Deploy a Web Server with Custom AWS Networking

Build a custom VPC, configure routing, and launch an Apache web server on EC2.

Introduction

30 Second Summary

Every website you visit lives on a server connected to a network. In your IT career, you have seen how routers, switches, and firewalls work together to move traffic. The cloud uses the same concepts, just built with software instead of hardware.

In this project, you will build a cloud network from scratch on AWS, launch a Linux server inside it, and deploy a custom web page visible to anyone on the internet.

What You'll Build

A fully functional cloud network built component by component, with a running web server that proves your infrastructure works.

By the end of this project, you'll have:

  • A custom Virtual Private Cloud (VPC) with subnets, an internet gateway, and route tables configured from scratch.
  • A running EC2 instance serving a live web page accessible from anywhere on the internet.
  • Hands-on experience mapping physical networking concepts (subnets, firewalls, routing) to their AWS cloud equivalents.
  • Secret Mission: Add a private subnet and prove network isolation by demonstrating why instances without internet routes cannot reach the outside world.

Are there any prerequisites?

You should be comfortable with basic networking concepts like IP addresses, ports, and firewalls. You should also be comfortable using a terminal or command line. No cloud experience is needed.

Before We Start

Before We Start...

Create Your AWS Account

Before you can build anything in the cloud, you need access to the cloud itself. AWS is the world's largest cloud platform, and its Free Tier lets you experiment without spending a cent.

In this step, you will create your AWS account, sign into the Management Console, and confirm that your computer has the tools needed to connect to cloud servers later in the project.

In this step, get ready to:
  • Create an AWS Free Tier account.
  • Sign in to the AWS Management Console and select a Region.
  • Verify that your Windows PC has an SSH client ready to use.
Sign up for AWS Free Tier

AWS requires an account before you can create any cloud resources. The Free Tier gives you credits to use services like EC2 at no cost for 6 months.

  • Open your web browser and navigate to https://aws.amazon.com/free/.
  • Click Create a Free Account.
  • Select the Free account plan.
  • Enter your email address and set a root user password.
  • Fill in your contact information.
  • Enter a credit or debit card when prompted.
  • Verify your identity via SMS or voice call.
  • Choose Basic Support (free) and complete the sign-up.
  • Wait for the activation email. This usually arrives within a few minutes but can take up to 24 hours.

Will I be charged?

No. AWS requires a card on file but will not charge you for anything in this project. Accounts created after July 15, 2025 receive $100 in signup credits plus up to $100 in additional credits, valid for 6 months.

The card is only charged if you exceed the Free Tier limits, which you will not do by following this project.

Haven't received the activation email?

Check your spam or junk folder. Activation usually completes in a few minutes, but AWS notes it can occasionally take up to 24 hours. You cannot proceed until your account is active.

Help me troubleshoot my AWS account activation

Sign in and select a Region

Every AWS resource you create lives in a specific Region. Choosing one close to you reduces latency and keeps all your resources in one place.

  • Navigate to https://console.aws.amazon.com/.
  • Select Root user, enter your email address, and click Next.
  • Enter your password and click Sign in.
  • Look at the top-right corner of the navigation bar. You will see a Region name (e.g., Ohio).
  • Click the Region name and select a Region close to you. For example, choose US East (N. Virginia) us-east-1 if you are in the eastern United States.

Why does the Region matter?

All resources you create (VPCs, subnets, EC2 instances) will live in the Region you select. If you switch Regions later, you will not see your previously created resources because they only exist in the original Region.

Verify SSH client availability

Later in this project, you will use SSH to connect to your cloud server from your local machine. Windows 10 and 11 include an OpenSSH client as an optional feature, and it is often already enabled.

  • Press the Windows key to open your search bar.
  • Type PowerShell and press Enter to open it.
  • Check if SSH is available by running this command:
ssh

You should see usage information listing options like [-l login_name] and [-p port].

✔️ I see usage information

OpenSSH is already installed and ready. You are all set to move on.

