Welcome back to backspace Academy. 1
If you have made it this far you're well and truly on your way to getting that much prized associate 2
certification with AWS. 3
Now this lab. 4
It's an absolute monster of a lab it's a 10 part lab so unlike the other labs where you're just learning 5
a concept and then moving on to the next subject and then learning another concept this lab is going 6
to cover a great deal of concepts that you've covered more or less previously. 7
But we're going to go into a lot more advanced detail and it's really going to challenge you and you're 8
going to have quite a bit of time spent on this lab and it's not because I don't like you quite the 9
opposite in this industry. 10
There are two types of people those that think they know and those that know their stuff and I produce 11
people that know their stuff because I take the effort to produce labs like this so please follow this 12
lab download the lab notes and make sure you get to the end because at the end of this you're going 13
to be very very confident. 14
So we'll start off talking about the lab and what we're going to be doing and then we'll be jumping 15
straight in and creating this three tiered advanced VPC architecture that's going to have public and 16
private subjects and it's going to have a whole different levels of permissions within those tiers then 17
we'll look at securing our VPC resources within this VPC with security groups and applying those or 18
associating those security groups to our resources but also look at how we can monitor and log IP activity 19
in and out of our VPC to our VPC resources using VPC flow logs. 20
Look at elastic network interfaces and how we can actually take one of those off a running instance 21
and then attach them to another instance so that the IP address and all of the traffic that is going 22
to that elastic nitwit interface will then go over to that other instance and that can be quite handy 23
force in different situations. 24
Then we'll look at building high availability by replicating our architecture into another availability 25
zone. 26
We'll create an application elastic load balancer that will span those multiple Availability Zones in 27
a public subnet and an auto scaling group in a private subnet that will also span those multiple Availability 28
Zones and then we'll deploy a multi A-Z Aurora service cluster that will span multiple Availability 29
Zones in a locked down private subnet. 30
Then because that Aurora service cluster is going to be in a private subnet we're going to also create 31
a bastion host using the cloud nine service it will allow us to remotely access our raw cluster without 32
causing any security issues. 33
And finally we're going to create another highly secure layer using network access control lists 34
okay. 35
So this is what our architecture is going to look like we're going to have a VPC which will be located 36
in the US east one region. 37
So make sure that you use that region so you can follow on with the lab notes quite easily. 38
We're going to have multiple subnets and we're going to have those subnets in multiple Availability 39
Zones obviously to take advantage of high availability. 40
We're going to have a public subnet that is going to receive traffic from the outside world from the 41
Internet through an Internet gateway. 42
We're going to receive that traffic with an elastic low balance that is going to span those multiple 43
public subnets the elastic low balance that will then distribute that traffic to an auto scaling group 44
of easy two instances that will have a lamp web server running on that and that load those lamp web 45
servers will communicate with an Amazon Aurora database that will be located in a DP subnet group that 46
will be spanning those two private subnets. 47
Now we're using an auto scaling group but in the future we may want to use Elastic Beanstalk has a lot 48
of advantages where we can just update our code we can integrate it with a C I C D pipeline and that 49
sort of thing but for now we're just going to create an auto scaling group with instances in that but 50
we're going to make sure that our our application architecture can support those requirements. 51
Now one of the requirements of Elastic Beanstalk is it needs to have outbound access to the wider internet 52
so that we need to have a route from our subnet through to the Internet gateway. 53
But by definition a private subnet doesn't have that. 54
So what we're going to do is that we're going to create a net instance in one of the public subnets. 55
Now in that instance can be used as a gateway between our easy two instances or the Elastic Beanstalk 56
environment and to the wider internet to receive updates and for other downloadable stuff that it needs. 57
So we're going to launch that using the NCT service and we're going to use a net. 58
Am I to do that now because our Amazon Aurora cluster is located in a private subnet. 59
We're not going to be able to communicate to that from the outside world which creates a bit of a problem 60
because we might want to connect into that database and do some Eskew El commands we might want to update 61
that database manually we might want to download some information manually. 62
