Project 1: A network by hand

QuickCart is about to leave its single server behind. Before any new server, load balancer or database can move in, it needs a network: one where customers can reach the front door, servers can reach the internet and AWS, and nothing outside can ever reach the database.

In this project you build that network by hand, one piece at a time, in the AWS console. No wizard fills anything in for you. At the end you’ll prove each piece works from inside the network, with real commands and real answers.

What you’ll have at the end

The finished network, drawn from what you’ll build. Choose a kind of traffic to see which route-table line it uses.

Project 2 builds a self-healing app on top of exactly this network.

Before you start

Read these first. The project assumes you know what each piece is; here you put them together.

You need:

• An AWS account, signed in to the console as a user who can create VPC, EC2, IAM, S3, Secrets Manager and CloudWatch resources. Set up your computer covers a safe login.
• A budget alert, so a forgotten NAT gateway can’t surprise you. Billing and Cost Management → Budgets → Create budget, a monthly cost budget of $20, with an email alert at 80%.
• About 3 to 4 hours. You can stop between stages, but the NAT gateway and endpoints cost money while they exist.

Pick the region first. At the top right of the console, choose US East (N. Virginia) us-east-1. Every resource in this project goes in that region. Check it at the start of each stage: a form that “can’t see” your VPC is almost always in the wrong region.

Your account ID appears in this project as 111122223333. Find yours in the account menu at the top right, and use it wherever you see that number.

Cost

Costs money — about $3.50 a day while the NAT gateway and endpoints exist. Delete them when you’re done.

Prices change and differ by region. Check the AWS pricing pages for current figures.

Stage 1: The VPC

The VPC is the range of addresses everything else will live in. It has one important setting, the range, and one setting that’s off by default and quietly breaks three things later.

1. Create the VPC

   AWSIn the AWS console: VPC→Your VPCs→Create VPC

   Field	Enter
   Resources to create	VPC only. The VPC and more option builds everything at once, which is exactly what this project avoids
   Name tag	quickcart-vpc
   IPv4 CIDR block	IPv4 CIDR manual input
   IPv4 CIDR	10.0.0.0/16
   IPv6 CIDR block	No IPv6 CIDR block
   Tenancy	Default. Dedicated costs much more and is for special compliance needs

   Choose Create VPC.

   A /16 gives you 65,536 addresses. You’ll use a few dozen. The spare room is free, and it means you never have to renumber.

2. Turn on DNS hostnames

   AWSIn the AWS console: VPC→Your VPCs→quickcart-vpc→Actions→Edit VPC settings

   Field	Enter
   Enable DNS resolution	Ticked. It already is; leave it
   Enable DNS hostnames	Ticked. It’s off by default for a VPC you create yourself

   Choose Save.

   Without DNS hostnames, the interface endpoints in stage 7 can’t use private DNS. Your servers would keep sending AWS traffic out through the NAT gateway, and the endpoints would bill you for doing nothing. The database’s address in Project 2 wouldn’t resolve either.

Checkpoint

Stage 2: Six subnets

A subnet is a slice of the VPC that lives in exactly one availability zone. Surviving the loss of a zone means having a copy of each tier in a second zone, so three tiers become six subnets.

The numbering lets you read a subnet’s job from its address: 1 and 2 are public, 11 and 12 are app, 21 and 22 are data. The gaps leave room to grow.

1. Create all six on one form

   AWSIn the AWS console: VPC→Subnets→Create subnet

   For VPC ID, choose quickcart-vpc. Fill in the first subnet, then choose Add new subnet for each of the others:

   Subnet name	Availability Zone	IPv4 subnet CIDR block
   quickcart-public-a	US East (N. Virginia) / us-east-1a	10.0.1.0/24
   quickcart-public-b	US East (N. Virginia) / us-east-1b	10.0.2.0/24
   quickcart-app-a	US East (N. Virginia) / us-east-1a	10.0.11.0/24
   quickcart-app-b	US East (N. Virginia) / us-east-1b	10.0.12.0/24
   quickcart-data-a	US East (N. Virginia) / us-east-1a	10.0.21.0/24
   quickcart-data-b	US East (N. Virginia) / us-east-1b	10.0.22.0/24

   Leave IPv4 VPC CIDR block as 10.0.0.0/16. Choose Create subnet.

