We have a library called Crosswalk (or AWSX) and in that there are some resources that make it easier to set up these things.
https://www.pulumi.com/docs/guides/crosswalk/aws/vpc/
One thing to note is that if you set up private subnets they include NAT gateways which can be a bit pricey