‫(Instructor) So let's start by understanding
‫what a VPC is.
‫So VPC is a Virtual Private Cloud.
‫And is a private network for you
‫to deploy your resources in, for example,
‫your EC2 instances,
‫a VPC is linked to a specific region.
‫So if you have multiple regions in AWS
‫and you have multiple VPC.
‫So here's an example.
‫Here's my VPC that I've created.
‫And within the VPC,
‫we can have subnets.
‫And a subnet is going to be a part of the VPC.
‫So partition of your network.
‫And that is going to be associated
‫with an availability zone.
‫So here's an example we have an AZ A.
‫And within an AZ we're going to have First of all,
‫a public subnet.
‫So this public subnet is special because it is a subnet
‫that is accessible from the internet.
‫As you can see on the diagram on the right hand side,
‫the public subnet has direct connectivity to the Internet,
‫and the internet can directly reach our public subnets.
‫Also, we can have a private subnet
‫and a private subnet is a subnet that is not accessible
‫from the internet.
‫We'll see how we can define a public subnet
‫and a private subnet later on.
‫So to define access to the internet
‫and access between the subnets so
‫that the resources can communicate,
‫we need to use Route Tables.
‫So the question is,
‫what do you put in a public subnet?
‫Well, when we did create our EC2 instances,
‫we created them in a public subnet.
‫But in a public subnet,
‫you can also put,
‫for example, a load balancer.
‫And in a private subnet,
‫which we don't have,
‫when we have a default VPC,
‫you could place your databases,
‫for example,
‫because they don't need access to the internet
‫and therefore they're going to be more secure.
‫So if we look at a VPC,
‫a more complete one,
‫we have the cloud of AWS, we have regions
‫within the region will have a VPC.
‫And the VPC will have what's called a CIDR Range,
‫which is a range of IP addresses
‫that is allowed within your VPC.
‫And then the VPC can go across two
‫or three availability zones.
‫So we have AZ1 that contains a public subnet,
‫and the private subnet and AZ2
‫which contains also a public subnet and a private subnet.
‫So in this example we have two AZ, one VPC, four subnets.
‫Two of them are public and two of them are private.
‫And we can launch EC2 instances.
‫In each of these subnets.
‫Finally, how do we define access to
‫the internet for these subnets?
‫Well, if we look at the same example as before,
‫say we had an EC2 instance in a public subnet,
‫for it to be able to access the internet,
‫we need to create what's called an Internet Gateway.
‫And this Internet Gateway will help our VPC instances
‫to connect directly to the internet.
‫So the VPC will be having an Internet Gateway.
‫And then the public subnet will have a route
‫to the Internet Gateway to be able to access the internet.
‫So fairly simple,
‫as soon as we have a Internet Gateway
‫and a route to the Internet Gateway that makes
‫the subnet a public subnet.
‫Now if you have an instance in a private subnet,
‫it is not going to be accessible from the internet.
‫But you may want to give it access to the internet
‫For example, to get updates for your operating system
‫or to download files.
‫So for this,
‫we can create what's called a NAT Gateway,
‫which is managed by AWS,
‫or in that instance,
‫which is self managed.
‫And that will allow your instances in your private subnets
‫to access the internet while remaining private.
‫So concretely, we create a NAT Gateway
‫or Nat instance in our public subnet.
‫And we create a route
‫from the private subnets to the NAT Gateway,
‫and from the NAT Gateway to the Internet Gateway.
‫And this will allow your private subnets
‫to get internet connectivity.
‫So that's it for the theory,
‫now I will just show you in the console what's
‫the default VPC and what is created for us.
‫So let's go in the Console of the VPC.
‫So I'll type in VPC.
‫And as was mentioned,
‫when we did create our account,
‫there was a default VPC created for us.
‫So this is what we observe
‫from here we have one VPC, three subnets,
‫one Route Table and one Internet Gateway.
‫So first, let's have a look at the VPC.
‫So if we look at the VPC,
‫we can see that this VPC is available
‫and we get the CIDR which corresponds to the IP
‫range of that VPC.
‫So if you want to know what this means,
‫you go to CIDR.XYZ,
‫which is a website.
‫And on this website you're going to enter
‫the CIDR you see here so 172
‫dot and then we have 31 00 16
‫so 31, zero, zero
‫and then 16
‫and this shows you the kind
‫of addresses range we're going to get.
‫So the first IP
‫is 172 point 31.01
‫and the last IP is 172 point 31
‫point 255 point 254.
