Complete Guide to Amazon VPC: Secure Cloud Networking#

1
# Basic VPC with public and private subnets
2
Resources:
3
  MyVPC:
4
    Type: AWS::EC2::VPC
5
    Properties:
6
      CidrBlock: 10.0.0.0/16
7
      EnableDnsHostnames: true
8
      EnableDnsSupport: true
9
      Tags:
10
        - Key: Name
11
          Value: MyVPC
12

13
  # Internet Gateway for public internet access
14
  InternetGateway:
15
    Type: AWS::EC2::InternetGateway
16
    Properties:
17
      Tags:
18
        - Key: Name
19
          Value: MyVPC-IGW
20

21
  AttachGateway:
22
    Type: AWS::EC2::VPCGatewayAttachment
23
    Properties:
24
      VpcId: !Ref MyVPC
25
      InternetGatewayId: !Ref InternetGateway
26

27
  # Public Subnet
28
  PublicSubnet:
29
    Type: AWS::EC2::Subnet
30
    Properties:
31
      VpcId: !Ref MyVPC
32
      CidrBlock: 10.0.1.0/24
33
      AvailabilityZone: !Select [0, !GetAZs '']
34
      MapPublicIpOnLaunch: true
35
      Tags:
36
        - Key: Name
37
          Value: Public Subnet
38

39
  # Private Subnet
40
  PrivateSubnet:
41
    Type: AWS::EC2::Subnet
42
    Properties:
43
      VpcId: !Ref MyVPC
44
      CidrBlock: 10.0.2.0/24
45
      AvailabilityZone: !Select [0, !GetAZs '']
46
      Tags:
47
        - Key: Name
48
          Value: Private Subnet

1
# Multi-AZ subnet configuration
2
PublicSubnet1:
3
  Type: AWS::EC2::Subnet
4
  Properties:
5
    VpcId: !Ref MyVPC
6
    CidrBlock: 10.0.1.0/24
7
    AvailabilityZone: !Select [0, !GetAZs '']
8
    MapPublicIpOnLaunch: true
9
    Tags:
10
      - Key: Name
11
        Value: Public Subnet AZ1
12
      - Key: Type
13
        Value: Public
14

15
PublicSubnet2:
16
  Type: AWS::EC2::Subnet
17
  Properties:
18
    VpcId: !Ref MyVPC
19
    CidrBlock: 10.0.2.0/24
20
    AvailabilityZone: !Select [1, !GetAZs '']
21
    MapPublicIpOnLaunch: true
22
    Tags:
23
      - Key: Name
24
        Value: Public Subnet AZ2
25
      - Key: Type
26
        Value: Public
27

28
PrivateSubnet1:
29
  Type: AWS::EC2::Subnet
30
  Properties:
31
    VpcId: !Ref MyVPC
32
    CidrBlock: 10.0.10.0/24
33
    AvailabilityZone: !Select [0, !GetAZs '']
34
    Tags:
35
      - Key: Name
36
        Value: Private Subnet AZ1
37
      - Key: Type
38
        Value: Private
39

40
PrivateSubnet2:
41
  Type: AWS::EC2::Subnet
42
  Properties:
43
    VpcId: !Ref MyVPC
44
    CidrBlock: 10.0.11.0/24
45
    AvailabilityZone: !Select [1, !GetAZs '']
46
    Tags:
47
      - Key: Name
48
        Value: Private Subnet AZ2
49
      - Key: Type
50
        Value: Private

1
# Public Route Table
2
PublicRouteTable:
3
  Type: AWS::EC2::RouteTable
4
  Properties:
5
    VpcId: !Ref MyVPC
6
    Tags:
7
      - Key: Name
8
        Value: Public Route Table
9

10
PublicRoute:
11
  Type: AWS::EC2::Route
12
  DependsOn: AttachGateway
13
  Properties:
14
    RouteTableId: !Ref PublicRouteTable
15
    DestinationCidrBlock: 0.0.0.0/0
16
    GatewayId: !Ref InternetGateway
17

18
PublicSubnetRouteTableAssociation1:
19
  Type: AWS::EC2::SubnetRouteTableAssociation
20
  Properties:
21
    SubnetId: !Ref PublicSubnet1
22
    RouteTableId: !Ref PublicRouteTable
23