ⓧ Command not recognized

OpenSSH Client is not enabled yet. Follow these steps to install it:

  • Press the Windows key and type Optional Features.
  • Select Optional Features from the search results.
  • Click Add a feature (or View features on newer Windows versions) at the top of the page.
  • Search for OpenSSH Client.
  • Select it and click Install (or Add).
  • Wait for the installation to complete, then close and reopen PowerShell.
  • Type ssh and press Enter again to confirm it now shows usage information.

Still not working after install?

Make sure you fully closed and reopened PowerShell after the installation completed. If the command is still not recognized, restart your PC and try again.

Help me get OpenSSH working on my Windows machine

What is SSH?

SSH (Secure Shell) is a protocol that lets you securely connect to and control a remote computer over a network. Think of it like a remote control for servers.

You will use SSH in a later step to log into your EC2 instance and install the web server software.

Your AWS account is active, your Region is set, and your SSH client is confirmed working. Next up, you will build your custom VPC and design the network that your web server will live inside.

Build Your Custom VPC and Networking

Your AWS account is ready to go. Now it's time to build the network infrastructure that your web server will live inside.

In the physical world, you'd set up a router, assign IP ranges, and cable devices into switch ports. In AWS, you do the same thing virtually by creating a Virtual Private Cloud. A VPC is your own isolated section of the AWS cloud where you control the networking rules.

In this step, get ready to:
  • Create a custom VPC with its own IP address range.
  • Create a public subnet inside the VPC.
  • Create and attach an Internet Gateway for internet access.
Create a VPC

A VPC gives you a logically isolated network with its own IP address range. Think of it as your own private data center inside AWS.

  • In the AWS Management Console, click the search bar at the top and type VPC.
  • Select VPC from the results to open the VPC dashboard.
  • Click Create VPC.
  • Select VPC only (you will create subnets manually to understand each component).
  • In the Name tag field, enter my-web-vpc.
  • In the IPv4 CIDR block field, enter 10.0.0.0/16.
  • Leave IPv6 CIDR block and Tenancy as their defaults.
  • Click Create VPC.

What is a CIDR block?

A CIDR block defines the range of IP addresses available in your network. 10.0.0.0/16 gives you 65,536 IP addresses to work with.

The /16 part is like saying "the first 16 bits are fixed, and the rest are yours to assign." This is the same notation used in physical network configuration.

You should see a green success banner confirming your VPC was created.

Don't see the success banner?

Make sure you selected VPC only and not VPC and more. The "VPC and more" option auto-creates subnets and gateways, which skips the learning we want.

Also check that your CIDR block is exactly 10.0.0.0/16 with no extra spaces.

Help me troubleshoot my VPC creation

Create a public subnet

A subnet is a smaller segment within your VPC. It's like a VLAN in physical networking. You'll create one subnet where your web server will live.

  • In the VPC dashboard left menu, click Subnets.
  • Click Create subnet.
  • In the VPC ID dropdown, select my-web-vpc.
  • In the Subnet name field, enter my-public-subnet.
  • In the Availability Zone dropdown, select the first option listed.
  • In the IPv4 subnet CIDR block field, enter 10.0.1.0/24.
  • Click Create subnet.

Why 10.0.1.0/24?

This carves out 256 addresses from your larger /16 block. The 10.0.1.0/24 range sits inside 10.0.0.0/16 like a room inside a building.

Later, the Secret Mission uses 10.0.2.0/24 for a second subnet. Keeping subnet CIDRs sequential makes your network easy to understand.

You should see your new subnet listed. Now you need to enable auto-assign public IP so that any instance launched in this subnet gets a public address.

  • Select the checkbox next to my-public-subnet.
  • Click the Actions dropdown, then choose Edit subnet settings.
  • Check the box for Enable auto-assign public IPv4 address.
  • Click Save.

Why enable auto-assign public IP?

By default, subnets in a custom VPC do not assign public IP addresses to instances. Without a public IP, your web server would have no way for internet users to reach it.

