Configure NAT Instance and Stream Web Logs to CloudWatch Using CloudWatch Agent

​

Overview

​

Lab Details

1. In this lab, you will set up an AWS NAT instance within a Virtual Private Cloud (VPC) to provide secure outbound internet access for instances in private subnets. Additionally, you will install and configure the CloudWatch Agent on a private instance to stream live web server logs to AWS CloudWatch, allowing you to monitor web activity in real time.
2. Duration: 1 hour.
3. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

​

What is NAT Instance ?

1. A Network Address Translation (NAT) instance is an EC2 instance configured to allow instances in a private subnet within an AWS Virtual Private Cloud (VPC) to access the internet. However, the private instances remain secure, as they do not have direct inbound internet access.
2. In a typical AWS setup, public subnets have direct internet access through an Internet Gateway, while private subnets do not. The NAT instance bridges this gap by providing internet access to the private subnet instances for activities like software updates or accessing external APIs, while still keeping them hidden from direct inbound internet traffic.
3. By disabling the source/destination check on the NAT instance and enabling IP forwarding, the NAT instance can forward traffic between the private instances and the internet, making it a secure and scalable solution for scenarios where internet access is needed for private instances without exposing them to direct external access.

​

What is Nginx?

• Delivering both static and dynamic web content
• Distributing client requests across multiple backend servers as a load balancer
• Routing traffic as a reverse proxy to improve performance, scalability, and security

​

Lab Feature :

​

Benefits:

• Learn how to configure NAT (Network Address Translation) for private EC2 instances to enable outbound internet access without exposing them to the internet directly.

• Understand how to create a VPC with public and private subnets, as well as configuring internet gateways and route tables for proper routing.

• Gain hands-on experience deploying EC2 instances in both public and private subnets, configuring security groups, and setting up key pairs for secure access.

• Convert an EC2 instance into a NAT instance by disabling source/destination checks and configuring IP forwarding, enabling private instances to access the internet.

• Learn how to install the CloudWatch Agent on a private instance, configure it, and view web server logs in AWS CloudWatch.

​

Architecture Diagram

​

Task Details :

1. Sign in to the AWS Management Console.
2. VPC and Subnet Setup
3. Launch EC2 instances within this VPC
4. Enable NAT Configuration for EC2 Instance
5. install Nginx (Webpage) in the Private Instance
6. Install and Configure CloudWatch Agent

​

Launching Lab Environment:

1. To launch the lab environment, click on the Start Lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM username, Password, Access Key, and Secret Access Key.

Note : You can only start one lab at any given time

​

Lab guide

​

Lab Steps

​

Task 1 : Sign in to AWS Management Console

1. Click On the Open Console Button, And You Will Get Redirected To AWS Console In A New Browser Tab.
2. On The AWS Sign-In Page,
3. Leave The Account ID As Default. Never Edit/Remove The 12 Digit Account ID Present In the AWS Console. Otherwise, You Cannot Proceed with the Lab.
4. Now Copy Your User Name And Password In the Lab Console to the IAM Username and Password In AWS Console and Click On the Sign in Button.
5. Once Signed in to the AWS Management Console, Make the Default AWS Region As US East (N. Virginia) Us-East-1.

​

Task 2 : VPC and Subnet Setup

1. In the AWS Management Console, you can find the VPC service by clicking on the “Services” dropdown at the top and type VPC in the search bar. Then, select the VPC service from the search results.

2. Once you’re in the VPC service, you’ll see the option to create a new VPC on the side menu or by clicking on the create VPC button and VPC only.
3. Create a new VPC: Name:  Nat_vpc
4. Specify an IPv4 CIDR block for your VPC (10.0.0.0/16) in the IPv4 CIDR block field.

5. Click on the Create VPC button.

Note : Kindly Ignore the error message if anything popped up!

6. Within your newly created VPC, you’ll need to create two subnets: one public and one private.
7. To create a subnet, go to the subnets section in the VPC service and click on the Create Subnet button.

8. Click the VPC which we created before i.e., Nat_vpc

9. Specify the VPC you just created, the CIDR block for the subnet

• Subnet Name: PublicSubnet
• Choose Availability zone “us-east-1a”
• IPv4 subnet CIDR block: 10.0.1.0/24

11. Now we are going to create the same steps,

• Subnet name: PrivateSubnet
• Choose Availability zone “us-east-1a”
• subnet CIDR block: 10.0.2.0/24
• Click  Create Subnet .

12. Configure the route tables and internet gateway for the public subnet
13. For the public subnet to have internet access, you’ll need to configure the route table and attach an internet gateway.
14. Go to the Route Tables section in the VPC service and create a new route table for the public subnet.

