# Basic AWS Network Architecture Deployment

## AWS Network Diagram

![](https://cdn.hashnode.com/uploads/covers/6767e8fe0ddd601305c860a0/7f193937-f7dc-466d-a49d-7edf3542824b.png align="center")

The AWS network diagram illustrates the setup of a Virtual Private Cloud (VPC) with public and private subnets in a single Availability Zone (AZ). It includes the creation of EC2 instances, route tables, an Internet Gateway, and a NAT Gateway, ensuring secure communication between the instances within the VPC and external services.

## Converting Diagram into AWS Network

### Creating Virtual Private Cloud

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734970981690/9217aee5-a390-48e0-9661-13580856de23.png align="center")

I configured the IPv4 CIDR block for the VPC as `10.0.0.0/16`, which provides 65,536 IP addresses to accommodate the network.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734972659598/67ccc789-f3fc-44b7-8a7b-d440e079722e.png align="center")

The first VPC is the default VPC.

### Creating Subnets

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734972159468/772e3df7-76b0-4c71-a152-4f7e1f8159f4.png align="center")

I selected the newly created VPC (`new-vpc`) for subnet creation.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734972200337/2498d8d9-47d8-4f8e-a15f-68c7dff07c39.png align="center")

For the first subnet, I created a `PublicSubnet` in Availability Zone `eu-west-2a`, with an IPv4 CIDR block of `10.0.0.0/24` (within the VPC CIDR block).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734972282980/7ef8b122-0998-48e0-91c8-17367c035889.png align="center")

I will create a **PrivateSubnet** in the same Availability Zone (AZ) of `eu-west-2a`. While it's typically recommended to distribute public and private subnets across different AZs for high availability, I will use a single AZ for simplicity in this setup. Since the `10.0.0.0/24` block is already assigned to the **PublicSubnet**, I will use `10.0.1.0/24` for the **PrivateSubnet**, which still falls within the VPC's CIDR block.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734972627818/ad78e8c6-557a-47eb-bf09-e6ee4310e4c2.png align="center")

### Launching a Public EC2 Instance

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734972878775/b8e5788c-03c1-47f0-9bbc-5bb010678c82.png align="center")

I launched a new EC2 instance called `PublicInstance`, selecting the default AMI and the `t2.micro` instance type, which is free-tier eligible.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734972982689/a79536ff-7bc3-4e65-b6e6-6ce96c0e3fd6.png align="center")

A new key pair, `my-key-pair`, was created to allow SSH access to the instance.

![](https://cdn.hashnode.com/uploads/covers/6767e8fe0ddd601305c860a0/dd42c369-347a-4be5-ad87-8aae807596ed.png align="center")

I edited the network settings to deploy `PublicInstance` in the `PublicSubnet`, assigned a public IP, and used the default security group (`PublicSecurityGroup`).

### Creating an Internet Gateway

![](https://cdn.hashnode.com/uploads/covers/6767e8fe0ddd601305c860a0/10d8229d-486f-4d84-8ca4-d0d16d032aa6.png align="center")

An Internet Gateway was created and attached to the VPC to enable internet access for public instances.

![](https://cdn.hashnode.com/uploads/covers/6767e8fe0ddd601305c860a0/098103cc-6870-4d9e-a50d-c7752a24cbae.png align="center")

### Creating Route Tables

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734973626184/da9b8f0e-8707-4fa0-b59b-0460661a219f.png align="center")

The default route table allows communication between `Public` and `Private` subnets by default, as indicated by the `local` route.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734973847316/5a4cb304-d2cc-4b5d-bad9-a95e1ee35813.png align="center")

Explicit subnet associations are required for both the Public and Private Route Tables.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734973919926/d3fb8258-9cab-40df-a278-284fb45ae7cf.png align="center")

Here, I associated the `PublicSubnet` with the `PublicRouteTable`.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734973959491/3618b553-c1c5-454b-9031-b51e20b100a8.png align="center")

Next, I associated the `PrivateSubnet` with the `PrivateRouteTable`.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734974002897/223bd51f-52b4-422a-801e-03e75d490306.png align="center")

The route tables have been successfully associated with the respective subnets.

### Allowing Route to Internet Gateway

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734974152835/4de4a28b-dfef-44de-b0ee-aebfb57ee6eb.png align="center")

I added a route to the `PublicRouteTable` with `0.0.0.0/0` targeting the Internet Gateway. This allows `PublicInstance` to connect to the internet.

### Connecting via EC2 Instance Connect

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734974340991/3354ba0e-c36e-43c0-a51d-2c71325543b2.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734974470977/81fc804b-efe0-475d-b814-322d24edb02a.png align="center")

I tested the internet connection by running `sudo yum update -y`, and it successfully connected, confirming the internet route is working.

### Launching a Private EC2 Instance

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734974641863/d42bb376-22ab-452a-9c3c-80649cf7ee49.png align="center")

I launched a new EC2 instance named `PrivateInstance` with default settings, using the existing `my-key-pair` key pair for SSH access.

![](https://cdn.hashnode.com/uploads/covers/6767e8fe0ddd601305c860a0/506557a0-687c-4bbf-9f88-1c0357ad9941.png align="center")

The instance was placed in the `PrivateSubnet` without a public IP, and the default `PrivateSecurityGroup` was used.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734975533424/0e0152ec-2089-4990-849e-dac978f0aab8.png align="center")

Using SCP, I uploaded the key pair to `PublicInstance` to enable SSH access to the `PrivateInstance`.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734975575813/2b59a3e4-e6b3-40ec-8bb0-024fb225b4a3.png align="center")

The key pair is successfully uploaded to the `PublicInstance`.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734975871527/181f022a-d423-446f-bc61-a560a26a39dd.png align="center")

I confirmed that I can access `PrivateInstance` since traffic is allowed between the two subnets by default. However, the `PrivateInstance` does not have internet access.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734975983328/d8711ecf-0c76-4573-9eef-e8a0d7f9d6c4.png align="center")

Attempting to run `sudo yum update -y` on `PrivateInstance` failed as there is no internet access.

### Creating a NAT Gateway

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734976215951/a0152ebd-37f2-45a5-8808-a856e3a0e726.png align="center")

I created a NAT Gateway in the `PublicSubnet`, which allows instances in private subnets to access the internet without allowing external services to initiate connections. The NAT Gateway was allocated an Elastic IP.

<div data-node-type="callout">
<div data-node-type="callout-emoji">❗</div>
<div data-node-type="callout-text"><strong>Important</strong>: Remember to release Elastic IP addresses once you finish using them, as idle Elastic IP incurs charges.</div>
</div>

### Adding Route to NAT Gateway

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734976450012/33629570-ba76-48f0-93b9-57d59a359502.png align="center")

I added a route in the `PrivateRouteTable`, setting `0.0.0.0/0` as the destination and the newly created NAT Gateway as the target.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1734976609409/808a239c-deb7-4ef6-82df-bf3b6c47ed39.png align="center")

This allows `PrivateInstance` to access the internet through the NAT Gateway, while external services cannot initiate a connection with it.

## Conclusion

This AWS setup provides a solid network architecture with proper segmentation between public and private subnets. By leveraging Network Access Control Lists (NACLs), additional security layers are added to restrict or allow traffic at the subnet level, offering more control over inbound and outbound traffic. This ensures a secure and organized VPC setup with controlled access to and from the internet for both public and private resources.