# Create VPC
aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=my-vpc}]'

# Enable DNS hostnames (required for public DNS names)
aws ec2 modify-vpc-attribute \
  --vpc-id vpc-0abc123 \
  --enable-dns-hostnames

# Add a secondary CIDR
aws ec2 associate-vpc-cidr-block \
  --vpc-id vpc-0abc123 \
  --cidr-block 10.1.0.0/16

# List VPCs
aws ec2 describe-vpcs --query 'Vpcs[*].{ID:VpcId,CIDR:CidrBlock,Default:IsDefault}'

# Public subnet in AZ a
aws ec2 create-subnet \
  --vpc-id vpc-0abc123 \
  --cidr-block 10.0.0.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-1a}]'

# Enable auto-assign public IP for public subnets
aws ec2 modify-subnet-attribute \
  --subnet-id subnet-0abc123 \
  --map-public-ip-on-launch

# Private subnet in AZ a
aws ec2 create-subnet \
  --vpc-id vpc-0abc123 \
  --cidr-block 10.0.2.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-1a}]'

# List subnets with AZ and available IPs
aws ec2 describe-subnets \
  --filters Name=vpc-id,Values=vpc-0abc123 \
  --query 'Subnets[*].{ID:SubnetId,AZ:AvailabilityZone,CIDR:CidrBlock,Available:AvailableIpAddressCount}'

VPC: 10.0.0.0/16

Public subnets (one per AZ — for load balancers, NAT GW):
  10.0.0.0/24   us-east-1a
  10.0.1.0/24   us-east-1b
  10.0.2.0/24   us-east-1c

Private subnets (app tier):
  10.0.10.0/24  us-east-1a
  10.0.11.0/24  us-east-1b
  10.0.12.0/24  us-east-1c

Isolated subnets (data tier):
  10.0.20.0/24  us-east-1a
  10.0.21.0/24  us-east-1b
  10.0.22.0/24  us-east-1c

# Create a route table
aws ec2 create-route-table --vpc-id vpc-0abc123 \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=public-rt}]'

# Add a route to IGW
aws ec2 create-route \
  --route-table-id rtb-0abc123 \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id igw-0abc123

# Associate subnet with route table
aws ec2 associate-route-table \
  --route-table-id rtb-0abc123 \
  --subnet-id subnet-0abc123

# View routes
aws ec2 describe-route-tables \
  --route-table-ids rtb-0abc123 \
  --query 'RouteTables[*].Routes'

Outbound: EC2 (10.0.0.5) → IGW → Internet
  IGW translates source 10.0.0.5 → public IP (EIP or auto-assigned)

Inbound: Internet → public IP → IGW → EC2 (10.0.0.5)
  IGW translates destination public IP → 10.0.0.5

Requirements:
  1. VPC has an IGW attached
  2. Subnet route table has 0.0.0.0/0 → igw-xxx
  3. Instance has a public IP (EIP or auto-assign) or is behind a public ELB
  4. Security group allows the traffic

# Create
aws ec2 create-internet-gateway \
  --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=my-igw}]'

# Attach to VPC (one IGW per VPC)
aws ec2 attach-internet-gateway \
  --internet-gateway-id igw-0abc123 \
  --vpc-id vpc-0abc123

# Detach
aws ec2 detach-internet-gateway \
  --internet-gateway-id igw-0abc123 \
  --vpc-id vpc-0abc123

# Allocate an Elastic IP
aws ec2 allocate-address --domain vpc

# Create NAT Gateway in the public subnet
aws ec2 create-nat-gateway \
  --subnet-id subnet-public-1a \
  --allocation-id eipalloc-0abc123 \
  --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=nat-1a}]'

# Wait for it to become available
aws ec2 wait nat-gateway-available --nat-gateway-ids nat-0abc123

# Add default route in private route table pointing to NAT GW
aws ec2 create-route \
  --route-table-id rtb-private-1a \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-0abc123

# Create
aws ec2 create-security-group \
  --group-name web-sg \
  --description "Web tier" \
  --vpc-id vpc-0abc123

# Allow HTTPS from anywhere
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --protocol tcp --port 443 --cidr 0.0.0.0/0

# Allow app traffic only from the web SG (SG reference)
aws ec2 authorize-security-group-ingress \
  --group-id sg-app123 \
  --protocol tcp --port 8080 \
  --source-group sg-0abc123

# Revoke a rule
aws ec2 revoke-security-group-ingress \
  --group-id sg-0abc123 \
  --protocol tcp --port 22 --cidr 0.0.0.0/0

