VPC [ Virtual Private Cloud] Setup & VPC Endpoints
Published: 2022-02-01 14:23:39

## __
## **_What is VPC?_**

> - Virtual Private Cloud (VPC) enables you to launch AWS resources into a virtual network that you've defined. This virtual network closely resembles a traditional network that you'd operate in your own data center, with the benefits of using the scalable infrastructure of AWS.

## **_Amazon VPC concepts_**

> - **Virtual private cloud (VPC)** — A virtual network dedicated to your AWS account.
> - **Subnet** — A range of IP addresses in your VPC.
> - **CIDR block** —Classless Inter-Domain Routing. An internet protocol address allocation and route aggregation methodology. 
> - **Route table** — A set of rules, called routes, that are used to determine where network traffic is directed.
> - **Internet gateway** — A gateway that you attach to your VPC to enable communication between resources in your VPC and the internet.

> - **Security groups**: Acts as a virtual firewall to control inbound and outbound traffic for an AWS resource, such as an EC2 instance. Each VPC comes with a default security group, and you can create additional security groups. A security group can be used only in the VPC for which it's created.
> - **Network ACLs**: An optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of your subnets.
> - **VPC endpoint** — Enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service.

- To understand what an S3 VPC endpoint is, we first need to know what problem it solves.
- Imagine we want to get access to S3 from an AWS resource. In the example below, we have an EC2 instance that needs to copy a file from an S3 bucket:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/29uozd1iivu1m0ydlnqn.png)

- This works, because:
- the EC2 instance is in a public subnet, so has access to the internet
- therefore the EC2 instance can reach the AWS S3 URL to copy the file from the S3 bucket

**The problem with S3 access from a private subnet**

> - Where this starts to fall down, though, is when we need to access S3 from an EC2 instance in a private subnet, as in the example below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pgvhbbbp5l12k3hbqnxt.jpeg)

> - This doesn’t work, because:
> - the EC2 instance is in a private subnet, so has no internet access
> - therefore the EC2 instance can’t reach the AWS S3 URL, and the request will time out

**- S3 VPC endpoints solve this problem**

> - An S3 VPC endpoint provides a way for an S3 request to be routed through to the Amazon S3 service, without having to connect a subnet to an internet gateway.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kjucqrr0wh9m6pn6232h.png)

## **_How can we access our s3 bucket if our instance is present inside a private subnet of VPC?_**

> - If your instance is in private subnet of VPC then: You need to have a NAT device running in public subnet. So that the instance in private subnet of VPC can access internet via NAT and access S3. But there may be a lots of latency , so in that case we can use VPC endpoint.
> - Through VPC endpoint we can access our s3 bucket directly through a private instance present in a private subnet of VPC 
> [ just like an internal tunneling ].



 ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ynloq9eqqgzvv9iwdmb7.png)



## _Lets do a Setup as per above diagram_


**1. Create a s3 bucket**

- Search for s3
- Click on Create Bucket and create a s3 bucket
- Follow this link :- https://dev.to/shankarsurya035/what-is-s3-bucket-how-to-mount-a-s3-bucket-in-a-drive-network-drive-3d4f

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0t7typv5rqk3uocuye9a.png)

-Upload some files inside that bucket.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6rizeehewc30xfgf4c9v.png)

**2. Create a IAM User**

- Search for IAM role
- Click on user and Add User
- Name it "s3user"[or your wish]
- grant access key permission , next permission.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t3b7g2evklsv9vbdeg7f.png)

- select attach existing polices
- select s3 full access ,next tag.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i4bhyaexcirfx6q4u98z.png)

- Download .CSV file [ here access and secret keys are present]

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pvl54e82uhfbv5e8tp3v.png)


**3. Create a VPC**

- Search for VPC

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z1v5vxq4bd08ai4zq80q.png)

- Click on create VPC 

- Name it VPC-1,
- CIDR range :- 10.0.0.0/16

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vucip4uf972wdpmj8wcp.png)

- Create VPC.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2tfjuzikeekc49a0yiw8.png)

**4. Create Subnets inside that VPC**

**- Create a PUBLIC SUBNET**

> - Click on subnet and create subnet
> - Choose Your VPC 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5ew28uijjblalltispkc.png)

> - Name :- public subnet
> - choose your zone
> - Give a CIDR range to it 
> - Create.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8bwm1p4ltdtbwwdgjwa3.png)

