🔬 Hands-On Lab · Amazon VPC

AWS VPC
Lab Presentation

Step-by-step practical guide. Build your own private network from scratch — subnets, internet gateway, routing, and security groups.

Lab 1: Explore Default VPC Lab 2: Create Custom VPC Lab 3: Subnets + IGW Lab 4: Route Tables Lab 5: Launch EC2 in VPC Activity: Draw-a-VPC

Before You Start

✓

Prerequisites

Everything should be ready before starting

What You Need

AWS Console open · IAM user login (not root) · Region set to ap-south-1 (Mumbai) · You've already done EC2 labs — you understand what an instance is

Important — Use ap-south-1

Set your region to Asia Pacific (Mumbai) in the top-right corner. VPCs are regional — always confirm you're in the right region before creating anything.

Opening Activity (8 min)

🎨 Think-Pair-Share Activity

Activity: "Public or Private?" — 8 Minutes

Before touching the console, build your mental model. Work in pairs.

Instructions for Students

For each item below, decide: should it go in a Public Subnet or Private Subnet? Write your answers on paper. Then compare with your partner.

1. A website that customers visit (frontend web server)
2. A database storing customer passwords
3. A payment processing server
4. A file server only IT team uses
5. An API that your mobile app calls
6. A backup storage server

Discuss: What is your rule for deciding Public vs Private?

Lab 1 of 5

Explore the Default VPC

See what AWS created for you automatically

What We Are Doing

AWS created a Default VPC in your account. Before building our own, let's understand what it looks like — this is exactly what a working VPC looks like.

1
Go to VPC service in AWS ConsoleServices → Networking & Content Delivery → VPC
2
Click Your VPCs (left sidebar) → You'll see a VPC with name "—" — this is the default one
3
Note the IPv4 CIDR: it should be 172.31.0.0/16
4
Click Subnets (left sidebar) → Count the subnets — there should be one per Availability Zone (typically 3 in Mumbai)
5
Click Internet Gateways → You'll see one already attached to the default VPC
6
Click Route Tables → Click on the main route table → Check the Routes tab → You'll see a route to 0.0.0.0/0 pointing to the IGW

What You Observed

A working VPC has: a CIDR block → subnets → an Internet Gateway → route tables pointing traffic to the IGW. We'll now build all of this from scratch.

Lab 2 of 5

Create a Custom VPC

Build your own private network from a blank slate

What We Are Doing

We'll create a VPC with the IP range 10.0.0.0/16. This is your private network — nothing is connected to the internet yet.

1
Go to Your VPCs → Click Create VPC

Select VPC only (not "VPC and more")

VPC Settings

Name tag       : iimt-vpc
IPv4 CIDR      : 10.0.0.0/16
IPv6 CIDR      : No IPv6
Tenancy        : Default

3
Click Create VPC
4
Your new VPC appears in the list. Notice: State = Available, but there are no subnets yet. The network exists but it's completely empty.

Expected Result

VPC iimt-vpc created with CIDR 10.0.0.0/16. State: Available. No subnets, no IGW, no route table yet — just the container.

Lab 3 of 5

Create Subnets + Attach Internet Gateway

Divide your VPC and connect it to the internet

What We Are Doing

We'll create one Public Subnet (for web servers) and one Private Subnet (for databases). Then attach an Internet Gateway to our VPC.

Part A — Create Public Subnet

1
Click Subnets (left sidebar) → Create subnet

Select VPC: iimt-vpc

Public Subnet

Name             : iimt-public-subnet
Availability Zone: ap-south-1a
IPv4 CIDR        : 10.0.1.0/24

3
Click Add new subnet to add the private one in the same create operation

Add Private Subnet:

Private Subnet

Name             : iimt-private-subnet
Availability Zone: ap-south-1b
IPv4 CIDR        : 10.0.2.0/24

5
Click Create subnet

Part B — Create and Attach Internet Gateway

6
Click Internet Gateways → Create internet gateway
Name: iimt-igw → Click Create
7
With iimt-igw selected → Click Actions → Attach to VPC → Select iimt-vpc → Click Attach

Checkpoint

You now have: iimt-vpc → 2 subnets (public 10.0.1.0/24 + private 10.0.2.0/24) → iimt-igw attached. But traffic can't reach the internet yet — we need route tables.

Lab 4 of 5

Configure Route Tables

Tell AWS where to send traffic

What We Are Doing

Currently, both subnets are private (no internet route). We'll create a public route table with a route to our IGW, then associate it with the public subnet. The private subnet keeps the default (private) route.

