> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ahmadraza.in/llms.txt
> Use this file to discover all available pages before exploring further.

# 2 Layer VPC

# AWS VPC Setup Guide for Public and Private Subnets in Mumbai Region (ap-south-1)

This guide will walk you through the process of setting up a Virtual Private Cloud (VPC) in the **Mumbai (ap-south-1)** region of AWS. The setup includes **3 Public Subnets**, **3 Private Subnets** across three Availability Zones (AZs), **Internet Gateway (IGW)**, **NAT Gateway**, and **Route Tables**.

## 1. Create a VPC

In AWS, **VPC** (Virtual Private Cloud) is the primary resource that defines your network.

### Steps:

1. **Go to VPC Dashboard** in the AWS Management Console.

2. **Click Create VPC**:
   * **Name**: `prod-vpc`
   * **IPv4 CIDR Block**: `10.0.0.0/16` (adjust the CIDR as needed).
   * **Tenancy**: Default (for shared tenancy).

3. **Create VPC**.

***

## 2. Create Subnets (Public and Private)

We will create **3 Public Subnets** and **3 Private Subnets**, each located in a different Availability Zone (AZ).

### Public Subnets:

1. **Subnet-1 (prod-public-subnet-1)**:
   * **CIDR Block**: `10.0.0.0/20`
   * **Availability Zone**: `ap-south-1a`
2. **Subnet-2 (prod-public-subnet-2)**:
   * **CIDR Block**: `10.0.16.0/20`
   * **Availability Zone**: `ap-south-1b`
3. **Subnet-3 (prod-public-subnet-3)**:
   * **CIDR Block**: `10.0.32.0/20`
   * **Availability Zone**: `ap-south-1c`

### Private Subnets:

1. **Subnet-1 (prod-private-subnet-1)**:
   * **CIDR Block**: `10.0.48.0/20`
   * **Availability Zone**: `ap-south-1a`
2. **Subnet-2 (prod-private-subnet-2)**:
   * **CIDR Block**: `10.0.64.0/20`
   * **Availability Zone**: `ap-south-1b`
3. **Subnet-3 (prod-private-subnet-3)**:
   * **CIDR Block**: `10.0.80.0/20`
   * **Availability Zone**: `ap-south-1c`

### Steps to Create Subnets:

1. Go to the **VPC Dashboard** and click **Subnets**.
2. Click **Create Subnet** and provide the following details:
   * **VPC**: Select the `prod-vpc`.
   * **Subnet CIDR Block**: Use the CIDR blocks mentioned above.
   * **Availability Zone**: Choose the respective AZ for each subnet.

***

## 3. Create Internet Gateway (IGW)

The **Internet Gateway (IGW)** allows communication between instances in your public subnets and the internet.

### Steps:

1. Go to the **VPC Dashboard** and select **Internet Gateways**.
2. Click **Create Internet Gateway**.
   * **Name**: `prod-IGW`
3. After creation, **Attach** the Internet Gateway to the VPC (`prod-vpc`).

***

## 4. Create NAT Gateway

The **NAT Gateway** allows instances in private subnets to access the internet for updates, downloads, etc., while maintaining security.

### Steps:

1. **Create an Elastic IP**:
   * Go to **EC2 Dashboard** → **Elastic IPs** → **Allocate New Address**.
   * Allocate the IP and note it down.

2. **Create the NAT Gateway**:
   * Go to **VPC Dashboard** → **NAT Gateways** → **Create NAT Gateway**.
   * Select one of the **public subnets**.
   * Assign the previously allocated **Elastic IP**.

3. **Route**: Add the route for private subnets to use the NAT Gateway.

***

## 5. Create Route Tables

### Public Route Table:

1. Go to **VPC Dashboard** → **Route Tables** → **Create Route Table**.
   * **Name**: `prod-public-route-table`
   * **VPC**: Select `prod-vpc`.
   * Click **Create**.

2. **Add Route**:
   * **Destination**: `0.0.0.0/0`
   * **Target**: Select **Internet Gateway (prod-IGW)**.

3. **Associate Subnets**:
   * Associate the **prod-public-subnet-1**, **prod-public-subnet-2**, and **prod-public-subnet-3** with the `prod-public-route-table`.

### Private Route Table:

1. Go to **VPC Dashboard** → **Route Tables** → **Create Route Table**.
   * **Name**: `prod-private-route-table`
   * **VPC**: Select `prod-vpc`.
   * Click **Create**.

2. **Add Route**:
   * **Destination**: `0.0.0.0/0`
   * **Target**: Select **NAT Gateway**.

3. **Associate Subnets**:
   * Associate the **prod-private-subnet-1**, **prod-private-subnet-2**, and **prod-private-subnet-3** with the `prod-private-route-table`.

***

## 6. Create Network Access Control Lists (ACLs)

A **Network ACL** is a stateless firewall for controlling traffic entering and leaving your subnets.

### Steps:

1. Go to **VPC Dashboard** → **Network ACLs** → **Create Network ACL**.
   * **Name**: `prod-acl`
   * **VPC**: Select `prod-vpc`.

2. **Inbound Rules**: Allow HTTP, HTTPS, and other required ports.

3. **Outbound Rules**: Allow outbound internet traffic.

4. **Associate with Subnets**:
   * Associate **prod-public-subnet-1**, **prod-public-subnet-2**, and **prod-public-subnet-3** for the public subnets.
   * Associate **prod-private-subnet-1**, **prod-private-subnet-2**, and **prod-private-subnet-3** for the private subnets.

***

## 7. Security Groups

### Public Security Group (SG):

1. **Allow** inbound traffic on HTTP (80), HTTPS (443), and SSH (22).
2. **Allow** all outbound traffic.

### Private Security Group (SG):

1. **Allow** inbound traffic from the VPC or specific public subnets.
2. **Allow** outbound traffic to the internet via NAT Gateway.

***

## 8. Architecture Diagram

```plaintext theme={null}
               +------------------------------------+
               |             AWS VPC               |
               +------------------------------------+
               |  CIDR Block: 10.0.0.0/16          |
               +------------------------------------+
                 /         |          |          \
                /          |          |           \
        +------------+ +------------+ +------------+ +------------+
        | Public Subnet| | Public Subnet| | Public Subnet| | Private Subnet|
        | 10.0.0.0/20  | | 10.0.16.0/20| | 10.0.32.0/20| | 10.0.48.0/20  |
        +------------+ +------------+ +------------+ +------------+
                 |          |            |           | 
         +-----------------------------------------------+
         |                  NAT Gateway                 |
         +-----------------------------------------------+
                 |          |            |           |
        +-----------------+ +------------------+ +-----------------+
        | Private Subnet  | | Private Subnet    | | Private Subnet  |
        | 10.0.64.0/20    | | 10.0.80.0/20      | | 10.0.96.0/20    |
        +-----------------+ +------------------+ +-----------------+
```

This diagram represents your **AWS VPC** setup with public and private subnets, **NAT Gateway**, **Internet Gateway**, and route tables.

***

> This guide walks you through the process of replicating your AWS infrastructure setup in the **Mumbai region (ap-south-1)**, including the setup of **public** and **private subnets**, **Internet Gateway**, **NAT Gateway**, and **Route Tables**.