Hands-on: Create custom VPC, Deploy public & private EC2

Hands-on: Create Custom VPC, Deploy Public & Private EC2 

Amazon Web Services (AWS) provides a robust platform for cloud networking and computing resources. One of the foundational services in AWS is the Virtual Private Cloud (VPC), which allows you to create isolated networks and control network configurations for your cloud resources. In this detailed hands-on tutorial, we will cover the complete process of creating a custom VPC, configuring public and private subnets, route tables, security groups, and launching EC2 instances in both public and private networks.

1. Introduction to AWS VPC

A VPC is a logically isolated network within the AWS cloud where you can launch AWS resources. Each VPC can have multiple subnets, internet gateways, NAT gateways, route tables, and security configurations to define how resources communicate internally and externally.

Components of AWS VPC

• Subnets: Segments of the VPC's IP address range. Can be public or private.
• Internet Gateway (IGW): Allows communication between the VPC and the internet.
• NAT Gateway: Enables private subnets to access the internet without exposing them publicly.
• Route Tables: Define how traffic is directed within the VPC and outside networks.
• Security Groups: Virtual firewalls controlling inbound and outbound traffic for EC2 instances.

2. Planning Your Custom VPC

Before creating a VPC, it is important to plan your network carefully. Consider the following:

• VPC CIDR block (e.g., 10.0.0.0/16)
• Public subnet CIDR block (e.g., 10.0.1.0/24)
• Private subnet CIDR block (e.g., 10.0.2.0/24)
• Regions and availability zones
• Internet connectivity requirements

3. Creating a Custom VPC in AWS

Follow these steps to create a custom VPC using the AWS Management Console:

Step 1: Create a VPC

1. Sign in to AWS Management Console.
2. Navigate to VPC Dashboard > VPCs > Create VPC.
3. Select VPC only.
4. Enter the following:
   - Name tag: MyCustomVPC
   - IPv4 CIDR block: 10.0.0.0/16
5. Click Create VPC.
    

Step 2: Create Public and Private Subnets

1. Go to Subnets > Create Subnet.
2. Select the VPC: MyCustomVPC
3. For public subnet:
   - Name: PublicSubnet
   - Availability Zone: us-east-1a
   - CIDR block: 10.0.1.0/24
4. For private subnet:
   - Name: PrivateSubnet
   - Availability Zone: us-east-1a
   - CIDR block: 10.0.2.0/24
5. Click Create Subnet for both.
    

Step 3: Configure an Internet Gateway

1. Go to Internet Gateways > Create Internet Gateway.
2. Name tag: MyIGW
3. Click Create Internet Gateway.
4. Attach IGW to your VPC:
   - Select MyIGW > Actions > Attach to VPC > Choose MyCustomVPC
5. Click Attach.
    

Step 4: Create Route Tables

Route tables direct traffic from subnets to other networks or the internet.

Public Route Table

1. Navigate to Route Tables > Create Route Table.
2. Name tag: PublicRouteTable
3. Select VPC: MyCustomVPC
4. Click Create
5. Associate public subnet:
   - Select PublicRouteTable > Subnet Associations > Edit
   - Check PublicSubnet
   - Save
6. Add a route to the Internet Gateway:
   - Select Routes > Edit Routes > Add route
   - Destination: 0.0.0.0/0
   - Target: MyIGW
   - Save routes
    

Private Route Table

1. Create another route table: PrivateRouteTable
2. Name tag: PrivateRouteTable
3. Select VPC: MyCustomVPC
4. Associate private subnet:
   - Subnet Associations > Edit
   - Check PrivateSubnet
   - Save
5. Do not add internet gateway for private subnet
    

Step 5: Configure NAT Gateway (Optional for Private Subnet Internet Access)

1. Navigate to NAT Gateways > Create NAT Gateway
2. Select Public Subnet: PublicSubnet
3. Allocate Elastic IP: Click Allocate New EIP
4. Click Create NAT Gateway
5. Update PrivateRouteTable:
   - Routes > Edit routes
   - Add route: Destination 0.0.0.0/0, Target: NAT Gateway
   - Save
    

4. Security Groups Configuration

Security groups act as virtual firewalls controlling inbound and outbound traffic for EC2 instances.

Create a Security Group for Public EC2

1. Navigate to Security Groups > Create Security Group
2. Name: PublicSG
3. VPC: MyCustomVPC
4. Inbound rules:
   - Type: SSH, Protocol: TCP, Port Range: 22, Source: Your IP
   - Type: HTTP, Protocol: TCP, Port Range: 80, Source: 0.0.0.0/0
5. Outbound rules:
   - Allow all traffic
6. Create security group
    

Create a Security Group for Private EC2

1. Create Security Group: PrivateSG
2. VPC: MyCustomVPC
3. Inbound rules:
   - Type: SSH, Protocol: TCP, Port Range: 22, Source: PublicSubnet IP or VPN
4. Outbound rules:
   - Allow all traffic
5. Create security group
    

5. Launching EC2 Instances

Step 1: Launch Public EC2

1. Navigate to EC2 Dashboard > Launch Instances
2. Choose AMI: Amazon Linux 2
3. Instance type: t2.micro
4. Network: MyCustomVPC
5. Subnet: PublicSubnet
6. Auto-assign Public IP: Enable
7. Security group: PublicSG
8. Launch instance
    

Step 2: Launch Private EC2

1. Navigate to EC2 Dashboard > Launch Instances
2. Choose AMI: Amazon Linux 2
3. Instance type: t2.micro
4. Network: MyCustomVPC
5. Subnet: PrivateSubnet
6. Auto-assign Public IP: Disable
7. Security group: PrivateSG
8. Launch instance
    

6. Testing Connectivity

• Public EC2: SSH using public IP from your local machine.
• Private EC2: SSH via Bastion host in public subnet or through VPN.
• Verify internet connectivity from public EC2.
• Verify private EC2 can access internet if NAT Gateway is configured.

7. EC2

• Use multiple availability zones for high availability.
• Enable CloudTrail and VPC Flow Logs for auditing and monitoring.
• Use least privilege security group rules.
• Separate public and private subnets for enhanced security.
• Consider using AWS Systems Manager for private EC2 management.

In this tutorial, we have covered a complete hands-on guide to creating a custom VPC in AWS, setting up public and private subnets, configuring route tables, security groups, and deploying EC2 instances. This setup provides a secure and scalable environment for deploying cloud applications, ensuring that public-facing instances are separated from private internal resources.