Lesson 11 — Enterprise Build Project

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 04 – Amazon VPC & Network Security

🎯 Project Objective

Congratulations!

You have completed the networking lessons of this module.

Now it’s time to work as a Cloud Security Engineer.

Your task is to build CloudNova Technologies’ production AWS network exactly as you would in a real organisation.

This project combines everything you’ve learned throughout this module into a single enterprise deployment.

📚 Project Information

Item	Details
Estimated Time	5–8 Hours
Difficulty	Intermediate
Project Type	Enterprise Infrastructure Build
Delivery	Documentation + AWS Environment
Hands-on	Yes

💼 Business Scenario

CloudNova Technologies is launching a new online learning platform.

Expected users:

100,000+ students
Multiple instructors
Secure payment gateway
Video streaming
REST APIs
AI-powered learning features

Business Requirements

High Availability
Scalability
Secure Network Design
Private Databases
AWS Best Practices
Future Expansion
Disaster Recovery Ready

You have been assigned as the Cloud Security Engineer responsible for delivering the networking infrastructure.

📋 Project Scope

You are required to design and deploy:

✅ Amazon VPC

✅ Public Subnets

✅ Private Application Subnets

✅ Private Database Subnets

✅ Route Tables

✅ Internet Gateway

✅ NAT Gateway

✅ Security Groups

✅ Network ACLs

✅ Amazon S3 Gateway Endpoint

✅ Systems Manager Interface Endpoint

✅ Enterprise Documentation

🏗 Target Architecture

                           Internet
                               │
                     Internet Gateway
                               │
        ┌──────────────────────┴──────────────────────┐
        │                                             │
 Public Subnet A                              Public Subnet B
        │                                             │
        └──────────── Application Load Balancer ──────┘
                               │
               ┌───────────────┴───────────────┐
               │                               │
       Private App A                   Private App B
               │                               │
        EC2 / Containers                EC2 / Containers
               │                               │
               └───────────────┬───────────────┘
                               │
                Private Database Subnets
                               │
                      Amazon RDS Multi-AZ
                               │
                     Amazon S3 Gateway Endpoint

────────────────────────────────────────────────────

Monitoring

CloudWatch

CloudTrail

VPC Flow Logs

Systems Manager

Secrets Manager

📁 Project Deliverables

At the end of this project you should have:

AWS Environment
Architecture Diagram
Network Documentation
Screenshots
CLI Outputs
Validation Report

🛠 Phase 1 — Build the VPC

Objective

Create the production VPC.

Console

Navigate to

AWS Console

↓

VPC

↓

Create VPC

Configuration

Setting	Value
Name	CloudNova-Prod-VPC
CIDR	10.10.0.0/16

AWS CLI

aws ec2 create-vpc \
    --cidr-block 10.10.0.0/16

Tag it

aws ec2 create-tags \
    --resources vpc-xxxxxxxx \
    --tags Key=Name,Value=CloudNova-Prod-VPC

🛠 Phase 2 — Build Subnets

Create:

Public-A

10.10.1.0/24

Public-B

10.10.2.0/24

Private-App-A

10.10.10.0/24

Private-App-B

10.10.11.0/24

Private-DB-A

10.10.20.0/24

Private-DB-B

10.10.21.0/24

Use both the AWS Console and AWS CLI where appropriate.

🛠 Phase 3 — Configure Routing

Create

Public Route Table
Private Route Table

Configure

Public

0.0.0.0/0

↓

Internet Gateway

Private

0.0.0.0/0

↓

NAT Gateway

Associate each subnet with the correct Route Table.

🛠 Phase 4 — Internet Connectivity

Deploy

Internet Gateway
Elastic IP
NAT Gateway

Verify:

Public subnet has Internet access.
Private subnet has outbound-only Internet access.

🛠 Phase 5 — Security Controls

Create:

ALB-SG
Web-SG
App-SG
DB-SG
Bastion-SG

Apply the Principle of Least Privilege.

Configure Network ACLs:

Public-NACL
App-NACL
DB-NACL

Associate each with the appropriate subnet.

🛠 Phase 6 — Private AWS Connectivity

Create:

Amazon S3 Gateway Endpoint
AWS Systems Manager Interface Endpoint

Verify that:

S3 traffic remains private.
Systems Manager works without public Internet access.

🛠 Phase 7 — Validation

Run the following commands and capture the output.

aws ec2 describe-vpcs

aws ec2 describe-subnets

aws ec2 describe-route-tables

aws ec2 describe-security-groups

aws ec2 describe-network-acls

aws ec2 describe-internet-gateways

aws ec2 describe-nat-gateways

aws ec2 describe-vpc-endpoints

aws ec2 describe-flow-logs

Store the outputs as project evidence.

📸 Evidence Collection

Capture screenshots of:

VPC Dashboard
Subnets
Route Tables
Internet Gateway
NAT Gateway
Security Groups
Network ACLs
VPC Endpoints
EC2 Networking
AWS CLI outputs

Organise the screenshots in an evidence/ folder.

📄 Project Documentation

Create the following documents in your project repository.

enterprise-vpc-project/

├── README.md
├── architecture.md
├── network-design.md
├── security-design.md
├── routing.md
├── validation-report.md
├── evidence/
└── diagrams/

Each document should explain the design decisions, security controls and validation performed.

✅ Production Readiness Checklist

Item	Status
VPC created	☐
Public Subnets	☐
Private App Subnets	☐
Private DB Subnets	☐
Internet Gateway	☐
NAT Gateway	☐
Route Tables	☐
Security Groups	☐
Network ACLs	☐
VPC Endpoints	☐
Multi-AZ design	☐
Resource tags	☐
Documentation completed	☐
Validation completed	☐

🧪 Challenge Tasks

After completing the core project, enhance the architecture by implementing:

Enable VPC Flow Logs.
Enable CloudTrail.
Enable GuardDuty.
Enable AWS Config.
Create an additional private subnet in a third Availability Zone.
Apply consistent resource tags (Environment, Project, Owner, CostCentre).
Estimate monthly costs using AWS Pricing Calculator.

🏢 Real-World Review

Imagine presenting this project to the CloudNova Architecture Review Board.

Be prepared to explain:

Why did you choose this CIDR range?
Why are databases isolated?
Why are multiple Availability Zones used?
Why does the application use a NAT Gateway?
Why are VPC Endpoints configured?
How does the architecture reduce the attack surface?
What improvements would you recommend as the platform scales?

These are the types of questions Cloud Security Engineers answer during design and security reviews.

🏆 Project Completion

Congratulations!

You have successfully designed and deployed a production-style AWS networking environment.

You have demonstrated practical experience with:

Amazon VPC
Multi-AZ networking
Public and Private Subnets
Route Tables
Internet Gateway
NAT Gateway
Security Groups
Network ACLs
VPC Endpoints
AWS PrivateLink
Enterprise network design
Infrastructure validation
Technical documentation

This project represents the type of work performed by Cloud Engineers, Cloud Architects and Cloud Security Engineers in enterprise AWS environments.

🚀 Next Lesson

➡️ Lesson 12 — Module Review