   Nothing on this form makes a subnet public. The names are only labels for people. Stage 5’s route tables decide what each subnet really is.

2. Check each subnet is in the zone you meant

   AWSIn the AWS console: VPC→Subnets

   Look at the Availability Zone column. Two subnets that should be in different zones but ended up in the same one is a silent mistake. Nothing complains until the zone failure test in Project 2.

Checkpoint

Stage 3: The internet gateway

The internet gateway is the VPC’s door to the internet. You create it and then attach it: two steps that people often only do half of.

1. Create it

   AWSIn the AWS console: VPC→Internet gateways→Create internet gateway

   Field	Enter
   Name tag	quickcart-igw

   Choose Create internet gateway. Its state says Detached. It does nothing yet.

2. Attach it to the VPC

   AWSIn the AWS console: VPC→Internet gateways→quickcart-igw→Actions→Attach to VPC

   Field	Enter
   Available VPCs	quickcart-vpc

   Choose Attach internet gateway.

   An internet gateway costs nothing, and AWS runs it across every zone, so it can’t be a single point of failure.

Checkpoint

Stage 4: The NAT gateway

Servers in the app subnets must never be reachable from the internet, but they still need to reach out: to install packages when they boot, for example. A NAT gateway is that one-way door.

It goes in a public subnet, which feels backwards. It serves the private subnets, but it needs its own route to the internet gateway, and only a public subnet has one.

1. Create the NAT gateway, with an Elastic IP

   AWSIn the AWS console: VPC→NAT gateways→Create NAT gateway

   Field	Enter
   Name	quickcart-nat-a
   Subnet	quickcart-public-a
   Connectivity type	Public
   Elastic IP allocation ID	Choose Allocate Elastic IP. A new address is filled in

   If your console also asks for an Availability mode, choose Zonal. This project deliberately builds the classic NAT gateway, which lives in one zone, so you can see the zone dependency it creates.

   Choose Create NAT gateway. It takes two or three minutes to become available.

2. Understand the trade-off you just made

   One NAT gateway, in zone a, serves both zones. That halves its cost, but zone b’s servers now depend on zone a for their way out to the internet. If zone a fails, they lose it.

   Stage 7 softens this: the endpoints give both zones a private path to the AWS services they need, without the NAT. The fully resilient design has one NAT gateway per zone, each app subnet using the one in its own zone, for about $1.10 more a day. Write this trade-off down now. You’ll see it for yourself in Project 2’s zone failure test.

Checkpoint

Stage 5: Route tables

This is the stage that decides which subnets are public. Before it, every subnet uses the VPC’s main route table, which has only the local route, so every subnet is isolated.

You’ll build four tables. Every table also gets 10.0.0.0/16 → local, which AWS adds and you can’t remove.

The two app tables say the same thing today. Keeping them separate makes the cross-zone dependency visible, and adding a second NAT gateway later becomes a one-line change.

1. The public route table

   AWSIn the AWS console: VPC→Route tables→Create route table

   Field	Enter
   Name	quickcart-rt-public
   VPC	quickcart-vpc

   Choose Create route table. On its Routes tab, choose Edit routes, then Add route:

   Destination	Target
   0.0.0.0/0	Internet Gateway, then quickcart-igw

   Choose Save changes. On the Subnet associations tab, choose Edit subnet associations, tick quickcart-public-a and quickcart-public-b, and choose Save associations.

2. The two app route tables

   Create two more route tables in the same way, in quickcart-vpc:

   Name	Route to add	Associate with
   quickcart-rt-app-a	0.0.0.0/0 → NAT Gateway → quickcart-nat-a	quickcart-app-a
   quickcart-rt-app-b	0.0.0.0/0 → NAT Gateway → quickcart-nat-a	quickcart-app-b

3. The data route table, with no routes added

   Field	Enter
   Name	quickcart-rt-data
   VPC	quickcart-vpc

   Add no routes. Associate it with quickcart-data-a and quickcart-data-b.

