Why VPC provides network isolation in AWS - See It in Action

Why VPC Provides Network Isolation

📖 Scenario: You are setting up a cloud environment for a small company. You want to keep their network safe and separate from other users in the cloud.

🎯 Goal: Build a simple Virtual Private Cloud (VPC) configuration that shows how network isolation is created using subnets and security groups.

📋 What You'll Learn

Create a VPC with a specific CIDR block

Add two subnets inside the VPC

Create a security group that allows only specific traffic

Associate the security group with an instance inside the VPC

💡 Why This Matters

🌍 Real World

Companies use VPCs to keep their cloud resources private and secure, separating them from other users and controlling network traffic.

💼 Career

Understanding VPCs and network isolation is essential for cloud architects and engineers to design secure cloud environments.

1

Create a VPC with CIDR block

Create a VPC named MyVPC with the CIDR block 10.0.0.0/16.

AWS

# Create a VPC named MyVPC with CIDR block 10.0.0.0/16
# Your code here

Hint

Use the aws_vpc resource and set cidr_block to 10.0.0.0/16.

2

Add two subnets inside the VPC

Add two subnets named SubnetA and SubnetB inside MyVPC with CIDR blocks 10.0.1.0/24 and 10.0.2.0/24 respectively.

AWS

resource "aws_vpc" "MyVPC" {
  cidr_block = "10.0.0.0/16"
  tags = {
    Name = "MyVPC"
  }
}

# Add two subnets SubnetA and SubnetB inside MyVPC
# Your code here

Hint

Use aws_subnet resources and link them to MyVPC using vpc_id.

3

Create a security group to allow specific traffic

Create a security group named MySG inside MyVPC that allows inbound TCP traffic on port 22 (SSH) from anywhere.

AWS

resource "aws_vpc" "MyVPC" {
  cidr_block = "10.0.0.0/16"
  tags = {
    Name = "MyVPC"
  }
}

resource "aws_subnet" "SubnetA" {
  vpc_id     = aws_vpc.MyVPC.id
  cidr_block = "10.0.1.0/24"
  tags = {
    Name = "SubnetA"
  }
}

resource "aws_subnet" "SubnetB" {
  vpc_id     = aws_vpc.MyVPC.id
  cidr_block = "10.0.2.0/24"
  tags = {
    Name = "SubnetB"
  }
}

# Create a security group MySG inside MyVPC allowing inbound TCP port 22 from 0.0.0.0/0
# Your code here

Hint

Use aws_security_group with ingress rules for port 22 TCP.

4

Associate the security group with an instance inside the VPC

Create an EC2 instance named MyInstance in SubnetA and associate it with the security group MySG.

AWS

resource "aws_vpc" "MyVPC" {
  cidr_block = "10.0.0.0/16"
  tags = {
    Name = "MyVPC"
  }
}

resource "aws_subnet" "SubnetA" {
  vpc_id     = aws_vpc.MyVPC.id
  cidr_block = "10.0.1.0/24"
  tags = {
    Name = "SubnetA"
  }
}

resource "aws_subnet" "SubnetB" {
  vpc_id     = aws_vpc.MyVPC.id
  cidr_block = "10.0.2.0/24"
  tags = {
    Name = "SubnetB"
  }
}

resource "aws_security_group" "MySG" {
  name        = "MySG"
  description = "Allow SSH inbound"
  vpc_id      = aws_vpc.MyVPC.id

  ingress {
    description      = "SSH from anywhere"
    from_port        = 22
    to_port          = 22
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
  }

  tags = {
    Name = "MySG"
  }
}

# Create an EC2 instance MyInstance in SubnetA with security group MySG
# Your code here

Hint

Use aws_instance resource with subnet_id and vpc_security_group_ids set correctly.

Practice

1. What is the main reason a VPC provides network isolation in AWS?

easy

A. It provides unlimited bandwidth for all resources.

B. It automatically encrypts all data in the cloud.

C. It limits the number of users who can access AWS services.

D. It creates a private network space separate from other users.

Solution

1. Step 1: Understand what a VPC does

   A VPC creates a private network space isolated from other AWS users.

