VPC basics: CIDR, subnets, route tables and the internet gateway

Start as usual:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'

1Do the CIDR maths first

Paste this whole block:

function Get-SubnetInfo([string]$Cidr) {
    $ip, $bits = $Cidr -split '/'
    $size = [math]::Pow(2, 32 - [int]$bits)
    [pscustomobject]@{ Cidr = $Cidr; Addresses = $size; UsableInAws = $size - 5 }
}
'10.20.0.0/16','10.20.1.0/24','10.20.21.0/28' | ForEach-Object { Get-SubnetInfo $_ } | Format-Table

You should see this:

Cidr          Addresses UsableInAws
----          --------- -----------
10.20.0.0/16      65536       65531
10.20.1.0/24        256         251
10.20.21.0/28        16          11

2Create the VPC

Run this:

$vpc = aws ec2 create-vpc --cidr-block 10.20.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=saat-vpc},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=08}]' --query Vpc.VpcId --output text
aws ec2 modify-vpc-attribute --vpc-id $vpc --enable-dns-hostnames Value=true
$vpc

You should see something like this:

vpc-0f1e2d3c4b5a69788

3Create the six subnets

Paste this whole block:

$plan = @(
  @{ Name = 'saat-public-a';  Cidr = '10.20.1.0/24';  Az = 'ap-south-1a' },
  @{ Name = 'saat-public-b';  Cidr = '10.20.2.0/24';  Az = 'ap-south-1b' },
  @{ Name = 'saat-private-a'; Cidr = '10.20.11.0/24'; Az = 'ap-south-1a' },
  @{ Name = 'saat-private-b'; Cidr = '10.20.12.0/24'; Az = 'ap-south-1b' },
  @{ Name = 'saat-db-a';      Cidr = '10.20.21.0/24'; Az = 'ap-south-1a' },
  @{ Name = 'saat-db-b';      Cidr = '10.20.22.0/24'; Az = 'ap-south-1b' }
)
$ids = @{}
foreach ($s in $plan) {
  $ids[$s.Name] = aws ec2 create-subnet --vpc-id $vpc --cidr-block $s.Cidr --availability-zone $s.Az --tag-specifications "ResourceType=subnet,Tags=[{Key=Name,Value=$($s.Name)},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=08}]" --query Subnet.SubnetId --output text
}
$ids

4Add the internet gateway and the public route table

Paste this whole block:

$igw = aws ec2 create-internet-gateway --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=saat-igw},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=08}]' --query InternetGateway.InternetGatewayId --output text
aws ec2 attach-internet-gateway --internet-gateway-id $igw --vpc-id $vpc

$rtPub = aws ec2 create-route-table --vpc-id $vpc --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=saat-rt-public},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=08}]' --query RouteTable.RouteTableId --output text
aws ec2 create-route --route-table-id $rtPub --destination-cidr-block 0.0.0.0/0 --gateway-id $igw
foreach ($n in 'saat-public-a','saat-public-b') {
  aws ec2 associate-route-table --route-table-id $rtPub --subnet-id $ids[$n] | Out-Null
  aws ec2 modify-subnet-attribute --subnet-id $ids[$n] --map-public-ip-on-launch
}

The create-route command should print:

{
    "Return": true
}

5Add the private route table

Paste this whole block:

$rtPriv = aws ec2 create-route-table --vpc-id $vpc --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=saat-rt-private},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=08}]' --query RouteTable.RouteTableId --output text
foreach ($n in 'saat-private-a','saat-private-b','saat-db-a','saat-db-b') {
  aws ec2 associate-route-table --route-table-id $rtPriv --subnet-id $ids[$n] | Out-Null
}

6Check the result

Run this:

aws ec2 describe-subnets --filters "Name=vpc-id,Values=$vpc" --query "Subnets[].[Tags[?Key=='Name']|[0].Value,CidrBlock,AvailabilityZone,MapPublicIpOnLaunch]" --output text | Sort-Object

You should see this:

saat-db-a       10.20.21.0/24   ap-south-1a     False
saat-db-b       10.20.22.0/24   ap-south-1b     False
saat-private-a  10.20.11.0/24   ap-south-1a     False
saat-private-b  10.20.12.0/24   ap-south-1b     False
saat-public-a   10.20.1.0/24    ap-south-1a     True
saat-public-b   10.20.2.0/24    ap-south-1b     True

7Save the IDs for later lessons

Run this:

[pscustomobject]@{
  VpcId = $vpc; IgwId = $igw; RtPublic = $rtPub; RtPrivate = $rtPriv
  PublicA = $ids['saat-public-a'];  PublicB = $ids['saat-public-b']
  PrivateA = $ids['saat-private-a']; PrivateB = $ids['saat-private-b']
  DbA = $ids['saat-db-a'];          DbB = $ids['saat-db-b']
} | ConvertTo-Json | Set-Content C:\aws-lab\saat-vpc.json
Get-Content C:\aws-lab\saat-vpc.json

From now on, any lesson can load the network with $v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json.

✅ Checkpoint: Six subnets exist, only the two public ones say True, the public route table has 0.0.0.0/0 to saat-igw, and saat-vpc.json holds all ten IDs. Don’t delete this VPC; it costs nothing and you need it from Lesson 9 on.