1
Click Route Tables (left sidebar) → Create route table
Route Table
```
Name: iimt-public-rt
VPC : iimt-vpc
```

Click on iimt-public-rt → Click Routes tab → Edit routes → Add route

Add Route — Internet Traffic

Destination: 0.0.0.0/0   # means "all internet traffic"
Target     : Internet Gateway → iimt-igw

3
Click Save changes
4
Now associate this route table with the public subnet:
Click Subnet associations tab → Edit subnet associations → Select iimt-public-subnet → Save
5
Enable auto-assign public IP on the public subnet:
Go to Subnets → Select iimt-public-subnet → Actions → Edit subnet settings → Enable Auto-assign public IPv4 address → Save

Architecture So Far

Internet → iimt-igw → iimt-public-rt → iimt-public-subnet (10.0.1.0/24) ✅ Internet accessible
No route to internet → iimt-private-subnet (10.0.2.0/24) ✅ Private only

Lab 5 of 5

Launch EC2 in Your Custom VPC

Prove your VPC works by running a web server inside it

What We Are Doing

Launch an EC2 instance in the public subnet of our custom VPC, configure the Security Group, and verify the instance gets a public IP and is accessible.

1
Go to EC2 → Launch Instance
Name: iimt-web-server · AMI: Amazon Linux 2023 · Instance type: t2.micro

Under Network settings → Click Edit

Network Settings

VPC              : iimt-vpc
Subnet           : iimt-public-subnet
Auto-assign public IP: Enable

Create a new Security Group:

Security Group Rules

Name: iimt-web-sg

# INBOUND RULES:
Type : SSH    · Port 22  · Source: My IP    # Admin access
Type : HTTP   · Port 80  · Source: 0.0.0.0/0 # Web access

Add User Data script to install a web server:

User Data (Advanced Details)

#!/bin/bash
yum update -y
yum install -y httpd
systemctl start httpd
systemctl enable httpd
echo "<h1>Hello from IIMT VPC Lab!</h1>" > /var/www/html/index.html

5
Click Launch Instance → Wait ~2 minutes for it to start
6
Copy the Public IPv4 address → Open in browser → You should see "Hello from IIMT VPC Lab!"

Success!

Your EC2 instance is running inside your custom VPC, in your public subnet, protected by your Security Group, accessible via your Internet Gateway. You built all of this from scratch!

Closing Activity (10 min)

🖊️ Pair Activity — Draw-a-VPC

Activity: Design a VPC for a Food Delivery App — 10 Minutes

Work in pairs. Draw on paper (or whiteboard). No laptop needed.

Scenario

You are building a food delivery app like Swiggy. It has:

A website customers use to order food (web server)
An app backend that processes orders (app server)
A database that stores orders, restaurants, and user accounts
A payment processing service

Draw a VPC architecture showing:
1. Where each component goes (public or private subnet?)
2. How the internet connects to your public components
3. What Security Group rules you need

Compare your design with the next pair. Are they the same? Different? Why?

Lab Recap

📋

What We Built Today

Lab	What We Did	Key Learning
Lab 1	Explored Default VPC	AWS creates a working VPC automatically — now we know what one looks like
Lab 2	Created Custom VPC (10.0.0.0/16)	VPC = empty container. IP range set at creation, cannot change later
Lab 3	Created 2 subnets + Internet Gateway	Subnets divide the VPC; IGW connects VPC to the internet
Lab 4	Configured Route Tables	The route 0.0.0.0/0 → IGW is what makes a subnet "public"
Lab 5	Launched EC2 in custom VPC with web server	Security Group controls what traffic reaches the instance

🎯 Ask Students These Questions

❓
You create a VPC with CIDR 10.0.0.0/16 and a subnet with CIDR 10.0.1.0/24. How many IP addresses does the VPC have? How many does the subnet have? Why is the actual usable count slightly less?
❓
You launch an EC2 in a subnet, but you cannot SSH into it. Name 3 possible reasons — where would you check first, second, third?
❓
What is the single thing that makes a subnet "public" rather than "private"? (Hint: it's not the subnet itself.)
❓
Your database server in a private subnet needs to download security updates from the internet. How do you allow this without making the subnet public or giving the database a public IP?
❓
You have a Security Group that allows port 80 inbound. A request comes in on port 80 and gets a response. Do you need to add an outbound rule for the response? Why or why not?
❓
You are building an e-commerce site. List the components and which subnet (public/private) each one belongs in. Justify your choices.

AWS Official Docs

Official Documentation — VPC Labs

Step-by-step AWS docs for every lab above.

Lab Topic	AWS Docs URL
Create a VPC (Lab 1)	vpc/create-vpc.html
Create Subnets — Public & Private (Lab 2)	vpc/create-subnets.html
Internet Gateway (Lab 3)	vpc/VPC_Internet_Gateway.html
Route Tables (Lab 3)	vpc/VPC_Route_Tables.html
Security Groups (Lab 4 & 5)	vpc/vpc-security-groups.html

Free Hands-On Labs AWS Skill Builder — free VPC labs. Every AWS account gets a free default VPC in every region — use it to practice without extra cost.