# ✅ Day 14 of My Cloud Journey ☁️ — EC2 in Private Subnet + NAT Gateway 🌐

Today was all about **designing secure and scalable network architecture** in AWS by deploying an EC2 instance in a **private subnet** and enabling it to access the internet using a **NAT Gateway**. This is a classic real-world setup often used in production environments to protect backend servers while still allowing them to fetch updates or communicate outward.

---

## 🧱 What We’re Building Today

We're creating a **VPC architecture** with:

* 🔹 **Public Subnet**: For internet-facing resources (e.g., NAT Gateway)
    
* 🔹 **Private Subnet**: For internal EC2 instances (no direct internet access)
    
* 🔹 **NAT Gateway**: So EC2 in private subnet can reach internet **without** exposing its IP
    
* 🔹 **Internet Gateway (IGW)**: Attached to the VPC for public subnet internet access
    
* 🔹 **Route Tables**: To control traffic flow in both public and private subnets
    

---

## 📐 Architecture Diagram

```plaintext
            ┌──────────────────── VPC ──────────────────────┐
            │                                               │
            │        ┌──────────── Public Subnet ─────────┐ │
            │        │                                    │ │
            │        │  EC2 (Optional Bastion)            │ │
            │        │  NAT Gateway                       │ │
            │        └────────────────────────────────────┘ │
            │                                               │
            │        ┌──────────── Private Subnet ────────┐ │
            │        │                                    │ │
            │        │  EC2 Instance (No Public IP)       │ │
            │        └────────────────────────────────────┘ │
            └───────────────────────────────────────────────┘
```

---

## 🚀 Why Use NAT Gateway?

* **Security**: EC2 in private subnet is not exposed to the internet
    
* **Outbound-only**: Instance can reach the internet but **can’t be reached from it**
    
* **Great for**: App servers, backend microservices, databases (for updates, APIs, etc.)
    

---

## 🔧 Step-by-Step Setup

### Step 1: Create a VPC

* CIDR: `10.0.0.0/16`
    

### Step 2: Create Two Subnets

* **Public Subnet**: `10.0.1.0/24` (Enable auto-assign public IP)
    
* **Private Subnet**: `10.0.2.0/24`
    

### Step 3: Create and Attach Internet Gateway

* IGW allows the **public subnet** to connect to the internet
    
* Attach IGW to the VPC
    

### Step 4: Create Route Tables

* **Public Route Table**:
    
    * Target: `0.0.0.0/0` → IGW
        
    * Associate with **public subnet**
        
* **Private Route Table**:
    
    * Target: `0.0.0.0/0` → NAT Gateway (next step)
        
    * Associate with **private subnet**
        

### Step 5: Create NAT Gateway in Public Subnet

* Allocate a new **Elastic IP**
    
* Place NAT Gateway in the **public subnet**
    
* NAT Gateway enables instances in private subnet to access the internet
    

### Step 6: Launch EC2 Instances

* **Public EC2 (Optional)**:
    
    * To act as a bastion or simply to test NAT functionality
        
* **Private EC2**:
    
    * In private subnet
        
    * **No public IP**
        

### Step 7: Test the Setup

* SSH into public EC2 (if used), then connect to private EC2
    
* From private EC2:
    
    * Run `ping` [`google.com`](http://google.com) (should work if ICMP is open)
        
    * Run `curl` [`https://amazon.com`](https://amazon.com) or `yum update` to verify outbound internet
        

---

## 🛡️ Security Considerations

* **Use Security Groups**:
    
    * Public EC2: Allow SSH from your IP
        
    * Private EC2: Allow only traffic from public EC2 (or internal apps)
        
* **Limit NAT traffic** with NACLs if needed
    
* Monitor NAT Gateway usage in **VPC Flow Logs**
    

---

## 🧠 Key Learnings

* NAT Gateway acts as an **outbound proxy** for private instances
    
* Internet Gateway works only when an instance has a public IP
    
* Route tables play a crucial role in controlling subnet connectivity
    
* Best practice: Use **Private EC2s** for app servers, **Public** only for ALBs or bastion
    

---

## 🔍 Common Use Cases

| Use Case | NAT Gateway Setup? |
| --- | --- |
| Backend services calling external APIs | ✅ Yes |
| Private EC2 downloading OS updates | ✅ Yes |
| Hosting a public website | ❌ Needs IGW |
| Database servers with no internet | ❌ No NAT needed |

---

## 📅 What’s Next?

**Day 15**: I’ll dive into launching a **web server (Apache/NGINX)** on EC2

#Day14 #AWS #VPC #NATGateway #EC2 #CloudSecurity #90DaysOfCloud #shubhamlondhe