🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🏗️ धडा 12 — Production VPC design: टिकण्यासाठी बांधलेला campus

📍 तुम्ही इथे आहात: 12 पैकी धडा 12 — शेवटचा धडा! · मागचा: lesson-11-troubleshooting

📦 या ब्रँचमध्ये काय आहे

संपूर्ण कोर्स, आणि आराखडा: vpc/demo.py मधले design() 3 AZs × public / app / data मांडते, प्रत्येक AZ ला एक NAT, S3 आणि DynamoDB gateway endpoints आणि flow logs — आणि वाढीसाठी किती जागा उरली ते मोजते.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

आता शाळा असा campus बांधते ज्यात ती वर्षानुवर्षे राहणार आहे. 🏗️

तीन इमारती, प्रत्येकीत तेच तीन wings. एक इमारत बंद पडू शकते; शाळा चालूच राहते.
Public wing मध्ये फक्त स्वागत कक्ष (load balancer) आणि बाजूचे दार (NAT) असते. तिथे कोणतीही विद्यार्थिनी बसत नाही.
App wing मध्ये शिक्षिका असतात. Public पत्ते नाहीत. त्या स्वतःच्याच इमारतीतल्या बाजूच्या दारातून बाहेर जातात — अंगण ओलांडून दुसऱ्या इमारतीच्या दाराकडे कधीच नाही.
Data wing मध्ये परीक्षेच्या प्रश्नपत्रिका असतात. त्याला शहराकडे जाणारा रस्ताच नाही — फक्त संग्रहालयाकडे जाणारा खाजगी बोगदा.
पहिल्या दिवसापासून प्रत्येक desk वर एक नोंदवही.
आणि अजून कुणीच विचार न केलेल्या नव्या wing साठी उरलेली मोकळी जमीन.

🗺️ आकृती

flowchart TB
    igw["🚪 internet gateway"]
    subgraph a["🏢 AZ a"]
        pa["public: ALB · nat-a"] --> aa["app: no public IPs"] --> da["data: no internet route"]
    end
    subgraph b["🏢 AZ b"]
        pb["public: ALB · nat-b"] --> ab["app"] --> db["data"]
    end
    subgraph c["🏢 AZ c"]
        pc["public: ALB · nat-c"] --> ac["app"] --> dc["data"]
    end
    igw --> pa
    igw --> pb
    igw --> pc
    ep["🚇 S3 + DynamoDB gateway endpoints"]
    fl["📓 flow logs on"]
    da -.-> ep

🗺️ रेखाटलेली आवृत्ती + एक lab: https://school-edh.pages.dev/vpc/lesson-diagrams.html#l12

❓ काय

तीन AZs × तीन tiers — नऊ subnets, प्रत्येक tier ची स्वतःची route table:
- public — 0.0.0.0/0 → igw; फक्त load balancers आणि NAT gateways.
- app — 0.0.0.0/0 → the NAT gateway in the same AZ, आणि endpoint routes.
- data — 0.0.0.0/0 route नाही; फक्त endpoint routes.
प्रत्येक AZ ला एक NAT gateway — एक AZ बंद पडला तरी बाकीचे AZs बाहेर जाऊ शकतात, आणि traffic AZs ओलांडत नाही (cross-AZ data ला खर्च लागतो). NAT gateway चा खर्च तासाप्रमाणे आणि प्रति GB (अनेक Regions मध्ये प्रत्येकी साधारण $0.045), म्हणून data च्या आधीच तीन NAT साधारण $100 दरमहा — AZ outage मध्ये टिकण्याची किंमत. NAT शाळा पाहा.
प्रत्येक private route table वर S3 आणि DynamoDB साठी Gateway endpoints — मोफत.
संदर्भाने security groups — ALB SG → app SG → db SG (धडा 06).
संपूर्ण VPC साठी Flow logs चालू (धडा 11).
वाढीसाठी जागा — पहिल्याच दिवशी संपूर्ण range वाटून टाकू नका. तुम्ही नंतर secondary CIDR blocks जोडू शकता (default quota प्रमाणे प्रत्येक VPC ला थोडेच, वाढवता येते); उदाहरणार्थ अनेक EKS clusters pods ना 100.64.0.0/16 सारख्या secondary range मध्ये ठेवतात. नव्या ranges कंपनीच्या आराखड्यातून घ्या (IPAM, धडा 02).
प्रत्येक environment ला एक VPC (बहुतेकदा प्रत्येक account ला): prod आणि dev कधीच एक campus share करत नाहीत. गरज असेल तिथे त्यांना Transit Gateway ने जोडा (धडा 10).

