Private subnets, NAT gateway and VPC endpoints

Start as usual and load the network IDs:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Give the database subnets their own route table

Paste this whole block:

$rtDb = aws ec2 create-route-table --vpc-id $v.VpcId --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=saat-rt-db},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=09}]' --query RouteTable.RouteTableId --output text
foreach ($s in $v.DbA, $v.DbB) {
  $assoc = aws ec2 describe-route-tables --filters "Name=association.subnet-id,Values=$s" --query "RouteTables[0].Associations[?SubnetId=='$s'].RouteTableAssociationId" --output text
  aws ec2 replace-route-table-association --association-id $assoc --route-table-id $rtDb | Out-Null
}
$v | Add-Member -NotePropertyName RtDb -NotePropertyValue $rtDb -Force
$v | ConvertTo-Json | Set-Content C:\aws-lab\saat-vpc.json
$rtDb

You should see something like this:

rtb-0c9d8e7f6a5b4c3d2

2Create a security group for CloudShell

Run this (it has no inbound rules and allows all outbound traffic):

$sgCs = aws ec2 create-security-group --group-name saat-cloudshell-sg --description "CloudShell VPC environment" --vpc-id $v.VpcId --tag-specifications 'ResourceType=security-group,Tags=[{Key=Name,Value=saat-cloudshell-sg},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=09}]' --query GroupId --output text
$v | Add-Member -NotePropertyName CloudShellSg -NotePropertyValue $sgCs -Force
$v | ConvertTo-Json | Set-Content C:\aws-lab\saat-vpc.json

3Open CloudShell inside the private subnet

In the console (Mumbai), open CloudShell. Choose the + menu, then Create VPC environment. Name it saat-private, choose saat-vpc, subnet saat-private-a and security group saat-cloudshell-sg.

A VPC environment has no saved home folder, so anything you create in it disappears when you close it.

Type this at the CloudShell prompt:

curl -m 5 https://checkip.amazonaws.com

You’ll get this error (something like this):

curl: (28) Connection timed out after 5001 milliseconds

That is correct: the private subnet has no route out yet.

4Create the NAT gateway (the clock starts now)

Back in PowerShell, paste this whole block. The wait line takes one to three minutes:

$eip = aws ec2 allocate-address --domain vpc --tag-specifications 'ResourceType=elastic-ip,Tags=[{Key=Name,Value=saat-nat-eip},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=09}]' --query AllocationId --output text
$nat = aws ec2 create-nat-gateway --subnet-id $v.PublicA --allocation-id $eip --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=saat-nat-a},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=09}]' --query NatGateway.NatGatewayId --output text
aws ec2 wait nat-gateway-available --nat-gateway-ids $nat
aws ec2 create-route --route-table-id $v.RtPrivate --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $nat
aws ec2 describe-addresses --allocation-ids $eip --query 'Addresses[0].PublicIp' --output text

You should see something like this:

{
    "Return": true
}
13.204.88.142

5Test again from CloudShell

In the CloudShell VPC environment, run:

curl -m 5 https://checkip.amazonaws.com
aws sts get-caller-identity --query Arn --output text

You should see something like this:

13.204.88.142
arn:aws:iam::123456789012:user/yourname.admin

The address the internet sees is the NAT gateway’s Elastic IP, not anything inside your VPC. The CLI works too, because it can now reach the STS endpoint.

6Add the S3 gateway endpoint (no charge, keep it)

Paste this whole block in PowerShell:

$vpce = aws ec2 create-vpc-endpoint --vpc-id $v.VpcId --vpc-endpoint-type Gateway --service-name com.amazonaws.ap-south-1.s3 --route-table-ids $v.RtPrivate $rtDb --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=saat-s3-endpoint},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=09}]' --query VpcEndpoint.VpcEndpointId --output text
aws ec2 describe-route-tables --route-table-ids $rtDb --query "RouteTables[].Routes[].[DestinationPrefixListId,GatewayId]" --output text

You should see something like this:

None    local
pl-78a54011     vpce-0f9e8d7c6b5a43210

The pl- route sends S3 traffic straight to S3 from both private route tables.

7Clean up the NAT gateway

Do this through the Break It lab below: it shows what happens when cleanup is done in the wrong order, then finishes it properly. Close the CloudShell VPC environment now (Actions, then Delete).

✅ Checkpoint: CloudShell in the private subnet timed out before the NAT and showed the Elastic IP after it, saat-rt-db has no internet route, and the S3 endpoint appears as a pl- route.