So to allow that to happen we're going to be creating or launching a bastion easy to instance again 63
in the public subnet and we're going to use a cloud nine service because as we'll see later on it does 64
have some advantages of using that rather than just launching an easy to instance on our own and that 65
will allow us to communicate safely and securely with our database without compromising security and 66
allowing access from outside our VPC. 67
The other thing that we need to do is that we're going to have some way to store our files which might 68
be images documents whatever. 69
So we're going to be using Amazon S three. 70
I mean this like we're not going to actually create a bucket because you know how to create a bug it's 71
pretty straightforward to do. 72
But when we create our VPC we're going to create a VPC endpoint to connect to the Amazon S three service 73
because he s three service and our bucket is not located in our VPC. 74
So we need to have an endpoint to allow communication between our Web services or our Web servers our 75
lamp web servers in our private net subnets to communicate with the Amazon S3 bucket and to receive 76
images documents and whatever and present them through to the elastic load balancer to our end users 77
the first thing that we're going to do is that we're going to use a VPC wizard to create a VPC in the 78
US East 1 region and we're going to use it to create public and private subnets and also to automatically 79
create a net instance for us and also a VPC endpoint for the Amazon S three service after we've created 80
those public and private subnets we're then going to create another private subnet using the VPC console 81
and that will be a locked down private subnet with no inbound or outbound traffic from the wider internet 82
and we'll be using that to launch our database service. 83
Okay so starting off in the VPC management console we need to launch the VPC wizard if you don't see 84
that big blue button there. 85
It means that you're not actually in the VPC dashboard so just click on VPC dashboard and you'll get 86
to there and you will see that launch VPC wizard button which we're going to click we need to select 87
a VPC with public and private subnets. 88
If you have a look at the diagram there on the right we're going to have a VPC. 89
So you have a public subnet with a net instance that's going to lay our connections from or outbound 90
connections from our private subnet through to the Internet. 91
We're also going to have a connection an endpoint for the Amazon S three services well Let's select 92
that will leave our side a block as 10 0 0 0 forward size 16 we're going to give this VPC a name backspace 93
dash lab will leave the public subnet there is 10 0 0 0 24 the availability zone will be us e 1 I make 94
sure that you are operating in US East North Virginia and we're going to call this public a subnet a 95
because it's located in the one a availability zone and our private subnet will leave that is 10 0 1 96
0 it's like 24 availabilities only a game we're going to use US East 1 a.m. We're going to call this 97
private net subnet a because it's going to be what's going to allow connections between a net and this 98
private subnet. 99
So we're going to call it the private subnet or private net subnet. 100
The next thing that we need to detail is a net gateway or a net instance the VPC management console 101
remembers what you used last. 102
So last time I did this I used a net gateway for this lab I'm going to use a net instance instead because 103
of the cost the net Gateway is a a perfect service it's highly available it's highly fault tolerant 104
and it's what you would use in a production environment for any decent sized company because this is 105
is only a lab we're just going to use a net instance instead so it just click on that use a net instance 106
instead or select 80 to micro just select the key pair there so we can connect into it later on if we 107
need to nixing we need to identify is a or define is a service endpoint. 108
So we've got their dynamo D.B. will select Amazon S three. 109
So we need to connect into a bucket and the subnet we've got a number of selections there is a public 110
and private subnets a public subnet or the private subnet on its own. 111
Now our public subnet is just going to contain our elastic low balances. 112
So our web servers are going to be located in the private subnet and they are what needs to have access 113
to the Amazon S3 service so we select the private subnet give that full access and we scroll down a 114
little bit further and create VPC. 115
Okay so after a short amount of time we've got these VPC successfully created. 116
So just click on. 117
Okay. 118
And then we can see backspace dash lab has been created. 119
So what I'm going to do now is just going to go into the easy to management console and just see that 120
net instance has been created. 121
And so there we can see we've got one running instance and there is our net instance say that's another 122
one that I created previously that I've terminated. 123
But here is the one that we just created. 124
So what I'm going to do now is just going to give that a name so that we know what it is. 125