2. Step 2: Identify the isolation feature

   This private network space ensures resources inside the VPC are separated from others.

3. Final Answer:

   It creates a private network space separate from other users. -> Option D

4. Quick Check:

   VPC isolation = private network space [OK]

Hint: VPC means private network space, so isolation is by separation [OK]

Common Mistakes:

• Confusing encryption with network isolation
• Thinking VPC limits user count globally
• Assuming VPC provides unlimited bandwidth

2. Which AWS component defines the IP address range for a VPC to isolate its network?

easy

A. Security Group

B. Subnet

C. CIDR Block

D. Route Table

Solution

1. Step 1: Identify IP range setting in VPC

   The IP address range for a VPC is defined by a CIDR block (Classless Inter-Domain Routing).

2. Step 2: Understand other options

   Security Groups control access, Subnets divide the VPC, Route Tables direct traffic but do not define IP range.

3. Final Answer:

   CIDR Block -> Option C

4. Quick Check:

   VPC IP range = CIDR Block [OK]

Hint: CIDR block sets IP range, isolating the network [OK]

Common Mistakes:

• Confusing Security Groups with IP range
• Thinking Subnets define the whole VPC range
• Assuming Route Tables set IP addresses

3. Given a VPC with CIDR block 10.0.0.0/16 and a subnet 10.0.1.0/24, which IP address belongs to the subnet?

medium

A. 10.0.1.50

B. 10.0.2.5

C. 10.1.1.10

D. 192.168.1.1

Solution

1. Step 1: Understand subnet IP range

   The subnet 10.0.1.0/24 includes IPs from 10.0.1.0 to 10.0.1.255.

2. Step 2: Check each IP

   10.0.2.5 is outside subnet, 10.0.1.50 is inside subnet, 10.1.1.10 and 192.168.1.1 are outside subnet.

3. Final Answer:

   10.0.1.50 -> Option A

4. Quick Check:

   IP in 10.0.1.0/24 = 10.0.1.50 [OK]

Hint: Check if IP matches subnet range bits [OK]

Common Mistakes:

• Choosing IPs outside the subnet range
• Confusing subnet and VPC ranges
• Ignoring CIDR notation meaning

4. You created a VPC but your instances cannot communicate with each other. What is the most likely cause?

medium

A. Security groups block all inbound and outbound traffic.

B. The route table has a route to the local network.

C. The subnet CIDR block overlaps with another VPC.

D. The VPC has no internet gateway attached.

Solution

1. Step 1: Analyze communication issue

   Instances in a VPC communicate if security groups allow traffic.

2. Step 2: Check options

   No internet gateway affects external access, overlapping CIDR causes conflicts but not internal block, route to local network is needed for communication.

3. Final Answer:

   Security groups block all inbound and outbound traffic. -> Option A

4. Quick Check:

   Blocked security groups = no communication [OK]

Hint: Check security group rules first for communication issues [OK]

Common Mistakes:

• Assuming internet gateway affects internal traffic
• Ignoring security group rules
• Thinking route table with local route blocks traffic

5. You want to isolate two applications in the same AWS account so they cannot access each other's resources. Which VPC design best achieves this?

hard

A. Create one VPC with separate subnets and use security groups to isolate traffic.

B. Create two separate VPCs with non-overlapping CIDR blocks and no peering.

C. Use one VPC and rely on route tables to block traffic between subnets.

D. Create one VPC and use a single security group for all instances.

Solution

1. Step 1: Understand isolation requirements

   Complete isolation means no network path between applications.

2. Step 2: Evaluate design options

   Separate VPCs with no peering ensure full network isolation. One VPC with subnets or security groups can isolate but is less strict and more complex.

3. Final Answer:

   Create two separate VPCs with non-overlapping CIDR blocks and no peering. -> Option B

4. Quick Check:

   Separate VPCs = full network isolation [OK]

Hint: Use separate VPCs without peering for full isolation [OK]

Common Mistakes:

• Relying only on security groups for full isolation
• Using route tables alone to block traffic
• Assuming one VPC can fully isolate apps without extra setup