
#### Table of Contents

1. Create a VPC
2. Create 2 Subnets
3. Create an Internet gateway
4. Create NAT Gateway
5. Create and Update Route Tables
6. Create public and private EC2 Instance
7. SSH to public EC2
8. SSH to private EC2

This blog shows how to create VPC in scratch

1. Create VPC

2. Create 2 Subnets

3. one for public Subnet and another for a private Subnet

4. Create Internet Gateway

5. Create a Route Table

6. Create 2 EC2 Instances

7. one public instance and another one is a private instance

8. Setup NAT Gateway for private EC2 instance

## Create a VPC

Go to VPC and click create VPC, start to enter information to create VPC.

  - Enter any name for the name field

  - IPv4 CIDR, enter IPv4 range as `10.0.0.0/16`

  - Choose `Amazon provided IPv6 CIDR block`

  - Tenancy, choose Default if wish to use as Tenancy

after creating VPC, AWS will generate following AWS default services.

  - Default route table

  - Network ACL

  - Default Security Group

## Create 2 Subnets

Create a public subnet, click the Subnets link, and click Create subnet.

  - Name, enter any meaningful name.

  - **VPC**, choose the VPC just created

  - **Availability Zone**, choose the AZ for this subnet

  - **IPv4 CIDR block**, enter **10.0.1.0/24** as IPv4
CIDR block

  - **Modify auto-assign IP settings**, enable auto-assign IP
address for the public subnet

Create a private subnet, by click the **Create subnet** button.

  - Name, enter any meaningful name.

  - **VPC**, choose the VPC just created

  - **Availability Zone**, choose the AZ for this subnet

  - **IPv4 CIDR block**, enter **10.0.2.0/24** as IPv4
CIDR block

  - **Modify auto-assign IP settings**, private subnet doesn't need
to enable public IP address

## Create an Internet gateway

Create Internet gateway so public subnet is able to access to the Internet.
Click the **Internet Gateways** and click the Create Internet
gateway button.

  - Name, enter any value for this internet gateway.

  - Attach this internet gateway to the **VPC** just created

## Create NAT Gateway

Create NAT Gateway so private EC2 will be able to connect to the Internet and
download software if need. Click
**Create NAT Gateway** button

  - Click **Create NAT Gateway** button

  - **Subnet**, choose the public subnet

  - click allocate the IP address

  - Click **Edit route table**

  - Click **Add route**

  - **Destination**, enter **0.0.0.0/0**

  - **Target**, choose NAT Gateway just create

## Create and Update Route Tables

Use default route table as default main route table, and associate to the
private subnet.

  - Choose the main route table and click the
**Subnet Associations**

  - Choose the private subnet

**Create a route table** to use as a public route.

  - Name, enter any name for this new route table

  - Choose the VPC just created earlier

  - Click subnet associations and choose the public subnet

  - **Click Edit routes** and click **Add route**

  - Destination, enter `0.0.0.0/0` for IPv4 address

  - Target, choose the **Internet gateway created earlier**

That's all for set up public and a private subnet for VPC, now we'll need to
create EC2 and attach to use this VPC

## Create public and private EC2 Instance

Let's create public EC2 instance first, go to EC2, and click instance to
create a new EC2 instance.

  - Enter configure instance details

  - **Network**, choose the custom VPC just created

  - **Subnet**, choose the public subnet created earlier

  - The rest just using the default settings and create a new instance

Let's create private EC2 instance, go to EC2, and click instance to create a
new EC2 instance.

  - Enter configure instance details

  - **Network**, choose the custom VPC just created

  - **Subnet**, choose the private subnet created earlier

  - The rest just using the default settings and create a new instance

## SSH to public EC2

Testing the EC2 by SSH into Public EC2 instance and download software from the
internet. The following are examples of how to SSH into EC2 from Mac OS.

  - cd to the location has the **private key**, something
looks like **mykey.pem**.