   An empty table is a security control. The database has no reason to reach the internet. With no route out, even a compromised database couldn’t send data anywhere or download anything.

4. Check the main route table is harmless

   AWSIn the AWS console: VPC→Route tables

   Find the table in quickcart-vpc that shows Main: Yes. It should have only the local route and no explicit subnet associations.

   Any subnet you forget to associate falls back to the main table. Keeping it local-only means a forgotten subnet has too little access, which you notice in minutes, rather than too much, which you might never notice.

Checkpoint

Stage 6: Security groups

A route table decides whether traffic can arrive. A security group decides whether it’s allowed when it does. You’ll build four, as a chain: each one names the group before it as its source, never a range of addresses.

Naming a group means “anything wearing that group”. When a server is replaced and gets a new address, nothing needs updating.

1. The load balancer's group

   AWSIn the AWS console: VPC→Security groups→Create security group

   Field	Enter
   Security group name	quickcart-alb-sg
   Description	Load balancer: HTTPS and HTTP from anywhere
   VPC	quickcart-vpc

   Under Inbound rules, choose Add rule twice:

   Type	Source
   HTTPS	Anywhere-IPv4 (0.0.0.0/0)
   HTTP	Anywhere-IPv4 (0.0.0.0/0)

   Leave Outbound rules as they are: All traffic to 0.0.0.0/0. Choose Create security group.

2. The app servers' group

   Field	Enter
   Security group name	quickcart-app-sg
   Description	App servers: HTTP from the load balancer only
   VPC	quickcart-vpc

   One inbound rule:

   Type	Source
   HTTP	Custom, then start typing quickcart-alb-sg and choose the group, not an address range

   Leave the outbound rule in place: All traffic to 0.0.0.0/0. Security groups are stateful, so replies to incoming requests go back out on their own. But connections the server starts need an outbound rule, and a booting server does little else: it registers with Systems Manager, fetches its secret and downloads packages. Choose Create security group.

   There’s no SSH rule, on purpose. You’ll reach servers through Session Manager, which needs no open inbound port at all.

3. The database's group

   Field	Enter
   Security group name	quickcart-db-sg
   Description	Database: MySQL from app servers only
   VPC	quickcart-vpc

   Type	Source
   MYSQL/Aurora (port 3306)	Custom → quickcart-app-sg

   Choose Create security group.

4. The endpoints' group

   Field	Enter
   Security group name	quickcart-endpoints-sg
   Description	Interface endpoints: HTTPS from app servers only
   VPC	quickcart-vpc

   Type	Source
   HTTPS	Custom → quickcart-app-sg

   Choose Create security group.

Checkpoint

Stage 7: VPC endpoints

App servers need S3, Secrets Manager and Systems Manager. Without endpoints, those requests go out through the NAT gateway to AWS’s public addresses. Endpoints keep them inside AWS’s network, and keep them working if the NAT gateway or its zone fails.

1. The S3 gateway endpoint

   AWSIn the AWS console: VPC→Endpoints→Create endpoint

   Field	Enter
   Name tag	quickcart-ep-s3
   Type	AWS services
   Services	Search for s3, and choose com.amazonaws.us-east-1.s3 with Type: Gateway. There’s also an Interface one with the same name; not that one
   VPC	quickcart-vpc
   Route tables	Tick quickcart-rt-app-a and quickcart-rt-app-b
   Policy	Full access

   Choose Create endpoint.

2. Four interface endpoints

   Create four more endpoints on the same form. Everything is the same except the name and the service:

   Name tag	Service (Type: Interface)	What it’s for
   quickcart-ep-secretsmanager	com.amazonaws.us-east-1.secretsmanager	Reading the database password
   quickcart-ep-ssm	com.amazonaws.us-east-1.ssm	Systems Manager itself. Without it, Session Manager can’t start
   quickcart-ep-ssmmessages	com.amazonaws.us-east-1.ssmmessages	The channel a Session Manager shell runs over. Without it, a session connects and then hangs
   quickcart-ep-ec2messages	com.amazonaws.us-east-1.ec2messages	The agent’s command channel. Without it, the server may never show up as managed