🤔 का

कारण servers नी भरल्यावर VPC बदलणे कठीण असते. आराखडा ठरवतो तुमचा blast radius (एक AZ, एक tier), तुमचे बिल (NAT आणि cross-AZ data), तुमची audit उत्तरे ("database ला internet कडे route नाही") आणि पुढच्या वर्षी तुम्ही कशाशीही जोडू शकाल की नाही.

🔧 कसे (या repo मध्ये)

vpc/demo.py मधले design() plan_subnets(VPC, 20, [...], AZS) बोलावते, नऊ /20 subnets किती पत्ते घेतात त्यांची बेरीज करते, आणि किती उरले ते छापते. धडा 05 मधला lab campus आधीच tier चे नियम पाळतो: rt-data मध्ये फक्त local आणि pl-s3 आहेत. Snippet हे सिद्ध करतो, आणि आराखड्यात overlaps आहेत का ते तपासतो.

🧪 करून पाहा

python3 vpc/demo.py design
python3 - <<'EOF'
import sys, ipaddress; sys.path.insert(0, "vpc"); from network import plan_subnets, overlaps
from demo import campus, VPC, AZS, PL
c = campus()
print("data wing → internet:", c.rts["rt-data"].lookup("93.184.216.34", PL))
print("data wing → S3:      ", c.rts["rt-data"].lookup("52.219.40.10", PL))
plan = plan_subnets(VPC, 20, ["public", "app", "data"], AZS)
print("any overlap in the plan:", any(overlaps(a[2], b[2]) for i, a in enumerate(plan) for b in plan[i+1:]))
print("last planned wing:", plan[-1])
nxt = ipaddress.ip_network("10.20.144.0/20")
print("next free /20:", nxt, "overlaps the plan?", any(overlaps(str(nxt), p[2]) for p in plan))
print("secondary CIDR 100.64.0.0/16 overlaps the campus?", overlaps(VPC, "100.64.0.0/16"))
EOF
python3 vpc/test_vpc.py

✅ तपासा — तुम्हाला काय दिसायला हवे

design हे छापते:

── a production campus: 3 AZs × (public · app · data), one NAT per AZ, S3 + DynamoDB gateway endpoints, flow logs on
   9 subnets use 36,864 of 65,536 addresses — 28,672 left for growth (EKS pods eat addresses fast)
   public: load balancers + NAT only · app: desks, no public IPs · data: databases, no route to the internet at all

तुमचा snippet हे छापतो: data wing → internet: (None, None), data wing → S3: ('pl-s3', 'vpce-s3'), any overlap in the plan: False, last planned wing: ('data', 'ap-south-1c', '10.20.128.0/20'), next free /20: 10.20.144.0/20 overlaps the plan? False आणि secondary CIDR 100.64.0.0/16 overlaps the campus? False. Tests शेवटी 12/12 passed छापतात.

🏁 तुम्ही आत्ताच काय सिद्ध केले

तुम्ही असा campus मांडू शकता जो एखादी इमारत गेली तरी टिकतो, आपला data wing internet पासून दूर ठेवतो, S3 साठी NAT टोल भरत नाही — आणि तरीही पुढच्या wing साठी त्यात जागा आहे.

⚠️ नेहमीच्या चुका

तीन AZs साठी एकच NAT gateway — एका AZ च्या outage ने सगळ्यांचा बाहेरचा मार्ग तुटतो, आणि cross-AZ data चे बिल लागते
"कदाचित लागेल म्हणून" 0.0.0.0/0 → nat असलेला data subnet
S3 gateway endpoint नाही, त्यामुळे backups वर NAT चा प्रति-GB खर्च
पहिल्याच दिवशी संपूर्ण /16 कापून टाकणे — EKS किंवा नव्या tier साठी काहीच उरत नाही
"पैसे वाचवण्यासाठी" dev आणि prod एकाच VPC मध्ये

🏭 प्रत्यक्ष वापरात

बहुतेक teams हे हाताने न बांधता test केलेल्या module मधून बांधतात.

खऱ्या account वर (Terraform आणि AWS credentials लागतात; values उदाहरणादाखल आहेत):

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"                       # pin the version you have tested

  name = "school-prod"
  cidr = "10.20.0.0/16"
  azs  = ["ap-south-1a", "ap-south-1b", "ap-south-1c"]

  public_subnets   = ["10.20.0.0/20",  "10.20.16.0/20", "10.20.32.0/20"]
  private_subnets  = ["10.20.48.0/20", "10.20.64.0/20", "10.20.80.0/20"]
  database_subnets = ["10.20.96.0/20", "10.20.112.0/20", "10.20.128.0/20"]
  create_database_subnet_route_table = true   # data wing: its own table, no NAT route

  enable_nat_gateway     = true
  one_nat_gateway_per_az = true

  enable_flow_log                      = true
  create_flow_log_cloudwatch_log_group = true
  create_flow_log_cloudwatch_iam_role  = true
}

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = module.vpc.vpc_id
  service_name      = "com.amazonaws.ap-south-1.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = concat(module.vpc.private_route_table_ids, module.vpc.database_route_table_ids)
}

मग धडा 11 मधल्या tools ने हे सिद्ध करा: database पासून internet gateway पर्यंतचा Reachability Analyzer path not reachable असाच परत यायला हवा.