24
# Private Route Table with NAT Gateway
25
PrivateRouteTable:
26
  Type: AWS::EC2::RouteTable
27
  Properties:
28
    VpcId: !Ref MyVPC
29
    Tags:
30
      - Key: Name
31
        Value: Private Route Table
32

33
PrivateRoute:
34
  Type: AWS::EC2::Route
35
  Properties:
36
    RouteTableId: !Ref PrivateRouteTable
37
    DestinationCidrBlock: 0.0.0.0/0
38
    NatGatewayId: !Ref NATGateway
39

40
PrivateSubnetRouteTableAssociation1:
41
  Type: AWS::EC2::SubnetRouteTableAssociation
42
  Properties:
43
    SubnetId: !Ref PrivateSubnet1
44
    RouteTableId: !Ref PrivateRouteTable

1
# NAT Gateway for private subnet internet access
2
NATGatewayEIP:
3
  Type: AWS::EC2::EIP
4
  DependsOn: AttachGateway
5
  Properties:
6
    Domain: vpc
7

8
NATGateway:
9
  Type: AWS::EC2::NatGateway
10
  Properties:
11
    AllocationId: !GetAtt NATGatewayEIP.AllocationId
12
    SubnetId: !Ref PublicSubnet1
13
    Tags:
14
      - Key: Name
15
        Value: NAT Gateway
16

17
# High Availability NAT Gateways
18
NATGateway2:
19
  Type: AWS::EC2::NatGateway
20
  Properties:
21
    AllocationId: !GetAtt NATGatewayEIP2.AllocationId
22
    SubnetId: !Ref PublicSubnet2
23
    Tags:
24
      - Key: Name
25
        Value: NAT Gateway AZ2

1
# Web Server Security Group
2
WebServerSecurityGroup:
3
  Type: AWS::EC2::SecurityGroup
4
  Properties:
5
    GroupDescription: Security group for web servers
6
    VpcId: !Ref MyVPC
7
    SecurityGroupIngress:
8
      - IpProtocol: tcp
9
        FromPort: 80
10
        ToPort: 80
11
        CidrIp: 0.0.0.0/0
12
        Description: HTTP access from anywhere
13
      - IpProtocol: tcp
14
        FromPort: 443
15
        ToPort: 443
16
        CidrIp: 0.0.0.0/0
17
        Description: HTTPS access from anywhere
18
      - IpProtocol: tcp
19
        FromPort: 22
20
        ToPort: 22
21
        SourceSecurityGroupId: !Ref BastionSecurityGroup
22
        Description: SSH access from bastion host
23
    SecurityGroupEgress:
24
      - IpProtocol: -1
25
        CidrIp: 0.0.0.0/0
26
        Description: All outbound traffic
27
    Tags:
28
      - Key: Name
29
        Value: WebServer-SG
30

31
# Database Security Group
32
DatabaseSecurityGroup:
33
  Type: AWS::EC2::SecurityGroup
34
  Properties:
35
    GroupDescription: Security group for database servers
36
    VpcId: !Ref MyVPC
37
    SecurityGroupIngress:
38
      - IpProtocol: tcp
39
        FromPort: 3306
40
        ToPort: 3306
41
        SourceSecurityGroupId: !Ref WebServerSecurityGroup
42
        Description: MySQL access from web servers
43
      - IpProtocol: tcp
44
        FromPort: 22
45
        ToPort: 22
46
        SourceSecurityGroupId: !Ref BastionSecurityGroup
47
        Description: SSH access from bastion host
48
    SecurityGroupEgress:
49
      - IpProtocol: tcp
50
        FromPort: 80
51
        ToPort: 80
52
        CidrIp: 0.0.0.0/0
53
        Description: HTTP for package updates
54
      - IpProtocol: tcp
55
        FromPort: 443
56
        ToPort: 443
57
        CidrIp: 0.0.0.0/0
58
        Description: HTTPS for package updates
59
    Tags:
60
      - Key: Name
61
        Value: Database-SG
62

