Building My First Public–Private AWS VPC Architecture
A hands-on walkthrough of my first AWS public–private VPC setup using EC2, subnets, route tables, security groups, and a private backend server. I also share the main issues I faced, including region mismatch, EC2 Instance Connect errors, and Python user-data problems, and how I solved them.
Recently, I completed a hands-on AWS networking lab where I built a simple public–private VPC architecture using Amazon VPC and EC2.
The goal was to create two EC2 instances:
- a public web server that could be accessed from the internet
- a private data server that could only be reached from the public server inside the VPC
This lab helped me understand how AWS networking components actually work together instead of only learning them theoretically.
Real-World Architecture
What I Configured
I created a custom VPC with separate Public and Private Subnets.
The public subnet was connected to an Internet Gateway, and its route table contained a default route:
1
0.0.0.0/0 → Internet GatewayThe private subnet had no direct route to the internet.
I also created two security groups:
Web-Server-SGfor the public EC2 instancePrivate-Data-SGfor the private EC2 instance
The important part was allowing the private server to accept traffic on port
8080 only from the Web-Server-SG, instead of opening it to everyone.
Private and Public Security Groups
Running the Private Student Data Server
On the private EC2 instance, I used a small Python HTTP server that returned student information as JSON.
The service ran on port:
1
8080I then tested the connection from my public EC2 instance using:
1
curl http://PRIVATE-IP:8080/studentWhen the JSON response appeared successfully, it confirmed that communication between the public and private subnets was working.
Terminal screenshot showing the successful curl response
The Problems I Faced
The lab was not completely smooth, and that was probably the most useful part.
One issue was that I initially could not see the VPC and security groups I had created while launching an EC2 instance.
The reason turned out to be a region mismatch.
After switching back to the correct AWS Region, all of my resources appeared.
I also faced an SSH connection error when trying to connect using EC2 Instance Connect.
My SSH security group rule was allowing only my own IP, while EC2 Instance Connect required the appropriate AWS service source.
After correcting the SSH rule, I was able to connect successfully.
Another issue was with the Python user-data script.
Python depends on correct indentation, so I had to make sure the code inside the class, function, and
if statements was properly indented before launching the instance.These small problems helped me understand AWS much better than simply following steps without errors.
Creating the Final Student Portal
After retrieving the data from the private server, I stored the response in a shell variable and inserted it into an HTML page hosted on the public EC2 instance.
The final flow looked like this:
1
Internet → Public EC2 → Private EC2The browser could access the public server, but the private server remained protected inside the VPC.
Final Student Portal webpage
What I Learned
This lab gave me a much clearer understanding of how VPCs, subnets, route tables, Internet Gateways, security groups, private IP addresses, and EC2 instances work together.
The biggest lesson for me was that AWS networking is mostly about understanding where traffic is allowed to go and why.
It was a simple architecture, but building it myself made the concepts much easier to understand.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article