Introduction to Amazon VPC
Amazon Virtual Private Cloud (VPC) allows you to provision a logically isolated section of the AWS cloud where you can launch AWS resources in a virtual network that you define. This gives you complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.
Key Concepts
- VPC: A virtual network dedicated to your AWS account.
- Subnets: Segments of a VPC's IP address range where you can place groups of isolated resources.
- Route Tables: Rules that determine where network traffic is directed.
- Internet Gateway: A gateway that allows communication between instances in your VPC and the internet.
- NAT Gateway: A network address translation (NAT) service that enables instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating a connection with those instances.
- Security Groups: Virtual firewalls that control inbound and outbound traffic to instances.
- Network ACLs: Optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets.
Creating a VPC
Step-by-Step Guide
-
Open the Amazon VPC Console:
- Navigate to the VPC Dashboard in the AWS Management Console.
-
Create a VPC:
- Click on "Create VPC".
- Enter a name for your VPC.
- Specify an IPv4 CIDR block (e.g., 10.0.0.0/16).
- Optionally, specify an IPv6 CIDR block.
- Choose tenancy (default or dedicated).
-
Create Subnets:
- Click on "Subnets" in the VPC Dashboard.
- Click "Create Subnet".
- Select the VPC you created.
- Enter a name for the subnet.
- Specify an IPv4 CIDR block (e.g., 10.0.1.0/24).
- Choose an Availability Zone.
-
Create an Internet Gateway:
- Click on "Internet Gateways" in the VPC Dashboard.
- Click "Create Internet Gateway".
- Enter a name for the Internet Gateway.
- Attach the Internet Gateway to your VPC.
-
Update Route Tables:
- Click on "Route Tables" in the VPC Dashboard.
- Select the main route table for your VPC.
- Click "Edit routes".
- Add a route with destination
0.0.0.0/0and target as the Internet Gateway.
-
Configure Security Groups:
- Click on "Security Groups" in the VPC Dashboard.
- Click "Create Security Group".
- Enter a name and description.
- Select your VPC.
- Add inbound and outbound rules as needed.
Practical Example
import boto3
# Create a VPC
ec2 = boto3.client('ec2')
response = ec2.create_vpc(CidrBlock='10.0.0.0/16')
vpc_id = response['Vpc']['VpcId']
# Create a subnet
response = ec2.create_subnet(CidrBlock='10.0.1.0/24', VpcId=vpc_id)
subnet_id = response['Subnet']['SubnetId']
# Create an Internet Gateway
response = ec2.create_internet_gateway()
igw_id = response['InternetGateway']['InternetGatewayId']
# Attach the Internet Gateway to the VPC
ec2.attach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id)
# Create a route table
response = ec2.create_route_table(VpcId=vpc_id)
route_table_id = response['RouteTable']['RouteTableId']
# Create a route to the Internet Gateway
ec2.create_route(RouteTableId=route_table_id, DestinationCidrBlock='0.0.0.0/0', GatewayId=igw_id)
# Associate the route table with the subnet
ec2.associate_route_table(RouteTableId=route_table_id, SubnetId=subnet_id)
# Create a security group
response = ec2.create_security_group(GroupName='my-security-group', Description='My security group', VpcId=vpc_id)
security_group_id = response['GroupId']
# Add a rule to allow SSH access
ec2.authorize_security_group_ingress(GroupId=security_group_id, IpProtocol='tcp', FromPort=22, ToPort=22, CidrIp='0.0.0.0/0')Practical Exercise
Exercise: Create a VPC with two subnets, one public and one private. The public subnet should have access to the internet, while the private subnet should not.
- Create a VPC with a CIDR block of
10.0.0.0/16. - Create a public subnet with a CIDR block of
10.0.1.0/24. - Create a private subnet with a CIDR block of
10.0.2.0/24. - Create an Internet Gateway and attach it to the VPC.
- Update the route table for the public subnet to allow internet access.
- Create a security group that allows SSH access to instances in the public subnet.
Solution:
import boto3
# Create a VPC
ec2 = boto3.client('ec2')
response = ec2.create_vpc(CidrBlock='10.0.0.0/16')
vpc_id = response['Vpc']['VpcId']
# Create a public subnet
response = ec2.create_subnet(CidrBlock='10.0.1.0/24', VpcId=vpc_id)
public_subnet_id = response['Subnet']['SubnetId']
# Create a private subnet
response = ec2.create_subnet(CidrBlock='10.0.2.0/24', VpcId=vpc_id)
private_subnet_id = response['Subnet']['SubnetId']
# Create an Internet Gateway
response = ec2.create_internet_gateway()
igw_id = response['InternetGateway']['InternetGatewayId']
# Attach the Internet Gateway to the VPC
ec2.attach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id)
# Create a route table
response = ec2.create_route_table(VpcId=vpc_id)
route_table_id = response['RouteTable']['RouteTableId']
# Create a route to the Internet Gateway
ec2.create_route(RouteTableId=route_table_id, DestinationCidrBlock='0.0.0.0/0', GatewayId=igw_id)
# Associate the route table with the public subnet
ec2.associate_route_table(RouteTableId=route_table_id, SubnetId=public_subnet_id)
# Create a security group
response = ec2.create_security_group(GroupName='my-security-group', Description='My security group', VpcId=vpc_id)
security_group_id = response['GroupId']
# Add a rule to allow SSH access
ec2.authorize_security_group_ingress(GroupId=security_group_id, IpProtocol='tcp', FromPort=22, ToPort=22, CidrIp='0.0.0.0/0')Common Mistakes and Tips
- Incorrect CIDR Blocks: Ensure that the CIDR blocks for your subnets do not overlap and are within the range of the VPC's CIDR block.
- Route Table Configuration: Make sure to update the route table for the public subnet to include a route to the Internet Gateway.
- Security Group Rules: Be cautious with security group rules. Allow only necessary traffic to minimize security risks.
Conclusion
In this section, you learned about Amazon VPC and its key components, including subnets, route tables, and security groups. You also learned how to create a VPC and configure it for internet access. This foundational knowledge will help you design and manage your AWS network infrastructure effectively. In the next module, we will explore Elastic Load Balancing and how it can be used to distribute traffic across multiple instances.