Building Secure and Scalable Network Architectures with AWS VPC

Building Secure and Scalable Network Architectures with AWS VPC

·Pavan Kalyan Meda

Learn how to design a secure multi-tier AWS VPC architecture using public and private subnets, Internet Gateway, NAT Gateway, route tables, and Application Load Balancer.

Brief Explanation of VPC Networking

  1. Create a Virtual Private Cloud (VPC) to define the overall network architecture.
  2. Within the VPC, create public and private subnets to organize resources based on their accessibility.
  3. Attach an Internet Gateway (IGW) to the VPC to enable internet connectivity for public resources.
  4. Configure route tables to control the flow of network traffic within the VPC.
  5. Associate separate route tables with private subnets and route outbound internet traffic through a NAT Gateway.
  6. Deploy resources by placing web server instances in the public subnet and application server instances in the private subnets.
  7. Create a NAT Gateway in a public subnet to provide secure outbound internet access for instances in private subnets.
  8. Verify the routing configuration:
    • Public subnet route tables should route internet-bound traffic to the Internet Gateway (IGW).
    • Private subnet route tables should route outbound internet traffic to the NAT Gateway.

Understanding AWS VPC Networking

Amazon Virtual Private Cloud (Amazon VPC) is a core AWS networking service that enables you to create a logically isolated virtual network in the AWS Cloud. It provides complete control over your network configuration, including IP address ranges, subnets, routing, and security settings.

The following sections introduce the key components of AWS VPC networking.

VPC (Virtual Private Cloud)

  • Serves as the top-level networking container for your AWS resources.
  • Provides a logically isolated virtual network where you can launch and manage AWS services securely.
  • Allows you to define IP address ranges, subnets, route tables, and network gateways.

Subnets

  • Subnets are logical subdivisions of a VPC.
  • They help organize resources based on accessibility and security requirements.
  • You can create:
    • Public subnets for internet-facing resources.
    • Private subnets for backend resources that should not be directly accessible from the internet.

Route Tables

  • Route tables define how network traffic is directed within the VPC.
  • They determine whether traffic is routed:
    • Within the VPC
    • To the internet
    • To a VPN or Direct Connect connection
    • To other AWS networks

Network Access Control Lists (NACLs)

  • Network ACLs provide subnet-level security.
  • They act as stateless firewalls that evaluate inbound and outbound traffic.
  • You can create rules to explicitly allow or deny traffic based on IP addresses, protocols, and ports.

Security Groups

  • Security Groups act as instance-level virtual firewalls.
  • They control inbound and outbound traffic for AWS resources such as Amazon EC2 instances.
  • Unlike NACLs, Security Groups are stateful, meaning return traffic is automatically allowed.

Internet Gateway (IGW)

  • An Internet Gateway enables communication between a VPC and the public internet.
  • It is attached directly to the VPC.
  • Public subnet resources use the IGW to send and receive internet traffic.

NAT Gateway

  • A NAT Gateway is deployed within a public subnet.
  • It enables instances in private subnets to initiate outbound internet connections while preventing unsolicited inbound connections from the internet.
  • This is commonly used for downloading software updates or accessing external services securely.

CIDR (Classless Inter-Domain Routing)

  • CIDR is a method of allocating IP address ranges efficiently.
  • It defines the IP address block assigned to a VPC and its subnets.
  • Proper CIDR planning helps avoid IP address conflicts and simplifies network scalability.

Step-by-Step Guide: Building a Multi-Tier Architecture

1. Create the VPC

Begin by signing in to the AWS Management Console and navigating to the Amazon VPC dashboard.

  • Create a new Virtual Private Cloud (VPC).
  • Configure the network by creating:
    • Two public subnets
    • One private subnet
  • Attach an Internet Gateway (IGW) to the VPC to enable internet connectivity for resources in the public subnets.

2. Configure Subnets and Route Tables

After creating the VPC and subnets, configure routing for network traffic.

  • Create a route table for each subnet as required.
  • Define routing rules to control traffic within the VPC and to external networks.
  • Associate each subnet with its corresponding route table.
  • Configure:
    • Public subnet route table → Route internet-bound traffic to the Internet Gateway (IGW).
    • Private subnet route table → Route outbound internet traffic to the NAT Gateway.

3. Deploy Amazon EC2 Instances

Deploy compute resources into the appropriate subnets based on their roles.

  • Launch an Amazon EC2 instance in the public subnet to function as the web server.
  • Launch an Amazon EC2 instance in the private subnet to function as the application server.

This architecture helps isolate backend services while allowing the web tier to communicate with users over the internet.