63
# Bastion Host Security Group
64
BastionSecurityGroup:
65
  Type: AWS::EC2::SecurityGroup
66
  Properties:
67
    GroupDescription: Security group for bastion host
68
    VpcId: !Ref MyVPC
69
    SecurityGroupIngress:
70
      - IpProtocol: tcp
71
        FromPort: 22
72
        ToPort: 22
73
        CidrIp: 203.0.113.0/24  # Your office IP range
74
        Description: SSH access from office
75
    SecurityGroupEgress:
76
      - IpProtocol: tcp
77
        FromPort: 22
78
        ToPort: 22
79
        CidrIp: 10.0.0.0/16
80
        Description: SSH to internal instances
81
    Tags:
82
      - Key: Name
83
        Value: Bastion-SG

1
# Custom Network ACL for additional security
2
PrivateNetworkAcl:
3
  Type: AWS::EC2::NetworkAcl
4
  Properties:
5
    VpcId: !Ref MyVPC
6
    Tags:
7
      - Key: Name
8
        Value: Private-NACL
9

10
# Inbound rules
11
PrivateNetworkAclEntryInbound:
12
  Type: AWS::EC2::NetworkAclEntry
13
  Properties:
14
    NetworkAclId: !Ref PrivateNetworkAcl
15
    RuleNumber: 100
16
    Protocol: -1
17
    RuleAction: allow
18
    CidrBlock: 10.0.0.0/16
19

20
# Outbound rules
21
PrivateNetworkAclEntryOutbound:
22
  Type: AWS::EC2::NetworkAclEntry
23
  Properties:
24
    NetworkAclId: !Ref PrivateNetworkAcl
25
    RuleNumber: 100
26
    Protocol: -1
27
    Egress: true
28
    RuleAction: allow
29
    CidrBlock: 0.0.0.0/0
30

31
# Associate with private subnets
32
PrivateSubnetNetworkAclAssociation:
33
  Type: AWS::EC2::SubnetNetworkAclAssociation
34
  Properties:
35
    SubnetId: !Ref PrivateSubnet1
36
    NetworkAclId: !Ref PrivateNetworkAcl

1
# VPC Flow Logs for monitoring
2
FlowLogRole:
3
  Type: AWS::IAM::Role
4
  Properties:
5
    AssumeRolePolicyDocument:
6
      Version: '2012-10-17'
7
      Statement:
8
        - Effect: Allow
9
          Principal:
10
            Service: vpc-flow-logs.amazonaws.com
11
          Action: sts:AssumeRole
12
    Policies:
13
      - PolicyName: CloudWatchLogPolicy
14
        PolicyDocument:
15
          Version: '2012-10-17'
16
          Statement:
17
            - Effect: Allow
18
              Action:
19
                - logs:CreateLogGroup
20
                - logs:CreateLogStream
21
                - logs:PutLogEvents
22
                - logs:DescribeLogGroups
23
                - logs:DescribeLogStreams
24
              Resource: '*'
25

26
VPCFlowLog:
27
  Type: AWS::EC2::FlowLog
28
  Properties:
29
    ResourceType: VPC
30
    ResourceId: !Ref MyVPC
31
    TrafficType: ALL
32
    LogDestinationType: cloud-watch-logs
33
    LogDestination: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:VPCFlowLogs'
34
    LogFormat: '${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${windowstart} ${windowend} ${action}'
35
    DeliverLogsPermissionArn: !GetAtt FlowLogRole.Arn

1
# Customer Gateway (your on-premises router)
2
CustomerGateway:
3
  Type: AWS::EC2::CustomerGateway
4
  Properties:
5
    Type: ipsec.1
6
    BgpAsn: 65000
7
    IpAddress: 203.0.113.12  # Your public IP
8
    Tags:
9
      - Key: Name
10
        Value: Main Office Gateway
11

12
# Virtual Private Gateway
13
VPNGateway:
14
  Type: AWS::EC2::VPNGateway
15
  Properties:
16
    Type: ipsec.1
17
    Tags:
18
      - Key: Name
19
        Value: VPC VPN Gateway
20

21
VPNGatewayAttachment:
22
  Type: AWS::EC2::VPCGatewayAttachment
23
  Properties:
24
    VpcId: !Ref MyVPC
25
    VpnGatewayId: !Ref VPNGateway
26

27
# VPN Connection
28
VPNConnection:
29
  Type: AWS::EC2::VPNConnection
30
  Properties:
31
    Type: ipsec.1
32
    StaticRoutesOnly: true
33
    CustomerGatewayId: !Ref CustomerGateway
34
    VpnGatewayId: !Ref VPNGateway
35
    Tags:
36
      - Key: Name
37
        Value: Main Office VPN
38

