AWS VPC

Introduction :

A VPC (virtual private cloud) is a virtual data center in the cloud. Amazon VPC provides a logically isolated area of the AWS cloud where you can launch AWS resources in a virtual network that you define. VPC allows the user to select IP address ranges, create subnets, and configure route tables, network gateways, security settings, etc. The benefit of VPC is that it helps in aspects of cloud computing like privacy, security, and preventing loss of proprietary data. EC2 instance launched in a VPC will be protected or not protected based on the configuration of the VPC.

VPC Component:

1. Route Tables:  control traffic flow within a VPC and determine the route traffic takes between subnets, internet gateways, NAT gateway, and virtual private gateways. allow communication between the VPC and the internet and provide a target for all internet-bound traffic.
2. Network Address Translation (NAT):  stateless firewalls that control traffic at the subnet level.
3. Security groups: Security groups are a set of firewall rules that controls the traffic for your instance. In Amazon Firewall the only action that can be carried out is allow. You cannot create a rule to deny. You can have a single security group associated with multiple instances.
4. Customer Gateway:  An Amazon VPC VPN connection links your data center (or network) to your Amazon VPC (virtual private cloud). A customer gateway Virtual Private GatewayA is the VPN concentrator on the Amazon side of the VPN connection. You create a virtual private gateway and attach it to the VPC from which you want to create the VPN connection.
5. VPC Peering: A VPC peering connection allows you to route traffic between two VPCs using IPv4 or IPv6 private addresses.  You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account. A VPC peering connection helps you to facilitate the transfer of data.
6. Network Access Control Lists (NACL):  an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.VPC stands for Virtual Private Cloud.VPC is a virtual network dedicated to your AWS account.

Steps We'll Perform

1. Create VPC
2. Create a Public & Private subnet with Route Table
3. Create a Route table
4. Create an Internet gateway
5. Create a NAT Gateway

Step 1: Create a VPC 

AWS Virtual Private Cloud VPC is an essential component of Amazon Web Services that enables us to launch AWS resources into a virtual network we have defined. It is logically isolated from other virtual networks in the AWS cloud.

Example: Go to the AWS console and search VPC in the search bar.

• Create VPC range is 10.0.0.0/16

Step 2: Create a Subnet 

Description: A subnet is a range of IP addresses in your VPC. You need to provide at least two subnets to create a VPC connection. Each subnet must belong a different availability zone. You can attach AWS resources, such as Amazon EC2 instances and Amazon RDS DB instances, to subnets. You can create subnets to group instances together according to your security and operational needs.

There are two types of subnets

• Private Subnet: If there is no route to the internet in the Route table associated with the subnet then the subnet is said to be a Private subnet.
  Use Case: Database servers and other application servers that should not be exposed to the internet are present in Private Subnet.
  
• Public Subnet: If there is an internet gateway attached to the Route table of the subnet.
  Use Case: Web Servers and other servers that need direct internet access are placed in Public subnets.

Example: Create a public and private subnet.

• Webserver1 - 10.0.1.0/24
• Webserver2 - 10.0.2.0/24
• Database1   - 10.0.3.0/24 
• Database2   - 10.0.4.0/24 

Public Subnet:

Private Subnet : 

 

Step 3: Create a Route table

A route table contains a set of rules, called routes, that are used to determine where network traffic from your subnet or gateway is directed. To put it simply, a route table tells network packets which way they need to go to get to their destination.

• Each subnet in your VPC must be associated with a route table, which controls the routing for the subnet (subnet route table). A subnet can be explicitly associated with a custom route table.
• The main route table automatically comes with VPC. It controls the routing for all subnets that are not explicitly associated with any other route table.
• The custom route table is empty, by default and you add routes as needed.
• A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same subnet route table.
• Every route table contains a local route for communication within the VPC.
• Gateway route table — it’s associated with an internet gateway or a virtual private gateway (gateway route table).
• You can associate a route table with an internet gateway or a virtual private gateway. When a route table is associated with a gateway, it’s referred to as a gateway route table.
• A gateway route table supports routes where the target is local or an elastic network interface in VPC.
• Each route in a table specifies a destination and a target.
• IPv4 and IPv6 traffic are treated separately. i.e. Routes to IPv4 and IPv6 addresses or CIDR blocks are independent of each other.

Example :

Direction was a key factor here. Direction Billboards are very useful to determine the next turning point to reach the destination. sam as route table provides direction to public and private subnets.

            

•     Create public and private route tables and subnet associations.

Step 4: Create an Internet Gateway

• Internet Gateway is a highly available VPC component that allows communication between resources in the VPC and the Internet.
• An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the Internet.
• An Internet Gateway serves two purposes:
• To provide a target in your VPC route tables for internet-routable traffic
• To perform network address translation (NAT) for instances that have been assigned public IPv4 addresses
• You cannot have multiple Internet Gateways in a VPC.
• IGWs must be detached before they can be deleted.

Example : 

              Create an Internet Gateway and attach it to vpc.

Step 5: Create a NAT Gateway

• NAT stands for Network Address Translation.
• A NAT Gateway is a device used to enable instances in a private subnet to connect to the internet or other AWS services.
• It prevents the Internet from initiating connections with the instances present in the private subnet.
• Charged for each hour that your NAT gateway is available and each Gigabyte of data that it processes.
• NAT gateways are not supported for IPv6 traffic.
• A NAT gateway supports 5 Gbps of bandwidth and automatically scales up to 45 Gbps.
• It is AWS managed service that has higher bandwidth, better availability, and no admin work required.
• NAT is created in a specific AZ and uses an EIP and No security group to manage/required.

Ref : https://docs.aws.amazon.com/vpc/index.html