‫And we get about 65,000 IP in this entire range.
‫So this is why when we've been creating EC2 instances
‫in our default VPC,
‫the private IP where within the range shown below,
‫okay, great. So we have our VPC.
‫And so far, it's good.
‫We have one CIDR block,
‫we could add more if you wanted to.
‫Next we want to look at the subnets.
‫So for this,
‫we go to subnets.
‫And we open this as a new tab.
‫And we can see that three subnets are created
‫for us in our VPC.
‫So each subnet correspond to a specific availability zone.
‫So for example,
‫this subnet right here is for eu-West-1a,
‫this subnet right here is for eu-West-1b.
‫And this right here for eu-West-1c.
‫And within each subnet,
‫we get a different IPv4 CIDR.
‫So if we look at this one
‫for example, for eu-West-1a, it is the same as before,
‫but slash 20.
‫So if we go to this website and do slash 20,
‫we can see what is the first IP and what is the last IP.
‫And then again,
‫this is a subset of everything we had from before.
‫So if we go back into our VPC,
‫our subnets excuse me,
‫and then look at this CIDR right here.
‫So this is a new CIDR's, point 16.0.
‫So copy this and paste it and shows you again,
‫the first IP and the last IP.
‫So we can have multiple subnets their partitions
‫within our VPC and each subnet in this example
‫Has 4091 available IPv4.
‫So if we launch an EC2 instance,
‫within a subnet,
‫an ipv4 will be used.
‫Okay. So we have three subnets,
‫corresponding to three AZ.
‫And so when we went into the EC2 Console,
‫I will show you this right now,
‫when we went to the EC2 Console,
‫and we launched an instance,
‫we're going to do it again,
‫launch an instance,
‫we had to choose the AMI type,
‫we had to choose the instance size
‫and then we had to choose the instance details.
‫The network was associated to the default VPC.
‫And for the subnets,
‫you have to choose the CIDR you want it to be in.
‫And these subnets correspond to AZ
‫and they correspond to the subnets
‫that we created right here.
‫So as an example,
‫if I create an instance in eu-West-1a,
‫so I'm going to create that instance,
‫do review and then launch
‫and then acknowledges our instance
‫is getting created automatically.
‫And if we look at
‫the private IP 172 point 31.6 point 131
‫this IP, is within the CIDR Range.
‫That has been defined, right here.
‫Okay, this is good.
‫So we understand better how it works.
‫And because this is a public subnet,
‫then this is why we were able to connect
‫to our EC2 instance,
‫and this is why our EC2 instance was able
‫to be used as a web server
‫and also, install different packages.
‫Okay, so this is good.
‫We understand better now
‫what goes on behind the scenes.
‫So next, what I told you about was
‫the Internet Gateway.
‫So the Internet Gateway here has been created already.
‫And it's attached to one VPC
‫so VPC can only have one Internet Gateway.
‫And this is what allows my EC2 instances in here
‫to get internet access.
‫If I do remove the Internet Gateway,
‫if I detach it,
‫I won't do it,
‫then I'm not going to be able
‫to access my EC2 instance anymore.
‫And for the Internet Gateway to be used,
‫it needs to be used by a Route Table.
‫So if I go back to my subnetS
‫and click on any of these subnets and go to the Route Table,
‫I can see there is a Route Table associated with it.
‫If I click on this Route Table,
‫this road table contains a Route in here
‫That says that if you're going within this CIDR,
‫you stay within your local VPC.
‫But if you're going anywhere else,
‫then please use the Internet Gateway.
‫This is a link to the Internet Gateway.
‫Well, this means that our instance has a Route
‫and within our subnets to the Internet Gateway,
‫and therefore it is a public subnet
‫and the EC2 instance can access the internet.
‫As I mentioned,
‫we don't have any private subnet in this example,
‫because it is a default VPC.
‫But if you wanted to as an exercise,
‫you could create a subnets.
‫It's more complicated,
‫I do this in my other courses.
‫And then you will need to also define
‫a specific Route Table.
‫Okay, finally, we are not using them
‫because we don't have any private subnets.
‫But you could create a NAT Gateway,
‫and the NAT Gateway would be associated with a subnet
‫and would allow your instances in your private subnets
‫to access the internet.
‫And this is more advanced.
‫You just need to know what it is at a high level.
‫Finally to clean up but do not forget
‫to take your instance right click
‫and terminate it to leave it clean after yourself.
‫That's it, I will see you in the next lecture.