通常，在一个VPC中我们会创建3种类型的VPC Subnet：
- Public Subnet
- NAT Subnet
- Private Subnet
由于每个子网必须完全位于一个可用区内，并且不能跨越区域。所以，如果我们需要支持多个AZ就需要在不同的AZ上创建相应的子网。
带单个Public Subnet的 VPC
假设，我们要创建如下的VPC网络：
VPC CIDR： 10.0.0.0/22
VPC Public Subnet A: 10.0.0.0/25
VPC Public Subnet B: 10.0.0.128/25
Internet gateway
An internet gateway enables communication over the internet，If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet。
AWS-VPC-single-public-subnet.png
Cloudformation YAML
Parameters:
Project:
Type: String
VpcCidr:
Type: String
Description: 'VPC CIDR'
PublicSubnetACidr:
Type: String
Description: 'Public-a Subnet CIDR'
PublicSubnetBCidr:
Type: String
Description: 'Public-b Subnet CIDR'
Resources:
########################################
# VPC settings
########################################
VPC:
Type: 'AWS::EC2::VPC'
Properties:
CidrBlock: !Ref VpcCidr
EnableDnsSupport: true
EnableDnsHostnames: true
InstanceTenancy: default
Tags:
- Key: Name
Value: !Ref "AWS::StackName"
########################################
# Internet
########################################
InternetGateway:
Type: 'AWS::EC2::InternetGateway'
Properties:
Tags:
- Key: Name
Value: !Sub "${Project}-internet-gateway"
VPCGatewayAttachment:
Type: 'AWS::EC2::VPCGatewayAttachment'
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
########################################
# Subnets
########################################
PublicSubnetA:
Type: 'AWS::EC2::Subnet'
Properties:
AvailabilityZone: !Select [0, !GetAZs '']
CidrBlock: !Ref PublicSubnetACidr
MapPublicIpOnLaunch: true
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-public-1a"
PublicSubnetB:
Type: 'AWS::EC2::Subnet'
Properties:
AvailabilityZone: !Select [1, !GetAZs '']
CidrBlock: !Ref PublicSubnetBCidr
MapPublicIpOnLaunch: true
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-public-1b"
########################################
# Route
########################################
PublicRouteTable:
Type: 'AWS::EC2::RouteTable'
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-public"
PublicInternetRouteTableEntry:
Type: 'AWS::EC2::Route'
Properties:
GatewayId: !Ref InternetGateway
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: '0.0.0.0/0'
RouteTableAssociationAPublic:
Type: 'AWS::EC2::SubnetRouteTableAssociation'
Properties:
SubnetId: !Ref PublicSubnetA
RouteTableId: !Ref PublicRouteTable
RouteTableAssociationBPublic:
Type: 'AWS::EC2::SubnetRouteTableAssociation'
Properties:
SubnetId: !Ref PublicSubnetB
RouteTableId: !Ref PublicRouteTable
VPC with Public and NAT Subnets
NAT Gateways
You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services but prevent the internet from initiating a connection with those instances.
NAT Gateway Basics
To create a NAT gateway, you must specify the public subnet in which the NAT gateway should reside.
You must also specify an Elastic IP address to associate with the NAT gateway when you create it. The Elastic IP address cannot be changed once you associate it with the NAT Gateway. After you've created a NAT gateway, you must update the route table associated with one or more of your private subnets to point Internet-bound traffic to the NAT gateway. This enables instances in your private subnets to communicate with the internet.
Each NAT gateway is created in a specific Availability Zone and implemented with redundancy in that zone.
