Understanding and Configuring Layered Security in an AWS VPC

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab details

1. This lab walks you through the steps to Configure Multi-layered Security in AWS VPC and to launch 2 EC2 instances (one in a public subnet and another in a private subnet)
2. You will practice it using Amazon VPC, Amazon EC2 services.
3. Duration: 1 Hour
4. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

​

Amazon Virtual Private Cloud

1. Amazon VPC allows us to launch AWS resources in an isolated network that is defined by us in a more private and secure environment.
2. This feature enables us to increase the security level of the AWS resources.
3. The AWS resources can be protected using multilayered VPC which includes security groups and Network Access Control list.
4. The VPC security group provides security at instance level which acts like a firewall and controls both inbound and outbound traffic.
5. The VPC NACL provides security at Network Level i.e subnet level which acts like a firewall for associated subnets and controls inbound and outbound traffic.

​

Architecture diagram

​

Task details

1. Sign in to AWS Management Console
2. Create a new VPC.
3. Create and attach an Internet Gateway.
4. Create two Subnets.
5. Create Route Tables, configure routes, and associate them with Subnets.
6. Create a Security Group.
7. Create and configure Network ACL.
8. Launch 2 EC2 Instances.
9. Test the EC2 Instances.
10. Validation of the Lab

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
   • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Creating a new VPC

In this task, we are going to create a new VPC with the required configurations such as name, IPv4 CIDR block.

1. Make sure to choose the N.Virginia region in the AWS Management Control dashboard, which is present in the top right corner.
2. Navigate and click on VPC which will be available under the Networking & Content Delivery section of Services
3. Click on Your VPCs from the left menu and Click on Create VPC button.

4. In Create VPC page fill the following details,

• Select VPC Only
• Name tag: Enter whizlabs_VPC
• IPV4 CIDR Block: Enter 10.0.0.0/16
• IPV6 CIDR block: Select No IPV6 CIDR block
• Tenancy: Default
• Click on Create VPC button**.**

​

Task 3: Creating and attaching an Internet gateway

In this task, we are going to create an internet gateway and will attach it to the created VPC.

1. Click on Internet Gateways from the left menu and click on Create internet gateway button and enter the following details:

• Name tag: Enter whizlabs_IGW
• Click on Create internet gateway button.

2. Select the Internet gateway you created from the list.

• Click on Actions button.
• Click on Attach to VPC button.

• Select MyVPC from the drop-down and click on Attach internet gateway button.

​

Task 4: Creating two Subnets

Important: To avoid EC2 capacity issues in a specific Availability Zone, please select different Availability Zones when creating the subnets except us-east-1e. For example, select us-east-1a for one subnet and us-east-1b for the other subnet. This helps avoid both subnets being placed in the same AZ and reduces the possibility of encountering temporary EC2 capacity limitations.

1. You will create 2 Subnets, one for public and another for private resources. First, we will create a public subnet.
2. For the Public Subnet**,** click on Subnets from the left menu and click on Create subnet button.

• VPC ID: Select whizlabs_VPC (Select the VPC which you created from the dropdown)
• Name tag: Enter public_subnet
• Availability zone: Select us-east-1a
• IPv4 CIDR block: Enter 10.0.1.0/24
• Click on Create subnet button

3. For Private Subnet**,** click on Create Subnet again.

• VPC ID: Select whizlabs_VPC (Select the VPC which you created from the dropdown)
• Name tag: Enter private_subnet
• Availability zone: Select us-east-1b
• IPv4 CIDR block: Enter 10.0.2.0/24
• Click on Create subnet button.

​

Task 5: Creating Route tables, configuring routes and associating them with Subnets

1. You will create 2 route tables, one for public routes and another for private routes.
2. Go to Route Tables from the left menu and click on Create route table button.

• Name tag: Enter public_route
• VPC: Select whizlabs_VPC (Select the VPC you created from the dropdown)
• Click on Create route table button**.**

3. Similarly, go to Route Tables from the left menu and click on Create route table.

• Name tag: Enter private_route
• VPC: Select whizlabs_VPC (Select the VPC you created from the dropdown)
• Click on Create route table button.

4. Now, you need to add routes to the Route Tables.

• Select public_route.
• Go to the Routes tab. Click on Edit routes. On the next page, click on Add route.
• Specify the following values:
  • Destination: Enter 0.0.0.0/0
  • Target: Select Internet Gateway from the dropdown menu to select whizlabs_IGW.
  • Click on Save changes button.

5. Next, you need to associate the public_subnet with this public_route. Select the public_route and go to the Actions and in that go to Edit Subnet Associations tab.
   • Click on Edit Subnet Associations.
   • Select public_subnet from the list.
   • Click on Save Associations button.

6. Similarly, you need to associate the private_subnet with this private_route. Select the private_route and go to the Actions and in that go to Edit Subnet Associations tab.
   • Click on Edit Subnet Associations.
   • Select private_subnet from the list.
   • Click on Save Associations button.

​

Task 6: Creating Security Group

In this task, we are going to create a security group for the EC2 Instance.

1. Go to Security Group from the left menu and click on Create security group button and then provide the following details**:**

• Security group name: Enter whizlabs_securitygroup
• Description: Enter Security group for multilayered VPC
• VPC: Select whizlabs_VPC (select from the dropdown)
• Under Inbound Rules, click on Add Rule button.
• To add SSH,
  • Choose Type: Select SSH
  • Source: Anywhere-IPv4
• To add All ICMP - IPv4,
  • Click on Add Rule
  • Choose Type: Select All ICMP - IPv4
  • Source: Anywhere IPv4
• Click on Create security group button.

