Create Data-Tier VPC Subnets

01 Sign in to your Cloud Conformity console, access Create Data-Tier VPC Subnets conformity rule settings and identify the tag set configured for all AWS resources available in your data tier (e.g. <data_tier_tag>:<data_tier_tag_value>).

02 Sign in to the AWS Management Console.

03 Navigate to VPC dashboard at https://console.aws.amazon.com/vpc/.

04 Select the Virtual Private Cloud (VPC) that you want to examine from the Select a VPC dropdown menu.

05 In the navigation panel, under Virtual Private Cloud, click Subnets.

06 Select the VPC subnet that you want to examine.

07 Select the Tags tab from the dashboard bottom panel.

08 On the Tags panel, search for the tag set identified at step no. 1 (i.e. <data_tier_tag>:<data_tier_tag_value>). If these two tag sets do not match, or the verified VPC resource is not tagged at all, the selected subnet is not a component of your data tier.

09 Repeat steps no. 6 – 8 to check the other subnets available within the selected VPC for data-tier tags. If none of the verified VPC subnets were tagged with <data_tier_tag>:<data_tier_tag_value>, there are no VPC subnets created for your data tier in the selected region.

10 Change the AWS region from the navigation bar and repeat steps no. 4 – 9 for other regions.

01 Sign in to your Cloud Conformity console, access Create Data-Tier VPC Subnets conformity rule settings and identify the tag set defined for the AWS resources available in your data tier (e.g. <data_tier_tag>:<data_tier_tag_value>).

02 Run describe-subnets command (OSX/Linux/UNIX) to list the IDs of the subnets associated with your data tier, available in the selected VPC, created within US East (N. Virginia) region:

aws ec2 describe-subnets
	--region us-east-1
	--filters Name=tag:<data_tier_tag>,Values=<data_tier_tag_value> Name=vpc-id,Values=vpc-12345678
	--query "Subnets[*].SubnetId"

03 The command output should return the requested data-tier subnet IDs:

[]

04 Change the AWS region by updating the --region command parameter value and repeat step no. 2 and 3 to check for VPC data-tier subnets in other regions.

01 Sign in to your Cloud Conformity console, access Create Data-Tier VPC Subnets conformity rule settings and copy the tags configured for the AWS resources available in your data tier (e.g. <data_tier_tag>:<data_tier_tag_value>).

02 Sign in to the AWS Management Console.

03 Navigate to VPC dashboard at https://console.aws.amazon.com/vpc/.

04 Select the Virtual Private Cloud where you want to deploy your new data-tier subnets from the Select a VPC dropdown menu.

05 In the navigation panel, under Virtual Private Cloud, click Subnets.

06 Click Create Subnet button from the dashboard top menu to start the setup process.

07 Inside Create Subnet dialog box, perform the following:

1. Select the ID of the current VPC from the VPC dropdown list.
2. Select the Availability Zone (AZ) where the new subnet will be provisioned from the Availability Zone dropdown list.
3. Enter the CIDR block (e.g. 10.0.20.0/24) for the new subnet in the IPv4 CIDR block box. The CIDR block of the subnet shouldn't be the same as the CIDR block for the VPC, listed in the VPC CIDRs section, however, this needs to be within the CIDR ranges of the selected VPC. The allowed block size must be between a /16 netmask and a /28 netmask. Since you need to create more than one subnet, make sure that the CIDR blocks of the new subnets do not overlap.
4. Click Yes, Create to create your new data-tier subnet.

08 Choose the newly created data-tier subnet and select the Tags tab from the dashboard bottom panel.

09 On the Tags panel, click Edit button to add the tags that will help organize the identity of the selected subnet within your data tier. Use the following format when you define your own tag set: <data_tier_tag>:<data_tier_tag_value> and ensure that the tag name (<data_tier_tag>) and the tag value (<data_tier_tag_value>) match the tag set copied at step no. 1. Once your tags are created, click Save to apply the changes.

10 Repeat steps no. 6 – 9 to create more data-tier subnets (at least one more in a different AZ), inside the selected Virtual Private Cloud (VPC).

11 If required, change the AWS region from the navigation bar and repeat steps no. 4 – 8 for other regions.

01 Sign in to your Cloud Conformity console, access Create Data-Tier VPC Subnets conformity rule settings and copy the tags defined for the AWS resources available in your data tier (e.g. <data_tier_tag>:<data_tier_tag_value>).

02 Run create-subnet command (OSX/Linux/UNIX) to create a new data-tier subnet within the selected VPC (see Audit section part II to identify the right AWS resource). The following command example creates a data-tier subnet with a CIDR block set to "10.0.20.0/24", inside an AWS VPC identified by the ID "vpc-12345678", available in the US East (N. Virginia) region:

aws ec2 create-subnet
	--region us-east-1
	--availability-zone us-east-1a
	--vpc-id vpc-abcd1234
	--cidr-block 10.0.1.0/24

03 The command output should return the new subnet metadata:

{
    "Subnet": {
        "AvailabilityZone": "us-east-1b",
        "AvailableIpAddressCount": 251,
        "DefaultForAz": false,
        "Ipv6CidrBlockAssociationSet": [],
        "VpcId": "vpc-12345678",
        "State": "pending",
        "MapPublicIpOnLaunch": false,
        "SubnetId": "subnet-ccccdddd",
        "CidrBlock": "10.0.20.0/24",
        "AssignIpv6AddressOnCreation": false
    }
}

04 Run create-tags command (OSX/Linux/UNIX) using the ID of the newly created data-tier subnet as identifier to create tags for managing the identity of the new VPC resource. Use the following format when you define your own tag set: <data_tier_tag>:<data_tier_tag_value> and make sure the tag name (<data_tier_tag>) and the tag value (<data_tier_tag_value>) match the tag set used to organize your data-tier resources, copied at step no. 1. Replace <data_tier_tag> and <data_tier_tag_value> with your own tags (the command does not produce an output):

aws ec2 create-tags
	--region us-east-1
	--resources subnet-ccccdddd
	--tags Key=<data_tier_tag>,Value=<data_tier_tag_value>

05 Repeat steps no. 2 – 4 to create more data-tier subnets (at least one more in a different AZ), inside the selected Amazon VPC.

06 If required, change the AWS region by updating the --region command parameter value and repeat steps no. 2 – 5 for other regions.