<
  - `chmod 400 {your_private_key.pem}`

  - SSH into EC2 by
`ssh ec2-user@{ec2 public IP address} -i {your_private_key.pem}`

  - run `sudo yum update` to download software

  - if able to download the software then this EC2 is able to connect to the
Internet

## SSH to private EC2

Testing the EC2 by SSH into private EC2 instance and download software from
the internet. Following is an example of how to SSH into EC2 from Mac OS.

  - ssh into the public EC2 instance

  - download the private key

  - ssh into the private EC2 by using the private IP

  - `chmod 400 {your_private_key.pem}`

  - SSH into EC2 by
`ssh ec2-user@{ec2 private IP address} -i {your_private_key.pem}`

  - run `sudo yum update` to download software

  - if able to download the software then this EC2 is able to connect to the
Internet


This blog shows how to create AWS VPC from scratch.

How to Create VPC with Public and Private Subnet


#### Table of Contents

1. Setup Custom VPC
2. Create VPC
3. Create Subnet
4. Create Internet Gateway
5. Setup Route Table
6. Setup EC2

This blog will show how to create an AWS application load balancer with custom
VPC's EC2 instances.

## Setup Custom VPC

### Create VPC

Go to VPC and click create VPC, enter the VPC field as below example.

  - Name tag: enter your VPC name

  - IPv4 CIDR block: enter your CIDR block IP range

  - IPv6 CIDR block: choose IPv6

  - Network Border Group

  - Tenancy: Default (you can choose if you want to single-tenant, dedicated
hardware or not)

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/nuz1eaznan55ydjdddu7)

### Create Subnet

We'll need 2 subnets to create the Application Load Balancer.

  - Name tag: enter any name

  - VPC: choose the VPC just created

  - Availability Zone: choose the availability zone

  - IPv4 CIDR block: 172.0.1.0/24

  - IPv6 CIDR block: don't assign IPv6 (don't need IPv6 for this blog)

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80/aggjgcq8l3r1bwcph1tx)

Create the second subnet, for creating Application Load balancer, you'll need
at least 2 subnets.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/ghlpqgdiuqnatp4ny9ay)

set auto-assign IP, so EC2 instance will get the public IP address.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/xg8k03u4q3dgungcdoxn)

### Create Internet Gateway

Create an internet gateway and attach the custom VPC.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/i6iajudvzm9jz30wo1fk)

### Setup Route Table

Create a route table for the subnet

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/dzm3594cl2omwejqms3h)

associate subnet to the route table

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/vgcmhjrsooaksk2t1ln3)

set route table to use the internet gateway for internet, enter the routes
as following

Destination: 0.0.0.0/0 (for IPv4 Access)

Target: choose the Internet gateway

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/krwph6pibjm8zbxyg6xn)

Now, VPC setup is done, we can use this custom VPC to create your own EC2.

## Setup EC2

We'll set up EC2 with simple Php code, let's leave everything as a default
setting and create 2 EC2 Instance.

  - Choose AMI (For example, choose Amazon AMI)

  - Choose General Purpose: t2.micro

  - Configure Instance Details

    - Network: choose the VPC just created

    - Subnet: choose the subnet just created

    - Leave everything as default

    - Put following to User Data field, this will start PHP simple
site.

    - ```
#!/bin/bash
yum update -y
yum install httpd -y
chkconfig httpd on
service httpd start
cd /var/www/html
echo "hi, server-01" > index.html
```



  Configure Security Group

    - add port 80 so it will be accessible from the browser.




Now, let's create another EC2 instance. Setup everything as the first one,
  except the User data, change to server-02 as following