​

Task 7: Creating and configuring Network ACL

Network Access Control Lists (ACLs) in AWS are used to control inbound and outbound traffic at the subnet level. They act as virtual firewalls that provide an additional layer of security for your Amazon Virtual Private Cloud (VPC). In this task, we are going to create and configure Network ACL by adding required inbound and outbound rules.

1. Go to Network ACLs from the left menu and click on Create network ACL. Provide the following details:

• Name tag: Enter whizlabs_NACL
• VPC: Select whizlabs_VPC (Select the VPC which you created from the dropdown)
• Click on Create network ACL button.

2. Select whizlabs_NACL and go to Inbound rules tab. Click on Edit inbound rules and then click on the Add new rule.
3. Add the following rules:

• For SSH, click on Add new rule,
  • Rule number : Enter 100
  • Type: Choose SSH (22)
  • Source: Enter 0.0.0.0/0
  • Allow / Deny: Select Allow
• For ALL ICMP- IPv4, click on Add new rule,
  • Rule number : Enter 200
  • Type: Choose ALL ICMP - IPv4
  • Source: Enter 0.0.0.0/0
  • Allow / Deny: Select Allow
• Click on Save changes button.

4. NACLs are stateless. You need to add the rules in Outbound rules too.
5. Select whizlabs_NACL and go to Outbound rules tab. Click on Edit Outbound rules and then click on the Add Rule button.

• For ALL ICMP- IPv4, click on Add new rule,
  • Rule# : Enter 100
  • Type: Choose ALL ICMP - IPv4
  • Destination: Enter 0.0.0.0/0
  • Allow / Deny: Select Allow
• For Custom TCP Rule, click on Add new rule,
  • Rule# : Enter 200
  • Type: Choose Custom TCP Rule
  • Port Range: Enter 1024 - 65535
  • Destination: Enter 0.0.0.0/0
  • Allow / Deny: Select Allow
• Click on Save changes button.

6. You need to associate both public and private subnets with the NACL.
7. Select whizlabs_NACL and go to the Subnet associations tab. Click on Edit subnet associations.
8. Choose all the available subnets and then click on Save changes button.

​

Task 8: Launching 2 EC2 Instances

1. Navigate to Services and choose EC2 under Compute
2. Navigate to Instances on the left panel and click on Launch Instances button.
3. Name : Enter public_instance
4. For Amazon Machine Image (AMI): Search for Amazon Linux 2023 AMI in the search box and click on the select button.

5. For Instance Type: Select t2.micro

6. For Key pair: Select Create a new key pair Button
   1. Key pair name: WhizKey
   2. Key pair type: RSA
   3. Private key file format: .pem
7. Select Create key pair Button.
8. In Network Settings Click on Edit button:
   • VPC: Select whizlabs_VPC
   • Subnet: Select public_subnet
   • Auto-assign public IP: Enable
   • Choose Select an existing security group and remove default one then select whizlabs_securitygroup

9. Keep Rest thing Default and Click on Launch Instance Button.
10. Select View all Instances to View Instance you Created
11. Similar to the above, launch another EC2 instance:

• Name the instance as private_instance
• Key pair : Select the existing one
• VPC: Select whizlabs_VPC
• Subnet: Select private_subnet
• Auto-assign public IP: Disable
• Choose Select an existing security group and remove default one then select whizlabs_securitygroup

12. Keep Rest thing Default and Click on Launch Instance Button.
13. Select View all Instances to View Instance you Created.

​

Task 9: Testing the EC2 instances

1. Select the public_instance from the EC2 dashboard and copy the public IPv4 address.

2. Similarly, copy the Private IPv4 Address of the private_instance.
3. SSH into public_instance EC2 Instance.

• Please follow the steps in SSH into EC2 Instance.

4. Ping the private IP of your private_instance by using the below command:
   • ping <your Private EC2 IPv4 address>
5. Once you execute this command, you will receive a response from the IP.

6. Press [Ctrl] + C to cancel the process.

​

Task 10 : Validation of the Lab

1. Once the lab steps are completed, please click on the Check my work button on the left side panel.
2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
3. Sample output :

​

Completion and conclusion

1. You have successfully created a new VPC.
2. You have successfully created and attached an Internet Gateway.
3. You have successfully created two subnets for public and private AWS instances.
4. You have successfully created and configured the Route Table.
5. You have successfully created a Security Group.
6. You have successfully created and configured Network ACL.
7. You have successfully launched 2 EC2 instances (one in a public subnet and one in a private subnet).
8. You have successfully tested the EC2 instance.

​

End lab

1. Sign out from the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps click on End lab in the IP Lab Portal.

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Launch an EC2 Instance — Check whether an EC2 Instance is launched or not.
• Launch EC2 AMI type Amazon Linux — Check whether the EC2 instance is launched using an Amazon AMI.
• Create Internet Gateway — Check whether an Internet Gateway is created and attached to the Custom VPC or not.
• Create Amazon Custom VPC Subnet — Check whether a Subnet is created for the Custom VPC or not.
• Create Amazon Custom VPC Public Route Table — Check whether a Custom VPC Public Route Table is created and an Internet Gateway route is added or not.
• Create Amazon Custom VPC — Check whether a Custom VPC is created or not.
• Create Custom VPC Network ACL — Check whether a Network ACL is created for the Custom VPC or not.

​

Related help

• FAQs and Troubleshooting