Enabling this setting means every instance you launch in this subnet automatically gets a public address.

Don't see your VPC in the dropdown?

Make sure you're in the same Region you selected in Step 1. Check the Region selector in the top-right corner of the console. Your VPC only exists in the Region where you created it.

Help me find my VPC when creating a subnet

Create and attach an Internet Gateway

An Internet Gateway is the door between your VPC and the public internet. Without it, nothing inside your VPC can communicate with the outside world. Think of it as the edge router in a physical network.

  • In the VPC dashboard left menu, click Internet gateways.
  • Click Create internet gateway.
  • In the Name tag field, enter my-web-igw.
  • Click Create internet gateway.

After creation, you land on the internet gateway details page. Now you need to attach it to your VPC.

  • Click the Actions dropdown at the top right.
  • Choose Attach to VPC.
  • In the Available VPCs dropdown, select my-web-vpc.
  • Click Attach internet gateway.

You should see the State column change to Attached with a green indicator.

Why is attaching a separate step?

Creating an internet gateway and attaching it are two separate actions in AWS. This mirrors real networking where you install an edge router (create) and then cable it into your network (attach).

An unattached internet gateway does nothing. It only works once it's connected to a specific VPC.

Can't attach the gateway?

Each VPC can only have one internet gateway attached at a time. If you see an error, check whether a different gateway is already attached to my-web-vpc.

Help me attach my internet gateway to my VPC

Your network foundation is in place. You have an isolated VPC, a subnet for your server, and a gateway connecting it all to the internet. Next up, you'll configure routing and security rules to control how traffic flows through this network.

Configure Routing and Security

Your VPC has its building blocks in place. You have an isolated network, a subnet inside it, and an internet gateway attached. But attaching a gateway alone does not let traffic flow.

Think of it this way: you installed a front door on your building, but nobody has directions to reach it. In this step, you will create routing rules that tell traffic where to go and firewall rules that control who gets in.

In this step, get ready to:
  • Create a route table that directs internet traffic through your gateway.
  • Create a security group that acts as a virtual firewall for your future server.
  • Map your cloud components to their physical networking equivalents.
Create a route table and add an internet route

A route table contains rules that determine where network traffic is directed. Without a route pointing to your internet gateway, your subnet stays isolated from the outside world.

  • In the VPC dashboard left menu, click Route tables.
  • Click Create route table.
  • Enter my-public-rt in the Name field.
  • In the VPC dropdown, select my-web-vpc.
  • Click Create route table.

Your route table exists, but it only has a local route. You need to add a route that sends internet-bound traffic to your gateway.

  • Select your new my-public-rt route table.
  • Click the Routes tab in the details panel below.
  • Click Edit routes.
  • Click Add route.
  • In the Destination field, enter 0.0.0.0/0.
  • In the Target dropdown, select Internet Gateway, then pick my-web-igw.
  • Click Save changes.

What does 0.0.0.0/0 mean?

The destination 0.0.0.0/0 means "all IP addresses." This is a catch-all route. Any traffic that does not match the local VPC range (10.0.0.0/16) gets sent to your internet gateway instead.

Adding this route is what makes a subnet "public." Without it, instances in the subnet have no path to reach the internet.

The route exists, but your subnet is not using this route table yet. You need to associate the subnet with it.

  • Click the Subnet associations tab.
  • Click Edit subnet associations.
  • Select the checkbox next to my-public-subnet.
  • Click Save associations.

Don't see your subnet in the list?

Make sure you selected my-web-vpc when creating the route table. A route table in a different VPC will not show subnets from my-web-vpc.

help me troubleshoot my route table subnet association

Create a security group

A security group acts as a virtual firewall for your instances. It controls which traffic is allowed in (inbound rules) and out (outbound rules). You need to allow SSH so you can connect to your server, and HTTP so the world can see your web page.

