Morodolu Oluwafikunayomi

Posted on Aug 31

AWS Networking Fundamentals: Building a Secure Cloud Architecture

#aws #beginners #devops #security

AWS Networking Explained Like Building a Neighborhood 🏡

If you’re new to AWS networking, it can feel like alphabet soup: VPCs, Subnets, IGWs, NATs, Route Tables, SGs, NACLs

But here’s the good news: it’s easier to understand if you think of it like building a secure neighborhood.

By the end of this post, you’ll:

Understand AWS networking through real-world analogies

Know the difference between gateways, firewalls, and route tables

Build your own secure cloud community step by step

1. VPC → Your Gated Community

A VPC (Virtual Private Cloud) is your private section of AWS.

Imagine buying land inside a gated estate. You decide how big it is, where the streets go, and who’s allowed in.

Isolated from other customers.
You choose the boundaries (IP ranges).
You control traffic in and out.

2. Subnets → Streets in Your Community

Inside your VPC, you divide land into subnets (streets).

Public Subnet → open for visitors (shops, restaurants, web servers).
Private Subnet → hidden residential area (databases, backend).

Pro tip: Always spread them across different availability zones so your app stays online even if one zone fails.

![Insert subnet diagram here]

3. Internet Gateway → The Main Gate

The Internet Gateway (IGW) is the guarded entrance/exit of your estate.

Lets outsiders visit your public servers.
Lets your public servers reach the internet.
Scales automatically (AWS manages it).

4. NAT Gateway → The Secure Mail Slot

Private residents (databases, backend servers) need the internet too—like downloading security updates. But you don’t want strangers knocking on their doors.

That’s what the NAT Gateway is for:

It allows private instances to send requests out.
Outsiders can’t start conversations with them.

Analogy: a one-way mail slot.

5. Route Tables → The Traffic GPS

How does data know where to go?

Public Subnet → IGW (for internet access).
Private Subnet → NAT Gateway (outbound only).

Think of it like street signs and GPS guiding cars to the right road.

6. Elastic IP → think of it as your Fixed house Address

An Elastic IP (EIP) is a permanent public address.

Doesn’t change if you restart your server.
Useful for NAT Gateways and critical servers.

7. Security Groups → Your Bodyguards

Every house/server gets its own bodyguard (SG).

Deny everything by default.
Example: “Allow web visitors (port 80, 443) but only let me in via SSH.”
Stateful: Replies are automatically allowed.

🚔 8. Network ACLs → The Street Patrol

A NACL is the patrol car for the whole street.

Controls traffic before it reaches houses.
Stateless: you must define both inbound & outbound rules.
Can allow and deny traffic (SGs can only allow).

Putting It All Together

So when you launch a simple website with a database:

VPC = your gated community.
Subnets = public (web server) + private (database).
IGW = main entrance gate.
NAT Gateway = one-way mail slot.
Route Tables = GPS for data traffic.
Elastic IP = permanent address.
Security Groups = bodyguards at each house.
NACLs = patrol cars on each street.

Result: Visitors can access your web server.

The web server talks to the database.

The database can fetch updates from the internet—but no hacker can reach it directly.

Hands-On Lab: Build Your Own AWS Neighborhood

Now that you’ve got the concepts, let’s build it step by step.

🔹 Phase 1: Foundation – Setting Up Your Land

Create a VPC (Your Gated Community)
- Go to: AWS Console → VPC → Your VPCs → Create VPC
- Name: My-Secure-VPC
- IPv4 CIDR: 10.0.0.0/16

Create Subnets (Your Streets)
- Public Subnet: public-subnet-1 → 10.0.1.0/24
- Private Subnet: private-subnet-1 → 10.0.2.0/24

Create an Internet Gateway (Main Gate)
- Name: My-IGW
- Attach to My-Secure-VPC

Phase 2: Routing & Security

Public Route Table (Signs for Public Street)
- Destination: 0.0.0.0/0 → Target: Internet Gateway
- Associate with: public-subnet-1

Security Group (Web Server’s Bodyguard)
- Inbound rules:
  - HTTP (80) → Anywhere
  - HTTPS (443) → Anywhere
  - SSH (22) → My IP only

🔹 Phase 3: NAT Gateway – Secure Mail Slot

Allocate an Elastic IP

Create NAT Gateway
- Name: My-NAT-Gateway
- Subnet: public-subnet-1
- Elastic IP: (select the one created)

Remember to create a route table for private route table

it the same process we used for public route table

Private Route Table (Signs for Private Street)
- Destination: 0.0.0.0/0 → Target: My-NAT-Gateway
- Associate with: private-subnet-1

🔹 Phase 4: Deploy Your Residents

Launch Web Server (Public Street)
- Name: Web-Server
- Type: t2.micro (Free Tier)
- Subnet: public-subnet-1
- Public IP: ✅ Enabled
- Security Group: Web-Server-SG
- User Data (auto install web server):

 ```bash
 #!/bin/bash
 sudo dnf update -y
 sudo dnf install -y httpd
 sudo systemctl start httpd
 sudo systemctl enable httpd
 echo "<h1>Hello World from my $(hostname -f)</h1>" > /var/www/html/index.html
 ```

Launch Database Server (Private Street)
- Name: DB-Server
- Type: t2.micro (Free Tier)
- Subnet: private-subnet-1
- Public IP: ❌ Disabled

Phase 5: Validation – Test Your Community

Test Web Server
- Open Web Server’s public IP in a browser → should show “Hello World”.
Test Private Database Internet Access
- SSH into Web Server → then into DB Server (using private IP).
- Run:
```
  curl https://checkip.amazonaws.com
```

- Output should be the NAT Gateway’s Elastic IP → proving secure outbound-only internet.

Final Result

Web Server: Accessible publicly.

Database: Hidden in private subnet, still can update.

Architecture: Secure, scalable, cloud-ready.

You’ve officially built a secure neighborhood in the cloud 🏡🌐

DEV Community