39
# VPN Connection Route
40
VPNConnectionRoute:
41
  Type: AWS::EC2::VPNConnectionRoute
42
  Properties:
43
    VpnConnectionId: !Ref VPNConnection
44
    DestinationCidrBlock: 192.168.0.0/16  # On-premises network

1
# VPC Peering Connection
2
VPCPeeringConnection:
3
  Type: AWS::EC2::VPCPeeringConnection
4
  Properties:
5
    VpcId: !Ref MyVPC
6
    PeerVpcId: !Ref PeerVPC
7
    PeerRegion: !Ref AWS::Region
8
    Tags:
9
      - Key: Name
10
        Value: VPC-Peering-Connection
11

12
# Route for peering in main VPC
13
PeeringRoute:
14
  Type: AWS::EC2::Route
15
  Properties:
16
    RouteTableId: !Ref PrivateRouteTable
17
    DestinationCidrBlock: 10.1.0.0/16  # Peer VPC CIDR
18
    VpcPeeringConnectionId: !Ref VPCPeeringConnection
19

20
# Security group rule to allow peering traffic
21
CrossVPCSecurityGroupRule:
22
  Type: AWS::EC2::SecurityGroupIngress
23
  Properties:
24
    GroupId: !Ref WebServerSecurityGroup
25
    IpProtocol: tcp
26
    FromPort: 80
27
    ToPort: 80
28
    SourceSecurityGroupId: !Ref PeerVPCSecurityGroup
29
    SourceSecurityGroupOwnerId: !Ref AWS::AccountId

1
# Transit Gateway for multiple VPC connectivity
2
TransitGateway:
3
  Type: AWS::EC2::TransitGateway
4
  Properties:
5
    AmazonSideAsn: 64512
6
    Description: Central hub for VPC connectivity
7
    Tags:
8
      - Key: Name
9
        Value: Main Transit Gateway
10

11
# Attach VPC to Transit Gateway
12
TransitGatewayVPCAttachment:
13
  Type: AWS::EC2::TransitGatewayAttachment
14
  Properties:
15
    TransitGatewayId: !Ref TransitGateway
16
    VpcId: !Ref MyVPC
17
    SubnetIds:
18
      - !Ref PrivateSubnet1
19
      - !Ref PrivateSubnet2
20
    Tags:
21
      - Key: Name
22
        Value: MyVPC Attachment
23

24
# Route table for Transit Gateway
25
TransitGatewayRouteTable:
26
  Type: AWS::EC2::TransitGatewayRouteTable
27
  Properties:
28
    TransitGatewayId: !Ref TransitGateway
29
    Tags:
30
      - Key: Name
31
        Value: Main Route Table
32

33
# Route through Transit Gateway
34
TransitGatewayRoute:
35
  Type: AWS::EC2::Route
36
  Properties:
37
    RouteTableId: !Ref PrivateRouteTable
38
    DestinationCidrBlock: 10.0.0.0/8
39
    TransitGatewayId: !Ref TransitGateway

1
# S3 VPC Endpoint (Gateway type)
2
S3VPCEndpoint:
3
  Type: AWS::EC2::VPCEndpoint
4
  Properties:
5
    VpcId: !Ref MyVPC
6
    ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
7
    VpcEndpointType: Gateway
8
    RouteTableIds:
9
      - !Ref PrivateRouteTable
10
    PolicyDocument:
11
      Version: '2012-10-17'
12
      Statement:
13
        - Effect: Allow
14
          Principal: '*'
15
          Action:
16
            - s3:GetObject
17
            - s3:PutObject
18
          Resource:
19
            - 'arn:aws:s3:::my-bucket/*'
20
        - Effect: Allow
21
          Principal: '*'
22
          Action:
23
            - s3:ListBucket
24
          Resource:
25
            - 'arn:aws:s3:::my-bucket'
26