4. Set Up a NAT Gateway

To enable secure outbound internet access for resources in private subnets:

  • Create a NAT Gateway in one of the public subnets.
  • Associate an Elastic IP address with the NAT Gateway.
  • Update the private subnet's route table to forward internet-bound traffic through the NAT Gateway.

This configuration allows instances in the private subnet to download updates or access external services without exposing them directly to inbound internet traffic.

Hands-On Example: Setting Up a Multi-Tier Architecture on AWS VPC

Step 1: Set Up the VPC and Subnets

1. Sign In to the AWS Management Console

  1. Open the AWS Management Console in your web browser.
  2. Sign in using your AWS account credentials.

2. Open the Amazon VPC Dashboard

  1. From the AWS Management Console, select Services.
  2. Under Networking & Content Delivery, choose VPC.

3. Create a New VPC

  1. In the Amazon VPC dashboard, click Create VPC.

  2. Enter a name for the VPC, for example:

    my-vpc

  3. Specify an IPv4 CIDR block, such as:

    10.0.0.0/16

  4. Review the configuration and create the VPC.


4. Create Public and Private Subnets

After creating the VPC, divide it into public and private subnets.

  1. Navigate to Subnets from the left navigation pane.
  2. Click Create subnet.
  3. Enter:
    • A subnet name
    • The VPC created in the previous step
    • An appropriate Availability Zone (AZ)
    • A subnet CIDR block within the VPC CIDR range

Example subnet layout:

VPC CIDR         : 10.0.0.0/16

Public Subnet 1 : 10.0.1.0/24  
Public Subnet 2 : 10.0.2.0/24  
Private Subnet  : 10.0.3.0/24
  1. Repeat the process until you have created:
    • Two public subnets
    • One private subnet

5. Associate Subnets with Route Tables

Once the subnets are created, associate each subnet with the appropriate route table.

  1. Open Route Tables from the VPC dashboard.
  2. Select the route table for the private subnet.
  3. Open the Subnet Associations tab.
  4. Click Edit subnet associations and select the private subnet.
  5. Create or select a route table for the public subnets.
  6. Associate both public subnets with the public route table.

Note: Configure the public route table to route internet-bound traffic (0.0.0.0/0) through the Internet Gateway (IGW). The private route table will later be configured to use the NAT Gateway for outbound internet access.


Step 2: Configure Route Tables and Internet Access

1. Enable Internet Access for the Public Subnet

To allow resources in the public subnet to communicate with the internet:

  1. Create an Internet Gateway (IGW).
  2. Attach the Internet Gateway to your VPC.
  3. Open Route Tables from the VPC dashboard.
  4. Select the route table associated with the public subnet.
  5. Add or verify the following default route:
Destination : 0.0.0.0/0  
Target      : Internet Gateway (IGW)

This configuration enables instances in the public subnet to send and receive traffic from the internet.


2. Configure a NAT Gateway for Private Subnets

To provide secure outbound internet access for instances in private subnets:

  1. Open NAT Gateways from the VPC dashboard.
  2. Create a new NAT Gateway in one of the public subnets.
  3. Allocate and associate an Elastic IP (EIP) with the NAT Gateway.
  4. Update the private subnet's route table by adding or modifying the default route to point to the NAT Gateway.

Example route:

Destination : 0.0.0.0/0  
Target      : NAT Gateway

With this configuration, resources in the private subnet can access the internet for software updates and external services without being directly accessible from the internet.

Final Network Architecture

After completing the configuration:

  • The Public Subnet routes internet traffic through the Internet Gateway (IGW).
  • The Private Subnet routes outbound traffic through the NAT Gateway.
  • Internet users can access only resources deployed in the public subnet.
  • Backend resources remain securely isolated while retaining outbound internet connectivity.

Step 3: Deploy the Web Server (Public Subnet)

1. Launch an Amazon EC2 Instance

Deploy a web server in the public subnet to handle incoming client requests.

  1. Open the Amazon EC2 console.
  2. Click Launch Instance.
  3. Choose an appropriate Amazon Machine Image (AMI), such as Ubuntu Server.
  4. Select an instance type based on your workload requirements.
  5. Configure the instance:
    • Select the VPC created earlier.
    • Choose one of the public subnets.
    • Configure any additional settings as required.
  6. Create or select a Security Group that allows inbound HTTP (Port 80) traffic from the internet.


Note: If you plan to connect using SSH, ensure the security group also allows inbound SSH (Port 22) access from your trusted IP address.

2. Install and Configure the Web Server

After the EC2 instance is running:

  1. Connect to the instance using SSH with your key pair. You can use an SSH client such as MobaXterm, or connect directly from the terminal.

