EC2 Networking: VPC, Security Groups & Elastic IPs

VPC & Subnet Architecture

• VPC: your private network in AWS, spans all AZs in a region, CIDR block e.g. 10.0.0.0/16

• Public subnet: has route to Internet Gateway, instances can have public IPs

• Private subnet: no IGW route, use NAT Gateway for outbound internet, no inbound from internet

• Default VPC: exists in every account/region, all subnets are public — do not use for production

• Best practice: web servers in public subnets, app/DB servers in private subnets

# Check if instance is in public or private subnet
aws ec2 describe-subnets --subnet-ids subnet-abc123 \
  --query 'Subnets[0].{CIDR:CidrBlock,Public:MapPublicIpOnLaunch,AZ:AvailabilityZone}'

# Check route table for subnet (look for igw-* destination for internet)
aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=subnet-abc123

Security Groups

Security groups are stateful firewalls at the instance level. Inbound and outbound rules are separate. Return traffic is automatically allowed. Rules specify port, protocol, and source (IP or another SG).

# Create security group
aws ec2 create-security-group \
  --group-name app-server-sg \
  --description "App server security group" \
  --vpc-id vpc-abc123

# Allow HTTPS from ALB security group
aws ec2 authorize-security-group-ingress \
  --group-id sg-appserver \
  --protocol tcp --port 443 \
  --source-group sg-alb   # Only from ALB, not the internet

# Allow SSH from bastion only
aws ec2 authorize-security-group-ingress \
  --group-id sg-appserver \
  --protocol tcp --port 22 \
  --source-group sg-bastion

# Allow PostgreSQL from app servers to DB
aws ec2 authorize-security-group-ingress \
  --group-id sg-database \
  --protocol tcp --port 5432 \
  --source-group sg-appserver

# View security group rules
aws ec2 describe-security-groups --group-ids sg-appserver \
  --query 'SecurityGroups[0].IpPermissions'

Elastic IPs

# Allocate Elastic IP
aws ec2 allocate-address --domain vpc
# Returns AllocationId and PublicIp

# Associate with instance
aws ec2 associate-address \
  --instance-id i-abc123 \
  --allocation-id eipalloc-abc123

# Disassociate (keep the EIP for later)
aws ec2 disassociate-address --public-ip 54.12.34.56

# Release EIP (stop being charged)
aws ec2 release-address --allocation-id eipalloc-abc123

# Note: EIPs cost money when NOT associated with a running instance

Session Manager (SSH Alternative)

SSM Session Manager provides browser-based or CLI shell access to instances WITHOUT opening port 22, key pairs, or bastion hosts. Requires SSM Agent (pre-installed on Amazon Linux 2023/Ubuntu) and instance profile with SSM permissions.

# Start session (no SSH required)
aws ssm start-session --target i-abc123

# Port forwarding via SSM (tunnel to RDS without VPN)
aws ssm start-session \
  --target i-abc123 \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"portNumber":["5432"],"localPortNumber":["5432"],"host":["rds-endpoint.eu-west-1.rds.amazonaws.com"]}'
# Now connect: psql -h localhost -p 5432 -U admin mydb

# Required IAM policy for instance profile
# AmazonSSMManagedInstanceCore (AWS managed policy)

Enhanced Networking & Placement Groups

• Enhanced Networking (ENA): up to 100 Gbps, enabled by default on modern instance types

• Placement Group - Cluster: instances in same AZ, low latency network — HPC, tightly coupled apps

• Placement Group - Spread: instances on different hardware — max 7 per AZ, critical apps

• Placement Group - Partition: groups of instances on separate hardware — Hadoop, Kafka, Cassandra

# Create cluster placement group
aws ec2 create-placement-group \
  --group-name my-hpc-cluster \
  --strategy cluster

# Launch into placement group
aws ec2 run-instances \
  --placement GroupName=my-hpc-cluster \
  ... # other params