Okay.
Hello loggers and welcome to this lecture.
So in this lecture we're going to create our own custom VPC.
This is going to take slightly over 20 minutes.
So we are going to break it into two parts.
So this is a lab and you will need to log into the adobe us console.
Okay so here I am in the database management console and I'm going to do the rest of this section of
course out of the Ohio region.
The reason for that is I'm currently in Austin Texas.
We have an office out here and Ohio gives me the lowest latency.
So we're going to find VPC if we go into services we're going to scroll down.
We're going to find networking and content delivery and VPC is always going to be the top one under
there.
So go ahead and click in there and this will load Al VPC splash screen and it looks a little bit like
this.
We can see all our resources by region but we can also see all regions so we can click on here and or
load all our V.P. season all the regions around the world and you can go ahead and launch BBC wizard.
But the problem with doing that is you're not going to learn anything.
And we want to be able to build a VPC all by ourselves.
So if we click on V.P. pieces in here we can see that we've got one VPC and this is our default VPC
and we have a quick look at our subnets we can see that it's got three subnets.
They are all using this site our address range so it's 1 7 2 dot 31 and then dot 16 dot 0 1 72 dot 31
dot 0 0 and then 172 dot 31 dot 32 dot 0.
So these are slash 20.
This gives us four thousand ninety one available IP addresses.
Now you will note that they each subnet is in a separate availability zone and we click on here we can
see our default route tables.
This is also a route table that's created for us when we have our default veeps.
You can see our internet gateway.
This allows our VPC to talk to the Internet and down here we've got our network access control lists
and then down here we've got our security groups and we can see a web DMC security groups because I
have used this VPC before.
So let's go ahead and create a VPC and what we want to see is what resources are created by default.
When we create our BPC.
So what are we going to call this VPC.
Well I'm going to call it a cloud guru VPC.
And in here we've got our HPV for side address block.
So what I'm going to do is I want the biggest address block possible so I'm going to go 10 0 0 0 and
then forward slash and then 16 and in here we can also do a IPTV six site a block that's entirely up
to you.
I am going to use the amazon provided HPV sex just so we can see some options later.
And here we've got our tenancy.
So if we want everything to be on dedicated hardware we would click on dedicated.
That is going to cost you a fortune.
I'm going to use the default which is multi tenant.
So we are sharing our underlying hardware with other AWOL customers.
What I'm going to do is go ahead and hit create and that has now created our VPC and we've got a new
VPC I.D..
So let's go back and see what has been created.
Let's see if there's been a subnet created.
And in here you can see this VPC all these three subnets are still out default VPC we cannot see our
new VPC in here.
So when we create a VPC it doesn't create any subnets per click on Route table however we'll be able
to see if we go over here and we just extend this across.
You'll be able to see here.
So here is our route to table this belongs to the a cloud group VPC and this one belongs to our default
BPC.
So it has created a route table.
What about an Internet gateway.
Well no.
There's no a cloud guru BPC in there so hasn't created an Internet gateway.
We go down and have a look at our network ACL.
We can now see that this does have a network ACL a default network ACL that's been created since the
clog everyone.
And likewise with a security group we can see just by moving this across.
It has created a security group.
Is this just showing us our VPC I.D. here it's not giving us the name but that's our a cloud guru VPC
in there.
So essentially when we create our BPC we're creating by default a route table a network ACL and a security
group.
So this is what our VPC looks like now ignore the region but everything else is identical so we've got
a router or a root table we've got a network ACL and we've got a security group so that's what our VPC
currently looks like.
Now in order to be able to use this VPC we need to go in and create some subnets so let's go ahead and
do that now.
So in order to be able to create our subnets we go over here to subnets and note these three subnets
that already exist.
They're using the 172 dot 31.
So these are the subnets that were created with our default VPC.
They're not using the 10 dot dot dot o range.
So what we want to do is go ahead and hit create subnet.
In here we're going to give our subnet a name before we do that as click on BPC and click on a cloud
guru BPC.