27
# EC2 VPC Endpoint (Interface type)
28
EC2VPCEndpoint:
29
  Type: AWS::EC2::VPCEndpoint
30
  Properties:
31
    VpcId: !Ref MyVPC
32
    ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ec2'
33
    VpcEndpointType: Interface
34
    SubnetIds:
35
      - !Ref PrivateSubnet1
36
      - !Ref PrivateSubnet2
37
    SecurityGroupIds:
38
      - !Ref VPCEndpointSecurityGroup
39
    PrivateDnsEnabled: true
40
    PolicyDocument:
41
      Version: '2012-10-17'
42
      Statement:
43
        - Effect: Allow
44
          Principal: '*'
45
          Action:
46
            - ec2:DescribeInstances
47
            - ec2:DescribeImages
48
            - ec2:DescribeSnapshots
49
          Resource: '*'
50

51
VPCEndpointSecurityGroup:
52
  Type: AWS::EC2::SecurityGroup
53
  Properties:
54
    GroupDescription: Security group for VPC endpoints
55
    VpcId: !Ref MyVPC
56
    SecurityGroupIngress:
57
      - IpProtocol: tcp
58
        FromPort: 443
59
        ToPort: 443
60
        CidrIp: 10.0.0.0/16
61
        Description: HTTPS access from VPC

1
# Custom DHCP Options Set
2
DHCPOptions:
3
  Type: AWS::EC2::DHCPOptions
4
  Properties:
5
    DomainName: !Sub '${AWS::Region}.compute.internal'
6
    DomainNameServers:
7
      - AmazonProvidedDNS
8
    NtpServers:
9
      - 169.254.169.123
10
    NetbiosNameServers:
11
      - 10.0.0.10
12
    NetbiosNodeType: 2
13
    Tags:
14
      - Key: Name
15
        Value: Custom DHCP Options
16

17
DHCPOptionsAssociation:
18
  Type: AWS::EC2::VPCDHCPOptionsAssociation
19
  Properties:
20
    VpcId: !Ref MyVPC
21
    DhcpOptionsId: !Ref DHCPOptions

1
# Network Load Balancer for high performance
2
NetworkLoadBalancer:
3
  Type: AWS::ElasticLoadBalancingV2::LoadBalancer
4
  Properties:
5
    Name: MyNetworkLoadBalancer
6
    Type: network
7
    Scheme: internal
8
    IpAddressType: ipv4
9
    Subnets:
10
      - !Ref PrivateSubnet1
11
      - !Ref PrivateSubnet2
12
    Tags:
13
      - Key: Name
14
        Value: Internal NLB
15

16
NLBTargetGroup:
17
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
18
  Properties:
19
    Name: NLB-Target-Group
20
    Port: 80
21
    Protocol: TCP
22
    VpcId: !Ref MyVPC
23
    HealthCheckProtocol: HTTP
24
    HealthCheckPath: /health
25
    HealthCheckIntervalSeconds: 10
26
    HealthyThresholdCount: 2
27
    UnhealthyThresholdCount: 2
28
    TargetType: instance
29

30
NLBListener:
31
  Type: AWS::ElasticLoadBalancingV2::Listener
32
  Properties:
33
    DefaultActions:
34
      - Type: forward
35
        TargetGroupArn: !Ref NLBTargetGroup
36
    LoadBalancerArn: !Ref NetworkLoadBalancer
37
    Port: 80
38
    Protocol: TCP

1
# Python script to analyze VPC Flow Logs
2
import boto3
3
import json
4
from collections import defaultdict
5

6
def analyze_vpc_flow_logs(log_group_name, start_time, end_time):
7
    """
8
    Analyze VPC Flow Logs to identify traffic patterns
9
    """
10
    logs_client = boto3.client('logs')
11

12
    query = """
13
    fields @timestamp, srcaddr, dstaddr, srcport, dstport, protocol, action, bytes
14
    | filter action = "REJECT"
15
    | stats count() by srcaddr, dstaddr, dstport
16
    | sort count desc
17
    | limit 20
18
    """
19

20
    response = logs_client.start_query(
21
        logGroupName=log_group_name,
22
        startTime=int(start_time.timestamp()),
23
        endTime=int(end_time.timestamp()),
24
        queryString=query
25
    )
26

27
    query_id = response['queryId']
28

29
    # Wait for query completion
30
    while True:
31
        result = logs_client.get_query_results(queryId=query_id)
32
        if result['status'] == 'Complete':
33
            break
34
        time.sleep(1)
35