• Route Table Name:  “Nat_public_rt”
• Select vpc  : “Nat_vpc”

15. Click Subnet associations then  “Edit subnet associations”

16. Select PublicSubnet  then click  Save associations .

17. Next, go to the Internet Gateways section and create a new internet gateway.

• Internet Gateway Name: My-Internet-Gateway

18. Once Internet gateway is created attach it the VPC that you have created.

19. In the ”Nat_public_rt“ route table, click on Edit routes, then add your internet gateway. The destination should  be (0.0.0.0/0), and the target should be the internet gateway.

20. Again create a route table for “PrivateSubnet”

• Route Table Name:  “private_rt”
• Select vpc  : “Nat_vpc”

22. Select PrivateSubnet  then click Save associations.

​

Task 3 : Launch EC2 instance within this VPC

1. Navigate to EC2 by clicking on the Services menu in the top, then click on EC2 in the Compute section.
2. In the EC2 service, you’ll see a left-hand side menu. Click on the Instances option, and then click on the Launch Instances button to start the process of creating a new EC2 instance.
3. Name: Enter NAT_instance

• Choose “Amazon Linux 2023 AMI”

4. For Instance Type: Select t2.micro

5. You’ll need to create a key pair to securely connect to your EC2 instances. Select the Create a new key pair option.
6. For Key pair(login): Select Create a new key pair Button

• Key pair name: WhizKey
• Key pair type: RSA
• Private key file format: .pem

7. Make sure to select the Nat_vpc and public subnet we created earlier**.**
8. In Network Settings Click on Edit Button:

• Auto-assign public IP: Enable
• Select Create security group
• Security group name: “NaT_ins_sg”
• Description: “Security Group to allow traffic to EC2 “

9. We will now add the security group rules. SSH will already be present there.

• Click to add rules:
  • For HTTP: Set the Source type  to 0.0.0.0 (Anywhere)
  • For HTTPS: Set the Source to  10.0.0.0/16
  • For All ICMP-IPv4: Set the Source to 10.0.0.0/16

10. Click Launch Instance.
11. Repeat the steps to launch another instance, ensuring it’s in the same VPC but in the private subnet.
12. To create the second EC2 instance, repeat the same steps 2-7 and make sure to select the key pair which we created before.

15. Auto assign Public IP - Disable
16. Create a new security group for this instance as private_ins_sg, allowing inbound traffic from the first instance’s security group.

17. In the Inbound Security Group Rules, leave the default settings as they are and  add new rule For HTTP: Set the Source to 10.0.0.0/16

18. Click Launch Instance.

​

Task 4 : Enable NAT Configuration for EC2 Instance

1. Select the NAT instance, go to the Actions menu, then choose Networking and click on Change Source/Destionation Check. Enable the Save option and Click on Save Opti.

2. Open your Local terminal and navigate to the location where your .pem file is stored.

chmod 400 "WhizKey.pem"

3. Then, Upload your .pem key from your local machine to the EC2 NAT instance using the following

scp -i WhizKey.pem  WhizKey.pem  ec2-user@<ec2-Nat-instance-public-ip>:/home/ec2-user/

• Replace the <ec2-Nat-instance-public-ip> and the Key pair name accordingly.

4. Navigate to VPC and Go to Route table Section. Select private_rt.
5. Select Routes Option and click Edit Routes Option.

6. Click Add route

• Destination : 0.0.0.0/0
• Target : Instance - Choose Nat instance
• Click “Save  changes “

7. Now, Navigate to EC2, Connect the Nat_instance

8. Copy paste the command on NAT instance :

• Enable IP forwarding :

sudo dnf update -y

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/custom-ip-forwarding.conf

sudo sysctl -p /etc/sysctl.d/custom-ip-forwarding.conf

• Setting up ip-tables for NAT (correct interface!)

9. Check correct interface by the below command:

ip a

Note :  Replace enX0 with your actual network interface (e.g., enX0, ens5,..). Run ip a to confirm your interface name before applying the below code.

sudo yum install iptables-services -y
sudo systemctl enable iptables
sudo systemctl start iptables
sudo iptables -t nat -A POSTROUTING -o enX0 -j MASQUERADE # Replace enX0 with your actual interface if different
sudo service iptables save

10. Ensure iptables FORWARD chain is ACCEPT :

sudo iptables -P FORWARD ACCEPT
sudo iptables -L FORWARD
# There should NOT be a REJECT rule—remove it if present!
sudo iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited

• Paste and run each command one at a time to see where it might hang or fail.

