1. Create the VPC (the network
foundation) :
Amazon VPC
👉 Why start here?
Because a VPC is like an empty piece of land.
✔️ Nothing can exist without it:
➡️ no servers
➡️ no network
➡️ no security
💡 It’s the foundation of the entire architecture.
---
2. Create Subnets (organizing the network) :
👉 Why next?
Because:
Subnets = rooms inside a house
We separate:
-public (accessible from the Internet)
-private (protected)
✔️ This helps structure and secure the architecture from the
beginning
---
3. Internet Gateway (open to the Internet) :
👉 Why now?
Because:
-A VPC is isolated by default
-The Internet Gateway allows communication with the Internet
✔️ Without IGW → no external access
---
4. NAT Gateway (secure Internet access for
private subnets) :
👉 Why after IGW?
Because:
Private servers must NOT be exposed
NAT allows them to:
✔️ access the Internet
❌ without being accessible from the Internet
💡 Example: safely updating a server
---
5. Configure Route Tables (the network GPS) :
👉 Why here?
Because:
Routes define where traffic goes
✔️ Example:
Public subnet → Internet Gateway
Private subnet → NAT Gateway
💡 Without routes → nothing flows correctly
---
6. Launch EC2 instances :
Amazon EC2
👉 Why now?
Because:
The network is ready
Traffic rules are already defined
✔️ You can launch machines in a secure environment
---
7. Security Groups (instance-level firewall) :
👉 Why after EC2?
Because:
Security Groups are attached to instances
✔️ You define:
➡️ who can access (SSH, HTTP…)
➡️ who is blocked
💡 Example:
Bastion host → SSH allowed
Private server → restricted access
---
8. NACLs (network-level security) :
👉 Why after that?
Because:
NACLs work at the subnet level (more global)
✔️ Double security:
➡️ Security Group = instance level
➡️ NACL = network level
---
9. SSH connection via Bastion host :
👉 Why here?
Because:
The bastion is ready
Security rules are configured
✔️ You can now access private servers securely
---
10. Enable VPC Flow Logs :
👉 Why now?
Because:
The infrastructure is complete
You can start monitoring traffic
✔️ It helps you see:
➡️ who communicates with whom
➡️ suspicious activity
---
11. Send logs to CloudWatch :
Amazon CloudWatch
👉 Why last?
Because:
You want centralized logging
Easier analysis and auditing
✔️ CloudWatch = monitoring and logging tool
---
-Build the network (VPC) :
-Organize (Subnets) :
-Open (Internet Gateway) :
-Route traffic (Route Tables) :
-Protect (Security Groups + NACLs) :
-Enable VPC Flow Logs :
Copyright © All rights reserved.