  • In the left menu, click Security groups.
  • Click Create security group.
  • Enter my-web-sg in the Security group name field.
  • Enter Allow SSH and HTTP traffic in the Description field.
  • In the VPC dropdown, remove the default VPC and select my-web-vpc.

Now add the inbound rules that control who can reach your server.

  • Under Inbound rules, click Add rule.
  • For the first rule, set Type to SSH.
  • Set Source to My IP. This auto-fills your current IP address.
  • Click Add rule again to add a second rule.
  • For the second rule, set Type to HTTP.
  • Set Source to Anywhere-IPv4 (0.0.0.0/0).
  • Leave the outbound rules as the default (all traffic allowed).
  • Click Create security group.

Why My IP for SSH but Anywhere for HTTP?

SSH gives full command-line access to your server. Restricting it to your IP means only you can connect. If you opened SSH to the world, anyone could attempt to log in.

HTTP is your web server's public content. The whole point is for anyone on the internet to view your web page, so you allow all IPs.

Your IP might change

If your ISP assigns dynamic IP addresses, your IP may change when you restart your router. If you cannot SSH later, return to this security group and update the SSH inbound rule to your new IP.

Seeing an error when creating the security group?

Check that you selected my-web-vpc in the VPC field. The default VPC is pre-selected, and you need to remove it first before selecting yours.

help me troubleshoot security group creation in AWS

Understand what you just built

Take a moment to see how every component you have created maps to physical networking equipment you already know.

  • VPC = your office network. An isolated environment where all your resources live.
  • Subnet = a VLAN. A segment within your network that groups resources together.
  • Internet Gateway = your edge router. The single point that connects your private network to the public internet.
  • Route Table = your routing table. Directions that tell traffic where to go next.
  • Security Group = your firewall ACLs. Rules that permit or deny traffic based on port and source.

Why are security groups stateful?

AWS security groups are stateful. This means if you allow an inbound request, the response is automatically allowed out. You do not need to create a matching outbound rule for every inbound rule.

Physical firewalls often require separate rules in each direction. Stateful security groups save you that extra configuration.

Your network is fully configured. Traffic has a path to the internet and firewall rules are in place. Next up, you will launch an actual server inside this network and connect to it.

Launch Your EC2 Instance

Your custom network is fully wired. You have a VPC, a public subnet, an internet gateway, a route table, and a security group all working together.

Now it is time to put something inside that network. In this step, you will launch an EC2 instance (a virtual server) running Amazon Linux 2023 and place it inside the public subnet you built.

In this step, get ready to:
  • Create an SSH key pair for secure remote access.
  • Launch an EC2 instance inside your custom VPC.
  • Verify the instance is running and note its public IP address.
Launch the instance

The EC2 launch wizard walks you through selecting an operating system, instance size, key pair, and network settings all in one page.

  • In the AWS Console top search bar, type EC2 and select the EC2 service from the results.
  • Click Launch instance.
  • Under Name and tags, enter my-web-server as the name.
  • Under Application and OS Images (AMI), confirm that Amazon Linux 2023 AMI is selected. It is marked Free tier eligible.
  • Under Instance type, select t3.micro (also marked Free tier eligible).

What is an AMI?

An AMI (Amazon Machine Image) is a pre-built template that contains the operating system and software for your virtual server. Think of it as a ready-to-go hard drive image.

Amazon Linux 2023 is maintained by AWS and comes with tools optimised for the cloud. The t3.micro instance type gives you 2 vCPUs and 1 GiB of memory, plenty for a small web server.

Next, you will create a key pair. This is how you securely connect to your server over SSH without a password.

  • Under Key pair (login), click Create new key pair.
  • Enter my-web-key as the Key pair name.
  • For Key pair type, select RSA.
  • For Private key file format, select .pem.
  • Click Create key pair.

Where did the .pem file go?

The .pem file downloads automatically to your Downloads folder (e.g., C:\Users\YourName\Downloads\my-web-key.pem). Keep this file safe. You will need it to SSH into your server in the next step.

If you lose this file, there is no way to download it again. You would have to create a new key pair.