And in here you can go ahead and click on your preferred availability zone now it is worth noting that
my let's say we've got two different AWB accounts.
My us e to a could be completely different to your US e to a.
The reason Amazon do that is they randomize the availability zones because everyone was always going
to pick 2A and 2B as their sort of first and second preferences and they want to make it completely
random.
So in one AWB account a certain availability zones such as us e to a could be a completely different
availability zone even though it's got the same name in another AWB accounts do just bear that in mind.
So I'm going to use us e to a and I'm gonna give it a a subnet address range of 10 dot 0 one dot 0 and
then I'm gonna give it a slash 24.
And in here I'm going to give it my name so it's already giving me my name as rain critic bug on to
make it very easy to read so I'm gonna do 10 0 1 0 and then hyphen and then I'm going to also put in
the name of the availability zone I'm going to call it us e to a and then that way I can just by looking
at the name know both decider address range as well as what availability zone that it's in.
And so then I'm going to go ahead and you can go in here and assign IP 6 if you want.
I'm not going to do that I'm just going to be using IP IPTV for.
So I'm going to go ahead and hit create and that has now created my subnet.
I can go ahead and hit close and now we can see it in here.
And if you would do one of sort by VTC just click in here and then everything will be sorted by our
VPC is gonna go ahead and create one more subnet.
And again in him going to select my BPC and I'm going to give this in put this in us e to be and I'm
gonna give it a address range of 10 0 2 0 forward slash 24.
And the name I'm gonna give it is going to be 10 0 2 0 then hyphen and then it's going to be us e to
be and I'm going to go ahead and hit create.
So that has now gone ahead and created my two subnets.
You can see them in here and just by looking at the name I am able to see what side their address ranges
that it's using as well as what availabilities and that it is in.
And note that we cannot have a subnet span availability zones.
So it's always one subnet equals one availability zone that comes up an awful lot in your exams.
Now if we scroll across here there's a couple of things we need to look at.
What do assign public IP address by default has been turned off.
So we are going to have to fix that because we're going to have one of these as a public subnet and
one of them as a private subnet.
And the other thing we should also note is in here we've only got 251 available addresses.
Now if you remember that website site dot x y z if we use a 10 dot dot let's just change this to 0 0
forward slash 24.
We should be getting 256 addresses available to us an actual usable amount of 254.
We seem to be missing some why do we only have 251.
And I'll put a link to this in the resources section of the course but if you just go over to VPC subnet
sizing in here you can see that the allowed block size is between a slash 16 which is what we created
and the very top one is a slash 28 which we covered off in the last election.
We scroll down we can actually go ahead and see some reserved IP addresses and Amazon go ahead and reserve
a five IP addresses they reserved the network address they reserved the network broadcast address and
then they reserve 10 dot dot Oh Dot one for the VPC router.
So that's actually your VPC routers address and 10 dot dot Oh Dot two is reserved by AWB.
And this is the IP address of the DNS server for your VPC and then they actually just reserve one more
and they don't explain why but they've reserved hen dot Oh Dot Oh Dot three.
So you're always going to have five addresses and that's why it says 251 addresses instead of a 256.
So now that we have our subnets where you are going to want to have one that is publicly accessible
is probably going to be this one we'll just keep it simple standard 0.01 dot com.
Now in order for this to be publicly accessible we're going to need two instances to launch in it with
IP public IP addresses.
So we're going to need to also assign our public ip addresses so select the one that you want the subnet
that you want go ahead to actions and then just go over to modify or to either assign IP and enable
or to assign a public IP V for and there we go that has now enabled it and we are now able to launch
see two instances into this subnet and they'll automatically be able to get a public IP address.
So this is what our VPC looks like right now we've got our public subnet ten dot 0.01 dot 0 and we've
got our private subnet 10 dot Oh dot to dot so we've got our network ACL as our security groups are
root table.
