The first step is to logically partition the VPC into separate subnets based on our requirements. Next we apply security groups (firewalls) to each of the subnets to accept connections on fixed TCP ports (from predefined subnets). The main purpose of having separate subnets is to secure the hosts by restricting access to them. For example, we host the RDS MYSQL database server in a private subnet that accepts connections on port 3306 only. This access is restricted to be from two public subnets. The VPC and the subnets created within the VPC are listed here:
- Subnet at 172.31.112.0/20 that hosts the bastion host and accepts SSH connection from trusted sources only.
- Public subnets hosting the EC2 instances in the auto-scaling group ...