# Show rules
aws ec2 describe-security-group-rules \
  --filters Name=group-id,Values=sg-0abc123

100   Allow HTTPS inbound (443)
110   Allow HTTP inbound (80)
120   Allow ephemeral ports inbound (1024-65535) for return traffic
...
32766 *DENY all  (implicit, cannot be removed)

# Create NACL
aws ec2 create-network-acl --vpc-id vpc-0abc123

# Add inbound allow rule (rule 100, TCP 443)
aws ec2 create-network-acl-entry \
  --network-acl-id acl-0abc123 \
  --rule-number 100 \
  --protocol tcp \
  --port-range From=443,To=443 \
  --cidr-block 0.0.0.0/0 \
  --rule-action allow \
  --ingress

# Allow ephemeral return ports inbound (stateless — required!)
aws ec2 create-network-acl-entry \
  --network-acl-id acl-0abc123 \
  --rule-number 120 \
  --protocol tcp \
  --port-range From=1024,To=65535 \
  --cidr-block 0.0.0.0/0 \
  --rule-action allow \
  --ingress

# Associate NACL with subnet
aws ec2 replace-network-acl-association \
  --association-id aclassoc-0abc123 \
  --network-acl-id acl-0abc123

# Step 1: Create peering request (from VPC A)
aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-aaa \
  --peer-vpc-id vpc-bbb \
  --peer-region us-west-2  # omit for same-region

# Step 2: Accept (from VPC B's account/region)
aws ec2 accept-vpc-peering-connection \
  --vpc-peering-connection-id pcx-0abc123

# Step 3: Add routes in VPC A's route table
aws ec2 create-route \
  --route-table-id rtb-aaa \
  --destination-cidr-block 10.1.0.0/16 \
  --vpc-peering-connection-id pcx-0abc123

# Step 4: Add routes in VPC B's route table
aws ec2 create-route \
  --route-table-id rtb-bbb \
  --destination-cidr-block 10.0.0.0/16 \
  --vpc-peering-connection-id pcx-0abc123

# Step 5: Update security groups to allow traffic from peer CIDR

VPC-A ──┐
VPC-B ──┤
VPC-C ──┼──► Transit Gateway ──► VPN (on-premises)
VPC-D ──┤                    └──► Direct Connect
VPC-E ──┘

Each VPC attaches via a TGW VPC attachment (one subnet per AZ).
TGW route tables control which attachments can talk to each other.

TGW Route Table: "shared-services-rt"
  Associates: VPC-shared (DNS, AD, monitoring)
  Propagates from: all VPCs
  → All VPCs can reach shared services

TGW Route Table: "spoke-rt"
  Associates: VPC-A, VPC-B, VPC-C (app VPCs)
  Propagates from: VPC-shared only
  → App VPCs can reach shared services but NOT each other

# Create TGW
aws ec2 create-transit-gateway \
  --description "Main TGW" \
  --options DefaultRouteTableAssociation=enable,DefaultRouteTablePropagation=enable

# Attach a VPC (one subnet per AZ recommended)
aws ec2 create-transit-gateway-vpc-attachment \
  --transit-gateway-id tgw-0abc123 \
  --vpc-id vpc-0abc123 \
  --subnet-ids subnet-1a subnet-1b

# Route VPC traffic to TGW
aws ec2 create-route \
  --route-table-id rtb-0abc123 \
  --destination-cidr-block 10.0.0.0/8 \
  --transit-gateway-id tgw-0abc123

# Share TGW to other accounts via RAM
aws ram create-resource-share \
  --name tgw-share \
  --resource-arns arn:aws:ec2:us-east-1:123456789:transit-gateway/tgw-0abc123 \
  --principals 987654321098

# Create gateway endpoint (free, add to route tables)
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc123 \
  --service-name com.amazonaws.us-east-1.s3 \
  --vpc-endpoint-type Gateway \
  --route-table-ids rtb-private-1a rtb-private-1b

# The route table gets a new entry automatically:
# Destination: pl-xxxxxx (S3 prefix list) → vpce-xxxxxx

# Restrict S3 bucket access to VPC only (bucket policy)
# Add this condition to your S3 bucket policy:
"Condition": {
  "StringNotEquals": {
    "aws:SourceVpce": "vpce-0abc123"
  }
}

# Create interface endpoint for SSM (enables Session Manager without internet)
for svc in ssm ssmmessages ec2messages; do
  aws ec2 create-vpc-endpoint \
    --vpc-id vpc-0abc123 \
    --service-name com.amazonaws.us-east-1.$svc \
    --vpc-endpoint-type Interface \
    --subnet-ids subnet-private-1a subnet-private-1b \
    --security-group-ids sg-endpoints \
    --private-dns-enabled
done

