VPC with Public and Private Subnets

Description:

The configuration for this scenario includes a virtual private cloud (VPC) with a public subnet and a private subnet. The instances in the public subnet can receive inbound traffic directly from the Internet, whereas the instances in the private subnet can't. The instances in the public subnet can send outbound traffic directly to the Internet, whereas the instances in the private subnet can't. Instead, the instances in the private subnet can access the Internet by using a network address translation (NAT) instance that you launch into the public subnet.

The following diagram shows what we will create in this example:

Steps:

1. Create a new VPC Stack, in the region of your choice:
   
   
2. A default VPC is created when you create a new VPC Stack, as well as a default Route Table.
   You can optionaly edit the subnet details in the right panel (don't forget to focus on the subnet by clicking on its blank area). The network address must be written following the CIDR notation:
   
3. You can now add a new Availability Zone of your choice by drag-n-drop it from the left panel:
   
4. When adding a new Availability Zone, a default subnet is created.
   You can edit the subnet properties in the right panel
   
   Note that all Subnets are automatically connected to the Main Route Table. Subnets must be connected to only one Route Table.
5. Add another subnet by dragging it from the resources panel and dropping it in the Availability Zone.
   Name one subnet "public" with the CIDR IP "10.0.0.0/24" and the other "private" with the CIDR IP "10.0.1.0/24" as following:
   
   
6. Add an Internet Gateway and connect it to the Route Table
   Drag an IGW from the resource panel (VPC category) to anywhere within the VPC. Note that the IGW will automatically snap to the left edge of the VPC and you can only have one IGW per VPC.
   Then, drag from the blue ports on the Route Table to the blue incoming port on the IGW to connect it.
   
   
7. You can click on the Route Table to define routing rules. Note that when you connect an RT to an IGW we will automatically add a destination "0.0.0.0/0" rule.
   
   
8. Add another Route Table
   Drag another RT from the resource panel to anywhere in the VPC. We can then associate subnet "private" to this RT by dragging from the grey port on the right of the subnet to an incoming grey port on the RT. Note that, as subnets can only be associated with one RT, the previous association will automatically be removed.
   
   
9. Add the AMIs to the Subnets
   We can now drag on some AMIs from the resource panel to inside the Subnets in our VPC.
   
   Let's start by dragging two Amazon Linux AMIs, one to each subnet. Optionally, click on the instances to rename the hosts in the right panel.
   
   
   Also add a NAT instance to the "public" subnet. You can find a Amazon Linux NAT AMI in the Quickstart AMIs. Drag it to the public subnet and name it "NAT".
   
10. Connect the NAT and configure the RT
    Connect the RT to the NAT AMI by dragging from its outgoing blue port to the incoming blue port on the left of the NAT AMI.
    
    Enter "0.0.0.0/0" as "Destination" in the right panel.
    
11. Configure the AMI IPs
    Click an AMI and select "Network Interface Details" in the right panel. Here you can manually specify the IP address within the subnet range (".x" means auto assign random IP) and click the icon on the right to add an Elastic IP to a private IP.
    
    Go ahead and use the following IP configurations:
    

    Subnet	Host	Private IP	Elastic IP
    public-host	NAT	10.0.0.x	Yes
    public-host	public-host	10.0.0.5	Yes
    private	private-host	10.0.1.5	No

    
    
12. Create and Configure Security Groups for each AMI
    Click an AMI and select "Security Groups" on the right panel. Here you can create some new Security groups.
    
    Configure the Security Groups as following:
    

    AMI	SG Name
    NAT	NATSG
    public-host	WebServerSG
    private-host	DBServerSG

    You can now add the following rules to the Security Groups (see the IDE documentation for more details about security groups):
    

    SG	AMI	Security Group Rules
    		In / Out	Soure / Dest	Protocol	Port Range
    WebServerSG	public-host	In	0.0.0.0/0	TCP	80
    			0.0.0.0/0	TCP	443
    			Your network’s public IP address range	TCP	22
    			Your network’s public IP address range	TCP	3389
    		Out	0.0.0.0/0	TCP	80
    			0.0.0.0/0	TCP	443
    			private.private_ip_address	TCP	1433
    			private.private_ip_address	TCP	3306
    DBServerSG	private-host	In	public.private_ip_address	TCP	1433
    			public.private_ip_address	TCP	3306
    		Out	0.0.0.0/0	TCP	80
    			0.0.0.0/0	TCP	443
    NATSG	NAT	In	10.0.1.0/24	TCP	80
    			10.0.1.0/24	TCP	443
    			Your network’s public IP address range	TCP	22
    		Out	0.0.0.0/0	TCP	80
    			0.0.0.0/0	TCP	443