The following diagram provides an overview of the resources included in this example. I created a VPC with public subnets, private subnets, and a bastion server in multiple Availability Zones. Each public subnet contains a NAT gateway and a load balancer node. The servers run in the private subnets, are launched and terminated by using an Auto Scaling group, and receive traffic from the load balancer. The servers can connect to the internet by using the NAT gateway. The servers can connect to Amazon S3 by using a gateway VPC endpoint. The bastion server provides secure access to the instances in the private subnets.

• Public Subnets: Contain NAT gateway, load balancer node, and bastion server.
• Private Subnets: Contain servers launched by an Auto Scaling group.
• Connectivity:
  • Servers to Internet: Through NAT gateway.
  • Servers to Amazon S3: Through gateway VPC endpoint.
  • Secure Access: Through bastion server.

When I created this VPC using the Amazon VPC console, a route table was created for the public subnets with local routes and routes to the internet gateway. Additionally, a route table was created for the private subnets with local routes, routes to the NAT gateway, egress-only internet gateway, and gateway VPC endpoint.

Example security group rules for servers and bastion server:

1. I opened the Amazon VPC console at https://console.aws.amazon.com/vpc/.
2. On the dashboard, I chose Create VPC.
3. For Resources to create, I chose VPC and more.

1. For Name tag auto-generation, I entered a name for the VPC.
2. For IPv4 CIDR block, I kept the default suggestion or entered the required CIDR block.
3. If using IPv6, I chose IPv6 CIDR block, Amazon-provided IPv6 CIDR block.

1. For Number of Availability Zones, I chose 2 or more to improve resiliency.
2. For Number of public subnets, I chose 2 or more.
3. For Number of private subnets, I chose 2 or more.
4. For NAT gateways, I chose 1 per AZ.

• I cleared Enable DNS hostnames.

• I chose Create VPC.

• I used Amazon EC2 Auto Scaling to deploy servers in multiple Availability Zones.

1. I created a launch template to specify the EC2 instances configuration.
2. I created an Auto Scaling group.
3. I created a load balancer and attached it to the Auto Scaling group.

1. I launched an EC2 instance to act as the bastion server in one of the public subnets.
2. I ensured the bastion server had a security group that allows SSH access from my IP and access to the private subnet instances.

I launched a simple Python page on the servers deployed in the private subnets.