🎓 Campus आता तुमचा आहे

कुंपण घातलेला campus → घर नंबर → तीन इमारतींमधले wings → corridor च्या पाट्या → मुख्य दरवाजा → पाहुण्यांच्या याद्या आणि wing ची दारे → संग्रहालयाकडे बोगदा → phone book → भागीदाराकडे corridor → bus station → नोंदवही आणि मार्गावरून चालणे → टिकण्यासाठी बांधलेला campus. तुम्ही फक्त VPC शिकला नाहीत — तुम्ही campus चा आराखडा करू शकता, तो जोडू शकता आणि debug करू शकता. 🏫🎓

शाळेतील पुढची दारे: NAT शाळा private wings ज्यातून बाहेर जातात ते बाजूचे दार बांधते; EC2 शाळा हे wings desks नी भरते; Networking शाळा IP, TCP आणि DNS मध्ये अधिक खोलवर जाते.

git checkout main
python3 vpc/demo.py     # one last run, for fun

🏗️ Lesson 12 — Production VPC design: a campus built to last

📍 You are here: Lesson 12 of 12 — the final lesson! · Previous: lesson-11-troubleshooting

📦 What's in this branch

The complete course, plus the blueprint: design() in vpc/demo.py lays out 3 AZs × public / app / data, one NAT per AZ, S3 and DynamoDB gateway endpoints and flow logs — and counts how much room is left to grow.

🧒 Explain like I'm 5

Now the school builds the campus it will live in for years. 🏗️

Three buildings, the same three wings in each. One building can close; the school keeps going.
The public wing holds only the reception desk (the load balancer) and the side gate (the NAT). No pupil sits there.
The app wing holds the teachers. No public addresses. They go out through the side gate in their own building — never across the yard to another building's gate.
The data wing holds the exam papers. It has no road to the city at all — only the private tunnel to the archive.
A logbook at every desk from day one.
And empty land left over, for the new wing nobody has thought of yet.

🗺️ Diagram

flowchart TB
    igw["🚪 internet gateway"]
    subgraph a["🏢 AZ a"]
        pa["public: ALB · nat-a"] --> aa["app: no public IPs"] --> da["data: no internet route"]
    end
    subgraph b["🏢 AZ b"]
        pb["public: ALB · nat-b"] --> ab["app"] --> db["data"]
    end
    subgraph c["🏢 AZ c"]
        pc["public: ALB · nat-c"] --> ac["app"] --> dc["data"]
    end
    igw --> pa
    igw --> pb
    igw --> pc
    ep["🚇 S3 + DynamoDB gateway endpoints"]
    fl["📓 flow logs on"]
    da -.-> ep

🗺️ Drawn version + a lab: https://school-edh.pages.dev/vpc/lesson-diagrams.html#l12

❓ What

Three AZs × three tiers — nine subnets, each tier with its own route table:
- public — 0.0.0.0/0 → igw; only load balancers and NAT gateways.
- app — 0.0.0.0/0 → the NAT gateway in the same AZ, plus the endpoint routes.
- data — no 0.0.0.0/0 route; endpoint routes only.
One NAT gateway per AZ — if one AZ fails, the other AZs still get out, and traffic does not cross AZs (cross-AZ data is charged). A NAT gateway costs by the hour and per GB (approximately $0.045 each in many Regions), so three are roughly $100 a month before data — the price of surviving an AZ outage. See the NAT school.
Gateway endpoints for S3 and DynamoDB on every private route table — free.
Security groups by reference — ALB SG → app SG → db SG (lesson 06).
Flow logs on for the whole VPC (lesson 11).
Room to grow — do not hand out the whole range on day one. You can also add secondary CIDR blocks later (a small number per VPC by default quota, adjustable); for example many EKS clusters put pods in a secondary range such as 100.64.0.0/16. Take new ranges from the company plan (IPAM, lesson 02).
One VPC per environment (often per account): prod and dev never share a campus. Connect them with a Transit Gateway where needed (lesson 10).

🤔 Why

Because a VPC is hard to change once full of servers. The plan decides your blast radius (one AZ, one tier), your bill (NAT and cross-AZ data), your audit answers ("the database has no route to the internet") and whether you can connect to anything next year.

