![Diff AWS internet gateway – Cloudformation Diff AWS internet gateway – Cloudformation](https://askjoechan.com/wp-content/uploads/2023/06/template1-designer2-1024x868.png)
Diff AWS internet gateway – Cloudformation
INTRO
There different in AWS, for EC2 instances in private subnet to reach public internet. We will take a closer look at how AWS enables for different type in internet access. We will use cloudformation to build VPC, Subnets, internetgateway , NAT gateway and also with VM to test.
Internet Gateway – It serves as the entry and exit point for internet traffic to and from your VPC.
NAT Gateway – IPV4
Egress-only Internet gateway – IPV6
Diagrams
At the bottom of the page, you can find cloudformation code. Bascially, you can save it in a text file. In Cloudformation, upload the text. It will create & store it in your S3 Bucket. Next you can open up Desgin template to review or modify.
Comparing with Terraform and Cloudformation. They are both infrastructure as code. If you use Cloudformation, you can view your resources under cloudformation stack in AWS application manager. Also you can view the status of the related EC2 .
![](https://askjoechan.com/wp-content/uploads/2023/06/template-1.2-1024x605.png)
![](https://askjoechan.com/wp-content/uploads/2023/06/end-1.5-1024x252.png)
Internet Gateway – bind EIP to Instance
If we use internet gateway , bind EIP to EC2 instance. It will allow your instance to reach public internet. Also at the same, your instance inbound port is opened as well. It will reply on your security group to allow specific port to open. Also EIP is binding to 1 instance.
![](https://askjoechan.com/wp-content/uploads/2023/06/end-1.13-1024x380.png)
NAT Gateways for Secure Internet Access:
NAT Gateways act as a bridge between the private subnets and the internet, allowing resources within the private subnets to access external services while preventing inbound connections from the internet. In our infrastructure example, each VPC has a dedicated NAT Gateway associated with its respective public subnet.
![](https://askjoechan.com/wp-content/uploads/2023/06/cloud-1.2-1024x264.png)
![](https://askjoechan.com/wp-content/uploads/2023/06/end-1.11-1024x286.png)
Result
Internet Gateway EIP – Obtained an public ip 35.174.68.6. when we use port scanner to scan, port 22 is open in the public.
NAT Gateway – Obtained an public ip 107.22.85.9 Same EC2 instance and same Security group, but we are using NAT gateway. Port 22 is closed this time by using port scanner.
![](https://askjoechan.com/wp-content/uploads/2023/06/end-1.12.png)
![](https://askjoechan.com/wp-content/uploads/2023/06/end-1.14.png)
![](https://askjoechan.com/wp-content/uploads/2023/06/end-1.15-1024x554.png)
By using this AWS CloudFormation template, wecan create a secure cloud infrastructure that separates their resources into VPCs, establishes public and private subnets, and enables outbound internet connectivity for private resources via NAT Gateways. The template automates the deployment process, making it easier to create consistent and secure cloud architectures.
CloudFormation Code
AWSTemplateFormatVersion: '2010-09-09'
Description: Aviatrix Systems - Immersion Day Lab Infrastructure.
Resources:
# Create VPCs with public subnets
VPCAA:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
EnableDnsSupport: true
EnableDnsHostnames: true
Tags:
- Key: Name
Value: VPC A
InternetGatewayA:
Type: AWS::EC2::InternetGateway
Properties:
Tags:
- Key: Name
Value: VPC A - IGW
InternetGatewayAttachmentA:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
InternetGatewayId: !Ref InternetGatewayA
VpcId: !Ref VPCAA
PublicSubnetA1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPCAA
AvailabilityZone: !Select [ 0, !GetAZs '' ]
CidrBlock: 10.0.0.0/24
MapPublicIpOnLaunch: true
Tags:
- Key: Name
Value: VPC A - AZ1
PublicSubnetA2:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPCAA
AvailabilityZone: !Select [ 1, !GetAZs '' ]
CidrBlock: 10.0.1.0/24
MapPublicIpOnLaunch: true
Tags:
- Key: Name
Value: VPC A - AZ2
PublicRouteTableA:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPCAA
Tags:
- Key: Name
Value: VPC A Route Table
DefaultPublicRouteA:
Type: AWS::EC2::Route
DependsOn: InternetGatewayAttachmentA
Properties:
RouteTableId: !Ref PublicRouteTableA
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGatewayA
PublicSubnetA1RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref PublicRouteTableA
SubnetId: !Ref PublicSubnetA1
PublicSubnetA2RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref PublicRouteTableA
SubnetId: !Ref PublicSubnetA2
# Create private subnets
PrivateSubnetA:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPCAA
AvailabilityZone: !Select [ 0, !GetAZs '' ]
CidrBlock: 10.0.2.0/24
MapPublicIpOnLaunch: false
Tags:
- Key: Name
Value: VPC A Private Subnet
PrivateRouteTableA:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPCAA
Tags:
- Key: Name
Value: VPC A Private Route Table
PrivateSubnetARouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref PrivateRouteTableA
SubnetId: !Ref PrivateSubnetA
# Create EC2 Instances
EC2InstanceA:
Type: AWS::EC2::Instance
Properties:
ImageId: ami-087c17d1fe0178315 #AL2 us-east-1
BlockDeviceMappings:
- DeviceName: /dev/sda1
Ebs:
VolumeSize: '8'
VolumeType: gp2
Encrypted: 'true'
DisableApiTermination: 'false'
KeyName: ee-default-keypair
InstanceType: t3.micro
IamInstanceProfile: Ec2RoleForSSM
NetworkInterfaces:
- DeviceIndex: '0'
PrivateIpAddress: '10.0.2.10'
GroupSet:
- !Ref 'EC2SecurityGroupA'
SubnetId: !Ref 'PrivateSubnetA'
Tags:
- Key: Name
Value: EC2 A
- Key: Environment
Value: Development
EC2SecurityGroupA:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: 'EC2 VPC A - AZ1'
VpcId: !Ref 'VPCAA'
SecurityGroupIngress:
- IpProtocol: icmp
CidrIp: '10.0.0.0/8'
FromPort: 8
ToPort: -1
Tags:
- Key: Name
Value: EC2 A Security Group
VPCAANatGatewayEIP:
Type: AWS::EC2::EIP
DependsOn: InternetGatewayAttachmentA
Properties:
Domain: vpc
VPCAANatGateway:
Type: AWS::EC2::NatGateway
Properties:
AllocationId: !GetAtt VPCAANatGatewayEIP.AllocationId
SubnetId: !Ref PublicSubnetA1
Tags:
- Key: Name
Value: NGW VPC A
VPCAADefaultPrivateRoute:
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PrivateRouteTableA
DestinationCidrBlock: 0.0.0.0/0
NatGatewayId: !Ref VPCAANatGateway