   For each one:

   Field	Enter
   Type	AWS services
   VPC	quickcart-vpc
   Additional settings → Enable DNS name	Ticked. This is the whole point: see below
   DNS record IP type	IPv4
   Subnets	us-east-1a → quickcart-app-a; us-east-1b → quickcart-app-b
   IP address type	IPv4
   Security groups	quickcart-endpoints-sg only. Untick the VPC’s default group
   Policy	Full access

   Why the DNS setting matters. With it ticked, the normal name secretsmanager.us-east-1.amazonaws.com resolves to the endpoint’s private address inside your subnet. Your code doesn’t change at all. With it unticked, the name still resolves to a public address, traffic still goes through the NAT gateway, and the endpoint sits there billing you.

Checkpoint

Stage 8: A bucket and a secret to test with

To prove the endpoints and the roles work, you need something to read. Project 2 uses the same bucket for its app files.

1. Create the bucket

   AWSIn the AWS console: S3→General purpose buckets→Create bucket

   Field	Enter
   Bucket type	General purpose
   Bucket name	quickcart-assets- followed by your account ID, like quickcart-assets-111122223333. Names are shared across every AWS account, so the number keeps yours unique
   Object Ownership	ACLs disabled (the default)
   Block all public access	On (the default). Leave all four boxes ticked
   Bucket Versioning	Enable
   Default encryption	SSE-S3 (the default)

   Choose Create bucket.

2. Upload a small test file

   On your computer, create a text file called hello.txt containing one line: hello from quickcart. Then:

   AWSIn the AWS console: S3→quickcart-assets-111122223333→Upload

   Choose Add files, pick hello.txt, and choose Upload.

3. Store a test secret

   AWSIn the AWS console: Secrets Manager→Secrets→Store a new secret

   Field	Enter
   Secret type	Other type of secret
   Key/value pairs	Key hello, value world
   Encryption key	aws/secretsmanager (the default)

   Choose Next.

   Field	Enter
   Secret name	quickcart/test
   Description	Test secret for the network project

   Choose Next. Leave Automatic rotation off, choose Next, then Store.

Checkpoint

Stage 9: Least-privilege IAM roles

A server that calls AWS needs permission. Access keys on the server are how credentials leak. Instead, the server wears an IAM role: AWS hands it short-lived credentials that change on their own, and nothing is stored on disk.

Least privilege means each role can do exactly its job. The app role can read one secret and one bucket, not every secret and every bucket.

1. Create the app servers' role

   AWSIn the AWS console: IAM→Roles→Create role

   Field	Enter
   Trusted entity type	AWS service
   Service or use case	EC2
   Use case	EC2

   Choose Next. Search for and tick these two AWS managed policies:

   Policy	What it allows
   AmazonSSMManagedInstanceCore	Registering with Systems Manager, so you can use Session Manager with no SSH
   CloudWatchAgentServerPolicy	Sending logs and metrics to CloudWatch. Project 2 uses it

   Choose Next.

   Field	Enter
   Role name	quickcart-app-role
   Description	QuickCart app servers: SSM, CloudWatch, one secret, one bucket

   Choose Create role.

2. Add a policy for exactly one secret

   AWSIn the AWS console: IAM→Roles→quickcart-app-role→Add permissions→Create inline policy

   Choose JSON, delete what’s there, and paste this. Put your own account ID in place of the highlighted number:

   quickcart-read-secretCopy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "ReadTheTestSecret",
         "Effect": "Allow",
         "Action": "secretsmanager:GetSecretValue",
         "Resource": "arn:aws:secretsmanager:us-east-1:111122223333:secret:quickcart/test-*"
       }
     ]
   }

   Part	What it means
   "Version": "2012-10-17"	The policy language version. Always this date; it isn’t when you wrote it
   "Sid"	A label for this statement, for people reading it
   "Effect": "Allow"	This statement grants permission. Anything not allowed is denied
   "Action": "secretsmanager:GetSecretValue"	Only reading a secret’s value. Not listing secrets, changing them or deleting them
   "Resource"	Only this secret. The -* at the end matches the six random characters AWS adds to every secret’s ARN. Without it, the policy matches nothing

   Choose Next, name it quickcart-read-secret, and choose Create policy.