11. Again go to Instance Page and Select Nat_Instance. Click on Connect and Open new tab.

12. Now we doing, Private instance via ssh command which is running inside NAT instance

13. Check the internet connectivity  in the private_instance

​

Task 5 : Install Nginx (Webpage) in the Private Instance

1. On Private EC2 Instance,

• Install Nginx  ,Copy paste the command

sudo dnf update -y
sudo dnf install nginx -y

2. Set up a Simple Web Page

echo "<h1>Hello from IP Lab Portal</h1>" | sudo tee /usr/share/nginx/html/index.html

3. Enable and Start NGINX

sudo systemctl enable nginx
 sudo systemctl start nginx
 sudo systemctl status nginx

4. Now, Again Login NAT_instance, Click Connect, Use EC2 Instance Connect (Browser-based SSH), You’re now inside the NAT instance terminal.

5. The NAT instance will use NGINX to act as a reverse proxy, forwarding requests to the private instance.

• Install NGINX :

sudo dnf install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx
sudo systemctl status nginx

6. Configure NGINX as a Reverse Proxy

• Open a new NGINX configuration file

sudo nano /etc/nginx/conf.d/reverse-proxy.conf

7. Paste the following configuration

• Replace 10.0.1.10 with the private IP address of your private_ins.

server {
    listen 80;
    location / {
        proxy_pass http://10.0.1.10;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

8. Save and exit the file .

• Press “CTRL + X”   to save. Press “Y”
• Press Enter to confirm the file name.

9. Test the new configuration for syntax errors

sudo nginx -t

10. Reload NGINX to apply the changes

sudo systemctl restart nginx

11. Disable Firewalld and Flush IPTables Rules

• Run these commands on the NAT instance to stop firewalld and flush iptables

sudo systemctl stop firewalld
sudo iptables -F
sudo iptables -t nat -F
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT

• This will allow traffic on port 80, which is necessary for NGINX reverse proxy to work.

12. Any requests made to the NAT instance’s public IP on port 80 will be forwarded to the private instance’s web server.

13. Again run this commands, which Setup iptables NAT:

Note : Replace enX0 with your actual network interface (e.g., enX0, ens5,..), Run ip a to confirm your interface name before applying the below code.

sudo yum install iptables-services -y
sudo systemctl enable iptables
sudo systemctl start iptables
sudo iptables -t nat -A POSTROUTING -o enX0 -j MASQUERADE # Replace ens5 with your actual interface if different
sudo service iptables save

​

​

Task 6 : Install and Configure CloudWatch Agent

1. Go to the EC2 section in the AWS Management Console, open the Instances page, and select your private_ins instance.
2. Then open the Actions menu, navigate to the Security settings, choose Modify IAM Role, select the EC2_CloudWatch_Agent_policy from the list of available roles, and confirm the update to attach the role to your instance.

3. Now we going to Connect to your private EC2 instance again,

5. Install CloudWatch Agent

sudo dnf install -y amazon-cloudwatch-agent

6. Create agent config file

sudo mkdir -p /opt/aws/amazon-cloudwatch-agent/etc/
sudo nano /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json

7. Paste this config (for monitoring NGINX logs)

{
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/nginx/access.log",
            "log_group_name": "/nginx/access",
            "log_stream_name": "{instance_id}-access",
            "timezone": "UTC"
          },
          {
            "file_path": "/var/log/nginx/error.log",
            "log_group_name": "/nginx/error",
            "log_stream_name": "{instance_id}-error",
            "timezone": "UTC"
          }
        ]
      }
    }
  }
}

8. Save the file

• Press “CTRL + X”   to save. Press “Y”
• Press Enter to confirm the file name.

9. Start the agent with your config

sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \\
  -a fetch-config \\
  -m ec2 \\
  -c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json \\
  -s

10. Confirm Logs in CloudWatch :

• Go to AWS Console, Search for CloudWatch, Select Log Groups in the left panel.

11. Open the log groups in the CloudWatch console and view the log streams associated with your EC2 instance ID.

• Check whether logs from your EC2 instance are being successfully delivered and displayed in the selected log streams.

Do You Know?

While NAT Instances are great for cost-effective small-scale use cases, NAT Gateways are more scalable and highly available. With NAT Gateways, you don’t need to manage instances, and AWS automatically scales them. However, NAT Instances are often cheaper in smaller environments and offer full control.

​

Completion and Conclusion

1. You have successfully created an VPC
2. You have converted an EC2 instance into a NAT Instance
3. You have successfully pinged Google from the private instance via the NAT instance.
4. You have installed Nignx , Cloud Watch Agent on the private instance
5. You have connected Cloud Watch Agent to AWS CloudWatch,

​

End Lab

1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you completed the steps, click on End Lab from your IP Lab Portal and wait till the process gets completed.

​

What gets checked

• Create Amazon Custom VPC — Check whether a Custom VPC is created or not.
• Create Amazon Custom VPC Subnet — Check whether a Subnet is created for the Custom VPC or not.
• Launch an EC2 Instance — Check whether an EC2 Instance is launched or not.
• Check Log Group — Check whether a CloudWatch log group exists.

​

Related help

• FAQs and Troubleshooting