Runbook 01 Build a Secure Enterprise AWS Network

Module: 04 – Amazon VPC & Network Security

Enterprise Lab: 01

Estimated Time: 3–4 Hours

Difficulty: ⭐⭐⭐⭐☆

Estimated Cost: AWS Free Tier (Some networking components such as NAT Gateway may incur charges. Always review AWS Pricing and monitor AWS Cost Explorer.)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, your task is to design and deploy a secure AWS network that follows enterprise security best practices.

By completing this runbook, you will learn how to:

Create an Amazon VPC
Design secure IP addressing
Create Public and Private Subnets
Configure Route Tables
Configure an Internet Gateway
Deploy a NAT Gateway
Configure Security Groups
Configure Network ACLs
Deploy a Bastion Host
Configure VPC Flow Logs
Validate secure network connectivity

🏢 Business Scenario

CloudNova Technologies is migrating its customer-facing web application to AWS.

The application consists of:

Web Tier
Application Tier
Database Tier

The architecture must follow enterprise security best practices by ensuring only required systems are publicly accessible while protecting internal resources from direct Internet access.

Your responsibility is to build the network foundation that every application team will use.

📋 Prerequisites

Complete:

Module 01 – AWS Security Foundations
Module 02 – Identity & Access Management (IAM)
Module 03 – AWS Organizations & Multi-Account Security

Required:

AWS Account
Administrator Access
AWS CLI Installed
Visual Studio Code
Secure AWS Environment

🏗 Enterprise Architecture

Internet
    │
    ▼
Internet Gateway
    │
──────────────────────────────────────────────
VPC (10.0.0.0/16)
│
├── Public Subnet A (10.0.1.0/24)
│      ├── Bastion Host
│      └── NAT Gateway
│
├── Private Application Subnet A (10.0.2.0/24)
│      └── EC2 Application Server
│
├── Private Database Subnet A (10.0.3.0/24)
│      └── Amazon RDS
│
├── Route Tables
│
├── Security Groups
│
├── Network ACLs
│
└── VPC Flow Logs

Step 1 — Create Amazon VPC

Navigate to:

AWS Console

↓

VPC

↓

Create VPC

Configuration

Name

CloudNova-Production-VPC

IPv4 CIDR

10.0.0.0/16

Tenancy

Default

AWS CLI

aws ec2 create-vpc \
--cidr-block 10.0.0.0/16 \
--tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=CloudNova-Production-VPC}]'

Step 2 — Create Public and Private Subnets

Create the following subnets:

Subnet	CIDR	Purpose
Public Subnet	10.0.1.0/24	Bastion & NAT
Private App	10.0.2.0/24	EC2 Application Servers
Private Database	10.0.3.0/24	Amazon RDS

Console

VPC

↓

Subnets

↓

Create Subnet

CLI Example

aws ec2 create-subnet \
--vpc-id <vpc-id> \
--cidr-block 10.0.1.0/24

Repeat for all subnets.

Step 3 — Create Internet Gateway

Navigate to:

VPC

↓

Internet Gateways

↓

Create

Attach the Internet Gateway to your VPC.

CLI

aws ec2 create-internet-gateway

Attach:

aws ec2 attach-internet-gateway \
--internet-gateway-id <igw-id> \
--vpc-id <vpc-id>

Step 4 — Configure Route Tables

Create:

Public Route Table
Private Route Table

Public Route Table

Destination

0.0.0.0/0

↓

Internet Gateway

Private Route Table

Destination

0.0.0.0/0

↓

NAT Gateway

Associate the appropriate subnets.

Step 5 — Deploy NAT Gateway

Navigate to:

VPC

↓

NAT Gateway

↓

Create

Configuration:

Public Subnet
Allocate Elastic IP

Discuss:

Why private resources should not have direct Internet access.
Why outbound updates should pass through the NAT Gateway.

Step 6 — Configure Security Groups

Create the following Security Groups:

Bastion Host

Allow:

SSH (22)

Source:

Your Public IP

Application Servers

Allow:

HTTP (80)

HTTPS (443)

Source:

Public Load Balancer (or Bastion for testing)

Database

Allow:

MySQL (3306)

Source:

Application Security Group

Discuss:

Stateful firewall
Least privilege
Restricting inbound access

Step 7 — Configure Network ACLs

Review the default Network ACL.

Create custom Network ACLs for:

Public Subnet
Private Application Subnet
Private Database Subnet

Review:

Inbound Rules
Outbound Rules
Rule Order

Discuss:

Stateless filtering
Difference between Security Groups and NACLs

Step 8 — Deploy Bastion Host

Launch an EC2 instance in the Public Subnet.

Configure:

Amazon Linux 2023
SSH Key Pair
Bastion Security Group

Validate:

SSH access from your workstation.

Step 9 — Configure VPC Flow Logs

Navigate to:

VPC

↓

Flow Logs

↓

Create Flow Log

Destination:

CloudWatch Logs

Review:

Accepted Traffic
Rejected Traffic

Discuss:

Network monitoring
Incident response
Threat hunting

Step 10 — Validate Connectivity

Verify:

Bastion Host is accessible
Application Server has outbound Internet access through the NAT Gateway
Database is not publicly accessible
Security Groups allow only required traffic
Network ACLs behave as expected
VPC Flow Logs capture traffic

Useful validation commands:

ping <private-ip>

curl https://aws.amazon.com

traceroute <destination>

🧪 Enterprise Challenge

CloudNova Technologies plans to host:

Customer Web Portal
Internal HR Application
Finance System
SOC Platform

Design a secure VPC architecture that provides:

Network Segmentation
High Availability
Secure Internet Access
Secure Administrative Access
Private Database Connectivity
Monitoring and Logging

Create a network diagram and explain your design decisions.

📄 Deliverables

Capture screenshots of:

Amazon VPC
Subnets
Route Tables
Internet Gateway
NAT Gateway
Security Groups
Network ACLs
Bastion Host
VPC Flow Logs

Submit:

VPC Architecture Diagram
Subnet Design
Route Table Design
Security Group Matrix
Network ACL Matrix
Validation Results

🧹 Cleanup

Delete:

Bastion Host
NAT Gateway (to avoid ongoing charges)
Elastic IP (if no longer required)
Temporary EC2 Instances
Test Security Groups
Test Network ACLs
Temporary Route Tables
Test Flow Logs (if not required)

Keep:

Amazon VPC (if it will be reused in future modules)
IP Addressing Plan
Network Design Documentation

✅ Runbook Checklist

💡 Lessons Learned

What did you learn?

Why should databases remain in private subnets?

When should Security Groups be used instead of Network ACLs?

How do NAT Gateways improve network security?

How would you improve this architecture for production?

🚀 Next Enterprise Runbook

Enterprise Runbook 02 — Enterprise AWS Network Security Assessment

In the next runbook, you will assess an existing AWS network, identify security weaknesses, evaluate routing, subnet design, Security Groups, Network ACLs, Internet exposure, and VPC Flow Logs, then produce an enterprise network security assessment report.