aws-vpc

# AWS VPC Design and manage Virtual Private Cloud networking for production AWS environments with proper subnet isolation, routing, and security. ## When to Use This Skill - Building a new VPC for production, staging, or development - Setting up public/private subnet architecture across multiple AZs - Configuring NAT Gateways for private subnet internet access - Creating security groups and NACLs for network segmentation - Setting up VPC peering or Transit Gateway for multi-VPC connectivity - Implementing VPC endpoints for private access to AWS services - Troubleshooting connectivity issues between resources ## Prerequisites - AWS CLI v2 installed and configured - IAM permissions: `ec2:*` (or scoped to VPC-related actions) - CIDR range planning completed (avoid overlaps with on-premises or other VPCs) - For VPC peering: access to both VPCs (same or different accounts) ## Network Architecture ``` VPC (10.0.0.0/16) - 65,536 IPs ├── Public Subnets (internet-facing via IGW) │ ├── 10.0.1.0/24 (us-east-1a) - 256 IPs - ALBs, NAT GW, bastion │ ├── 10.0.2.0/24 (us-east-1b) - 256 IPs │ └── 10.0.3.0/24 (us-east-1c) - 256 IPs ├── Private Subnets (app tier, NAT GW for outbound) │ ├── 10.0.11.0/24 (us-east-1a) - 256 IPs - ECS, EC2, Lambda │ ├── 10.0.12.0/24 (us-east-1b) - 256 IPs │ └── 10.0.13.0/24 (us-east-1c) - 256 IPs ├── Data Subnets (isolated, no internet) │ ├── 10.0.21.0/24 (us-east-1a) - 256 IPs - RDS, ElastiCache │ ├── 10.0.22.0/24 (us-east-1b) - 256 IPs │ └── 10.0.23.0/24 (us-east-1c) - 256 IPs ├── Internet Gateway ├── NAT Gateways (one per AZ for HA) ├── Route Tables (public, private, data) └── VPC Flow Logs → CloudWatch / S3 ``` ## Create a VPC with CLI ```bash # Create the VPC VPC_ID=$(aws ec2 create-vpc \ --cidr-block 10.0.0.0/16 \ --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=production-vpc},{Key=Environment,Value=production}]' \ --query 'Vpc.VpcId' --output text) # Enable DNS support and hostnames aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-support '{"Value":true}' aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-hostnames '{"Value":true}' # Create public subnets PUB_SUB_A=$(aws ec2 create-subnet \ --vpc-id $VPC_ID \ --cidr-block 10.0.1.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-a},{Key=Tier,Value=public}]' \ --query 'Subnet.SubnetId' --output text) PUB_SUB_B=$(aws ec2 create-subnet \ --vpc-id $VPC_ID \ --cidr-block 10.0.2.0/24 \ --availability-zone us-east-1b \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-b},{Key=Tier,Value=public}]' \ --query 'Subnet.SubnetId' --output text) # Enable auto-assign public IP on public subnets aws ec2 modify-subnet-attribute --subnet-id $PUB_SUB_A --map-public-ip-on-launch aws ec2 modify-subnet-attribute --subnet-id $PUB_SUB_B --map-public-ip-on-launch # Create private subnets PRIV_SUB_A=$(aws ec2 create-subnet \ --vpc-id $VPC_ID \ --cidr-block 10.0.11.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-a},{Key=Tier,Value=private}]' \ --query 'Subnet.SubnetId' --output text) PRIV_SUB_B=$(aws ec2 create-subnet \ --vpc-id $VPC_ID \ --cidr-block 10.0.12.0/24 \ --availability-zone us-east-1b \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-b},{Key=Tier,Value=private}]' \ --query 'Subnet.SubnetId' --output text) # Create data subnets (isolated) DATA_SUB_A=$(aws ec2 create-subnet \ --vpc-id $VPC_ID \ --cidr-block 10.0.21.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=data-a},{Key=Tier,Value=data}]' \ --query 'Subnet.SubnetId' --output text) DATA_SUB_B=$(aws ec2 create-subnet \ --vpc-id $VPC_ID \ --cidr-block 10.0.22.0/24 \ --availability-zone us-east-1b \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=data-b},{Key=Tier,Value=data}]' \ --query 'Subnet.SubnetId' --output text) ``` ## Internet Gateway and NAT Gateway ```bash # Create and attach Internet Gateway IGW_ID=$(aws ec2 create-internet-gateway \ --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=production-igw}]' \ --query 'InternetGateway.InternetGatewayId' --output text) aws ec2 attach-internet-gateway --vpc-id $VPC_ID --internet-gateway-id $IGW_ID # Create public route table PUB_RT=$(aws ec2 create-route-table \ --vpc-id $VPC_ID \ --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=public-rt}]' \ --query 'RouteTable.RouteTableId' --output text) aws ec2 create-route --route-table-id $PUB_RT --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID aws ec2 associate-route-table --route-table-id $PUB_RT --subnet-id $PUB_SUB_A aws ec2 associate-route-table --route-table-id $PUB_RT --subnet-id $PUB_SUB_B # Allocate Elastic IPs for NAT Gateways (one per AZ for HA) EIP_A=$(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text) EIP_B=$(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text) # Create NAT Gateways in public subnets NAT_A=$(aws ec2 create-nat-gateway \ --subnet-id $PUB_SUB_A \ --allocation-id $EIP_A \ --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=nat-a}]' \ --query 