  2. Update the package repository and install Nginx.

sudo apt update  
sudo apt install nginx -y  
sudo systemctl start nginx  
sudo systemctl enable nginx
  1. Verify that the Nginx service is running.
sudo systemctl status nginx

  1. Open the EC2 instance's public IP address in a web browser to verify that the default Nginx welcome page is displayed.

  2. Replace the default web content with your own website or application files as needed.


Step 4: Set Up the Application Server (Private Subnet)

1. Launch an Amazon EC2 Instance in the Private Subnet

Deploy a second EC2 instance that will host the application server.

  1. Open the Amazon EC2 console and click Launch Instance.
  2. Select an appropriate Amazon Machine Image (AMI).
  3. Choose the required instance type.
  4. During network configuration:
    • Select the existing VPC.
    • Choose Private Subnet 1.
  5. Complete the remaining configuration and launch the instance.


2. Configure the Security Group

Create a dedicated security group for the application server.

Configure inbound rules to allow application traffic only from the web server's security group instead of allowing public internet access.

Example:

ProtocolPortSource
TCP80Web Server Security Group
TCP8080 (Tomcat)Web Server Security Group
TCP22 (Optional)Bastion Host or Public EC2 Security Group

This approach ensures that the application server remains isolated within the private subnet.

3. Connect to the Private EC2 Instance

Since the application server resides in a private subnet, direct internet access is not available.

Use the public EC2 instance as a Bastion Host (Jump Server).

  1. Connect to the EC2 instance in the public subnet using SSH.
  2. Upload your .pem key file if required.
  3. Before connecting to the private instance, update the key permissions:
chmod 400 dose.pem
  1. Connect to the private EC2 instance using its private IP address.

Best Practice: In production environments, consider using AWS Systems Manager Session Manager instead of copying PEM keys to a bastion host.

4. Install and Configure Apache Tomcat

Update the package repository and install Java.

sudo apt update  
sudo apt install adoptopenjdk-17-hotspot  
java --version

Create a dedicated Tomcat user and group.

sudo groupadd tomcat

sudo useradd -s /bin/false \  
-g tomcat \  
-d /opt/tomcat \  
tomcat

Download and extract Apache Tomcat.

wget https://downloads.apache.org/tomcat/tomcat-10/v10.0.18/bin/apache-tomcat-10.0.18.tar.gz -P /tmp

sudo tar xf /tmp/apache-tomcat-10.0.18.tar.gz -C /opt

sudo ln -s /opt/apache-tomcat-10.0.18 /opt/tomcat/latest

sudo chown -R tomcat: /opt/tomcat/latest/

Configure the required environment variables.

nano ~/.bashrc

Add:

export CATALINA_HOME="/opt/tomcat/latest"  
export JAVA_HOME="/usr/lib/jvm/default-java"

Reload the shell configuration.

source ~/.bashrc

Start Tomcat.

/opt/tomcat/latest/bin/startup.sh

Verify that Tomcat is running before exposing the application through a load balancer.

5. Configure an Application Load Balancer (ALB)

To expose the application running in the private subnet:

  1. Create a Target Group.
  2. Register the private EC2 instance as a target.
  3. Navigate to EC2 → Load Balancers.
  4. Click Create Load Balancer.
  5. Select Application Load Balancer.
  6. Configure:
    • VPC
    • Public subnets for the ALB
    • Listener (HTTP/HTTPS)
  7. Associate the previously created Target Group with the listener.
  8. Complete the load balancer creation.

Note: The Application Load Balancer should be deployed in public subnets, while its Target Group contains EC2 instances in the private subnet. This is the recommended AWS architecture for internet-facing applications.

After the ALB becomes active, access the application using the DNS name provided by the load balancer.




Conclusion

In this guide, you learned how to build a secure and scalable multi-tier network architecture using Amazon Virtual Private Cloud (Amazon VPC).

The tutorial covered the complete setup process, including:

  • Creating a custom VPC and defining an appropriate CIDR block.
  • Organizing resources into public and private subnets.
  • Configuring route tables for efficient traffic routing.
  • Setting up an Internet Gateway (IGW) for public internet access.
  • Deploying a NAT Gateway to provide secure outbound internet connectivity for private resources.
  • Launching and configuring web and application servers on Amazon EC2.
  • Exposing the application securely using an Application Load Balancer (ALB) while keeping backend resources isolated in private subnets.

By applying these networking best practices, you can build highly available, secure, and scalable AWS infrastructures that align with modern cloud architecture principles and support a wide range of production workloads.

Back to all posts
Hi! I'm ERICA. Ask me anything!