But what we're missing is a way to get into this VPC so we're going to need to add an Internet gateway
and then we're going to have to go in and start configuring our route tables.
So let's go over to the obvious console.
Okay so to add our internet gateway or we need to do is click on Internet gateways in him and you can
see that there's no internet gateway for our VPC currently.
So let's go ahead and create one.
And I'm going to call this my AGW soon my internet gateway and go ahead and hit create that has now
created an Internet gateway.
It can seem like AGW is detached.
That's the state that it said now.
So if I go to actions I can go attached to a VPC and I can go ahead and select a VPC.
I'm going to select the eclair group APC and I'm going to go ahead and hit attach.
And that has now attached an Internet gateway.
I could go ahead and do my AGW too and create a second Internet gateway and hit close and let's see
if I can attach a second Internet gateway to my VPC and if I click in here you can see that there's
no V.P. sees in this box.
So you can only have one Internet gateway per VPC.
Don't worry about high availability.
Amazon completely design Internet gateways to always be highly available.
So just remember you can only have one Internet gateway attached to one VPC.
I'm just going to go in and delete this.
This Internet gateway because we don't need it.
So now that we have an Internet gateway we need to go into our route table and configure our main routes.
So we have a route out to the Internet.
So you click on here.
This is my default route to table and we click on our routes we can see two routes in here.
And essentially what this is doing is it's allowing our subnets to be able to talk to each other so
any subnet that we have inside our VPC using these two routes essentially means that they can communicate
to each other over HPV 4 and then over IP B6 we click on subnet associations and we maximum we maximize
this just so you can see it a little bit better says down here the following subnets have not been explicitly
associated with any route tables and are therefore associated with the main root table.
So if we were to put a route out to the Internet in our main route table that means that any subnets
that we were creating would automatically be as so associated to our main route table.
And what that would mean is is that all every subnet that we create by default would be public.
Now that could be a security concern.
So really what we want to do is always keep our main root table as private.
And then we have a separate root table for our publics subnets.
So let's go ahead and do that.
Let's go over and create a route table and I'm going to call this my public route.
So this essentially any route any subnet that's associated with this route table will then be able to
talk to the Internet it's click in here.
BP says we're going to create it into our BPC and go go ahead and hit create.
We now have to route tables.
We just minimize this a bit more.
You can see we've got my public route and then we've got my other route to table.
And you can see that this is the main route table and this is not the main one.
So anytime we create a subnet it's always going to be associated with the main.
But with our public route and we have to go in specifically associate our subnets with this public route
first thing we're going to do with our public route is create a route out to the Internet so we could
go ahead and hit edit routes and we can go in and add our routes.
So to create a route out all we do is type in 0 8 0 0 0 forward slash and then 0 and then that will
give us a destination.
And then here we just type our target and our target will repopulate with all of these.
What we want is our Internet gateway and then we select our internet gateway and then we can also go
in and add our route.
And you can go if you want to do IP v 6 you just go.
Colon colon and then forward slash and then Oh.
And that will give us a route out.
And again we're going to do that using our internet gateway and just click on the Internet gateway in
there.
Go ahead and save your roots.
And that has now given you a route out for HPV for an IP v sex to our Internet gateway and now any subnet
that's associated with this route table will automatically become public.
Both both for HPV for as well as HPV 6.
So let's go ahead and click on our subnet associations in here go to edit subnet association.
And we're going to add this subnet to our public group table and that has now associated that subnet
with this root table.
So if you go in and click on your main one you'll be able to see that the only one that's associated
with our route to table is to dot.
We no longer have 1.0 and 1.0 is now associated with our public route table.
And so you can see it in here 10 dot dot 1.0 is associated to this route table.
And guess what.
It has a route out to the Internet.
It's got our own dot dot dot o which points to our Internet gateway.
So that's how it all works.
We now have a public subnet and we have a private subnet.
Next thing to do is to go in and start provisioning easy two instances.
And we're going to create an easy to instance in a public subnet as well as one in our private subnet
some then we're going to go in and test it.
