AWS Cloud Path Week 11: AWS Networking Workshop Part 1 – Building Secure VPC Infrastructure

Welcome to Week 11 of the AWS Cloud Path series! In this hands-on workshop, we dive deep into AWS networking fundamentals by working through a comprehensive AWS Networking Workshop. This tutorial covers the full spectrum of AWS networking, from basic VPC and subnet configurations to advanced setups with security groups, route tables, and NAT gateways.

Missed the session? Catch up here:

Prerequisites

Before diving into this workshop, you should have:

• An active AWS account with appropriate permissions
• Basic understanding of networking concepts (IP addresses, CIDR blocks, subnets)
• Familiarity with AWS Console navigation
• Understanding that resources created in this workshop will incur costs (~$7 USD in us-east-1)

⚠️ Cost Warning: The resources created in this workshop will cost approximately $7 in the US East 1 region. Pricing may vary in different regions.

Workshop Overview

This workshop is part of the AWS Networking Immersion Day and covers foundational to advanced networking topics:

Foundation Topics Covered:

• Virtual Private Cloud (VPC) creation and configuration
• Public and private subnet architecture
• Internet Gateway setup
• NAT Gateway configuration
• Route tables and routing
• Network Access Control Lists (NACLs)
• Security group configuration

Advanced Topics (Future Sessions):

• VPC Endpoints
• Transit Gateway
• VPN connections
• Gateway Load Balancers
• Multi-cast networking

Step-by-Step Implementation

1. Environment Setup with CloudFormation

Before creating our networking infrastructure, we need to deploy a CloudFormation template that provisions prerequisite resources.

Deploying the Initial Stack

1. Download the provided CloudFormation template
2. Navigate to the CloudFormation console
3. Create a new stack and upload the template
4. Name your stack (e.g., “networking-workshop-prerequisites”)
5. Deploy the stack

Resources Created:

• Flow logs role
• VPC endpoint policies
• Elastic IP addresses

# The CloudFormation template creates essential resources like:
# - IAM roles for flow logs
# - Endpoint policies
# - Pre-allocated Elastic IPs

2. Creating Your VPC Foundation

VPC Creation

Navigate to the VPC console and create a new VPC:

• Name: VPCA
• IPv4 CIDR block: 10.0.0.0/16
• IPv6 CIDR block: No IPv6 CIDR block
• Tenancy: Default

CIDR Block Explanation:
10.0.0.0/16 provides approximately 65,536 IP addresses
This gives us plenty of room for multiple subnets across availability zones

Enable DNS Hostnames

After VPC creation:

1. Select your VPC
2. Go to Actions → Edit VPC settings
3. Enable DNS hostnames
4. Save changes

This allows instances in your VPC to receive public DNS hostnames when they have public IP addresses.

3. Subnet Architecture Design

We’ll create four subnets across two Availability Zones following AWS best practices:

Creating Subnets

For each subnet:

1. Navigate to VPC → Subnets → Create subnet
2. Select your VPC (VPCA)
3. Configure subnet settings following the table above
4. Create the subnet

Naming Convention Best Practices:

• Use consistent naming patterns (e.g., VPCA-public-subnet-az1)
• Include VPC identifier, subnet type, and availability zone
• This makes resource management much easier in production environments

4. Network Access Control Lists (NACLs)

Creating Custom NACLs

Default NACLs allow all traffic, which isn’t ideal for security. Let’s create a custom NACL:

1. Navigate to VPC → Network ACLs → Create network ACL
2. Name: VPCA-workload-subnet-nacl
3. VPC: VPCA

Configuring NACL Rules

Inbound Rules:

Rule # | Type | Protocol | Port Range | Source | Allow/Deny
100    | HTTP | TCP      | 80         | 0.0.0.0/0 | ALLOW

Outbound Rules:

Rule # | Type | Protocol | Port Range | Destination | Allow/Deny
100    | All Traffic | All | All | 0.0.0.0/0 | ALLOW

⚠️ Security Note: This configuration allows all traffic for demonstration purposes. In production, implement least-privilege access with specific rules for your application requirements.

Associate Subnets with NACL

1. Select your custom NACL
2. Go to Subnet associations tab
3. Edit subnet associations
4. Associate all four subnets with the custom NACL

5. Route Tables Configuration

Route tables determine where network traffic from subnets is directed. We’ll create separate route tables for public and private subnets.

