AWS-VPC-Creation-and-Hardening

This project focuses on designing, deploying, and securing an AWS Virtual Private Cloud following security best practices. The goal is to create a segmented network, limit exposure to the internet, and apply defense in depth controls at the network level.

Architecture Overview

The VPC includes:

• One custom VPC
• Public and private subnets across two Availability Zones
• Internet Gateway for controlled public access
• NAT Gateway for outbound internet access from private subnets
• Route tables with least privilege routing
• Security Groups and Network ACLs for layered security

Tools and Services Used

• AWS VPC
• EC2
• Internet Gateway
• NAT Gateway
• Security Groups
• Network ACLs
• IAM

Resource Map

Step 1 Create a Custom VPC

• Open the AWS VPC console
• Click Create VPC
• Choose VPC only
• Set IPv4 CIDR block
• Create the VPC A custom VPC gives full control over routing, segmentation, and security.

Step 2 Create Subnets

Create four subnets:

• Public Subnets
• 192.168.10.0/26 - AZ1
• 192.168.10.64/26 - AZ2
• Private Subnets
• 192.168.10.128/26 - AZ1
• 192.168.10.192/26 - AZ2 Separating public and private workloads reduces the attack surface.

Step 3 Attach Internet Gateway

• Create an Internet Gateway
• Attach it to the VPC
• Only public subnets should have direct internet access.

Step 4 Create NAT Gateway

• Allocate an Elastic IP
• Create NAT Gateway in a public subnet
• Update private route table to use NAT Gateway Private instances can download updates without being exposed.

Step 5 Configure Route Tables

Public Route Table

• Local route for 192.168.10.0/24
• Default route 0.0.0.0/0 pointing to Internet Gateway
• Associate with public subnets

Private Route Table

• Local route for 192.168.10.0/24
• Default route 0.0.0.0/0 pointing to NAT Gateway
• Associate with private subnets This ensures private instances never receive inbound internet traffic.

Step 6 Harden Security Groups

Public Instance Security Group

• Allow SSH only from your IP
• Allow HTTP or HTTPS if required
• Deny all other inbound traffic Private Instance Security Group
• Allow traffic only from public security group or internal CIDR
• No direct internet inbound access Security Groups act as stateful firewalls with least privilege rules.

Step 7 Harden Network ACLs

Public NACL

• Allow inbound HTTP HTTPS SSH
• Allow ephemeral ports outbound
• Deny all else Private NACL
• Allow traffic only from VPC CIDR
• Block all inbound internet traffic NACLs provide stateless filtering as an extra security layer.

Step 8 IAM Hardening

• Use IAM roles instead of access keys
• Apply least privilege policies
• Enable MFA for root and IAM users Network security is useless if identity is weak.

Step 9 Validation and Testing

• Launch EC2 in public subnet and verify internet access
• Launch EC2 in private subnet and confirm no inbound access
• Verify outbound access from private subnet via NAT

Security Best Practices Implemented

• Network segmentation
• Least privilege routing
• No public IPs on private resources
• Layered firewall approach

Future Improvements

• Add AWS Network Firewall
• Implement VPC endpoints for S3 and DynamoDB
• Enable GuardDuty
• Automate using Terraform
• VPC Flow Logs for monitoring and auditing