Parameters:
Project:
Type: String
VpcCidr:
Type: String
Description: 'VPC CIDR'
PublicSubnetACidr:
Type: String
Description: 'Public-a Subnet CIDR'
PublicSubnetBCidr:
Type: String
Description: 'Public-b Subnet CIDR'
NatSubnetACidr:
Type: String
Description: 'NAT-a Subnet CIDR'
NatSubnetBCidr:
Type: String
Description: 'NAT-b Subnet CIDR'
Resources:
########################################
# VPC settings
########################################
VPC:
Type: 'AWS::EC2::VPC'
Properties:
CidrBlock: !Ref VpcCidr
EnableDnsSupport: true
EnableDnsHostnames: true
InstanceTenancy: default
Tags:
- Key: Name
Value: !Ref "AWS::StackName"
########################################
# Internet
########################################
InternetGateway:
Type: 'AWS::EC2::InternetGateway'
Properties:
Tags:
- Key: Name
Value: !Sub "${Project}-internet-gateway"
VPCGatewayAttachment:
Type: 'AWS::EC2::VPCGatewayAttachment'
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
########################################
# Subnets
########################################
PublicSubnetA:
Type: 'AWS::EC2::Subnet'
Properties:
AvailabilityZone: !Select [0, !GetAZs '']
CidrBlock: !Ref PublicSubnetACidr
MapPublicIpOnLaunch: true
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-public-1a"
PublicSubnetB:
Type: 'AWS::EC2::Subnet'
Properties:
AvailabilityZone: !Select [1, !GetAZs '']
CidrBlock: !Ref PublicSubnetBCidr
MapPublicIpOnLaunch: true
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-public-1b"
NatSubnetA:
Type: 'AWS::EC2::Subnet'
Properties:
AvailabilityZone: !Select [0, !GetAZs '']
CidrBlock: !Ref NatSubnetACidr
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-nat-1a"
NatSubnetB:
Type: 'AWS::EC2::Subnet'
Properties:
AvailabilityZone: !Select [1, !GetAZs '']
CidrBlock: !Ref NatSubnetBCidr
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-nat-1b"
########################################
# NAT Gateways
########################################
NatAEIP:
Type: 'AWS::EC2::EIP'
Properties:
Domain: vpc
NatGatewayA:
Type: 'AWS::EC2::NatGateway'
Properties:
AllocationId: !GetAtt 'NatAEIP.AllocationId'
SubnetId: !Ref PublicSubnetA
Tags:
- Key: Name
Value: !Sub "${Project}-nat-gateway-a"
NatBEIP:
Type: 'AWS::EC2::EIP'
Properties:
Domain: vpc
NatGatewayB:
Type: 'AWS::EC2::NatGateway'
Properties:
AllocationId: !GetAtt 'NatBEIP.AllocationId'
SubnetId: !Ref PublicSubnetB
Tags:
- Key: Name
Value: !Sub "${Project}-nat-gateway-b"
########################################
# Route
########################################
PublicRouteTable:
Type: 'AWS::EC2::RouteTable'
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-public"
PublicInternetRouteTableEntry:
Type: 'AWS::EC2::Route'
Properties:
GatewayId: !Ref InternetGateway
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: '0.0.0.0/0'
RouteTableAssociationAPublic:
Type: 'AWS::EC2::SubnetRouteTableAssociation'
Properties:
SubnetId: !Ref PublicSubnetA
RouteTableId: !Ref PublicRouteTable
RouteTableAssociationBPublic:
Type: 'AWS::EC2::SubnetRouteTableAssociation'
Properties:
SubnetId: !Ref PublicSubnetB
RouteTableId: !Ref PublicRouteTable
NatRouteTableA:
Type: 'AWS::EC2::RouteTable'
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-nat-a"
NatRouteTableAEntry:
Type: 'AWS::EC2::Route'
Properties:
NatGatewayId: !Ref NatGatewayA
RouteTableId: !Ref NatRouteTableA
DestinationCidrBlock: '0.0.0.0/0'
NatRouteTableB:
Type: 'AWS::EC2::RouteTable'
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub "${Project}-nat-b"
NatRouteTableBEntry:
Type: 'AWS::EC2::Route'
Properties:
NatGatewayId: !Ref NatGatewayB
RouteTableId: !Ref NatRouteTableB
DestinationCidrBlock: '0.0.0.0/0'
RouteTableAssociationNatA:
Type: 'AWS::EC2::SubnetRouteTableAssociation'
Properties:
SubnetId: !Ref NatSubnetA
RouteTableId: !Ref NatRouteTableA
RouteTableAssociationNatB:
Type: 'AWS::EC2::SubnetRouteTableAssociation'
Properties:
SubnetId: !Ref NatSubnetB
RouteTableId: !Ref NatRouteTableB