```
#!/bin/bash
yum update -y
yum install httpd -y
chkconfig httpd on
service httpd start
cd /var/www/html
echo "hi, server-02" > index.html
```


## Create Target Groups


Let's create a target group for Application Load Balancer, this blog only
  trying to set up HTTP only.


  - Target type choose Instances

  - Enter any name for the target group name

  - Protocol - Http - 80

  - Choose the VPC

  - Health checks


    - Enter the path



  Choose available instances
  Click Create Target Group
  Creating a target is done and associated with a list of instances.

## Create Registered targets


Click registered targets and add EC2 instance by choose 2 EC2 instance and
  click include as pending


![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/p18kpugbrz9g2tyeekvt)


## Create Application Load Balancer


  - Click Create Load Balancer

  - Choose Application Load Balancer

  - Enter Name

  - Use default Http - 80

  - Choose VPC

  - Choose subnet (here you'll need at least 2 subnet)

  - Choose Security Groups

  - Configure Routing (here, select the target group created earlier)

  - Now, Load Balancer is creating

  - Should be able to see application load between 2 instances


After Application Load Balancer become **active**, copy the dns
  name to the browser you should see the site will change between the two
  server.Now, this is how you can simple provision application load balancer
  with AWS.


![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/rja3y1cqjllbypjmetsl)


This blog will show how to create an AWS application load balancer with custom VPC's EC2 instances.

How to Setup AWS Application Load Balancer


#### Table of Contents

1. Create Flow logs
2. Set up IAM role for flow logs
3. Policy Document

## Create Flow logs

Select the VPC to want to use flow logs, click action then click
**Create flow log**.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/xnbezqoi0trexcc1tokk)

Setup Destination log group

If you choose to send to CloudWatch logs, you'll have to set up a destination
log group. Go to CloudWatch and choose
**Log groups**.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/cys5v8t4cknnyzxtoyyx)

### Set up IAM role for flow logs

Click set up permission on the create VPC flow logs page, this UI will only
show on old UI, which will create the following policy to enable flow logs to
read and write to cloud watch.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/vqxucobcf6pu3jmnmekx)

### Policy Document

```
{
  "Statement": [
    {
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
```

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/bbm4ihsi8xa6ptjawos5)

After setup flow logs, when you hit the EC2 using the VPC, you should see the
following logs from log groups.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/lcbrau7bqjp002gar9sx)


This blog shows how to set up VPC flow logs.

Use VPC Flow Logs


#### Table of Contents

1. Attach IAM role to private EC2 Instance
2. Create a new role and select the AmazonS3FullAccess.
3. enter the name and create the role
4. Attach the role to the private EC2 Instance
5. Create VPC EndPoint
6. Endpoints
7. SSH into Private EC2 Instance

This blog shows how to use VPC Endpoint from private EC2 Instance to S3
without going through the internet, with VPC Endpoint access s3 should be
within AWS service which will be no charge.

## Attach IAM role to private EC2 Instance

Since we'll need to access s3 from EC2 private instance, we'll need to set up
an s3 full access role for EC2 instance.

### Create a new role and select the AmazonS3FullAccess.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/uupxrgghfivz1gfqrk65)

### enter the name and create the role

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/fseyxhqceun1jnyiklqc)

### Attach the role to the private EC2 Instance

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/bkpxw5dbuwhs5dx6zqwg)

## Create VPC EndPoint

### Endpoints

Go to VPC, click the **Endpoints** from Virtual private cloud. At
the Create Endpoint page, choose as following.

  - Service category: AWS services

  - Service name: choose s3, since we only want to access for s3 in this blog,
find the s3 from the list.

  - VPC: choose the VPC you created earlier.

  - Configure route tables: choose the private EC2 instance's route table,
should be the private route table

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/ongwitu8ubczp6uxxvol)

S3 full access role to private EC2

## SSH into Private EC2 Instance

Now, your private EC2 instance should be able to access to s3. Let's type ssh
into ec2 instance and type **aws s3 ls**. This command should
list of s3 buckets if has any.


Category VPC

How to Create VPC with Public and Private Subnet

How to Setup AWS Application Load Balancer

Use VPC Flow Logs

VPC End Point - Use S3 from Private EC2 Instance