# With --private-dns-enabled, the service's public DNS name
# (e.g. ssm.us-east-1.amazonaws.com) resolves to the ENI private IP
# — no code changes needed in the application.

version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status

Example accepted record:
2 123456789 eni-0abc123 10.0.1.5 10.0.2.8 54321 443 6 10 4096 1620000000 1620000060 ACCEPT OK

Example rejected record:
2 123456789 eni-0abc123 1.2.3.4 10.0.1.5 54321 22 6 1 40 1620000000 1620000060 REJECT OK

# Flow logs to CloudWatch Logs
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-0abc123 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /aws/vpc/flowlogs \
  --deliver-logs-permission-arn arn:aws:iam::123456789:role/flowlogs-role

# Flow logs to S3 (cheaper for long-term retention)
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-0abc123 \
  --traffic-type ALL \
  --log-destination-type s3 \
  --log-destination arn:aws:s3:::my-flowlogs-bucket/vpc-logs/

# Custom format — include more fields
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-0abc123 \
  --traffic-type ALL \
  --log-format '${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${action} ${tcp-flags} ${type} ${pkt-srcaddr} ${pkt-dstaddr}'

# Top talkers by bytes
fields srcaddr, dstaddr, bytes
| stats sum(bytes) as total by srcaddr, dstaddr
| sort total desc
| limit 20

# Find rejected traffic (security group blocks)
fields srcaddr, dstaddr, dstport, action
| filter action = "REJECT"
| stats count() as rejects by srcaddr, dstport
| sort rejects desc

# Traffic to a specific port
fields srcaddr, dstaddr, dstport, action
| filter dstport = 22 and action = "REJECT"

Inbound endpoint  — on-premises DNS → Resolver endpoint ENIs in VPC
                    on-prem servers can query AWS private hosted zones

Outbound endpoint — Route 53 Resolver → Resolver endpoint → on-premises DNS
                    VPC instances can resolve on-premises domain names
                    using Resolver forwarding rules

# Create outbound endpoint (for forwarding to on-premises)
aws route53resolver create-resolver-endpoint \
  --creator-request-id my-endpoint \
  --name outbound-to-onprem \
  --security-group-ids sg-0abc123 \
  --direction OUTBOUND \
  --ip-addresses SubnetId=subnet-1a SubnetId=subnet-1b

# Create forwarding rule: corp.example.com → on-premises DNS
aws route53resolver create-resolver-rule \
  --creator-request-id my-rule \
  --rule-type FORWARD \
  --domain-name corp.example.com \
  --resolver-endpoint-id rslvr-out-0abc123 \
  --target-ips Ip=192.168.1.53,Port=53

# Associate rule with VPC
aws route53resolver associate-resolver-rule \
  --resolver-rule-id rslvr-rr-0abc123 \
  --vpc-id vpc-0abc123

# Create custom DHCP options (e.g., custom domain search)
aws ec2 create-dhcp-options \
  --dhcp-configurations \
    "Key=domain-name,Values=corp.example.com" \
    "Key=domain-name-servers,Values=AmazonProvidedDNS"

# Associate with VPC
aws ec2 associate-dhcp-options \
  --dhcp-options-id dopt-0abc123 \
  --vpc-id vpc-0abc123

# List all VPCs
aws ec2 describe-vpcs --query 'Vpcs[*].{ID:VpcId,CIDR:CidrBlock,Name:Tags[?Key==`Name`]|[0].Value}'

# Find which SG is blocking a port
aws ec2 describe-security-group-rules \
  --filters Name=group-id,Values=sg-0abc123 \
  --query 'SecurityGroupRules[?ToPort==`443`]'

# Find instances in a subnet
aws ec2 describe-instances \
  --filters Name=subnet-id,Values=subnet-0abc123 \
  --query 'Reservations[*].Instances[*].{ID:InstanceId,IP:PrivateIpAddress,State:State.Name}'

# Check NAT Gateway data usage
aws cloudwatch get-metric-statistics \
  --namespace AWS/NATGateway \
  --metric-name BytesOutToDestination \
  --dimensions Name=NatGatewayId,Value=nat-0abc123 \
  --start-time 2026-05-12T00:00:00Z \
  --end-time 2026-05-13T00:00:00Z \
  --period 86400 --statistics Sum

# Trace route table for a subnet
aws ec2 describe-route-tables \
  --filters Name=association.subnet-id,Values=subnet-0abc123 \
  --query 'RouteTables[*].Routes'