🔧 How (in this repo)

design() in vpc/demo.py calls plan_subnets(VPC, 20, [...], AZS), adds up the addresses the nine /20 subnets take, and prints what is left. The lab campus from lesson 05 already follows the tier rules: rt-data has only local and pl-s3. The snippet proves it, and checks the plan for overlaps.

🧪 Try it

python3 vpc/demo.py design
python3 - <<'EOF'
import sys, ipaddress; sys.path.insert(0, "vpc"); from network import plan_subnets, overlaps
from demo import campus, VPC, AZS, PL
c = campus()
print("data wing → internet:", c.rts["rt-data"].lookup("93.184.216.34", PL))
print("data wing → S3:      ", c.rts["rt-data"].lookup("52.219.40.10", PL))
plan = plan_subnets(VPC, 20, ["public", "app", "data"], AZS)
print("any overlap in the plan:", any(overlaps(a[2], b[2]) for i, a in enumerate(plan) for b in plan[i+1:]))
print("last planned wing:", plan[-1])
nxt = ipaddress.ip_network("10.20.144.0/20")
print("next free /20:", nxt, "overlaps the plan?", any(overlaps(str(nxt), p[2]) for p in plan))
print("secondary CIDR 100.64.0.0/16 overlaps the campus?", overlaps(VPC, "100.64.0.0/16"))
EOF
python3 vpc/test_vpc.py

✅ Verify — what you should see

design prints:

── a production campus: 3 AZs × (public · app · data), one NAT per AZ, S3 + DynamoDB gateway endpoints, flow logs on
   9 subnets use 36,864 of 65,536 addresses — 28,672 left for growth (EKS pods eat addresses fast)
   public: load balancers + NAT only · app: desks, no public IPs · data: databases, no route to the internet at all

Your snippet prints data wing → internet: (None, None), data wing → S3: ('pl-s3', 'vpce-s3'), any overlap in the plan: False, last planned wing: ('data', 'ap-south-1c', '10.20.128.0/20'), next free /20: 10.20.144.0/20 overlaps the plan? False and secondary CIDR 100.64.0.0/16 overlaps the campus? False. The tests end with 12/12 passed.

🏁 What you just proved

You can lay out a campus that survives a lost building, keeps its data wing off the internet, pays no NAT toll for S3 — and still has room for the next wing.

⚠️ Common mistakes

one NAT gateway for three AZs — one AZ outage cuts everyone's way out, and cross-AZ data is billed
a data subnet with 0.0.0.0/0 → nat "just in case"
no S3 gateway endpoint, so backups pay NAT per-GB charges
the whole /16 carved on day one — nothing left for EKS or a new tier
dev and prod in one VPC "to save money"

🏭 In production

Most teams build this from a tested module rather than by hand.

On a real account (needs Terraform and AWS credentials; values are examples):

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"                       # pin the version you have tested

  name = "school-prod"
  cidr = "10.20.0.0/16"
  azs  = ["ap-south-1a", "ap-south-1b", "ap-south-1c"]

  public_subnets   = ["10.20.0.0/20",  "10.20.16.0/20", "10.20.32.0/20"]
  private_subnets  = ["10.20.48.0/20", "10.20.64.0/20", "10.20.80.0/20"]
  database_subnets = ["10.20.96.0/20", "10.20.112.0/20", "10.20.128.0/20"]
  create_database_subnet_route_table = true   # data wing: its own table, no NAT route

  enable_nat_gateway     = true
  one_nat_gateway_per_az = true

  enable_flow_log                      = true
  create_flow_log_cloudwatch_log_group = true
  create_flow_log_cloudwatch_iam_role  = true
}

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = module.vpc.vpc_id
  service_name      = "com.amazonaws.ap-south-1.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = concat(module.vpc.private_route_table_ids, module.vpc.database_route_table_ids)
}

Then prove it with the tools from lesson 11: a Reachability Analyzer path from a database to the internet gateway should come back not reachable.

🎓 The campus is yours

A fenced campus → house numbers → wings in three buildings → corridor signs → the front gate → guest lists and wing doors → a tunnel to the archive → the phone book → a corridor to the partner → the bus station → the logbook and the walk → a campus built to last. You didn't just learn VPC — you can plan, connect and debug the campus. 🏫🎓

Next doors in the school: the NAT school builds the side gate private wings go out through; the EC2 school fills these wings with desks; the Networking school goes deeper into IP, TCP and DNS.

git checkout main
python3 vpc/demo.py     # one last run, for fun

← Previoustroubleshooting Finished! Take the quiz →check what stuck

This page is the lesson's README from the lesson-12-production-design branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.