3. Add a policy for exactly one bucket

   Create a second inline policy in the same way:

   quickcart-read-assetsCopy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "ReadObjects",
         "Effect": "Allow",
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::quickcart-assets-111122223333/*"
       },
       {
         "Sid": "ListTheBucket",
         "Effect": "Allow",
         "Action": "s3:ListBucket",
         "Resource": "arn:aws:s3:::quickcart-assets-111122223333"
       }
     ]
   }

   Part	What it means
   s3:GetObject on …/*	Read any object (file) in the bucket. Objects are addressed as bucket name, a slash, then the object’s key, hence /*
   s3:ListBucket on the bucket’s ARN	List what’s in the bucket. This action acts on the bucket itself, so its ARN has no /*

   Name it quickcart-read-assets and choose Create policy. Mixing up the two ARNs is one of the most common IAM mistakes there is: see Troubleshooting.

4. Create the flow logs' log group

   Flow logs need somewhere to write. Create the log group first, so the role can be limited to exactly it.

   AWSIn the AWS console: CloudWatch→Log groups→Create log group

   Field	Enter
   Log group name	/quickcart/vpc-flow-logs
   Retention setting	1 week. Logs kept forever cost money forever
   Log class	Standard

   Choose Create.

5. Create the flow logs' role

   This role is used by the VPC Flow Logs service, not by a server, so it needs a custom trust policy.

   AWSIn the AWS console: IAM→Roles→Create role

   For Trusted entity type, choose Custom trust policy, and paste:

   Trust policyCopy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": { "Service": "vpc-flow-logs.amazonaws.com" },
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": { "aws:SourceAccount": "111122223333" }
         }
       }
     ]
   }

   Part	What it means
   "Principal": { "Service": "vpc-flow-logs.amazonaws.com" }	Only the VPC Flow Logs service may use this role
   "Action": "sts:AssumeRole"	“Use” means taking on the role’s permissions for a while
   "Condition" → "aws:SourceAccount"	And only when it’s acting for your account. This stops another account’s flow logs being pointed at your role

   Choose Next, add no managed policies, choose Next, name it quickcart-flow-logs-role, and choose Create role. Then add this inline policy to it, named quickcart-write-flow-logs:

   quickcart-write-flow-logsCopy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "WriteToOneLogGroup",
         "Effect": "Allow",
         "Action": [
           "logs:CreateLogStream",
           "logs:PutLogEvents",
           "logs:DescribeLogStreams"
         ],
         "Resource": "arn:aws:logs:us-east-1:111122223333:log-group:/quickcart/vpc-flow-logs:*"
       },
       {
         "Sid": "FindTheLogGroup",
         "Effect": "Allow",
         "Action": "logs:DescribeLogGroups",
         "Resource": "*"
       }
     ]
   }

   Part	What it means
   logs:CreateLogStream, logs:PutLogEvents	Create a stream inside the group, and write records to it
   logs:DescribeLogStreams	See which streams already exist
   Resource ending log-group:/quickcart/vpc-flow-logs:*	Only this one log group, and the streams inside it
   logs:DescribeLogGroups on *	List the names of log groups, to find this one. It can’t read or change any of them

Checkpoint

Stage 10: Flow logs

Flow logs record every connection in the VPC: who talked to whom, on which port, and whether it was ACCEPTed or REJECTed. When something times out, they tell you whether a security group dropped it.

1. Turn on flow logs for the VPC

   AWSIn the AWS console: VPC→Your VPCs→quickcart-vpc→Flow logs→Create flow log

   Field	Enter
   Name	quickcart-flow-logs
   Filter	All. In production you might record only Reject, to save money
   Maximum aggregation interval	1 minute, so records appear quickly
   Destination	Send to CloudWatch Logs
   Destination log group	/quickcart/vpc-flow-logs
   Service access / IAM role	Use an existing service role, then quickcart-flow-logs-role
   Log record format	AWS default format

   Choose Create flow log.

