# Amazon VPC for Secure and Scalable Infrastructures

In this blog, we will deep dive into one of the important services of AWS i.e. VPC. VPC is abbreviated as the Virtual Private Network.

Virtual Private Clouds (VPCs) have become a major factor in building scalable and secured infrastructures. It provides a way to create isolated and customizable networks within the cloud environment, offering businesses the flexibility and control they need. In this blog post, we will delve into the components that make up a Virtual Private Cloud and explore how they work together to create a robust and secure networking foundation.

**Why do we need VPC?**

* Isolation and Security
    
* Customization of Network Architecture
    
* Scalability
    
* Hybrid Cloud Connectivity
    
* High Availability and Fault Tolerance
    

### Components of VPC

1. **VPC:** The VPC itself is the top-level container that holds all other components. It is a logically isolated section within the cloud where users can deploy their resources and make it more secure. VPCs allow any organization or users to define their IP address range, route tables, and subnets.
    
2. **Subnets:** Subnets are subdivisions of a VPC and are associated with a specific availability zone. Subnets allow us to isolate and group resources based on the user's needs.
    
3. **Route Tables:** Route tables define the rules for routing traffic within the VPC. Each subnet is associated with a route table, determining how traffic is directed. Route tables control the flow of traffic between subnets and the internet, ensuring proper communication.
    
4. **Internet Gateway (IGW):** The Internet Gateway is a component that facilitates communication between instances within the VPC and the Internet. It acts as a gateway for outbound and inbound traffic, allowing instances to access the internet and be accessed from the internet.
    
5. **Network Access Control Lists (NACLs):** NACLs are stateless filters that control traffic at the subnet level. They act as a firewall, allowing or denying traffic based on rules defined by the user. NACLs are operated at the subnet level and provide an additional layer of security.
    
6. **Security Groups:** Security Groups are stateful firewalls that operate at the instance level. They control inbound and outbound traffic for instance by defining rules.
    
7. **Elastic Load Balancer (ELB):** ELB is a service that automatically distributes incoming application traffic across multiple targets, such as EC2 instances, in multiple availability zones.
    
8. **Virtual Private Network (VPN) and Direct Connect:** VPN establishes a secure tunnel over the public internet, while Direct Connect provides a dedicated network connection.
    
9. **Elastic IP Addresses:** Elastic IP addresses provide a persistent IP address that remains associated with an instance, even if it is stopped and restarted.
    
10. **Peering Connections:** VPC peering allows the connection of two VPCs, enabling them to communicate with each other as if they are within the same network. It is useful when resources from different VPCs need to interact.
    

Now we know the basic terminologies that are used at the VPC level. Its time for us to practically implement and know the usage of AWS VPC services.

**Search VPC > click on VPC > create VPC**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704865239878/612dc5f3-bf6d-485f-a8e2-b3683b0e7059.png align="center")

In clicking Create VPC, you will be prompted to fill in the details below:

> Resources to creat : VPC and more
> 
> Name tag auto-generation: aws-prod-project
> 
> IPv4 CIDR block\*\*:\*\* default
> 
> IPv6 CIDR block: No ipv6
> 
> Tenancy: default
> 
> Number of Availability Zones (AZs): 2
> 
> Number of public subnets:2
> 
> Number of private subnets:2
> 
> NAT gateways : 1 per AZ
> 
> VPC endpoints: None

Then click on Create VPC

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704865925822/eff042b8-a7ff-48af-852a-a7935c5420ea.png align="center")

This is the configuration that I have done.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704866134293/bfe2b8fb-b3da-4956-94dc-b0047fef9c93.png align="center")

Our VPC is successfully created

Create ec2 with the autoscaling group

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704866636598/f985f407-d5a2-407e-a0e7-bbf86fd5802b.png align="center")

In AWS autoscaling group cannot be created directly, we need to choose ***Create Launch Template.***

