DEV Community: Do Ngoc Tuan Duy

Virtual Private Cloud (VPC) Networking

Do Ngoc Tuan Duy — Mon, 22 Jun 2026 08:26:45 +0000

More AWS Guides

Scenario

So when first come to AWS I overwhalming because there have 200+ services, so which services I first use first. Networking is the most challenging but most crucial part. Anyone can create an EC2 instance. Anyone can create an RDS database. But connecting everything properly is where real cloud engineering begins

If your networking foundations are strong subnets, routing, NAT, security groups, NACLs, DNS you can troubleshoot almost any cloud issue. And trust me, networking problems are the reason behind most outages.

By the end of this article, you'll:
✅ Understand the what is VPC, NACLs, security group and how to manage access in the AWS.
✅ Know the flow of the network traffic go and in the AWS resources and how to control them.
✅ Network is the fundemental that help we deep dvie into more AWS services

Quick Theory

Amazon Virtual Private Cloud(VPC):

A VPC is a logically isolated portion of the AWS cloud within a region
Subnets are created within AZs
You can launch EC2 instances into your VPC subnets
The VPC router takes care of the routing within the VPC or outside the VPC and to different network. So in the AWS you can't see the router but you can see the route table instead.
The route table is used to configure the VPC router
An Internet Gateway is attached to a VPC and used to connect to the internet. There are two flow:
1. Sending data out to the internet( egress traffic)
2. And in from the internet( ingress traffic)

Note: So we must configure the route table with the route to the Internet Gateway that tell it to send all traffic that doesn't fit one of the network in the route table before it to the internet gateway

You can create multiple VPCs in the region, each VPC has a CIDR block. That's a overall block of addresses from which you can create addresses you can assign to your subnets. So it's a kind of like a master block of addresses

Amazon VPC Components

Amazon VPC Core Knowledge

A virtual private cloud (VPC) is a virtual network dedicated to your AWS account
Similar to having your own data center inside AWS
It is logically isolated from other virtual networks in AWS Cloud
Provides complete control over the virtual networking enviroment including selection IP of ranges, creation of subnets, and configuration of roue tables and gateway
You can launch your AWS resources, such as Amazon EC2 instances, into your VPC
When you create a VPC, you must specify a range of IPv4 addresses for the VPC in form of a Classless Inter-Domain Routing (CIDR) block; for examples, 10.0.0.0/16
A VPC spans all the Availability Zones in the region
You have full control over who has access to the AWS resources inside your VPC
By default you can create up to 5 VPCs per region
A default VPC is created in each region with subnet in each AZ --> Always public subnets

NOTE: The diagram below show the Flow of my VPC which I devided into public subnet and private subnet. The public subnet for services that can directly connect to the Internet via the Internet Gateway. In the other hand, the private subnet is for internal use like: database, web, file server. So when that internal services want to access the outside network, it will need the NAT gateway. The cost of the NAT gateway is $0.045 per hour. Public IPv4 addresses and internet data transfer out incur extra charges

First you create the Elastic IP address( EIP)

Then use it for the NAT gateway and apply for your private subnet

Check your route table of private route

Add one route in your route table to your NAT Gateway for the traffic know the way to go Internet

After all the set up completed:

Security Group and Network ACLs

NACLs:

NACLs apply at the subnet level
NACLs apply only to traffic entering/exiting the subnet Security group:
Security Groups apply at the instances level
Security Groups can be applied to instances in any subnet

Stateful vs Stateless Firewalls
NACLs - Stateless
Security Group - Stateful
A stateful firewall allows the return traffic automatically
A stateless firewall checks for an allow rule for both connections

Security Group support allow rule only
A Source can be IP address or security group ID

NACLs has explicit deny

Build the infrastructure and understand Terraform

Do Ngoc Tuan Duy — Thu, 14 May 2026 07:26:50 +0000

More AWS Guides

Scenario

In the previous section, we know how to set up Terraform on Ubuntu24.04. Now, in this section we will learn how to use the Terraform to Initialize and manage the infrastructure. Not by using AWS console, but use the CLI instead.

By the end of this article, you'll:
✅ Understand the Terraform workflow
✅ Write .tf file
✅ Create an actual S3 bucket and EC2 on AWS
✅ Understand what a state file
✅ Clean up resources properly

Quick Theory: The Terraform Workflow

Before we dive in, there are 4 commands that we need to know form the core Terraform workflow. You'll use these commands in every project, whether you're creating a simple S3 bucket or a complex multi-tier application with many services on AWS.

terraform init      #Initialize the providers
terraform plan      #See what resources will change
terraform apply     #Build the real insfrastructure
terraform destroy   #Clean up the resources after using

Understanding Terraform Files

Terraform uses files extension .tf written in HCL (HashiCorp Configuration Language). It's much simpler than it sounds!

