AWS VPC: Security and Control from Scratch

VPC Lab: Practical Fundamentals of Cloud Networking

Virtual Private Clouds (VPCs) are the heart of any architecture on AWS.
They are not just virtual networks: They are the foundation of the security, control, and scalability of your solutions.

In this lab, you will learn to design and deploy a VPC from scratch, understanding each architectural decision and its impact on cost, security, and performance.

VPC Lab: Practical Fundamentals of Cloud Networking

🔐Stage 1: From the AWS console, click on VPC to start building a new network.

Step 1: From the AWS console, click on VPC to start building a new network.

Step 2: Define the IPv4 CIDR block: 20.0.0.0/16.

Step 3: Configure public and private subnets across different Availability Zones:
-Public Subnet A → Zone us-east-1a → 20.0.1.0/24
-Public Subnet B → Zone us-east-1b → 20.0.2.0/24
-Private Subnet A → Zone us-east-1a → 20.0.4.0/24
-Private Subnet B → Zone us-east-1b → 20.0.3.0/24

📌 This establishes the foundation of your network, with a clear separation between public and private resources.

🔐Stage 2: Tagging and Governance

Step 4: Create tags such as Owner, Project, etc.

📌 Tags are essential for auditing, cost tracking, and resource management.

🔐Stage 3: Initial Validation

Step 5: The wizard shows the creation process as successful.

Step 6: Review the public and private subnets created along with their IP ranges.

📌 You confirm that the basic infrastructure is active and available.

🔐Stage 4: Route Tables

Step 7: Open the Route Table for the public subnet.

📌 It has its own table named Public.

Step 8: Open the Route Table for the private subnet.

📌 Create a table named Private and associate it with the private subnets.

Note: This separates public and private traffic for better control.

🔐Stage 5: Internet Gateway (IGW)

Step 9: Create an Internet Gateway (IGW) to enable internet access.

Step 10: Confirm the IGW was created successfully.

Step 11: In the Public route table, add a route:
Destination: 0.0.0.0/0
Target: the IGW you created

📌 Public subnets now have direct access to the internet.

🔐Stage 6: NAT Gateway

Step 12: For private subnets, you need controlled internet access.

Step 13: Create a NAT Gateway in a public subnet:
-Select the public subnet (us-east-1a or us-east-1b).
-Allocate and assign an Elastic IP.

Step 14: Confirm the NAT Gateway is created and available.

📌 The NAT Gateway allows private instances to reach the internet without being exposed.

🔐Stage 7: Configuring Private Routes

Step 15: In the Private route table, add a route:
-Destination: 0.0.0.0/0
-Target: the NAT Gateway you created.

Step 16: Save the changes and verify the new route is active.

📌 Private subnets now have secure outbound internet access.

🔐Stage 8: Final Validation

Step 17: Review the route tables:
-Public → local + IGW
-Private → local + NAT

Step 18: Confirm that all subnets are in Available state and correctly associated.

📌 Your architecture is complete: public for direct access, private for secure backend with controlled internet connectivity.

🌟 Conclusion
You’ve built a segmented and secure VPC with:
-Public and private subnets across two Availability Zones.
-An Internet Gateway for public subnet access.
-A NAT Gateway for controlled private subnet access.
-Separate and properly configured route tables.
-Tags for auditing and governance.

Final Reflection
Building a VPC with public and private subnets, an Internet Gateway, and a NAT Gateway is more than just a technical exercise—it’s about designing secure, scalable foundations for cloud workloads. By separating traffic flows and applying clear governance, you ensure resilience and control, while enabling your applications to grow with confidence.