpc_id = "${aws_vpc.main.id}"
+
+    tags {
+        Name = "main"
+    }
+}
+
+# route tables
+resource "aws_route_table" "main-public" {
+    vpc_id = "${aws_vpc.main.id}"
+    route {
+        cidr_block = "0.0.0.0/0"
+        gateway_id = "${aws_internet_gateway.main-gw.id}"
+    }
+
+    tags {
+        Name = "main-public-1"
+    }
+}
+
+# route associations public
+resource "aws_route_table_association" "main-public-1-a" {
+    subnet_id = "${aws_subnet.main-public-1.id}"
+    route_table_id = "${aws_route_table.main-public.id}"
+}
+resource "aws_route_table_association" "main-public-2-a" {
+    subnet_id = "${aws_subnet.main-public-2.id}"
+    route_table_id = "${aws_route_table.main-public.id}"
+}
+resource "aws_route_table_association" "main-public-3-a" {
+    subnet_id = "${aws_subnet.main-public-3.id}"
+    route_table_id = "${aws_route_table.main-public.id}"
+}