So we just go over to compute click on easy to launch two different easy two instances.
I'm going to go ahead and launch my instance and I'm going to use the amazon Linux 2 am I.
And I'm going to just use a to my crew.
So we're not going to leave everything as default what we're gonna do is we're going to go over to our
network.
We're going to change this to our BPC and then we're going to select our public for our public subnet
which is this one us e to a similar click in there and then you can see here it says auto assign public
IP address use the subnet setting which is enable.
So it's automatically going to get a public IP address.
Next we're going to add our storage and add our tags.
I'm going to add a tag I'm just gonna call this name and then this will be web server 0 1 and then I'm
gonna go ahead and configure my security groups.
Right now I'm going to if a click existing security groups there's only my default security groups note
that I do not have any web DMZ security groups in here.
That's because my web DMZ security group was in my other VPC so security groups do not span VPC is going
to go ahead and create a new security group.
I'm going to call it Web DMZ because we're going to need to be able to SSA reach into this as well as
give it Internet access as sorry as well as give it HBP access.
So going to add in here GDP and then I'm gonna go in and hit review and launch.
So this has created a new security group that will allow has ss hate and HDTV opened to the world.
And then I'm just gonna go ahead and launch it and I'm gonna actually do a new keypad because I don't
have this keep hair on this computer.
So I'm just going to call it my new key pair and I'm going to download that and then I'm gonna go ahead
and launch my instance and that is now launching and going to go over a few instances are going to launch
our second instance it's going to be an Amazon Linux.
Am I too gonna go ahead and hit next in here make sure you change your network to your new VPC and I'm
going to launch this instance into us e to be note or to assign public IP address.
The last one said enable this one says disable and is using the subnet settings so as we're not going
to get a public IP address for this easy to instance let's go ahead and at our storage just going to
leave that as default and add my tag and the name we might just call this my D.B. server.
So this is my database server I'm going to go in and configure my security groups I'm gonna use an existing
security group but I'm not going to use the Web DMC I'm going to use the default security group and
then I'm going to go ahead and hit review and launch and then I'm gonna go ahead and hit launch and
I'm going to use my new key keypad to use the same key pair as I did for the other one and I'm gonna
go in and view instances now straight away we can see over here we have a public IP address for this
easy to instance so let's go in and try and connect to this easy to instance case I'm going to go over
to my downloads directory and I'm going to hit enter and in here I've got my my new key pad so my new
key power I am just going to switch mod that because this is a new key player so I'm gonna do the appropriate
commish permissions so I can connect in and there we go.
And then I'm just going to clear the screen and to SSA Chen I'm just gonna type SSA H.
Easy to use.
And then at.
And then the public IP address so pasted that in there and minus I.
And then it was my new key paired up PM hit Enter type in yes.
And there we go.
I am now SSA reached in to my AC to instance to elevate my privileges to route and then I'm just gonna
go ahead and clear the screen so that is the end for part 1 am conscious we're about to go over 20 minutes.
This is basically what we've created thus far so we've got our VPC with an Internet gateway attached
we've got our two different route tables once a public route table and one's our default route table
we've got one network ACL we've got two security groups one's web DMC and one's our default security
group our easy two instances private is in our default security group and our AC two instances public
is in our web DMZ and right now we can only connect into the public easy to instance because we've got
a public IP address so do we learn in this lecture.
Well we learnt that when you create a VPC a default route table and network access controls and a default
security group is created.
It won't create any subnets nor will it create a default Internet gateway.
And just remember that US is one eh in your AWB account can be a completely different availability zone
to us e one a in another AWB account that the availability zones are always randomized.
And then of course Amazon always reserve five IP addresses within your subnets can only have one Internet
gateway per VPC.
And then finally we learnt that security groups can't span V.P. seas.
So that is it for this lecture in the next lecture we're going to connect into our easy to instance
that's in our private subnet.
So if you've got the time please join me in the next lecture.
Thank you.