✅ Day 14 of My Cloud Journey ☁️ — EC2 in Private Subnet + NAT Gateway 🌐

Today was all about designing secure and scalable network architecture in AWS by deploying an EC2 instance in a private subnet and enabling it to access the internet using a NAT Gateway. This is a classic real-world setup often used in production environments to protect backend servers while still allowing them to fetch updates or communicate outward.

---

🧱 What We’re Building Today

We're creating a VPC architecture with:

• 🔹 Public Subnet: For internet-facing resources (e.g., NAT Gateway)

• 🔹 Private Subnet: For internal EC2 instances (no direct internet access)

• 🔹 NAT Gateway: So EC2 in private subnet can reach internet without exposing its IP

• 🔹 Internet Gateway (IGW): Attached to the VPC for public subnet internet access

• 🔹 Route Tables: To control traffic flow in both public and private subnets

---

📐 Architecture Diagram

            ┌──────────────────── VPC ──────────────────────┐
            │                                               │
            │        ┌──────────── Public Subnet ─────────┐ │
            │        │                                    │ │
            │        │  EC2 (Optional Bastion)            │ │
            │        │  NAT Gateway                       │ │
            │        └────────────────────────────────────┘ │
            │                                               │
            │        ┌──────────── Private Subnet ────────┐ │
            │        │                                    │ │
            │        │  EC2 Instance (No Public IP)       │ │
            │        └────────────────────────────────────┘ │
            └───────────────────────────────────────────────┘

---

🚀 Why Use NAT Gateway?

• Security: EC2 in private subnet is not exposed to the internet

• Outbound-only: Instance can reach the internet but can’t be reached from it

• Great for: App servers, backend microservices, databases (for updates, APIs, etc.)

---

🔧 Step-by-Step Setup

Step 1: Create a VPC

• CIDR: 10.0.0.0/16

Step 2: Create Two Subnets

• Public Subnet: 10.0.1.0/24 (Enable auto-assign public IP)

• Private Subnet: 10.0.2.0/24

Step 3: Create and Attach Internet Gateway

• IGW allows the public subnet to connect to the internet

• Attach IGW to the VPC

Step 4: Create Route Tables

• Public Route Table:

  • Target: 0.0.0.0/0 → IGW

  • Associate with public subnet

• Private Route Table:

  • Target: 0.0.0.0/0 → NAT Gateway (next step)

  • Associate with private subnet

Step 5: Create NAT Gateway in Public Subnet

• Allocate a new Elastic IP

• Place NAT Gateway in the public subnet

• NAT Gateway enables instances in private subnet to access the internet

Step 6: Launch EC2 Instances

• Public EC2 (Optional):

  • To act as a bastion or simply to test NAT functionality

• Private EC2:

  • In private subnet

  • No public IP

Step 7: Test the Setup

• SSH into public EC2 (if used), then connect to private EC2

• From private EC2:

  • Run ping google.com (should work if ICMP is open)

  • Run curl https://amazon.com or yum update to verify outbound internet

---

🛡️ Security Considerations

• Use Security Groups:

  • Public EC2: Allow SSH from your IP

  • Private EC2: Allow only traffic from public EC2 (or internal apps)

• Limit NAT traffic with NACLs if needed

• Monitor NAT Gateway usage in VPC Flow Logs

---

🧠 Key Learnings

• NAT Gateway acts as an outbound proxy for private instances

• Internet Gateway works only when an instance has a public IP

• Route tables play a crucial role in controlling subnet connectivity

• Best practice: Use Private EC2s for app servers, Public only for ALBs or bastion

---

🔍 Common Use Cases

---

📅 What’s Next?

Day 15: I’ll dive into launching a web server (Apache/NGINX) on EC2

#Day14 #AWS #VPC #NATGateway #EC2 #CloudSecurity #90DaysOfCloud #shubhamlondhe