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704866997203/28be6e69-585c-4420-9648-21037030cc7e.png align="center")

In the launch template page,enter the required details

* Launch template name *\- required: aws-demo-proj*
    
* Template version description: describe the template
    
* Application and OS Images (Amazon Machine Image) - required: choose any supposed Ubuntu
    
* AMI: Free tier
    
* instance type: t2.micro (Free Tier)
    
* key pair: use existing or create a new key pair
    
* In **Network settings,** subnet: default (do not change)
    
* Firewall (security groups): create a security group
    
    \-Add a security group name, description
    
* VPC: Choose a newly created VPC
    
* ##### Inbound Security Group Rules: add 2 rules ssh(to access ec2 instance) and custom TCP (port 8000 to access the application)
    
* Remaining all as it is (Default)
    

Click Create Launch Template

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704868093558/a142aecf-4e4a-4b76-999f-ab53c8e7394c.png align="center")

This is a sample of how I configured the template.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704868230253/93baa9fe-30a1-455e-a163-bf472527b51c.png align="center")

Our template is successfully created and now create the autoscaling group.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704868382171/b939b293-4bc1-4d9f-83eb-dc38a241e46b.png align="center")

Our template is now available, if you cannot see the template just refresh the page. After adding the details click next.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704868574792/1d1598dc-9c51-4ac0-b069-93f2e3d0b198.png align="center")

Here we have chosen our VPC and in the Availability Zones and subnets, we choose the private subnets since we want our instances in the private subnet as in the architecture of the project.

Click on Next.

Configure advanced options: keep everything default

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704868811728/90850092-5945-40ba-8cf4-05c0e3189e20.png align="center")

Click on Next.

In the Configure group size, keep desired capacity=2, min.=1, and max=4

Automatic scaling= No scaling policies

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704868914473/bdf3135f-ab93-479e-a806-e66b16424302.png align="center")

Click on Next and after this all are optional to add notifications and tags. I have skipped these and created the autoscaling group.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704869164713/2050f9f7-6a4b-455c-b80f-1de0733e1b89.png align="center")

We can see our 2 instances are launched as we kept desired state as two.

Now let's verify whether the autoscaling group has created instances in us-east-1a and us-east-1b.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704869316882/894e01a5-c317-4564-919c-ce663501f577.png align="center")

Perfect the autoscaling group has created the two instances in two zones in the private subnet.

Before creating an application load balancer we need to install the application in the server(instances).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704869569801/122ba631-1450-409b-9f09-9576a290cd9b.png align="center")

Since we need the public IPV4 address to ssh into any instance. We can see clearly in the image we have no IPv4 address as it is in a private subnet and we don't want our server to be access public. To solve this issue, a bastion host comes into the picture. Bastion host acts as a mediator between private subnet and public subnet.

So we will create a bastion host in the public subnet and try to access the server.

The process is the same to create a bastion host as creating the instance but in a bastion host, three important points are: **VPC -** choose the same VPC in which the above-created servers are running, choose auto-assign public IP **enable** and inbound rules **allow ssh.**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704870288872/92925814-9512-4914-9ee9-442207be2d47.png align="center")

Click on the launch instance.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704870427141/c5fa2f6f-8f6c-4afd-8bae-4cc305f1128b.png align="center")

Our instance is created and we will SSH into the bastion host and from this we will try to access the other two instances and install the application.

