> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Build Amazon VPC with Public and Private Subnets from Scratch
> Hands-on lab · 30m
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.
Open IP Lab Portal
## Overview
### Lab details
1. In this lab, you will be guided through the process of creating a Virtual Private Cloud (VPC) in AWS. Unlike using the VPC Wizard, all the necessary components for building public and private subnets will be manually created and configured, providing a deeper understanding of VPCs and subnets' internal components.
2. The lab will cover the creation of a VPC, configuration of public and private subnets, and setting up route tables.
3. Duration: **30 minutes**
4. AWS Region: **US East (N. Virginia) us-east-1**
### Introduction
#### What is VPC?
* VPC stands for Virtual Private Cloud, which is a custom-defined virtual network within the AWS Cloud.
* The primary components of a VPC include subnets, IP addresses, NAT devices, route tables, gateways, access control lists, security groups, and VPC endpoints.
* Subnets are a segment of the VPC IP address range where AWS resources can be launched, and they are classified as public and private.
* Public subnets hold resources that can be accessed from the Internet, and they must have an Elastic IP address, an Internet Gateway, and a route table entry with destination as an internet gateway.
* Private subnets hold resources that can be accessed from within the VPC network, and they use NAT devices to interact with the Internet.
* Route tables hold sets of rules, called routes, that are used to determine where the traffic is directed, and every subnet in a VPC is linked to a route table.
* Internet Gateway is a virtual router that helps a VPC connect to the Internet, and it is attached to the VPC to enable Internet access.
* EIP is a static IPv4 address used by AWS to manage its dynamic cloud computing services, and it can be associated with an AWS account to mask if an instance failure occurs.
* NAT devices can be an instance or a gateway residing in a public subnet, and they help instances in private subnets interact with the Internet.
* Access Control List is an optional layer of security that acts as a firewall for controlling network traffic in and out of the subnet, and it uses rules to allow or deny network traffic based on ports or IP addresses.
#### Basic Understanding before we start building VPC from scratch
* When you create an Amazon AWS VPC, you specify a set of IP addresses in the form of a **Classless Inter-Domain Routing (CIDR)** block (Ex: **10.0.0.0/16**).
* You can assign a single CIDR block to a VPC. The allowed block size is between a /28 netmask and /16 netmask. In other words, the VPC can contain from 16 to 65,536 IP addresses.
### Architecture diagram
### Task Details
1. Sign in to AWS Management Console.
2. Create a VPC without using the VPC Wizard.
3. Create an Internet Gateway.
4. Create private and public subnets for the VPC.
5. Create and Configure Route tables.
6. Validation of the lab.
### Launching the lab environment
1. To launch the lab environment, Click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with **IAM user name**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.
You can only start one lab at any given time
## Lab guide
### Lab steps
#### Task 1: Sign in to AWS Management Console
1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
* Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
* Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.**
#### Task 2 : Creating New VPC
1. Make sure you are in the **US East (N. Virginia) us-east-1** Region.
2. Navigate to VPC by clicking on **Services** on the top of AWS Console.
3. Click on **VPC** (under **Networking & Content Delivery** section) or you can also search for VPC.
4. Click on **Your VPCs** from the left menu.
5. Here you can see the list of all VPC, No need to do anything with the existing and default VPCs, we will create a new VPC for this lab.
6. Click on **Create VPC** button.
* Select **VPC Only**
* **Name tag:** Enter a VPC name for identification to your VPC. Ex: ***MyVPC***
* **IPv4 CIDR block:** Enter ***10.0.0.0/16***
* **IPv6 CIDR block:** No need to change this, make sure **No IPv6 CIDR Block** is checked.
* **Tenancy:** No need to change this, make sure **Default** is selected.
* Now click on **Create VPC** button.
7. Once VPC is created, it will appear with details as shown below:
#### Task 3 : Creating Subnets
In this lab, we will create one public subnet and a private subnet in us-east-1a and us-east-1b Availability Zones respectively as follows:
1. For the Public Subnet\*\*,\*\* click on **Subnets** from the left menu and click on **Create subnet** button.
* **VPC ID:** Select **MyVPC** from the list you created earlier.
