Lab: Designing a VPC Diagram
Lab Objective
In this lab, you will design and document a complete VPC architecture on paper or with a diagram tool. This is a fundamental exercise because in a company, you must always plan before creating.
Key Skill
The ability to draw and explain a network architecture is essential for any cloud professional.
Part 1: Scenario
Context
You are a cloud architect at TechnoShop, an e-commerce company. You are asked to design the AWS infrastructure for their new application.
Requirements
┌─────────────────────────────────────────────────────────────┐
│ TECHNOSHOP REQUIREMENTS │
├─────────────────────────────────────────────────────────────┤
│ │
│ APPLICATION │
│ • Website accessible from the Internet │
│ • Application servers (backend API) │
│ • MySQL database │
│ │
│ SECURITY │
│ • Database NOT accessible from the Internet │
│ • Protected application servers │
│ • Only the Load Balancer exposed to the Internet │
│ │
│ AVAILABILITY │
│ • Application available even if one AZ fails │
│ • Minimum 2 availability zones │
│ │
│ NETWORK │
│ • Application servers must be able to download updates │
│ from the Internet │
│ │
└─────────────────────────────────────────────────────────────┘
Part 2: Design Exercise
Step 1: Define the VPC CIDR
Choose an address range for your VPC:
Questions to ask yourself:
- How many IP addresses do you need?
- Which RFC 1918 range to use?
- Which CIDR prefix to choose?
Your answer:
VPC CIDR: ________________
Justification: ________________
💡 Suggested Solution
VPC CIDR: 10.0.0.0/16
Justification:
- 65,536 addresses = more than enough
- 10.x.x.x range = standard for enterprises
- /16 allows creating many /24 subnets
Step 2: Plan the Subnets
Complete the following table:
| Name | Type | AZ | CIDR | Usage |
|---|---|---|---|---|
| public-1a | Public | us-east-1a | ? | ? |
| public-1b | Public | us-east-1b | ? | ? |
| private-app-1a | Private | us-east-1a | ? | ? |
| private-app-1b | Private | us-east-1b | ? | ? |
| private-db-1a | Private | us-east-1a | ? | ? |
| private-db-1b | Private | us-east-1b | ? | ? |
💡 Suggested Solution
| Name | Type | AZ | CIDR | Usage |
|---|---|---|---|---|
| public-1a | Public | us-east-1a | 10.0.1.0/24 | ALB, NAT GW |
| public-1b | Public | us-east-1b | 10.0.2.0/24 | ALB, NAT GW |
| private-app-1a | Private | us-east-1a | 10.0.11.0/24 | App Servers |
| private-app-1b | Private | us-east-1b | 10.0.12.0/24 | App Servers |
| private-db-1a | Private | us-east-1a | 10.0.21.0/24 | MySQL Master |
| private-db-1b | Private | us-east-1b | 10.0.22.0/24 | MySQL Replica |
Step 3: Define the Route Tables
For each type of subnet, define the routes:
Public Route Table:
| Destination | Target |
|---|---|
| ? | ? |
| ? | ? |
Private App Route Table (1a):
| Destination | Target |
|---|---|
| ? | ? |
| ? | ? |
Private DB Route Table:
| Destination | Target |
|---|---|
| ? | ? |
💡 Suggested Solution
Public Route Table:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local |
| 0.0.0.0/0 | igw-xxx |
Private App Route Table (1a):
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local |
| 0.0.0.0/0 | nat-1a |
Private DB Route Table:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local |
| (No Internet route) | - |
Step 4: Draw the Architecture
Draw the complete architecture diagram. Use:
- Draw.io (free)
- Lucidchart
- Paper and pencil
Elements to include:
- VPC with its CIDR
- All subnets with their CIDR
- Internet Gateway
- NAT Gateways (where to place them?)
- Load Balancer (where to place it?)
- EC2 Instances (app servers)
- Database
- Traffic arrows
💡 Solution Diagram
┌─────────────────────────────────────────────────────────────────────────┐
│ TECHNOSHOP ARCHITECTURE │
├─────────────────────────────────────────────────────────────────────────┤
│ │
│ INTERNET │
│ │ │
│ │ │
│ ┌──────▼──────┐ │
│ │ IGW │ │
│ └──────┬──────┘ │
│ │ │
│ ┌──────────────────────────────┼──────────────────────────────┐ │
│ │ VPC │ (10.0.0.0/16) │ │
│ │ │ │ │
│ │ ┌──────────────────────────┼────────────────────────────┐ │ │
│ │ │ │ │ │ │
│ │ │ ┌───────────────────────▼───────────────────────┐ │ │ │
│ │ │ │ APPLICATION LOAD BALANCER │ │ │ │
│ │ │ │ (alb-web) │ │ │ │
│ │ │ └───────────────────────┬───────────────────────┘ │ │ │
│ │ │ │ │ │ │
│ │ │ ┌─────────────────┐ │ ┌─────────────────┐ │ │ │
│ │ │ │ PUBLIC 1a │ │ │ PUBLIC 1b │ │ │ │
│ │ │ │ 10.0.1.0/24 │ │ │ 10.0.2.0/24 │ │ │ │
│ │ │ │ │ │ │ │ │ │ │
│ │ │ │ ┌─────────────┐ │ │ │ ┌─────────────┐ │ │ │ │
│ │ │ │ │ NAT GW 1a │ │ │ │ │ NAT GW 1b │ │ │ │ │