Basic Structure:

# This is a comment

block_type "label" "name" {
  argument = "value"
  another_argument = 1234
}

Three main block types we'll use when edit the configuration:

terraform - Configuration settings
provider - Which cloud (AWS, Azure, GCP)
resource - What to create (S3, EC2, RDS etc...)
Ok now you see it simlifier than before right. Let's see them in action!

🛠️ Hands-On: Create Your First S3 Bucket

Step 1: Create Your Project Directory

# Create a directory for Terraform project
mkdir -p ~/terraform-project
cd ~/terraform-project

Create mns3.tf

nano mns3.tf # or use your favorite editor vim, vscode, etc...

Step 2: Write Your First Terraform Code

terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "ap-southeast-1" #Choose the region that closest your country
}

# Create two S3 buckets
resource "aws_s3_bucket" "logs" {
  bucket = "my-app-logs-shoeshop-2026"

  tags = {
    Name        = "Application Logs"
    Environment = "Development"
    Purpose     = "Logging"
  }
}

resource "aws_s3_bucket" "backups" {
  bucket = "my-app-backups-shoeshop-2026"

  tags = {
    Name        = "Application Backups"
    Environment = "Development"
    Purpose     = "Backup Storage"
  }
}

# Outputs
output "logs_bucket_id" {
  value = aws_s3_bucket.logs.id
}

output "backups_bucket_id" {
  value = aws_s3_bucket.backups.id
}

⚠️ Important: Change the bucket name = "my-app-logs-shoeshop-2026" and "my-app-backups-shoeshop-2026" to differnt name because S3 bucket names must be globally unique across ALL AWS accounts!

Save the file

🚀 The 4 Commands in Action

Now comes the exciting part! Let's run our 4 magic commands.

Command 1: terraform init

This downloads the AWS provider plugin.

terraform init

You'll see:

What just happened?

Terraform downloaded the AWS provider plugin
Created a .terraform/ directory (hidden folder)
Created .terraform.lock.hcl file (locks provider versions)

Pro Tip: You only need to run init once per project, or when you add new providers.

Command 2: terraform plan

This show you what Terraform will create (you can preview the change before apply it).

terraform plan

You'll see:

Understanding the output:

means "will be created" ~ means "will be modified" (you'll see this later)
means "will be destroyed" (known after apply) means AWS will generate this value This is your safety check! Always review the plan before applying.

Command 3: terraform apply

This actually creates the resources on AWS.

terraform apply

Type yes and press Enter.

You'll see:

🎉 Congratulations! You just created your first AWS resource with code!

Verify in AWS Console

Let's confirm it's really there:

Go to AWS S3 Console
You should see two bucket: my-app
Click on it and check the Tags tab - you'll see all the tags you defined!
This is the "enjoy!" moment - you created AWS infrastructure without clicking through the console!

🗂️ Understanding the State File

After running terraform apply, you'll notice a new file: terraform.tfstate

ls -al

You'll see:

.terraform/
.terraform.lock.hcl
main.tf
terraform.tfstate

What is the State File?

The state file is Terraform's memory. It stores:

What resources Terraform created
Current configuration of those resources
Metadata and dependencies Let's peek inside:

cat terraform.tfstate

You'll see JSON with details about your S3 bucket - its name, ARN, region, tags, etc.

Why Does State Matter?

When you run terraform plan or terraform apply again, Terraform:

Reads the state file to know what exists
Compares it with your .tf files
Calculates what needs to change Without state, Terraform wouldn't know what it created!

⚠️ Important State Rules:

Never edit state files manually
Never delete state files (you'll lose track of resources)
Never commit state files to Git (they contain sensitive data)

🧪 Let's Make a Change

Now let's see Terraform's power - making changes to existing infrastructure.

Edit mns3.tf file and add a new tag:

terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "ap-southeast-1"
}

# Create two S3 buckets
resource "aws_s3_bucket" "logs" {
  bucket = "my-app-logs-shoeshop-2026"

  tags = {
    Name        = "Application Logs"
    Environment = "Development"
    Purpose     = "Logging"
    LastUpdated = "Today" # <- Add this new tag
  }
}

resource "aws_s3_bucket" "backups" {
  bucket = "my-app-backups-shoeshop-2026"

  tags = {
    Name        = "Application Backups"
    Environment = "Development"
    Purpose     = "Backup Storage"
    LastUpdated = "Today"  # <- Add this new tag
  }
}

# Outputs
output "logs_bucket_id" {
  value = aws_s3_bucket.logs.id
}

output "backups_bucket_id" {
  value = aws_s3_bucket.backups.id
}

Run plan again:
terraform plan
You'll see:

# aws_s3_bucket.backups will be updated in-place
  ~ resource "aws_s3_bucket" "backups" {
        id                          = "my-app-backups-shoeshop-2026"
      ~ tags                        = {
            "Environment" = "Development"
          + "LastUpdated" = "Today"
            "Name"        = "Application Backups"
            "Purpose"     = "Backup Storage"
        }
      ~ tags_all                    = {
          + "LastUpdated" = "Today"
            # (3 unchanged elements hidden)
        }
        # (14 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # aws_s3_bucket.logs will be updated in-place
  ~ resource "aws_s3_bucket" "logs" {
        id                          = "my-app-logs-shoeshop-2026"
      ~ tags                        = {
            "Environment" = "Development"
          + "LastUpdated" = "Today"
            "Name"        = "Application Logs"
            "Purpose"     = "Logging"
        }
      ~ tags_all                    = {
          + "LastUpdated" = "Today"
            # (3 unchanged elements hidden)
        }
        # (14 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Notice the ~ symbol - it means "modify existing resource"!
Apply the change:
terraform apply
Type yes when prompted.

Check AWS Console - your bucket now has the new tag!

This is Infrastructure as Code magic - you changed infrastructure by editing a text file!

🧹 Command 4: terraform destroy

Always clean up resources you're not using (to avoid unexpected charges).

terraform destroy

Terraform will show what it will delete:

# aws_s3_bucket.logs will be destroyed
  - resource "aws_s3_bucket" "logs" {
      - bucket                      = "my-app-logs-shoeshop-2026" -> null
          - "Environment" = "Development"
          - "LastUpdated" = "Today"
          - "Name"        = "Application Logs"
          - "Purpose"     = "Logging"
        } -> null
          .....
        }
    }

Plan: 0 to add, 0 to change, 2 to destroy.

Type yesto confirm.

Verify in AWS Console - your bucket is gone!

🎓 What You Just Learned

Let's recap what you accomplished:

✅ The Terraform Workflow:
init - Initialize project
plan - Preview changes
apply - Create resources
destroy - Clean up

✅ HCL Basics:
terraform block (configuration)
provider block (cloud provider)
resource block (what to create)
output block (display information)

✅ State Management:

State file tracks resources
Never edit state manually
State enables change detection

✅ Real Infrastructure:

Created actual AWS S3 bucket
Modified existing resource
Destroyed resources cleanly

Installing Terraform and Setting Up EC2 Environment for Ubuntu24.04

Do Ngoc Tuan Duy — Sun, 03 May 2026 10:45:31 +0000

More AWS Guides

In this guide, we will walk through the step-by-step process of installing Terraform and preparing your local environment for infrastructure automation.

What You'll Learn

Install Terraform on Linux
Install AWS CLI
Configure AWS credentials
Verify your setup

Step 1: Install Terraform

# Update package list
sudo apt-get update

# Install required packages
sudo apt-get install -y gnupg software-properties-common wget gpg

# Add HashiCorp GPG key
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
gpg --no-default-keyring --keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg --fingerprint

# Add HashiCorp repository
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
sudo tee /etc/apt/sources.list.d/hashicorp.list

# Update and install Terraform
sudo apt-get update
sudo apt-get install -y terraform

Verify Installation

terraform version

Expected Output

Step 2: Install AWS CLI (Recommended)

# Download AWS CLI installer
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"

# Install unzip if not present
sudo apt-get install -y unzip

# Unzip the installer
unzip awscliv2.zip

# Run the installer
sudo ./aws/install

#Check version
aws --version

# Clean up
rm -rf aws awscliv2.zip

Step 3: Create IAM User for Terraform

In AWS Console:

Go to IAM → Users → Create User
Username: terraform (or your preferred name)
Select "Provide user access to the AWS Management Console" (optional)
Attach policies: AdministratorAccess (for learning; use restricted policies in production)
Create user
Go to Security Credentials → Create Access Key
Select "Command Line Interface (CLI)"
Download or copy:
Access Key ID
Secret Access Key

Step 4: Configure AWS Credentials

aws configure

You'll be prompted for:

AWS Access Key ID [None]: <YOUR_ACCESS_KEY_ID>
AWS Secret Access Key [None]: <YOUR_SECRET_ACCESS_KEY>
Default region name [None]: ap-southeast-1 (or your preferred region)
Default output format [None]: json

Verify Configuration

aws sts get-caller-identity

Step 5: Set Up Your Working Directory

# Create project directory
mkdir -p ~/terraform-projects
cd ~/terraform-projects

# Create your first project folder
mkdir my-first-terraform
cd my-first-terraform

Step 6: Test Your Setup

Create a simple test file with nano test.tf:

terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-southeast-1"
}

# This is just a test - we won't create any resources yet
output "account_id" {
  value = data.aws_caller_identity.current.account_id
}

data "aws_caller_identity" "current" {}

Run Terraform commands:

# Initialize Terraform
terraform init

# Validate configuration
terraform validate

# See what would happen (no resources created)
terraform plan

Expected Output:

Terraform has been successfully initialized!
Success! The configuration is valid.
Changes to Outputs:
  + account_id = "300374333197"

Clean up test file:

rm test.tf
rm -rf .terraform .terraform.lock.hcl