* **Subnet Name:** Enter Name ***MyPublicSubnet***
* **Availability Zone:** Select **us-east-1a**
* **IPv4 CIDR block:** Enter the range ***10.0.1.0/24***
* Click on **Create subnet** button.
2. For the Private Subnet\*\*,\*\* click on **Create subnet** again.
* **VPC ID :** Select **MyVPC** from the list you created earlier.
* **Subnet Name :** Enter Name ***MyPrivateSubnet***
* **Availability Zone :** Select **us-east-1b**
* **IPv4 CIDR block :** Enter the range ***10.0.2.0/24***
* Click on **Create subnet** button.
#### Task 4: Create and configure Internet Gateway
In this task, we are going to create an internet gateway and configure it with the VPC.
1. Click on **Internet Gateways** from the left menu and click on **Create internet gateway** button.
* **Name Tag:** Enter ***MyInternetGateway***
* Click on **Create internet gateway** button.
2. Select the Internet gateway you created from the list
* Click on **Actions**.
* Click on **Attach to VPC**.
* Select **MyVPC** which you created from the list and click on **Attach internet gateway** button.
#### Task 5: Create Route Tables
In this task, we are going to create two route tables and associate them with their respective subnets.
1. Go to **Route Tables** from the left menu and click on **Create route table** button.
* **Name:** Enter ***PublicRouteTable***
* **VPC:** Select **MyVPC** from the list.
* Click on **Create route table** button.
2. Repeat the same steps to create a route table for the Private subnet.
* **Name:** Enter ***PrivateRouteTable***
* **VPC:** Select **MyVPC** from the list.
* Click on **Create route table** button.
3. Now we will **associate the subnets** to the route tables.
4. Select the **PublicRouteTable** and go to the **Subnet Associations** tab.
* Click on **Edit subnet associations.**
* Select **MyPublicSubnet** from the list.
* Click on **Save associations** button.
5. Select the **PrivateRouteTable** and go to the **Subnet Associations** tab.
* Click on **Edit subnet associations**.
* Select **MyPrivateSubnet** from the list.
* Click on **Save associations** button.
6. Make sure not to associate any subnets with the **Main Route Table**.
7. **PublicRouteTable**: Add a route to allow Internet traffic to the VPC.
* Select **PublicRouteTable.**
* Go to **Routes** tab, click on **Edit routes** and on the next page, click on **Add route** button.
* Specify the following values:
* **Destination:** Enter ***0.0.0.0/0***
* **Target:** Select **Internet Gateway** from the dropdown menu to select **MyInternetGateway**.
* Click on **Save changes** button.
**Do you know?**
VPC Flow Logs capture information about the IP traffic flowing in and out of your VPC. It provides detailed insights into network traffic patterns, helping you analyze and troubleshoot connectivity issues, monitor security, and meet compliance requirements.
#### Task 6 : Validation Test
1. Once the lab steps are completed, please click on the **Check my work** button on the left side panel.
2. This will validate the resources in the AWS account and shows you whether you have completed this lab successfully or not.
3. Sample output :
### Completion and conclusion
* You have successfully completed and learned how to create public and private subnets.
* You have learned how to create an Internet Gateway and associate it to VPC.
* You now understand how public and private subnets are different (through associating Internet Gateway or not).
* The instances launched inside the public subnet will be able to access the internet and instances launched inside the private subnet will not have access to the internet.
### End lab
1. Sign out from the AWS Management Console.
2. Click on **End lab** button in the IP Lab Portal and wait till the process gets completed
## What gets checked
When you press **Check my work**, the platform verifies each of these:
* **Create Amazon Custom VPC** — Check whether a Custom VPC is created or not.
* **Create Amazon Custom VPC Subnet** — Check whether a Subnet is created for the Custom VPC or not.
* **Create Amazon Custom VPC Public Route Table** — Check whether a Custom VPC Public Route Table is created and an Internet Gateway route is added or not.
* **Create Amazon Custom VPC Private Route Table** — Check whether a Custom VPC Private Route Table is created or not.
* **Create Internet Gateway** — Check whether an Internet Gateway is created and attached to the Custom VPC or not.
## Related help
* [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)