36
    return result['results']
37

38
# Usage example
39
if __name__ == "__main__":
40
    from datetime import datetime, timedelta
41

42
    end_time = datetime.now()
43
    start_time = end_time - timedelta(hours=1)
44

45
    rejected_traffic = analyze_vpc_flow_logs(
46
        'VPCFlowLogs',
47
        start_time,
48
        end_time
49
    )
50

51
    print("Top rejected traffic patterns:")
52
    for result in rejected_traffic:
53
        print(f"From: {result[0]['value']} To: {result[1]['value']} "
54
              f"Port: {result[2]['value']} Count: {result[3]['value']}")

1
#!/bin/bash
2
# Network connectivity testing script
3

4
VPC_ID="vpc-123456789"
5
INSTANCE_ID="i-123456789"
6

7
echo "=== VPC Network Diagnostics ==="
8

9
# Check VPC configuration
10
echo "1. VPC Configuration:"
11
aws ec2 describe-vpcs --vpc-ids $VPC_ID --query 'Vpcs[0].[VpcId,CidrBlock,State]' --output table
12

13
# Check subnets
14
echo "2. Subnets:"
15
aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC_ID" \
16
  --query 'Subnets[].[SubnetId,CidrBlock,AvailabilityZone,MapPublicIpOnLaunch]' --output table
17

18
# Check route tables
19
echo "3. Route Tables:"
20
aws ec2 describe-route-tables --filters "Name=vpc-id,Values=$VPC_ID" \
21
  --query 'RouteTables[].[RouteTableId,Routes[?State==`active`].[DestinationCidrBlock,GatewayId,NatGatewayId]]' --output table
22

23
# Check security groups
24
echo "4. Security Groups for Instance:"
25
aws ec2 describe-instances --instance-ids $INSTANCE_ID \
26
  --query 'Reservations[0].Instances[0].SecurityGroups[].[GroupId,GroupName]' --output table
27

28
# Check NACLs
29
echo "5. Network ACLs:"
30
SUBNET_ID=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \
31
  --query 'Reservations[0].Instances[0].SubnetId' --output text)
32

33
aws ec2 describe-network-acls --filters "Name=association.subnet-id,Values=$SUBNET_ID" \
34
  --query 'NetworkAcls[0].[NetworkAclId,Entries[?RuleAction==`allow`].[RuleNumber,Protocol,CidrBlock]]' --output table
35

36
# Test connectivity
37
echo "6. Testing Connectivity:"
38
ping -c 3 8.8.8.8
39
nslookup google.com
40
curl -I https://aws.amazon.com

1
import boto3
2
import ipaddress
3
from typing import List, Dict, Tuple
4

5
class VPCValidator:
6
    def __init__(self, vpc_id: str):
7
        self.vpc_id = vpc_id
8
        self.ec2 = boto3.client('ec2')
9

10
    def validate_vpc_configuration(self) -> Dict:
11
        """
12
        Comprehensive VPC configuration validation
13
        """
14
        results = {
15
            'vpc_basics': self._validate_vpc_basics(),
16
            'subnets': self._validate_subnets(),
17
            'routing': self._validate_routing(),
18
            'security': self._validate_security(),
19
            'connectivity': self._validate_connectivity()
20
        }
21

22
        return results
23

24
    def _validate_vpc_basics(self) -> Dict:
25
        """Validate basic VPC configuration"""
26
        try:
27
            vpc = self.ec2.describe_vpcs(VpcIds=[self.vpc_id])['Vpcs'][0]
28

29
            issues = []
30
            recommendations = []
31

32
            # Check DNS resolution
33
            if not vpc.get('EnableDnsSupport', False):
34
                issues.append("DNS support is disabled")
35

36
            if not vpc.get('EnableDnsHostnames', False):
37
                recommendations.append("Consider enabling DNS hostnames")
38

39
            # Check CIDR block size
40
            cidr = ipaddress.IPv4Network(vpc['CidrBlock'])
41
            if cidr.num_addresses < 256:
42
                recommendations.append("Small CIDR block, consider larger range for growth")
43

44
            return {
45
                'status': 'healthy' if not issues else 'issues_found',
46
                'vpc_id': self.vpc_id,
47
                'cidr_block': vpc['CidrBlock'],
48
                'dns_support': vpc.get('EnableDnsSupport', False),
49
                'dns_hostnames': vpc.get('EnableDnsHostnames', False),
50
                'issues': issues,
51
                'recommendations': recommendations
52
            }
53