Okay so now we know where we go and look at our list of easy two instances we're going to know what 126
that is all about. 127
So we jump back into the VPC management console. 128
Okay. 129
So there we can see we've got a network access control list allocated or created forced by the VPC wizard. 130
We've also got a round table there. 131
And that is the main round table that is associated with the VPC. 132
What that means is that if there are any subnets within these VPC they don't have a root table explicitly 133
associated to them. 134
Then the main rate table will be automatically associated to those subnets. 135
So we can see there it ends in six easy to there. 136
If we go to subnets and we select our private net subnet a here which is going to be again for our backspace 137
lad there what we will see is it has the same root table. 138
There it is six easy to on the end of it has its same root table the main root table associated to that. 139
And our public subnet has a different one has a different round table associated to that. 140
So let's have a look at these two. 141
So let's first have a look at the private net subnet. 142
So it's going to open that in another screen or another tab 143
and we'll have a look at the root entries for that so they can see it has a root entry there for local 144
traffic within the VPC. 145
So that's fine. 146
But it also has destination to the wider internet. 147
So if instances within this private subnet need to access a wider Internet outbound they can do that 148
through the elastic network interface which is attached to our net instance. 149
And that is exactly what we are looking for. 150
So it doesn't allow traffic coming in from the wider internet. 151
But if we if instances within or services within that private subnet need to download updates or whatever. 152
And again the elastic beanstalk service does require that it can do that through a net instance. 153
So going back to our subnets we'll have a look at the public subnet a and we can see it's got a totally 154
different rail type. 155
It's not the main round table we'll open that one and have a look at that. 156
So this will be a public round table with round table entries to allow access from the wider internet. 157
So again we've got local traffic a rep for that. 158
So that is fine. 159
But we've also got for traffic to and from the wider internet it allows it to go through to an Internet 160
gateway. 161
So again that is that is what defines a public subnet. 162
So that's fine. 163
So what we're going to do now is we are going to create another subnet which is going to be locked down. 164
It's going to be a private subnet that's not going to create or allow any traffic from to or from the 165
wider internet now because we're going to be creating multiple custom roundtables for these VPC just 166
going to give this one a name backspace lab public. 167
That'll be fine just so that we can identify easy enough later on and I'll just close it down and we'll 168
just go back into subnets and what we want to do now is when to create a subnet we'll give that a name 169
and we'll select our best backspace dash lab VPC and we'll select their availability zone again is us 170
e 1 8. 171
And aside about this time is going to be 10 dot 0 dot to dot 0 forward size 24 and we'll create that 172
and they revised so there we can see we've got our private subnet a that has just been created with 173
this side a block 10 0 2 0 forward size 24. 174
Now one thing that we haven't done yet is that this has got the main round table implicitly associated 175
to it because we didn't define a round table for this subnet. 176
So what we need to do now is we need to go into round tables open it up in another screen and we need 177
to create a round table for that subnet. 178
And so that's going to be completely private. 179
It's only going to allow local traffic and nothing else. 180
So we just click on Create round table we'll give this one a name and we'll select our VPC the backspace 181
dash led VPC and then create that 182
okay. 183
So we scroll down here we can see that we've got our pub our private subnet. 184
So what we're going to do now is we're going to have a look at the route say. 185
So we've got here a local route for local traffic and nothing else. 186
And so there is all that we need. 187
We don't need to have net access for these private subnets so that is fine. 188
But we need to have a subnet association so there's no subnet association. 189
So this privates all these private roundtable is not associated to any subnet. 190
So what you need to do is edit subnet associations and we need to select our private subnet that we 191
created and so we can see here we've got private subnet A it's currently has the main round table implicitly 192
associated to it. 193
We need to change that. 194
So we'll select that and save and now we can see that we have that subnet. 195
If we go back into that subnet or just click on it and we can see private subnet. 196
Now has that rare table private subnet artsy associated to it. 197
Okay. 198
Coming up next we're going to be securing this VPC by creating some security groups that we can associate 199
to our resources inside of these VPC. 200
Look forward to seeing you in that next one.