To get access to two of these private subnets, we also need a key-pairs file in Bastion. So we will copy our pem file in Bastion host also.

```bash
scp -i ~/Downloads/nod.pem ~/Downloads/nod.pem ubuntu@3.238.77.37:/home/ubuntu
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704871035871/12709912-0129-4cbd-9d90-5be5c5bdd525.png align="center")

Now let's access the bastion-host instance using SSH protocol

```bash
ssh -i .pem_fiel ubuntu@3.238.77.37
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704871191453/dddf9d43-4b10-471b-95d8-99de8c1d419e.png align="center")

We have done this step successfully.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704872435759/01cec4fa-16c4-47e5-a72e-68eb57256e16.png align="center")

We can see our pem file is available in the instance. Now we will SSH into the other instance using the same pem file.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704872528157/a3e7415d-91e5-4469-999b-90e3796ef544.png align="center")

As of now we are in the bastion-host instance and from here we will ssh into instance 1 using its private IP address

```bash
ssh -i pemfile ubuntu@private_ip
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704872671730/a4e4140a-8fc2-4ba5-8c2d-8523f042a1ac.png align="center")

We can see the private IP of instance 1 so we have access to the instance. In this instance, we will create a very simple application and run it on port 8000.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704872889265/b718cf30-bba3-4322-82c0-f802ecbe4b84.png align="center")

In the same way, we will create our second application on instance 2.

```bash
ssh -i nod.pem ubuntu@10.0.138.152
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704879004258/20a8189a-602f-4748-8dd5-fdb12b24d662.png align="center")

Now, Create a Load balancer and attach these instances as target groups

In the EC2 Dashboard select load balancers. Then click on Create the load balancer.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704873055813/4ba70d63-fa53-47e8-aa79-c737b6954b60.png align="center")

In the next step select Application load balancer.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704877328745/d3a73bd5-3e22-464f-8e03-ec77ac66a26c.png align="center")

Click create.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704877372204/4548dc5b-d08b-44ab-b668-a364916fbb95.png align="center")

Give the name to the load balancer and it must be internet-facing and has an IPV4 address type.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704877436827/5b8f8636-ea9d-46dc-af78-7b7ec3afdc15.png align="center")

Choose the VPC that we created earlier as our servers are running on that VPC. In Loadbalancer we need to select the public subnets for mapping.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704877511925/cdf69d99-1acb-4046-9c10-4f56229eef64.png align="center")

Select the Create security groups and port 80. For default action, if there is no any security group, click on Create Security group.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704877798461/c2bb43cd-3569-4476-b57e-de9fb77e2072.png align="center")

Choose instance as our target, give the target group name, keep other default, and choose next.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704877919327/ade7adda-ca4a-43b1-b3c8-4e80fafdf297.png align="center")

Select the target instances in which the application will be running or application is running and also click include as pending below. Then click Create Target group.

In the load balancer configuration select the recently created target group.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704878109384/91c2976f-00d3-4b76-b63d-3b1c910af44e.png align="center")

Finally, our load balancer is created and also we can see the HTTP protocol at port 80 is not reachable. So click on the Security tab, choose security group, and in the inbound rule add HTTP at port 80.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704878369997/4c28b3e2-96f6-41a6-96a6-482ceb9065d1.png align="center")

Now let's check the load balancers.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704878453296/ba700157-231a-427c-8b44-e4d6a8ce7d79.png align="center")

Now it is reachable.

To check the health status of the Targets click on the project name.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704878409192/1b868309-679e-4200-aa3c-317c226b13db.png align="center")

We can see our servers are both healthy. We will try to access our applications using this link [aws-prod-project-1090487507.us-east-1.elb.amazonaws.com](http://aws-prod-project-1090487507.us-east-1.elb.amazonaws.com), it will be available under the Details section (DNS name) in the load balancer page.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704878699298/f5eff12a-3e13-4696-885a-7370d485a29f.png align="center")

Our first application is perfectly running.

Again let's try to access the same URL in another tab.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704878721506/da9f20a3-b942-4008-93a5-f0d0a5adca2c.png align="center")

We can see our second app running on the second server is loaded successfully. Hence the load balancer has successfully distributed the server requests.

We covered the basic building blocks like subnets and route tables, and walked through practical steps for setting up a secure and scalable cloud environment. Think of VPCs as the foundation for creating a safe and flexible space in the cloud, and learning about them is a valuable skill for anyone working with online services.

Happy Learning!!