54
        except Exception as e:
55
            return {'status': 'error', 'message': str(e)}
56

57
    def _validate_subnets(self) -> Dict:
58
        """Validate subnet configuration"""
59
        try:
60
            subnets = self.ec2.describe_subnets(
61
                Filters=[{'Name': 'vpc-id', 'Values': [self.vpc_id]}]
62
            )['Subnets']
63

64
            issues = []
65
            recommendations = []
66

67
            # Check AZ distribution
68
            az_count = len(set(subnet['AvailabilityZone'] for subnet in subnets))
69
            if az_count < 2:
70
                issues.append("Subnets not distributed across multiple AZs")
71

72
            # Check for public/private subnet pairs
73
            public_subnets = [s for s in subnets if s.get('MapPublicIpOnLaunch', False)]
74
            private_subnets = [s for s in subnets if not s.get('MapPublicIpOnLaunch', False)]
75

76
            if len(public_subnets) == 0:
77
                recommendations.append("No public subnets found - may limit internet connectivity")
78

79
            if len(private_subnets) == 0:
80
                recommendations.append("No private subnets found - consider security best practices")
81

82
            return {
83
                'status': 'healthy' if not issues else 'issues_found',
84
                'total_subnets': len(subnets),
85
                'availability_zones': az_count,
86
                'public_subnets': len(public_subnets),
87
                'private_subnets': len(private_subnets),
88
                'issues': issues,
89
                'recommendations': recommendations
90
            }
91

92
        except Exception as e:
93
            return {'status': 'error', 'message': str(e)}
94

95
    def _validate_routing(self) -> Dict:
96
        """Validate routing configuration"""
97
        try:
98
            route_tables = self.ec2.describe_route_tables(
99
                Filters=[{'Name': 'vpc-id', 'Values': [self.vpc_id]}]
100
            )['RouteTables']
101

102
            issues = []
103
            recommendations = []
104

105
            # Check for internet gateway routes
106
            has_igw_route = any(
107
                any(route.get('GatewayId', '').startswith('igw-') for route in rt['Routes'])
108
                for rt in route_tables
109
            )
110

111
            if not has_igw_route:
112
                recommendations.append("No Internet Gateway routes found")
113

114
            # Check for default route
115
            has_default_route = any(
116
                any(route.get('DestinationCidrBlock') == '0.0.0.0/0' for route in rt['Routes'])
117
                for rt in route_tables
118
            )
119

120
            if not has_default_route:
121
                recommendations.append("No default routes found - may affect internet connectivity")
122

123
            return {
124
                'status': 'healthy' if not issues else 'issues_found',
125
                'route_tables_count': len(route_tables),
126
                'has_internet_gateway': has_igw_route,
127
                'has_default_route': has_default_route,
128
                'issues': issues,
129
                'recommendations': recommendations
130
            }
131

132
        except Exception as e:
133
            return {'status': 'error', 'message': str(e)}
134

135
    def _validate_security(self) -> Dict:
136
        """Validate security configuration"""
137
        try:
138
            security_groups = self.ec2.describe_security_groups(
139
                Filters=[{'Name': 'vpc-id', 'Values': [self.vpc_id]}]
140
            )['SecurityGroups']
141

142
            issues = []
143
            recommendations = []
144

145
            # Check for overly permissive rules
146
            for sg in security_groups:
147
                for rule in sg['IpPermissions']:
148
                    for ip_range in rule.get('IpRanges', []):
149
                        if ip_range.get('CidrIp') == '0.0.0.0/0':
150
                            if rule.get('FromPort') == 22:  # SSH
151
                                issues.append(f"SG {sg['GroupId']}: SSH open to 0.0.0.0/0")
152
                            elif rule.get('FromPort') == 3389:  # RDP
153
                                issues.append(f"SG {sg['GroupId']}: RDP open to 0.0.0.0/0")
154
                            elif rule.get('IpProtocol') == '-1':  # All traffic
155
                                issues.append(f"SG {sg['GroupId']}: All traffic open to 0.0.0.0/0")
156