Now configure the network settings so your instance launches inside the VPC and subnet you built earlier.

  • Under Network settings, click Edit.
  • For VPC, select my-web-vpc.
  • For Subnet, select my-public-subnet.
  • For Auto-assign public IP, select Enable.
  • Under Firewall (security groups), select Select existing security group.
  • From the dropdown, select my-web-sg.

Why select an existing security group?

The launch wizard offers to create a new security group for you. You already built one with the exact rules you need (SSH from your IP, HTTP from anywhere). Selecting your existing my-web-sg reuses that work instead of duplicating it.

  • Leave Configure storage as the default (8 GiB gp3).
  • Click Launch instance.

You should see a success banner confirming your instance is launching.

Seeing an error about your VPC or subnet?

Make sure you selected my-web-vpc as the VPC before choosing the subnet. If the wrong VPC is selected, my-public-subnet will not appear in the subnet dropdown.

Also confirm that Auto-assign public IP is set to Enable. Without a public IP, you will not be able to connect to your instance from the internet.

help me troubleshoot my EC2 launch settings

Wait for the instance to start

Your instance needs a minute or two to boot up and pass its health checks.

  • Click View all instances.
  • Wait until the Instance state column shows Running.
  • Wait until Status check shows 2/2 checks passed. This takes 1-2 minutes.
  • Select your my-web-server instance by clicking its checkbox.
  • In the Details tab at the bottom of the page, find the Public IPv4 address field.
  • Copy this IP address and save it somewhere. You will need it to connect to your server.

Refresh the status checks

If the status check column still shows Initializing, click the refresh icon at the top of the instances table. It typically takes about 1-2 minutes for both checks to pass.

No public IP address showing?

If the Public IPv4 address field is empty, it means the instance did not receive a public IP. This happens when Auto-assign public IP was not set to Enable during launch.

The quickest fix is to terminate this instance (select it, then Instance state > Terminate instance) and launch a new one with the correct setting.

help me fix my EC2 instance missing a public IP

Your server is running inside your custom network. Next up, you will connect to it over SSH and install a web server to serve a live page to the internet.

Connect and Deploy Your Web Server

Your server is running, but right now it is an empty box sitting in your custom network. To turn it into a web server, you need to connect to it and install software that serves web pages.

In this step, you will use SSH to remotely access your instance's command line, then install Apache (a web server) and create a custom HTML page that anyone on the internet can visit.

In this step, get ready to:
  • SSH into your EC2 instance from Windows PowerShell.
  • Install and start the Apache web server.
  • Create a custom HTML page and verify it loads in a browser.
SSH into your instance from Windows PowerShell

SSH lets you open a terminal session on a remote machine as if you were sitting in front of it. You will use the my-web-key.pem private key you downloaded earlier to authenticate.

  • Press the Windows key, type PowerShell, and press Enter to open it.
  • Navigate to the folder where your key file downloaded by running this command:
cd [[KEYPATH="path to your Downloads folder, e.g. C:\Users\YourName\Downloads"]]

Where is my key file?

When you created the key pair in the previous step, the .pem file downloaded automatically to your browser's default download location. On most Windows machines, this is your Downloads folder.

  • Connect to your EC2 instance by running this command:
ssh -i "my-web-key.pem" ec2-user@[[EC2_PUBLIC_IP="your EC2 public IPv4 address"]]

What does this command do?

ssh opens a secure connection to a remote machine. The -i "my-web-key.pem" flag tells SSH which private key to use for authentication.

ec2-user is the default username on Amazon Linux 2023 instances. The IP address after the @ is the public address of your instance, which you can find in the EC2 console's Details tab.

  • When prompted with "Are you sure you want to continue connecting?", type yes and press Enter.

What is this fingerprint prompt?

The first time you connect to any server via SSH, your computer asks you to verify the server's identity. Typing yes saves the server's fingerprint so you will not be asked again.

