Uncategorized

Day 5 – Build a 2-Tier Network in AWS VPC from Scratch | #100DaysOfMultiCloud

By Tech Career Hubs

Published On:

Build a 2-Tier Network in AWS VPC from Scratch

Day 5 – Build a 2-Tier Network in AWS VPC from Scratch | #100DaysOfMultiCloud

Welcome to Day 5 of my 100 Days of Multi-Cloud journey! Today will Build a 2-Tier Network in AWS VPC from Scratch 🚀

Today, we dive into one of the most fundamental but powerful AWS concepts — building a secure, production-grade 2-tier VPC with a public subnet for the frontend and a private subnet for the backend.

This hands-on project walks you through how real companies build secure networking infrastructure using:

✅ Custom VPC
✅ Public & private subnets
✅ Internet Gateway & NAT Gateway
✅ Route tables
✅ Security groups
✅ EC2 frontend and backend servers
✅ Internal communication testing

🧠 What You’ll Learn

By the end of this post, you’ll know:

  • How to build a custom VPC architecture

  • The difference between public and private subnets

  • How to use NAT Gateway to allow outbound access without exposing your backend

  • How to properly configure route tables and security groups

  • How to test internal EC2-to-EC2 communication

🧭 Architecture Overview

We’re building a 2-tier network like below:

Build a 2-Tier Network in AWS VPC from Scratch

🌐 Step 1 – Create the VPC

  1. Go to AWS Console → VPC → Your VPCs → Create VPC

  2. Choose “VPC only”

  3. Name: day4-vpc

  4. CIDR block: 10.0.0.0/16

  5. Click Create VPC

🗣️ “This is our cloud data center. The 10.0.0.0/16 range gives us up to 65K IPs!”

🌍 Step 2 – Create Public and Private Subnets

🔸 Public Subnet

  • Name: public-subnet-a

  • AZ: ap-south-1a

  • CIDR: 10.0.1.0/24

  • Enable auto-assign public IP

🔸 Private Subnet

  • Name: private-subnet-a

  • CIDR: 10.0.2.0/24

  • No public IPs

🗣️ “Public subnet is where internet-facing servers live. Private subnet is internal-only.”

🚪 Step 3 – Internet Gateway

  1. VPC → Internet Gateways → Create

  2. Name: day4-igw

  3. Attach to VPC: day4-vpc

🗣️ “IGW is like a door to the internet for our public subnet.”

🌐 Step 4 – NAT Gateway + Elastic IP

4.1 Allocate Elastic IP

EC2 → Elastic IPs → Allocate → Name: day4-nat-eip

4.2 Create NAT Gateway

  • VPC → NAT Gateways → Create

  • Name: day4-nat-gw

  • Subnet: public-subnet-a

  • Elastic IP: day4-nat-eip

🗣️ “NAT Gateway lets private subnet go outbound to internet but blocks incoming traffic.”

🛣️ Step 5 – Configure Route Tables

🔸 Public RT

  • Name: public-rt

  • Route: 0.0.0.0/0 → IGW

  • Associate with: public-subnet-a

🔸 Private RT

  • Name: private-rt

  • Route: 0.0.0.0/0 → NAT Gateway

  • Associate with: private-subnet-a

🗣️ “Route tables control where traffic flows. Public = IGW. Private = NAT.”

🔐 Step 6 – Create Security Groups

frontend-sg

  • Inbound:

    • HTTP (80) → 0.0.0.0/0

    • SSH (22) → Your IP

  • Outbound: Allow all

backend-sg

  • Inbound:

    • TCP (8080) → Source: frontend-sg

  • Outbound: Allow all

🗣️ “This ensures backend is isolated. Only frontend can talk to it.”

💻 Step 7 – Launch EC2 Instances

🔸 Frontend EC2 (in public subnet)

  • AMI: Amazon Linux 2023

  • Type: t3.micro

  • Subnet: public-subnet-a

  • SG: frontend-sg

  • Auto-assign Public IP: Yes

  • User Data:

#!/bin/bash
yum update -y || dnf update -y
yum install -y httpd || dnf install -y httpd
echo "AWS Frontend Server - Day 4 Multi-Cloud" > /var/www/html/index.html
systemctl enable httpd
systemctl start httpd

🔸 Backend EC2 (in private subnet)

  • Subnet: private-subnet-a

  • SG: backend-sg

  • No public IP

  • User Data:

#!/bin/bash
dnf update -y || yum update -y
dnf install -y python3 || yum install -y python3
pip3 install flask || python3 -m pip install flask
cat << 'EOF' > /home/ec2-user/app.py
from flask import Flask
app = Flask(__name__)
@app.route("/")
def home():
return "Hello from AWS Backend in Private Subnet"
if __name__ == "__main__":
app.run(host="0.0.0.0", port=8080)
EOF
nohup python3 /home/ec2-user/app.py &

🧪 Step 8 – Test Everything

✅ Frontend Web Test

http://<frontend-public-ip>

Expected: "AWS Frontend Server - Day 4 Multi-Cloud"

✅ Frontend → Backend

SSH into frontend, then:

curl http://<backend-private-ip>:8080

Expected: "Hello from AWS Backend in Private Subnet"

✅ Backend → Internet

From backend (SSH from frontend):

curl ifconfig.me

Expected: NAT Gateway public IP

🎯 What You Built Today

✅ A fully working AWS VPC
✅ Subnet planning and routing
✅ Public + private tier separation
✅ Internal EC2-to-EC2 secure comms
✅ Secure, job-ready networking architecture!

🎁 Bonus Resources

 

📺 Video Tutorial: https://youtube.com/@TechCareerHubs
🌐 Blog Home: https://techcareerhubs.com

🔗 Follow Me

⁣    

Tech Career Hubs

At TechCareerHubs, we aim to bridge the gap between talent and opportunity. Our mission is to provide accurate, timely, and reliable job notifications while keeping you informed about the latest advancements in technology and career-building courses.

🔴Related Post

Day 5 – Build a 2-Tier Network in AWS VPC from Scratch | #100DaysOfMultiCloud

Day-4 AWS VPC vs Azure VNet: A Complete Multi-Cloud Networking

Day 3 — MFA + Security Basics (AWS vs Azure Conditional Access)

Day 2 — Azure Entra ID + RBAC (Role-Based Access Control)

Leave a Comment