Checkpoint

Prove it

Every piece is in place. Now prove it from inside the network, with a throwaway server in an app subnet: no public address, no SSH key, and only the app security group and app role.

Each check below tests one or more pieces. If one fails, Troubleshooting says which piece to look at.

1. Launch a test server in app subnet a

   AWSIn the AWS console: EC2→Instances→Launch instances

   Field	Enter
   Name	quickcart-test
   Application and OS Images	Amazon Linux 2023 AMI, 64-bit (x86)
   Instance type	t3.micro
   Key pair	Proceed without a key pair

   Under Network settings, choose Edit:

   Field	Enter
   VPC	quickcart-vpc
   Subnet	quickcart-app-a
   Auto-assign public IP	Disable
   Firewall (security groups)	Select existing security group → quickcart-app-sg

   Under Advanced details:

   Field	Enter
   IAM instance profile	quickcart-app-role
   Metadata version	V2 only (token required)

   Choose Launch instance. Wait until Status check shows 3/3 checks passed, a few minutes.

2. Check 1: Session Manager connects

   AWSIn the AWS console: EC2→Instances→quickcart-test→Connect→Session Manager→Connect

   You should see

   A black terminal in your browser, with a prompt like sh-5.2$. That alone proves several things: the app role reached the server, the ssm, ssmmessages and ec2messages endpoints work, the endpoints’ security group lets the app group in, and the app group’s outbound rule is there. No port was opened and no key was used.

   If the Connect button says the agent isn’t online, wait two more minutes. If it still isn’t, see Troubleshooting.

3. Check 2: the NAT gateway works

   In the Session Manager terminal:

   TerminalCopy

   curl -s checkip.amazonaws.com

   Part	What it means
   curl	fetch a web address and print what comes back
   -s	silent: no progress bar
   checkip.amazonaws.com	an AWS page that replies with the public address your request came from

   You should see

   203.0.113.25

   The address should match the NAT gateway’s public address from stage 4, not anything belonging to the server, which has no public address. That proves the app route table sends traffic to the NAT, the NAT works, the public route table sends it to the internet gateway, and the gateway is attached.

4. Check 3: Secrets Manager's name resolves to a private address

   TerminalCopy

   getent hosts secretsmanager.us-east-1.amazonaws.com

   Part	What it means
   getent hosts	look up the address a name resolves to, the same way programs on this server do
   secretsmanager.us-east-1.amazonaws.com	the normal, public name of Secrets Manager in this region

   You should see

   10.0.11.143     secretsmanager.us-east-1.amazonaws.com

   Your address differs, but it starts 10.0.11.: the endpoint’s interface in this subnet. That’s private DNS working.

5. Check 4: read the secret through the endpoint

   TerminalCopy

   aws secretsmanager get-secret-value --secret-id quickcart/test --query SecretString --output text --region us-east-1

   Part	What it means
   aws secretsmanager get-secret-value	ask Secrets Manager for a secret’s value
   --secret-id quickcart/test	which secret, by name
   --query SecretString	print only the secret itself, not the other details
   --output text	as plain text instead of JSON
   --region us-east-1	the region the secret is in

   You should see

   {"hello":"world"}

   The server used the role’s short-lived credentials, reached Secrets Manager over the endpoint, and was allowed by the one-secret policy.

6. Check 5: read from S3 through the gateway endpoint

   TerminalCopy

   aws s3 cp s3://quickcart-assets-111122223333/hello.txt - --region us-east-1

   Part	What it means
   aws s3 cp	copy a file to or from S3
   s3://quickcart-assets-111122223333/hello.txt	the file you uploaded. Use your own bucket name
   -	copy it to the screen instead of to a file
   --region us-east-1	the bucket’s region

   You should see

   hello from quickcart

7. Check 6: least privilege says no

   Now ask for something the role was never given: a list of every bucket in the account.