You should see the Amazon Linux command line prompt, which looks something like [ec2-user@ip-10-0-1-xxx ~]$.

Connection timed out or permission denied?

If you see a timeout error, check that your security group's SSH rule uses your current public IP. Your IP may have changed since you created the rule. Go back to the VPC console, find my-web-sg, and update the SSH inbound rule source to My IP.

If you see a "permissions are too open" error for your .pem file, fix the file permissions by running these commands in PowerShell before retrying:

icacls.exe "my-web-key.pem" /reset
icacls.exe "my-web-key.pem" /grant:r "$($env:USERNAME):(R)"
icacls.exe "my-web-key.pem" /inheritance:r

If you see "No such file or directory", make sure you ran the cd command to move into the folder containing my-web-key.pem.

Help me troubleshoot my SSH connection

Install and start Apache

Apache is one of the most popular web servers in the world. It listens for incoming HTTP requests and serves back web pages.

  • Update the system packages on your instance by running this command:
sudo dnf update -y

What does this command do?

dnf is the package manager for Amazon Linux 2023. Running update -y downloads the latest security patches and software updates, and the -y flag automatically confirms all prompts.

This may take a minute or two to complete.

  • Install the Apache web server by running:
sudo dnf install -y httpd
  • Start the Apache service by running:
sudo systemctl start httpd
  • Enable Apache to start automatically whenever the instance reboots by running:
sudo systemctl enable httpd
  • Verify Apache is running by checking its status:
sudo systemctl status httpd

You should see active (running) in green text in the output.

What just happened?

You installed Apache (httpd), started it so it immediately begins serving web pages, and enabled it so it survives reboots. Apache is now listening on port 80, which your security group my-web-sg already allows from anywhere.

Not seeing active (running)?

If the status shows "inactive" or "failed", try running sudo systemctl start httpd again. If you see "command not found" for systemctl, make sure you are typing commands inside the SSH session (on the remote instance), not in your local PowerShell.

Help me diagnose why Apache is not running

Create your custom web page and test

Apache serves files from the /var/www/html directory. Any HTML file you place there becomes a web page accessible via your instance's public IP.

  • Create your custom web page by running this command in your SSH session:
sudo bash -c 'echo "<html><body><h1>Hello from my AWS cloud server!</h1><p>I built this network from scratch.</p></body></html>" > /var/www/html/index.html'

What does this command do?

This writes a simple HTML page into Apache's web root directory. The sudo bash -c wrapper runs the whole command with elevated permissions, which is needed because /var/www/html is owned by root.

The > operator redirects the output of echo into the file index.html, creating it if it does not exist.

  • Open a web browser on your local machine.
  • Navigate to your instance's public IP address using this URL format:
http://[[EC2_PUBLIC_IP="your EC2 public IPv4 address"]]

You should see your custom message: "Hello from my AWS cloud server!" followed by "I built this network from scratch."

Page not loading in your browser?

Make sure you are using http:// (not https://). Your security group only allows HTTP traffic on port 80, and you have not set up an SSL certificate.

If the page still will not load, go back to the EC2 console, select your instance, and confirm it has a Public IPv4 address in the Details tab. Also verify that the security group my-web-sg has an HTTP inbound rule with source 0.0.0.0/0.

Help me troubleshoot why my web page is not loading

✔️ Awesome, I've got everything!

Great. Double check you see your custom message in the browser, then you are all set.

ⓧ I'd like to double check the full code

Here is the exact content that should be in /var/www/html/index.html on your instance:

<html><body><h1>Hello from my AWS cloud server!</h1><p>I built this network from scratch.</p></body></html>

Secret mission

Add a Private Subnet and Prove Network Isolation

Your web server lives in a public subnet where anyone can reach it. But what about databases, internal APIs, and backend services that should never be exposed to the internet? In this mission, you'll build a private subnet and prove that route tables are the real gatekeepers of network traffic.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. Your EC2 instances are covered by the AWS Free Tier for 6 months, so there is no immediate cost if you leave them running.

