> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Understanding and Configuring Layered Security in an AWS VPC
> Hands-on lab · 45m
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.
Open IP Lab Portal
## Overview
### Lab details
1. This lab walks you through the steps to Configure Multi-layered Security in AWS VPC and to launch 2 EC2 instances (one in a public subnet and another in a private subnet)
2. You will practice it using Amazon VPC, Amazon EC2 services.
3. Duration: **1 Hour**
4. AWS Region: **US East (N. Virginia) us-east-1**
### Introduction
#### Amazon Virtual Private Cloud
1. Amazon VPC allows us to launch **AWS resources in an isolated network** that is defined by us in a **more private and secure environment.**
2. This feature enables us to **increase the security level** of the AWS resources.
3. The AWS resources can be protected using **multilayered VPC** which includes **security groups** and **Network Access Control list**.
4. The VPC **security group** provides security at **instance level** which acts like a firewall and controls both inbound and outbound traffic.
5. The VPC **NACL** provides security at **Network Level** i.e **subnet level** which acts like a firewall for associated subnets and controls inbound and outbound traffic.
### Architecture diagram
### Task details
1. Sign in to AWS Management Console
2. Create a new VPC.
3. Create and attach an Internet Gateway.
4. Create two Subnets.
5. Create Route Tables, configure routes, and associate them with Subnets.
6. Create a Security Group.
7. Create and configure Network ACL.
8. Launch 2 EC2 Instances.
9. Test the EC2 Instances.
10. Validation of the Lab
### Launching the lab environment
1. To launch the lab environment, Click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with **IAM user name**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.
## Lab guide
### Lab steps
#### Task 1: Sign in to AWS Management Console
1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
* Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
* Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.**
There is no **Check my work** function for this lab.
#### Task 2: Creating a new VPC
In this task, we are going to create a new VPC with the required configurations such as name, IPv4 CIDR block.
1. Make sure to choose the **N.Virginia** region in the AWS Management Control dashboard, which is present in the top right corner.
2. Navigate and click on **VPC** which will be available under the **Networking & Content Delivery** section of **Services**
3. Click on **Your VPCs** from the left menu and Click on **Create VPC** button.
4. In **Create VPC** page fill the following details,
* Select **VPC Only**
* Name tag: Enter ***whizlabs\_VPC***
* IPV4 CIDR Block: Enter ***10.0.0.0/16***
* IPV6 CIDR block: Select **No IPV6 CIDR block**
* Tenancy: **Default**
* Click on **Create** **VPC** button\*\*.\*\*
#### Task 3: Creating and attaching an Internet gateway
In this task, we are going to create an internet gateway and will attach it to the created VPC.
1. Click on **Internet Gateways** from the left menu and click on **Create internet gateway** button and enter the following details:
* Name tag: Enter ***whizlabs\_IGW***
* Click on **Create** **internet gateway** button.
2. **Select** the Internet gateway you created from the list.
* Click on **Actions** button.
* Click on **Attach to VPC** button.
* **Select** MyVPC from the drop-down and click on **Attach internet gateway** button.
#### Task 4: Creating two Subnets
> **Important:** To avoid EC2 capacity issues in a specific Availability Zone, please select **different Availability Zones** when creating the subnets except **us-east-1e**. For example, select **us-east-1a** for one subnet and **us-east-1b** for the other subnet. This helps avoid both subnets being placed in the same AZ and reduces the possibility of encountering temporary EC2 capacity limitations.
1. You will create **2 Subnets,** one for public and another for private resources. First, we will create a **public subnet**.
2. For the Public Subnet\*\*,\*\* click on **Subnets** from the left menu and click on **Create subnet** button.
* VPC ID: Select **whizlabs\_VPC** (Select the VPC which you created from the dropdown)
* Name tag: Enter ***public\_subnet***
* Availability zone: Select **us-east-1a**
* IPv4 CIDR block: Enter ***10.0.1.0/24***
* Click on **Create subnet** button
3. For Private Subnet\*\*,\*\* click on **Create Subnet** again.
* VPC ID: Select **whizlabs\_VPC** (Select the VPC which you created from the dropdown)
* Name tag: Enter ***private\_subnet***
* Availability zone: Select **us-east-1b**
* IPv4 CIDR block: Enter ***10.0.2.0/24***
* Click on **Create subnet** button.