> - Click on subnet setting and enable auto assign public IP.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/scyw8k4rcnb8z6h796ox.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4jfc089e596agogv7r76.png)

**- Create a PRIVATE SUBNET**

> - Choose Your VPC 
> - Name :- private subnet
> - choose your zone
> - Give a CIDR range to it 
> - Create.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z267o3t3fb12w93nzvl8.png)

> - Here Two Subnets Are 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/exso23jen1u7rbqmyc6i.png)
 

**5. Create a Internet Gate way [igw]**

> - Select Internet gateway

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b8nhsnx8s5fc9cbk3s9g.png) 

> - Create igw and name it.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hclk0g936uq38g435xju.png)

> - Attach it to your VPC

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3p0xtzcwtf9qswpc48qm.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l9yzyh866n0ii6bavai6.png)

**- Now we have to create Routes table with Subnets Association.**

**_- Routes For Public Subnet_**
> - Click on Create Routes table.
> - Create routes table for **public subnet**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t5dy65e92w6fy5ez3ut4.png)

> - Associate That private subnet to it

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qzpmvg051by4iink8tkp.png)

> - Then Edit Routes , give a gate way path to the internet.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/moph8zucb4sen98ljrvq.png) 

**_- Routes For Private Subnet_**
> - Click on Create Routes table.
> - Create routes table for **private subnet**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o6mcvc406z5a2kr68wpu.png)

> - Associate That public subnet to it

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r7qeu37zrfcl6tt5xr08.png)

> - Now as we want to restrict internet in our private subnet, so we don't give any internet routes path to it.


**6. Lets Deploy Server/instances inside those Subnets**

**Public server**

> - Search for Ec2
> - Click on Launch instance
> - Launch Amazon linux 2 AMI

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/16n6ijhufn04c00dg926.png)

> - Select T2micro [free version]
> - On step-3 :- Select Your Vpc , public subnet.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sck3lg4txupq5tm0r66x.png)

> - On security group select All traffic , Anywhere [ Its not a best industry practice ].

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kbhd1k5bsn3o8oobu0hd.png)

> - Click next and download key pairs.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s4kimtdxuea55a4aqiwd.png)

**Private server**
> - Click on Launch instance
> - Launch Amazon linux 2 AMI
> - Select T2micro [free version]
> - On step-3 :- Select Your Vpc , private subnet.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o6d2qlc13gczdqv867ol.png)

> - Launch it and download key pairs.

**_Here are Two servers_**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2b9io1scft6sqwgyj0x6.png)

## Now lets connect our public server through Xshell and try to access s3 bucket using internet

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cre5dp3kp2fpgqyy3pfx.png)

> - Go to root user and type **aws configure**

> - copy paste those IAM secret and access keys created earlier.

> - Type your region name and output format (example:-json,table).


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r3z4irv5atdkp70u9xpx.png)

> - Type **aws s3 ls** [To list out your s3 buckets].
> - Type **aws s3 ls s3://Your bucket name** [To list all files inside that bucket]

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/my5ev1cuquur4079gla2.png)

_- Here we Successfully Access our s3 bucket through our Public server_

- Now we cannot Directly connect to our private server because that server don't have any public IP, we can only able connect to our private server through our public server [ inside our public server]

> - Connect to public server , and now try to connect private server inside it.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/szc4nbb2oeqgsqmdgpq2.png)

> - Create private key file by vi command , paste the private keys keys , click esc shift+:wq to save

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dzxnboaeffczr1sgo9ac.png)

> - Give read write permission to it by chmod command

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zul6xduaeagsuz9ffz3v.png)

> - Now try to ssh into it You will able to connect 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/30dt56lg7w8p5fcims54.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fdcdqhadybkgj5w509w6.png)

**Inorder to access to our s3 bucket through private instance we need to setup a VPC end points**

> - Click on endponits , Create endpoints.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/721gd4rnzmdwmyw6cock.png)

> - Name it
> - Select AWS services catagory.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nv0lpnjzjznl5o7x8tpt.png)

> - select Your services , vpc and routes table

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1ntfnv4six62xko3c82c.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nvo5vs8io7z6qb9wfgk2.png)

> - Create endpoint.

- Now you can Able to access s3 bucket without connecting to the internet through private instance.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vh0d1szcsrk0g15zg3xh.png)