Cost warning

Your EC2 instances (t3.micro) are covered under the AWS Free Tier for 6 months after account creation. VPCs, subnets, internet gateways, route tables, and security groups are free.

If you leave instances running beyond the 6-month Free Tier window, you will start incurring compute charges. Public IPv4 addresses are free for up to 750 hours per month under the Free Tier.

Resources you used:

  • EC2 instance: my-web-server (public subnet, running Apache).
  • EC2 instance: my-private-server (private subnet, Secret Mission).
  • VPC: my-web-vpc with subnets, internet gateway, route table, and security groups (all free).
  • Key pair: my-web-key (AWS) and my-web-key.pem file (local machine).

Keep everything running

No action needed. Choose this if you are still actively building or experimenting with your cloud network.

  • Your instances are covered by the AWS Free Tier ($100 signup credit plus up to $100 earned credits, valid for 6 months).
  • VPC networking resources (subnets, internet gateway, route table, security groups) are free regardless of Free Tier status.
  • Your my-web-key.pem file remains on your local machine. Keep it somewhere safe in case you need to SSH back in.

Pause - I'll come back to this later

Stop your EC2 instances to free up compute credits while keeping all your files and configuration intact.

  • In the AWS Console, search for EC2 and open the EC2 service.
  • In the left navigation pane, choose Instances.
  • Select my-web-server, then choose Instance state, then Stop instance.
  • Choose Stop when prompted for confirmation.
  • Repeat for my-private-server if you completed the Secret Mission.
  • Stopped instances do not consume compute credits. EBS storage charges continue but are minimal (8 GiB gp3 per instance).
  • To resume later, select the instance and choose Instance state, then Start instance. Your instance will receive a new public IP address on restart.

Delete - I don't want to use this again

Remove all project resources permanently. This cannot be undone.

Follow these steps in order:

  • Terminate all EC2 instances:
  • In the EC2 console, choose Instances in the left navigation pane.
  • Select my-web-server, then choose Instance state, then Terminate (delete) instance.
  • Choose Terminate (delete) when prompted for confirmation.
  • Repeat for my-private-server if you completed the Secret Mission.
  • Wait until both instances show a state of Terminated.
  • Delete the internet gateway:
  • Open the VPC console. In the left navigation pane, choose Internet gateways.
  • Select my-web-igw, choose Actions, then Detach from VPC.
  • Choose Detach internet gateway to confirm.
  • With my-web-igw still selected, choose Actions, then Delete internet gateway.
  • Enter delete when prompted, then choose Delete internet gateway.
  • Delete the VPC (this removes subnets, route tables, and security groups):
  • In the VPC console left navigation pane, choose Your VPCs.
  • Select my-web-vpc, then choose Actions, then Delete VPC.
  • Enter delete when prompted, then choose Delete.
  • This automatically deletes my-public-subnet, my-private-subnet, my-public-rt, my-web-sg, and my-private-sg.
  • Delete the local key file:
  • On your Windows machine, navigate to your Downloads folder and delete my-web-key.pem.
  • Delete the key pair from AWS:
  • In the EC2 console left navigation pane, choose Key Pairs.
  • Select my-web-key, then choose Actions, then Delete.
  • Enter delete in the confirmation field and choose Delete.

Nice Work!

Nice Work!

Congratulations! You just built a cloud network from the ground up and deployed a live web server on it.

You've learned how to:

  • Created a custom VPC with a public subnet, internet gateway, and route table to replicate physical networking in the cloud.
  • Configured security groups to control SSH and HTTP traffic like a virtual firewall.
  • Launched an EC2 instance, connected via SSH, and deployed an Apache web server serving a live page to the internet.
  • Demonstrated network isolation with public vs. private subnets using the bastion host pattern.

This is the exact foundation that every cloud and DevOps engineer builds upon. VPC + EC2 is the starting point for everything else: load balancers, auto-scaling, containers, and Infrastructure-as-Code.

Ready to quiz yourself?