   TerminalCopy

   aws s3 ls --region us-east-1

   Part	What it means
   aws s3 ls	with no bucket named, list every bucket in the account
   --region us-east-1	the region to ask

   You should see

   An error occurred (AccessDenied) when calling the ListBuckets operation: User: arn:aws:sts::111122223333:assumed-role/quickcart-app-role/i-0a1b2c3d is not authorized to perform: s3:ListAllMyBuckets because no identity-based policy allows the s3:ListAllMyBuckets action

   This error is a pass. The role can read one bucket, and can’t even see that others exist. Your instance ID in the message differs.

8. Check 7: flow logs are recording

   AWSIn the AWS console: CloudWatch→Log groups→/quickcart/vpc-flow-logs

   You should see

   One or more log streams, named after network interfaces (eni-…). Open one: each line is one flow, ending in ACCEPT OK or REJECT OK. Traffic to port 443 on the endpoints’ private addresses shows up as ACCEPT.

Record your results. Everything should pass:

Nothing here tested the data subnets directly: nothing lives there yet. Their route table, with only local, and the database group, which only trusts quickcart-app-sg, are checked by reading them in stages 5 and 6. Project 2 puts a database there and proves the chain end to end.

Troubleshooting

These are real mistakes from building exactly this network.

Clean up

Going straight on to Project 2? Terminate the test server (step 1) and keep everything else: Project 2 builds on this network. If you’ll start it another day, do the whole clean-up now and rebuild later. The network costs about $3.50 a day even when idle.

Delete things in this order. Some can’t be deleted while something else still uses them.

1. Terminate the test server

   AWSIn the AWS console: EC2→Instances→quickcart-test→Instance state→Terminate (delete) instance

   Confirm with Terminate (delete). Its state goes to Terminated.

2. Delete the five endpoints

   AWSIn the AWS console: VPC→Endpoints

   Tick all five quickcart-ep-… endpoints, choose Actions → Delete VPC endpoints, type delete, and choose Delete.

3. Delete the NAT gateway, then release its address

   AWSIn the AWS console: VPC→NAT gateways→quickcart-nat-a→Actions→Delete NAT gateway

   Type delete and confirm. Wait until its state is Deleted, a minute or two. Then:

   AWSIn the AWS console: VPC→Elastic IPs→the address→Actions→Release Elastic IP addresses

   Choose Release.

4. Delete the flow log, then the VPC

   AWSIn the AWS console: VPC→Your VPCs→quickcart-vpc→Flow logs→quickcart-flow-logs→Actions→Delete flow logs

   Then delete the VPC itself:

   AWSIn the AWS console: VPC→Your VPCs→quickcart-vpc→Actions→Delete VPC

   The console lists what goes with it: the six subnets, the route tables, the internet gateway and the security groups. Type delete and choose Delete.

5. Empty and delete the bucket

   AWSIn the AWS console: S3→quickcart-assets-111122223333→Empty

   Type permanently delete and choose Empty. With versioning on, this also removes every old version. Then choose Delete on the bucket and type its name to confirm.

6. Schedule the secret for deletion

   AWSIn the AWS console: Secrets Manager→quickcart/test→Actions→Delete secret

   Set the waiting period to 7 days, the shortest the console allows, and choose Schedule deletion. You’re not charged for a secret that’s waiting to be deleted.

7. Delete the log group and the two roles

   AWSIn the AWS console: CloudWatch→Log groups→/quickcart/vpc-flow-logs→Actions→Delete log group(s)

   AWSIn the AWS console: IAM→Roles

   Tick quickcart-app-role and quickcart-flow-logs-role, choose Delete, type delete and confirm. Their inline policies go with them.

8. Clean-up step: Confirm nothing is left billing

   Check each of these:

   Where	Should show
   VPC → NAT gateways	Nothing, or only quickcart-nat-a as Deleted
   VPC → Elastic IPs	No addresses
   VPC → Endpoints	No endpoints
   VPC → Your VPCs	Only the account’s default VPC
   EC2 → Instances	quickcart-test as Terminated, or gone
   Resource Groups & Tag Editor → Tag Editor, region us-east-1, resource types All supported resource types, search	No resources with a quickcart name

   You should see

   All six checks come back empty. Tomorrow, check Billing and Cost Management → Bills: the charges for this project stop on the day you cleaned up.