#### Task 5: Creating Route tables, configuring routes and associating them with Subnets
1. You will create **2 route tables,** one for public routes and another for private routes.
2. Go to **Route Tables** from the left menu and click on **Create route table** button.
* Name tag: Enter ***public\_route***
* VPC: Select **whizlabs\_VPC** (Select the VPC you created from the dropdown)
* Click on **Create** **route table** button\*\*.\*\*
3. Similarly, go to **Route Tables** from the left menu and click on **Create route table.**
* Name tag: Enter ***private\_route***
* VPC: Select **whizlabs\_VPC** (Select the VPC you created from the dropdown)
* Click on **Create** **route table** button.
4. Now, you need to **add routes to the Route Tables**.
* Select **public\_route.**
* Go to the **Routes** tab. Click on **Edit routes**. On the next page, click on **Add route.**
* Specify the following values:
* **Destination:** Enter ***0.0.0.0/0***
* **Target:** Select **Internet Gateway** from the dropdown menu to select **whizlabs\_IGW**.
* Click on **Save changes** button.
5. Next, you need to associate the **public\_subnet** with this **public\_route**. Select the **public\_route** and go to the **Actions** and in that go to **Edit Subnet Associations** tab.
* Click on **Edit Subnet Associations**.
* Select **public\_subnet** from the list.
* Click on **Save Associations** button.
6. Similarly, you need to associate the **private\_subnet** with this **private\_route**. Select the **private\_route** and go to the **Actions** and in that go to **Edit Subnet Associations** tab.
* Click on **Edit Subnet Associations**.
* Select **private\_subnet** from the list.
* Click on **Save Associations** button.
#### Task 6: Creating Security Group
In this task, we are going to create a security group for the EC2 Instance.
1. Go to **Security Group** from the left menu and click on **Create security group** button and then provide the following details\*\*:\*\*
* Security group name: Enter ***whizlabs\_securitygroup***
* Description: Enter ***Security group for multilayered VPC***
* VPC: Select **whizlabs\_VPC** (select from the dropdown)
* Under **Inbound Rules,** click on **Add Rule** button.
* To add **SSH**,
* Choose Type: Select **SSH**
* Source: **Anywhere-IPv4**
* To add **All ICMP - IPv4,**
* Click on **Add Rule**
* Choose Type: Select **All ICMP - IPv4**
* Source: **Anywhere IPv4**
* Click on **Create security group** button.
#### Task 7: Creating and configuring Network ACL
Network Access Control Lists (ACLs) in AWS are used to control inbound and outbound traffic at the subnet level. They act as virtual firewalls that provide an additional layer of security for your Amazon Virtual Private Cloud (VPC). In this task, we are going to create and configure Network ACL by adding required inbound and outbound rules.
1. Go to **Network ACLs** from the left menu and click on **Create network ACL**. Provide the following details:
* Name tag: Enter ***whizlabs\_NACL***
* VPC: Select **whizlabs\_VPC** (Select the VPC which you created from the dropdown)
* Click on **Create network ACL** button.
2. Select **whizlabs\_NACL** and go to **Inbound rules tab.** Click on **Edit inbound rules** and then click on the **Add new rule.**
3. Add the following rules:
* For **SSH**, click on **Add new rule**,
* Rule number : Enter ***100***
* Type: Choose ***SSH (22)***
* Source: Enter ***0.0.0.0/0***
* Allow / Deny: Select **Allow**
* For **ALL ICMP- IPv4**, click on **Add new rule**,
* Rule number : Enter ***200***
* Type: Choose ***ALL ICMP - IPv4***
* Source: Enter ***0.0.0.0/0***
* Allow / Deny: Select **Allow**
* Click on **Save changes** button.
4. NACLs are stateless. You need to add the rules in Outbound rules too.
5. Select **whizlabs\_NACL** and go to **Outbound rules tab.** Click on **Edit Outbound rules** and then click on the **Add Rule** button.
* For **ALL ICMP- IPv4**, click on **Add new rule**,
* Rule# : Enter ***100***
* Type: Choose ***ALL ICMP - IPv4***
* Destination: Enter ***0.0.0.0/0***
* Allow / Deny: Select **Allow**
* For **Custom TCP Rule**, click on **Add new rule**,
* Rule# : Enter ***200***
* Type: Choose ***Custom TCP Rule***
* Port Range: Enter ***1024 - 65535***
* Destination: Enter ***0.0.0.0/0***
* Allow / Deny: Select **Allow**
* Click on **Save changes** button.
