NODELOG by THIVELAB
Subscribe
Home/Engineer/Cloud/AWS VPC Network Design — Sub…
CloudIntermediateawsvpcnat

AWS VPC Network Design — Subnets, Routing, and Security Groups

Explains how to build an AWS network: create a VPC, design public and private subnets, and configure an Internet Gateway, NAT Gateway, route tables, security groups, and NACLs.

NONodelog0 views
Contents
  1. VPC Fundamentals
  2. Create a VPC
  3. Subnet Design (2-AZ Pattern)
  4. Internet Gateway + NAT Gateway
  5. Route Table Configuration
  6. Security Group Design
  7. VPC Flow Logs (Network Audit)

VPC Fundamentals

ComponentRole
VPCIsolated virtual network (define a CIDR block)
SubnetIP range segments inside the VPC (public / private)
Internet Gateway (IGW)Internet egress for public subnets
NAT GatewayLets private subnets reach the internet outbound-only
Route tableTraffic path rules
Security group (SG)Instance-level stateful firewall
NACLSubnet-level stateless firewall

Create a VPC

Bash
# Create VPC (CIDR: 10.0.0.0/16)
aws ec2 create-vpc   --cidr-block 10.0.0.0/16   --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=my-vpc}]'

# Enable DNS hostnames
aws ec2 modify-vpc-attribute   --vpc-id vpc-xxxxxxxx   --enable-dns-hostnames

Subnet Design (2-AZ Pattern)

Bash
# Public subnets (load balancer, NAT GW)
aws ec2 create-subnet   --vpc-id vpc-xxxxxxxx   --cidr-block 10.0.1.0/24   --availability-zone ap-northeast-2a   --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-2a}]'

aws ec2 create-subnet   --vpc-id vpc-xxxxxxxx   --cidr-block 10.0.2.0/24   --availability-zone ap-northeast-2c   --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-2c}]'

# Private subnets (app servers, DB)
aws ec2 create-subnet   --vpc-id vpc-xxxxxxxx   --cidr-block 10.0.11.0/24   --availability-zone ap-northeast-2a   --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-2a}]'

aws ec2 create-subnet   --vpc-id vpc-xxxxxxxx   --cidr-block 10.0.12.0/24   --availability-zone ap-northeast-2c   --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-2c}]'

Internet Gateway + NAT Gateway

Bash
# Create and attach an Internet Gateway
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway   --vpc-id vpc-xxxxxxxx   --internet-gateway-id igw-xxxxxxxx

# Allocate an Elastic IP (for NAT GW)
aws ec2 allocate-address --domain vpc

# Create a NAT Gateway (place it in a public subnet)
aws ec2 create-nat-gateway   --subnet-id subnet-public-2a   --allocation-id eipalloc-xxxxxxxx   --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=nat-gw}]'

Route Table Configuration

Bash
# Public route table (→ IGW)
aws ec2 create-route-table --vpc-id vpc-xxxxxxxx
aws ec2 create-route   --route-table-id rtb-public   --destination-cidr-block 0.0.0.0/0   --gateway-id igw-xxxxxxxx

# Associate public subnets
aws ec2 associate-route-table --subnet-id subnet-public-2a --route-table-id rtb-public
aws ec2 associate-route-table --subnet-id subnet-public-2c --route-table-id rtb-public

# Private route table (→ NAT GW)
aws ec2 create-route-table --vpc-id vpc-xxxxxxxx
aws ec2 create-route   --route-table-id rtb-private   --destination-cidr-block 0.0.0.0/0   --nat-gateway-id nat-xxxxxxxx

aws ec2 associate-route-table --subnet-id subnet-private-2a --route-table-id rtb-private
aws ec2 associate-route-table --subnet-id subnet-private-2c --route-table-id rtb-private

Security Group Design

Bash
# ALB security group (Internet → ALB)
aws ec2 create-security-group   --group-name sg-alb   --description "ALB Security Group"   --vpc-id vpc-xxxxxxxx

aws ec2 authorize-security-group-ingress   --group-id sg-alb-id   --protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress   --group-id sg-alb-id   --protocol tcp --port 443 --cidr 0.0.0.0/0

# App server security group (ALB → app)
aws ec2 create-security-group   --group-name sg-app   --description "App Server SG"   --vpc-id vpc-xxxxxxxx

# Allow port 3000 only from the ALB SG
aws ec2 authorize-security-group-ingress   --group-id sg-app-id   --protocol tcp --port 3000   --source-group sg-alb-id

# DB security group (app → DB)
aws ec2 create-security-group   --group-name sg-db   --description "Database SG"   --vpc-id vpc-xxxxxxxx

aws ec2 authorize-security-group-ingress   --group-id sg-db-id   --protocol tcp --port 5432   --source-group sg-app-id

VPC Flow Logs (Network Audit)

Bash
aws ec2 create-flow-logs   --resource-type VPC   --resource-ids vpc-xxxxxxxx   --traffic-type ALL   --log-destination-type cloud-watch-logs   --log-group-name /aws/vpc/flowlogs   --deliver-logs-permission-arn arn:aws:iam::ACCOUNT:role/FlowLogsRole
#aws#vpc#nat
Editorial note

AI tools may assist drafting. Check the evidence in each guide for whether commands were run and which environment was used. Confirm the current docs for your version before applying instructions, and email us about errors. email us

Topic-related official docs (auto-linked · not per-claim sources)AWS documentation ↗OWASP documentation ↗web.dev Core Web Vitals ↗
How we write and review →Editorial policy →

Questions & answers

Ask a question about this guide. We'll review and reply.