157
            return {
158
                'status': 'healthy' if not issues else 'issues_found',
159
                'security_groups_count': len(security_groups),
160
                'issues': issues,
161
                'recommendations': recommendations
162
            }
163

164
        except Exception as e:
165
            return {'status': 'error', 'message': str(e)}
166

167
    def _validate_connectivity(self) -> Dict:
168
        """Validate connectivity options"""
169
        try:
170
            # Check for NAT Gateways
171
            nat_gateways = self.ec2.describe_nat_gateways(
172
                Filters=[{'Name': 'vpc-id', 'Values': [self.vpc_id]}]
173
            )['NatGateways']
174

175
            # Check for VPN connections
176
            vpn_connections = self.ec2.describe_vpn_connections(
177
                Filters=[{'Name': 'vpc-id', 'Values': [self.vpc_id]}]
178
            )['VpnConnections']
179

180
            # Check for VPC endpoints
181
            vpc_endpoints = self.ec2.describe_vpc_endpoints(
182
                Filters=[{'Name': 'vpc-id', 'Values': [self.vpc_id]}]
183
            )['VpcEndpoints']
184

185
            recommendations = []
186

187
            if len(nat_gateways) == 0:
188
                recommendations.append("No NAT Gateways found - private subnets can't reach internet")
189

190
            if len(vpc_endpoints) == 0:
191
                recommendations.append("No VPC Endpoints found - consider for AWS service access")
192

193
            return {
194
                'status': 'healthy',
195
                'nat_gateways': len(nat_gateways),
196
                'vpn_connections': len(vpn_connections),
197
                'vpc_endpoints': len(vpc_endpoints),
198
                'recommendations': recommendations
199
            }
200

201
        except Exception as e:
202
            return {'status': 'error', 'message': str(e)}
203

204
# Usage example
205
if __name__ == "__main__":
206
    validator = VPCValidator('vpc-123456789')
207
    results = validator.validate_vpc_configuration()
208

209
    print(json.dumps(results, indent=2))

1
# Single NAT Gateway for cost optimization (less HA)
2
# Use NAT Instances for very low traffic scenarios
3
NATInstance:
4
  Type: AWS::EC2::Instance
5
  Properties:
6
    ImageId: ami-00a9d4a05375b2763  # NAT AMI
7
    InstanceType: t3.micro
8
    KeyName: !Ref KeyPairName
9
    SubnetId: !Ref PublicSubnet1
10
    SecurityGroupIds:
11
      - !Ref NATInstanceSecurityGroup
12
    SourceDestCheck: false
13
    Tags:
14
      - Key: Name
15
        Value: NAT Instance
16
    UserData: !Base64
17
      !Sub |
18
        #!/bin/bash
19
        echo 1 > /proc/sys/net/ipv4/ip_forward
20
        /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
21
        /sbin/iptables -F FORWARD

1
def calculate_vpc_endpoint_savings(monthly_data_gb: float,
2
                                 endpoint_hours: int = 744) -> Dict:
3
    """
4
    Calculate potential savings from VPC endpoints vs NAT Gateway
5
    """
6

7
    # NAT Gateway costs (us-east-1)
8
    nat_gateway_hourly = 0.045  # per hour
9
    nat_gateway_data = 0.045   # per GB processed
10

11
    # VPC Endpoint costs (Interface)
12
    vpc_endpoint_hourly = 0.01  # per AZ per hour
13
    vpc_endpoint_data = 0.01   # per GB processed
14

15
    # Calculate monthly costs
16
    nat_cost = (nat_gateway_hourly * endpoint_hours) + (nat_gateway_data * monthly_data_gb)
17
    endpoint_cost = (vpc_endpoint_hourly * endpoint_hours) + (vpc_endpoint_data * monthly_data_gb)
18

19
    savings = nat_cost - endpoint_cost
20

21
    return {
22
        'nat_gateway_cost': round(nat_cost, 2),
23
        'vpc_endpoint_cost': round(endpoint_cost, 2),
24
        'monthly_savings': round(savings, 2),
25
        'annual_savings': round(savings * 12, 2),
26
        'breakeven_gb': round(
27
            (nat_gateway_hourly - vpc_endpoint_hourly) * endpoint_hours /
28
            (vpc_endpoint_data - nat_gateway_data), 2
29
        )
30
    }