My latest project at Gobbler has been the trasition
of our infrastrcture from “EC2 Classic” to Virtual Private Cloud (VPC).
The AWS docs do a pretty good job explaining VPC concepts, and the web
console does a great job launching a basic VPC setup for you. But, for
me, I am best able to understand a concept when I see the code,
All of my examples will be in ruby using the aws-sdk gem, but the same
results can be achieved using any of their other SDKs.
You have a basic undertsanding of AWS
You already have an active AWS account
You have a keypair called key-lab located at ~/.ec2/key-lab.pem (rename where appropriate)
All commands are probably best done in irb, this way you can
inspect objects as you go along. Make sure to look at the aws-sdk docs.
Creating the VPC
First, let’s set up our AWS credentials
Next, let’s create a basic VPC (this will also create a route table
Create an Internet Gateway, this allows servers to have a way to get
back to the internet.
Add a default route
Now it’s time to create 2 subnets, one public, one private
We need to create 2 security groups, one for public access, and one for
The public security group should be allowed to talk to the
world on tcp/22 (ssh) and the private one should only be allowed to talk
to members of the public security group over tcp/22
Launching the Instances
Create a network interface that you will attach a public IP to. This
will be on the public subnet and use the public security group.
Launch an instance into your VPC, since you’re specifiying to
use an interface that’s already connected to your VPC you will be on
its’ subnet and use its’ security groups.
Now you should be able to SSH to the server
We can use an SSH config file (at ~/.ssh/config) to make that easier.
note: You may want to consider adding a DNS CNAME entry for your
elastic IP. This way, if it changes later, there’s nothing that needs
updating besides the DNS.
Now, just ssh to that server
Next, let’s launch an instance inside the private subnet. This will only
have an internal IP, so it wouldn’t otherwise have the ability to
be routable to the outside world.
With some ssh proxying magic, you can get to it through the ssh
server that you’ve created by adding this to ~/.ssh/config.
Now you can just ssh to that server’s internal IP address
Amazon charges you per hour, so if you’re just testing and want to shut
everything down, here are some clean-up steps. There’s a mess of
dependencies, so you need to do it in a specific order.
More to Come
There is, obviously, a lot more to VPC, and I hope to cover some more
topics in future blog posts.