- Lab
-
Libraries: If you want this lab, consider one of these libraries.
Build a Three-Tier Network VPC from Scratch in AWS
In this lab, learners build a three-tier VPC network architecture (web, application, database) from scratch. The focus is on CIDR planning, routing behavior, NAT-based egress, and NACL-based traffic control. ## Scenario Your organization is migrating a legacy three-tier web application to AWS. As the network engineer, you are responsible for designing the foundational VPC networking layer before any application teams deploy compute or databases. The security team has mandated the following: - Clear network segmentation between web, application, and database tiers - No direct internet access to application or database tiers - Controlled outbound-only internet access for patching and updates - Stateless network controls to complement security groups You must deliver a minimal but production-aligned VPC design that meets these requirements and can scale later without redesign.
Lab Info
Table of Contents
-
Challenge
Objective One: Create VPC
Create a new VPC with a
10.0.0.0/16CIDR block in theus-east-1Region -
Challenge
Objective Two: Create Subnets
Create
sixtotal subnets across two availability zones with/27CIDR blocks:- Two public
- Two app
- Two database
-
Challenge
Objective Three: Configure IGW and NAT Gateway
- Create and attach an Internet Gateway to the VPC
- Create a Regional NAT Gateway to enable internet connectivity for the VPC
-
Challenge
Objective Four: Configure Route Tables
Create three route tables:
- Public
- App
- Database
Add the appropriate routes to Internet Gateway for the public subnets, and routes to the NAT Gateway for the app tier subnets. The database subnets should not have internet access.
Associate each tier of subnets accordingly.
-
Challenge
Objective Five: Configure Network ACLs
Create three Network ACLs, one for each of the subnet tiers:
- Public
- App
- Database
Add stateless inbound and outbound rules to control traffic flow at the subnet level.
Public Rules
- Outbound: Allow all traffic to any destination
- Inbound: Allow all traffic from any source
App Rules
- Outbound: Allow all traffic to any destination
- Inbound: Allow all traffic from ephemeral ports (
1024-65535). Allow all traffic from VPC CIDR block.
Database Rules
- Outbound: Allow all traffic to any destination
- Inbound: Allow MySQL/Aurora traffic from the app tier CIDR blocks only
-
Challenge
Objective Six: Validate Traffic Flow
Create EC2 instances in all three tiers with SSM access using the provided IAM role and instance profile (Example:
test-StartingRoleInstanceProfile-8zkcxy9E1RpG) to test and validate connectivity and routing through the three-tier architecture.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.