│ │ │ │ └──────┬──────┘ │ │ │ └──────┬──────┘ │ │ │ │
│ │ │ └────────┼────────┘ │ └────────┼────────┘ │ │ │
│ │ │ │ │ │ │ │ │
│ │ └───────────┼──────────────┼──────────────┼──────────────┘ │ │
│ │ │ │ │ │ │
│ │ ┌───────────┼──────────────┼──────────────┼──────────────┐ │ │
│ │ │ │ │ │ │ │ │
│ │ │ ┌────────▼────────┐ │ ┌────────▼────────┐ │ │ │
│ │ │ │ PRIVATE APP 1a │◄────┴────►│ PRIVATE APP 1b │ │ │ │
│ │ │ │ 10.0.11.0/24 │ │ 10.0.12.0/24 │ │ │ │
│ │ │ │ │ │ │ │ │ │
│ │ │ │ ┌───────────┐ │ │ ┌───────────┐ │ │ │ │
│ │ │ │ │ EC2 App 1 │ │ │ │ EC2 App 2 │ │ │ │ │
│ │ │ │ └─────┬─────┘ │ │ └─────┬─────┘ │ │ │ │
│ │ │ └────────┼────────┘ └────────┼────────┘ │ │ │
│ │ │ │ │ │ │ │
│ │ └───────────┼─────────────────────────────┼───────────────┘ │ │
│ │ │ │ │ │
│ │ ┌───────────┼─────────────────────────────┼───────────────┐ │ │
│ │ │ │ │ │ │ │
│ │ │ ┌────────▼────────┐ ┌────────▼────────┐ │ │ │
│ │ │ │ PRIVATE DB 1a │ │ PRIVATE DB 1b │ │ │ │
│ │ │ │ 10.0.21.0/24 │ │ 10.0.22.0/24 │ │ │ │
│ │ │ │ │ │ │ │ │ │
│ │ │ │ ┌───────────┐ │ │ ┌───────────┐ │ │ │ │
│ │ │ │ │ MySQL │◄────────────►│ │ MySQL │ │ │ │ │
│ │ │ │ │ Primary │ Replication │ │ Standby │ │ │ │ │
│ │ │ │ └───────────┘ │ │ └───────────┘ │ │ │ │
│ │ │ └─────────────────┘ └─────────────────┘ │ │ │
│ │ │ │ │ │
│ │ └──────────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────────────┘ │
│ │
└──────────────────────────────────────────────────────────────────────────────┘
Part 3: Analysis Questions
Question 1: Traffic Flow
Describe the traffic path for a user accessing the website:
User → ? → ? → ? → Database
💡 Answer
User
→ Internet
→ IGW
→ ALB (public subnet)
→ EC2 App (private app subnet)
→ MySQL (private db subnet)
Question 2: Software Update
How can an application server download an update from the Internet?
💡 Answer
The application server is in a private subnet. It uses the NAT Gateway:
- EC2 App sends a request to the Internet
- Traffic follows the route 0.0.0.0/0 → NAT Gateway
- NAT Gateway translates the private IP to a public IP (Elastic IP)
- Traffic goes through the IGW to the Internet
- The response returns via the same path
Question 3: AZ Failure
What happens if the us-east-1a zone fails?
💡 Answer
Impact:
- EC2 App 1a: unavailable
- NAT GW 1a: unavailable
- MySQL Primary (if in 1a): fails over to Standby
What continues to work:
- ALB redirects to EC2 App 1b
- NAT GW 1b handles outbound traffic from 1b
- MySQL Standby takes over
Lesson: Multi-AZ architecture ensures service continuity.
Question 4: Security
Why is the database in a subnet without Internet access?
💡 Answer
Security reasons:
- Reduced attack surface: No public IP = no direct access
- Defense in depth: Even if an attacker compromises the app, they cannot directly exfiltrate data
- Compliance: PCI-DSS, HIPAA, etc. requirements
- Principle of least privilege: The DB does not need Internet
Part 4: Deliverable
Create a Document
Produce a PDF or Word document containing:
-
Title Page: Project name, your name, date
-
IP Addressing Table:
- VPC CIDR
- All subnets with their CIDR
-
Architecture Diagram:
- Clear and readable diagram
- Legend of components
-
Routing Tables:
- One table per subnet type
- With justifications
-
Security Analysis:
- Which components are exposed?
- How are others protected?
-
Availability Analysis:
- How does the architecture handle an AZ failure?
Evaluation Criteria
| Criterion | Points |
|---|---|
| Correct and justified CIDR | /10 |
| Well-planned subnets | /20 |
| Correct routes | /20 |
| Clear and complete diagram | /25 |
| Security analysis | /15 |
| Availability analysis | /10 |
| Total | /100 |
Bonus: CLI Commands
If you want to create this architecture with LocalStack, here are the commands:
# Create the VPC
aws --endpoint-url=http://localhost:4566 ec2 create-vpc \
--cidr-block 10.0.0.0/16 \
--tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=technoshop-vpc}]'
# Create the public subnets
aws --endpoint-url=http://localhost:4566 ec2 create-subnet \
--vpc-id vpc-xxx \
--cidr-block 10.0.1.0/24 \
--availability-zone us-east-1a \
--tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-1a}]'
# Create the Internet Gateway
aws --endpoint-url=http://localhost:4566 ec2 create-internet-gateway \
--tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=technoshop-igw}]'
# ... continue with other resources
Summary
This lab allowed you to:
- ✅ Understand the VPC design process
- ✅ Plan consistent IP addressing
- ✅ Define appropriate routing tables
- ✅ Analyze security and availability
- ✅ Document a cloud architecture
Next week: Network Security