cd ../environments/dev
terraform init
terraform plan
terraform apply

Expect: VPC, 2 public + 2 private subnets across 2 AZs, 1 Internet Gateway, 2 NAT Gateways (one per AZ), correctly paired per-AZ route tables, EKS subnet discovery tags.

IAM checkpoint: add the EC2/VPC networking permission statement before this stage - expect AccessDenied on ec2:CreateVpc etc. otherwise, and add actions as errors name them.