'NatGateway.NatGatewayId' --output text) NAT_B=$(aws ec2 create-nat-gateway \ --subnet-id $PUB_SUB_B \ --allocation-id $EIP_B \ --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=nat-b}]' \ --query 'NatGateway.NatGatewayId' --output text) # Wait for NAT Gateways aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT_A $NAT_B # Create private route tables (one per AZ for HA NAT) PRIV_RT_A=$(aws ec2 create-route-table \ --vpc-id $VPC_ID \ --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=private-rt-a}]' \ --query 'RouteTable.RouteTableId' --output text) aws ec2 create-route --route-table-id $PRIV_RT_A --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT_A aws ec2 associate-route-table --route-table-id $PRIV_RT_A --subnet-id $PRIV_SUB_A PRIV_RT_B=$(aws ec2 create-route-table \ --vpc-id $VPC_ID \ --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=private-rt-b}]' \ --query 'RouteTable.RouteTableId' --output text) aws ec2 create-route --route-table-id $PRIV_RT_B --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT_B aws ec2 associate-route-table --route-table-id $PRIV_RT_B --subnet-id $PRIV_SUB_B ``` ## Security Groups ```bash # ALB security group (public-facing) ALB_SG=$(aws ec2 create-security-group \ --group-name alb-sg \ --description "Application Load Balancer" \ --vpc-id $VPC_ID \ --query 'GroupId' --output text) aws ec2 authorize-security-group-ingress --group-id $ALB_SG --protocol tcp --port 443 --cidr 0.0.0.0/0 aws ec2 authorize-security-group-ingress --group-id $ALB_SG --protocol tcp --port 80 --cidr 0.0.0.0/0 # Application security group (only from ALB) APP_SG=$(aws ec2 create-security-group \ --group-name app-sg \ --description "Application tier" \ --vpc-id $VPC_ID \ --query 'GroupId' --output text) aws ec2 authorize-security-group-ingress \ --group-id $APP_SG \ --protocol tcp \ --port 8080 \ --source-group $ALB_SG # Database security group (only from app tier) DB_SG=$(aws ec2 create-security-group \ --group-name db-sg \ --description "Database tier" \ --vpc-id $VPC_ID \ --query 'GroupId' --output text) aws ec2 authorize-security-group-ingress \ --group-id $DB_SG \ --protocol tcp \ --port 5432 \ --source-group $APP_SG # List all security groups in the VPC aws ec2 describe-security-groups \ --filters "Name=vpc-id,Values=$VPC_ID" \ --query "SecurityGroups[].{Name:GroupName,ID:GroupId,Description:Description}" \ --output table ``` ## VPC Endpoints (Private Access to AWS Services) ```bash # Gateway endpoint for S3 (free, route-table based) aws ec2 create-vpc-endpoint \ --vpc-id $VPC_ID \ --service-name com.amazonaws.us-east-1.s3 \ --route-table-ids $PRIV_RT_A $PRIV_RT_B \ --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=s3-endpoint}]' # Gateway endpoint for DynamoDB (free) aws ec2 create-vpc-endpoint \ --vpc-id $VPC_ID \ --service-name com.amazonaws.us-east-1.dynamodb \ --route-table-ids $PRIV_RT_A $PRIV_RT_B # Interface endpoint for Secrets Manager (ENI-based, has hourly cost) aws ec2 create-vpc-endpoint \ --vpc-id $VPC_ID \ --vpc-endpoint-type Interface \ --service-name com.amazonaws.us-east-1.secretsmanager \ --subnet-ids $PRIV_SUB_A $PRIV_SUB_B \ --security-group-ids $APP_SG \ --private-dns-enabled \ --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=secretsmanager-endpoint}]' ``` ## VPC Flow Logs ```bash # Enable VPC flow logs to CloudWatch aws ec2 create-flow-log \ --resource-type VPC \ --resource-ids $VPC_ID \ --traffic-type ALL \ --log-destination-type cloud-watch-logs \ --log-group-name /vpc/production-flow-logs \ --deliver-logs-permission-arn arn:aws:iam::123456789012:role/VPCFlowLogRole \ --max-aggregation-interval 60 \ --tag-specifications 'ResourceType=vpc-flow-log,Tags=[{Key=Name,Value=production-flow-log}]' # Enable VPC flow logs to S3 (cheaper for long-term storage) aws ec2 create-flow-log \ --resource-type VPC \ --resource-ids $VPC_ID \ --traffic-type ALL \ --log-destination-type s3 \ --log-destination arn:aws:s3:::my-flow-logs-bucket/vpc-logs/ \ --max-aggregation-interval 60 ``` ## VPC Peering ```bash # Request peering connection PEERING_ID=$(aws ec2 create-vpc-peering-connection \ --vpc-id vpc-requester \ --peer-vpc-id vpc-accepter \ --peer-owner-id 987654321098 \ --peer-region us-west-2 \ --tag-specifications 'ResourceType=vpc-peering-connection,Tags=[{Key=Name,Value=prod-to-shared}]' \ --query 'VpcPeeringConnection.VpcPeeringConnectionId' --output text) # Accept peering (from the accepter account/region) aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id $PEERING_ID # Add routes in both VPCs aws ec2 create-route --route-table-id rtb-requester --destination-cidr-block 10.1.0.0/16 --vpc-peering-connection-id $PEERING_ID aws ec2 create-route --route-table-id rtb-accepter --destination-cidr-block 10.0.0.0/16 --vpc-peering-connection-id $PEERING_ID ``` ## Terraform VPC Module ```hcl resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" enable_dns_support = true enable_dns_hostnames = true