01 Run create-vpc command (OSX/Linux/UNIX) to create a new, non-default Virtual Private Cloud (VPC) network in the selected AWS cloud region. Configure the --cidr-block parameter with the IPv4 address range (CIDR block) approved by your organization. You can't provide an IPv4 CIDR block larger than /16. The following command example deploys a shared tenancy VPC with the IPv4 CIDR block set to 10.0.0.0/16, in the US East (N. Virginia) region:
aws ec2 create-vpc
--region us-east-1
--cidr-block 10.0.0.0/16
--instance-tenancy default
02 The command output should return the configuration metadata available for the new VPC:
{
"Vpc": {
"VpcId": "vpc-0abcd1234abcd1234",
"InstanceTenancy": "default",
"CidrBlockAssociationSet": [
{
"AssociationId": "vpc-cidr-assoc-01234abcd1234abcd",
"CidrBlock": "10.0.0.0/16",
"CidrBlockState": {
"State": "associated"
}
}
],
"Ipv6CidrBlockAssociationSet": [],
"State": "pending",
"DhcpOptionsId": "dopt-1234abcd",
"OwnerId": "123456789012",
"CidrBlock": "10.0.0.0/16",
"IsDefault": false
}
}
03 Run create-internet-gateway command (OSX/Linux/UNIX) to create an Internet Gateway (IGW) for the newly created Virtual Private Cloud (VPC) network:
aws ec2 create-internet-gateway
--region us-east-1
04 The command output should return the metadata available for the new Internet Gateway:
{
"InternetGateway": {
"OwnerId": "123456789012",
"Tags": [],
"Attachments": [],
"InternetGatewayId": "igw-01234abcd1234abcd"
}
}
05 Run attach-internet-gateway command (OSX/Linux/UNIX) to attach the newly created Internet Gateway (IGW) to the VPC created at step no. 1 (if successful, the command does not produce an output):
aws ec2 attach-internet-gateway
--region us-east-1
--internet-gateway-id igw-01234abcd1234abcd
--vpc-id vpc-0abcd1234abcd1234
06 Run create-subnet command (OSX/Linux/UNIX) to set up a custom subnet for your new VPC network. Choose the IPv4 network range for the new subnet (i.e. --cidr-block parameter) based on the IPv4 address range approved by your organization, configured for the VPC network created at step no. 1. Repeat this step to create as many VPC subnets as needed:
aws ec2 create-subnet
--region us-east-1
--vpc-id vpc-0abcd1234abcd1234
--cidr-block 10.0.1.0/24
07 The command output should return the VPC subnet metadata:
{
"Subnet": {
"MapPublicIpOnLaunch": false,
"AvailabilityZoneId": "use1-az2",
"AvailableIpAddressCount": 251,
"DefaultForAz": false,
"SubnetArn": "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-0aabbccddaabbccdd",
"Ipv6CidrBlockAssociationSet": [],
"VpcId": "vpc-0abcd1234abcd1234",
"State": "available",
"AvailabilityZone": "us-east-1c",
"SubnetId": "subnet-0aabbccddaabbccdd",
"OwnerId": "123456789012",
"CidrBlock": "10.0.1.0/24",
"AssignIpv6AddressOnCreation": false
}
}
08 Run create-route-table command (OSX/Linux/UNIX) to create a route table for your new VPC network:
aws ec2 create-route-table
--region us-east-1
--vpc-id vpc-0abcd1234abcd1234
09 The command output should return the VPC route table metadata:
{
"RouteTable": {
"Associations": [],
"RouteTableId": "rtb-0abcdabcdabcdabcd",
"VpcId": "vpc-0abcd1234abcd1234",
"PropagatingVgws": [],
"Tags": [],
"Routes": [
{
"GatewayId": "local",
"DestinationCidrBlock": "10.0.0.0/16",
"State": "active",
"Origin": "CreateRouteTable"
}
],
"OwnerId": "123456789012"
}
}
10 Run associate-route-table command (OSX/Linux/UNIX) to associate the VPC subnet(s) created at step no. 6 with the new VPC route table:
aws ec2 associate-route-table
--region us-east-1
--route-table-id rtb-0abcdabcdabcdabcd
--subnet-id subnet-0aabbccddaabbccdd
11 The command output should return the state and the ID of the route table association:
{
"AssociationState": {
"State": "associated"
},
"AssociationId": "rtbassoc-01234123412341234"
}
12 Run create-route command (OSX/Linux/UNIX) to add a new route to the Amazon VPC route table deployed at the previous steps. Repeat this step to add as many routes as needed:
aws ec2 create-route
--region us-east-1
--route-table-id rtb-0abcdabcdabcdabcd
--destination-cidr-block 0.0.0.0/0
--gateway-id igw-01234abcd1234abcd
13 The command output should return the request status (true for success or an error message if the request fails):
14 Configure your new Amazon VPC network based on your application requirements and migrate your application from the non-default VPC to the new VPC.
15 If required, change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.
Security