☁️ 🚀 Virtual Private Cloud on AWS — Quickstart with CloudFormation
Published: 2021-03-15 15:04:08

A Virtual Private Cloud is the foundation from which to build a new system. In this article, I demonstrate how to create one using CloudFormation.

![Photo by [Pero Kalimero](https://unsplash.com/@pericakalimerica?utm_source=medium&utm_medium=referral) on [Unsplash](https://unsplash.com?utm_source=medium&utm_medium=referral)](https://cdn-images-1.medium.com/max/7008/0*kmVpoS3oecZICPjc)*

Photo by [Pero Kalimero](https://unsplash.com/@pericakalimerica?utm_source=medium&utm_medium=referral) on [Unsplash](https://unsplash.com?utm_source=medium&utm_medium=referral)*

Virtual Private Clouds (VPCs) are networks in the cloud. A VPC contains a range of IP addresses that can be subdivided into smaller ranges of IPs known as subnets. Communication across these subnets can be controlled using route tables, security groups and access control lists. Communication to and from the internet is enabled by two types of gateway:

* NAT Gateways which enable access **to** the internet.

* Internet Gateways which enable access **to** and **from** the internet.

A subnet is considered private if it uses a NAT instead of an Internet Gateway. Route tables determine where network traffic from your subnet or gateway is directed. A route is required from the subnet to the gateway to enable internet access.

VPCs are important because they are environments which can be configured to reduce security risks and improve networks speed between components.

### Architecture

For this example, I am going to create a place in Amazon’s Cloud. The VPC comprises three public and three private (hybrid) subnets.

![](https://cdn-images-1.medium.com/max/2000/1*0xJI-GnE10TDeDZvQGvQrQ.png)

### Deployment

To deploy this system, I am using the AWS CLI with CloudFormation. It is as simple as:

    `aws cloudformation create-stack --stack-name service --template-body file://template.yml --capabilities CAPABILITY_NAMED_IAM`

The full template can be found [here](https://github.com/sk-t3ch/AWS-VPC).

### VPC

To begin, the simplest VPC:

    VPC:
        Type: AWS::EC2::VPC
        Properties:
        CidrBlock: "10.0.0.0/16"


The only property we are required to provide is the `CidrBlock`, a range of IP addresses that you declare available for use in the network.

The next step is to add subnets to the VPC. These occupy sections of the range of IPs in the VPC. You are required to configure `CidrBlock` which in this case is `10.0.1.0/24` meaning that we can use the addresses in the range `10.0.1.0 — 10.0.1.255` .

    Subnet:
        Type: AWS::EC2::Subnet
        Properties:
        VpcId: !Ref VPC
        CidrBlock: "10.0.1.0/24"

The component required to enable access from a subnet to the internet is an Internet Gateway. This sits at the edge of the VPC and orchestrates any traffic routed from or to them with the internet.

The following template configures a public subnet:

    PublicSubA:
        Type: AWS::EC2::Subnet
        Properties:
        VpcId: !Ref VPC
        CidrBlock: "10.0.1.0/24"
        AvailabilityZone: !Select
            - 0
            - Fn::GetAZs: !Ref AWS::Region
            
    InternetGateway:
        Type: AWS::EC2::InternetGateway
        
    GatewayAttachment:
        Type: AWS::EC2::VPCGatewayAttachment
        Properties:
        VpcId: !Ref VPC
        InternetGatewayId: !Ref InternetGateway
        
    RouteTablePublic:
        Type: AWS::EC2::RouteTable
        Properties:
        VpcId: !Ref VPC
        
    RoutePublic:
        Type: AWS::EC2::Route
        Properties:
        DestinationCidrBlock: "0.0.0.0/0"
        GatewayId: !Ref InternetGateway
        RouteTableId: !Ref RouteTablePublic

    RouteTableAssocSubnetPublicA:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
        RouteTableId: !Ref RouteTablePublic
        SubnetId: !Ref PublicSubA

A private subnet is not directly accessible from the internet. However, it is possible to access the internet from a private subnet using a NAT Gateway. An Elastic IP is required because the NatGateway is not automatically assigned a public IP.

    PrivateSubA:
        Type: AWS::EC2::Subnet
        Properties:
        VpcId: !Ref VPC
        CidrBlock: "10.0.4.0/24"
        AvailabilityZone: !Select
            - 0
            - Fn::GetAZs: !Ref AWS::Region
            
    ElasticIPNatGatewayPrivateA:
        Type: AWS::EC2::EIP
        
    NatGatewayPrivateA:
        Type: AWS::EC2::NatGateway
        Properties:
        SubnetId: !Ref PrivateSubA
        AllocationId: !Ref ElasticIPNatGatewayPrivateA
        
    RouteTablePrivateA:
        Type: AWS::EC2::RouteTable
        Properties:
        VpcId: !Ref VPC
        
    RoutePrivate:
        Type: AWS::EC2::Route
        Properties:
        DestinationCidrBlock: "0.0.0.0/0"
        InstanceId: !Ref NatGatewayPrivateA
        RouteTableId: !Ref RouteTablePrivateA
        
    RouteTableAssocSubnetPrivateA:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
        RouteTableId: !Ref RouteTablePrivateA
        SubnetId: !Ref PrivateSubA


Availability Zones (AZs) are groups of data centres inside a Region that are isolated from the failure of another AZ. Each subnet created in a VPC must be placed in a single AZ and a system can be protected from an AZ failure by utilising multiple AZ architecture — you’re recommended to have three public and three private subnets spanning different AZ zones. A VPC template for this can be found [here](https://github.com/sk-t3ch/AWS-VPC).

A VPC is pretty useless without any services running inside it. For that, check out the following articles:
[**Cheaper than API Gateway — ALB with Lambda using CloudFormation**
*An alternative to API gateway is Application Load Balancer. ALB can be connected with Lambda to produce a highly…*medium.com](https://medium.com/@t3chflicks/cheaper-than-api-gateway-alb-with-lambda-using-cloudformation-b32b126bbddc)
[**AWS Auto Scaling Spot Fleet Cluster — Quickstart with CloudFormation**
*Running applications on separate machines quickly becomes an inefficient use of compute and therefore money. In this…*medium.com](https://medium.com/@t3chflicks/aws-auto-scaling-spot-fleet-cluster-quickstart-with-cloudformation-6504a61f7aab)

### Thanks For Reading

I hope you have enjoyed this article. If you like the style, check out [T3chFlicks.org](https://t3chflicks.org/Projects/aws-quickstart-series) for more tech focused educational content ([YouTube](https://www.youtube.com/channel/UC0eSD-tdiJMI5GQTkMmZ-6w), [Instagram](https://www.instagram.com/t3chflicks/), [Facebook](https://www.facebook.com/t3chflicks), [Twitter](https://twitter.com/t3chflicks)).



Resources:

* [https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html)

* [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html)