6. You need to associate both public and private subnets with the NACL.
7. Select **whizlabs\_NACL** and go to the **Subnet associations tab.** Click on **Edit subnet associations.**
8. Choose all the available subnets and then click on **Save changes** button.
#### Task 8: Launching 2 EC2 Instances
1. Navigate to **Services** and choose **EC2** under **Compute**
2. Navigate to **Instances** on the left panel and click on **Launch Instances** button.
3. Name : Enter ***public\_instance***
4. **For Amazon Machine Image (AMI):** Search for **Amazon Linux 2023 AMI** in the search box and click on the **select** button.
If there are two AMIs present for Amazon Linux 2 AMI, choose any of them.
5. **For Instance Type:** Select ***t2.micro***
6. **For Key pair:** Select **Create a new key pair** Button
1. Key pair name: **WhizKey**
2. Key pair type: **RSA**
3. Private key file format: **.pem**
7. Select **Create key pair** Button.
8. In Network Settings Click on **Edit** button:
* VPC: Select **whizlabs\_VPC**
* Subnet: Select **public\_subnet**
* Auto-assign public IP: **Enable**
* Choose **Select an existing security group** and remove default one then select **whizlabs\_securitygroup**
9. Keep Rest thing Default and Click on **Launch Instance** Button.
10. Select **View all Instances** to View Instance you Created
11. Similar to the above, launch **another EC2 instance:**
* **Name** the instance as ***private\_instance***
* Key pair : Select the existing one
* VPC: Select **whizlabs\_VPC**
* Subnet: Select **private\_subnet**
* Auto-assign public IP: **Disable**
* Choose **Select an existing security group** and remove default one then select **whizlabs\_securitygroup**
12. Keep Rest thing Default and Click on **Launch Instance** Button.
13. Select **View all Instances** to View Instance you Created.
#### Task 9: Testing the EC2 instances
1. Select the **public\_instance** from the EC2 dashboard and copy the public IPv4 address.
2. Similarly, copy the **Private IPv4 Address** of the **private\_instance**.
3. SSH into **public\_instance** EC2 Instance.
* Please follow the steps in [SSH into EC2 Instance](/aws-cp/support/ssh-into-ec2-instance).
4. **Ping** the **private IP** of your **private\_instance** by using the below command:
* **ping \**
5. Once you execute this command, you will receive a response from the IP.
6. Press **\[Ctrl] + C** to cancel the process.
**Do you know?**
Security groups are applied at the instance level and provide stateful control over traffic, while NACLs are applied at the subnet level and provide stateless control over traffic.
#### Task 10 : Validation of the Lab
1. Once the lab steps are completed, please click on the **Check my work** button on the left side panel.
2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
3. Sample output :
### Completion and conclusion
1. You have successfully created a new VPC.
2. You have successfully created and attached an Internet Gateway.
3. You have successfully created two subnets for public and private AWS instances.
4. You have successfully created and configured the Route Table.
5. You have successfully created a Security Group.
6. You have successfully created and configured Network ACL.
7. You have successfully launched 2 EC2 instances (one in a public subnet and one in a private subnet).
8. You have successfully tested the EC2 instance.
### End lab
1. Sign out from the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps click on **End lab** in the IP Lab Portal.
## What gets checked
When you press **Check my work**, the platform verifies each of these:
* **Launch an EC2 Instance** — Check whether an EC2 Instance is launched or not.
* **Launch EC2 AMI type Amazon Linux** — Check whether the EC2 instance is launched using an Amazon AMI.
* **Create Internet Gateway** — Check whether an Internet Gateway is created and attached to the Custom VPC or not.
* **Create Amazon Custom VPC Subnet** — Check whether a Subnet is created for the Custom VPC or not.
* **Create Amazon Custom VPC Public Route Table** — Check whether a Custom VPC Public Route Table is created and an Internet Gateway route is added or not.
* **Create Amazon Custom VPC** — Check whether a Custom VPC is created or not.
* **Create Custom VPC Network ACL** — Check whether a Network ACL is created for the Custom VPC or not.
## Related help
* [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)