Public Route Table

1. Navigate to VPC → Route Tables → Create route table
2. Name: VPCA-public-route-table
3. VPC: VPCA
4. Associate with public subnets

Private Route Table

1. Create another route table
2. Name: VPCA-private-route-table
3. VPC: VPCA
4. Associate with private subnets

Default Routes:
Both route tables automatically include a local route for the VPC CIDR (10.0.0.0/16) with target “local”, enabling communication within the VPC.

6. Internet Connectivity Setup

Internet Gateway Configuration

Public subnets need internet access through an Internet Gateway:

1. Navigate to VPC → Internet Gateways → Create Internet Gateway
2. Name: VPCA-IGW
3. Attach to VPCA

Configure Public Route Table

Add internet route to public route table:

1. Select VPCA-public-route-table
2. Edit routes → Add route
3. Destination: 0.0.0.0/0
4. Target: Internet Gateway (VPCA-IGW)

This route directs all non-local traffic to the internet gateway.

NAT Gateway for Private Subnets

Private subnets need outbound internet access through a NAT Gateway:

1. Navigate to VPC → NAT Gateways → Create NAT Gateway
2. Name: VPCA-NAT-Gateway
3. Subnet: Select a public subnet (VPCA-public-subnet-az1)
4. Connectivity type: Public
5. Elastic IP: Allocate Elastic IP
6. Create NAT Gateway

Configure Private Route Table

Add NAT Gateway route to private route table:

1. Select VPCA-private-route-table
2. Edit routes → Add route
3. Destination: 0.0.0.0/0
4. Target: NAT Gateway (VPCA-NAT-Gateway)

Key Learning Points

1. CIDR Block Planning

• Plan your IP address space carefully
• Leave room for future expansion
• Avoid overlapping CIDR blocks
• Consider connectivity requirements with other networks

2. High Availability Design

• Deploy resources across multiple Availability Zones
• Use consistent naming conventions
• Implement redundancy for critical components

3. Security Best Practices

• Use custom NACLs instead of defaults
• Follow least-privilege access principles
• Separate public and private subnets
• Control outbound traffic from private subnets

4. Route Table Strategy

• Create dedicated route tables for different subnet types
• Understand local routes vs. internet routes
• Plan for hybrid connectivity (VPN/Direct Connect)

Common Troubleshooting Tips

Internet Connectivity Issues

1. Check Internet Gateway: Ensure it’s attached to the VPC
2. Verify Route Tables: Confirm 0.0.0.0/0 routes point to correct targets
3. Security Groups: Check that security groups allow required traffic
4. NACLs: Ensure NACLs aren’t blocking traffic

NAT Gateway Problems

1. Subnet Selection: NAT Gateway must be in a public subnet
2. Elastic IP: Ensure Elastic IP is allocated and attached
3. Route Configuration: Private subnets should route 0.0.0.0/0 to NAT Gateway

Production Considerations

Cost Optimization

• NAT Gateway: Consider NAT instances for development environments
• Elastic IPs: Release unused Elastic IP addresses
• Data Transfer: Monitor data transfer costs

Security Enhancements

• Implement AWS Config rules for compliance monitoring
• Use VPC Flow Logs for traffic analysis
• Consider AWS Network Firewall for advanced filtering

Monitoring and Logging

• Enable VPC Flow Logs
• Set up CloudWatch monitoring for NAT Gateways
• Monitor Elastic IP usage and costs

Next Steps

In the upcoming sessions, we’ll explore:

VPC Endpoints (Next Session)

• S3 Gateway Endpoints
• Interface Endpoints for AWS services
• Private connectivity without internet gateway dependency
• Cost optimization through private connectivity

Advanced Networking Topics

• Transit Gateway for multi-VPC connectivity
• VPN connections for hybrid cloud
• Direct Connect for dedicated connectivity
• Network segmentation strategies

Conclusion

This foundational networking workshop provides the essential building blocks for secure, scalable AWS network architectures. By understanding VPCs, subnets, route tables, and security controls, you’re building expertise in the core networking components that underpin most AWS solutions.

The hands-on approach of working through actual AWS console configurations helps solidify theoretical knowledge with practical skills. Remember to clean up resources after the workshop to avoid unnecessary costs!

Additional Resources

• AWS VPC Documentation
• AWS Networking Workshops
• VPC Best Practices
• AWS Well-Architected Framework – Security Pillar

Join us next week as we continue with VPC Endpoints and explore how to create private connectivity to AWS services without routing traffic through the public internet!