Lecture 16: Hands On: Creating VPC with Public Subnet
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：13:06
- 来源：Udemy Lecture 24112482
- 小节数量：9
- 画面切换：约 01:30、03:01、04:08、04:56、06:11、07:51、11:16、12:48
扫描说明
按页面英文 transcript 的 321 个时间点逐一定位并检查视频画面。两张讲义页分别单列；AWS 控制台连续操作按完整任务阶段划分为创建 VPC、IGW、子网、路由表、EC2 和连接验证；结尾返回架构图后单列回顾小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Demo – VPC with Single Public Subnet
时间范围：00:00–01:30
总结 / Summary
中文
目标架构使用 10.100.0.0/16 的虚拟私有云（Virtual Private Cloud, VPC），在其中创建 10.100.0.0/24 公有子网（public subnet）、互联网网关（Internet Gateway, IGW）和自定义路由表（custom route table）。路由表保留 VPC 本地路由（local route），并添加 0.0.0.0/0 指向 IGW。EC2 实例要直接从互联网访问，必须位于该公有子网并拥有公有 IP 地址（public IP address）。
English
The target architecture uses a 10.100.0.0/16 Virtual Private Cloud (VPC) with a 10.100.0.0/24 public subnet, an Internet Gateway (IGW), and a custom route table. The route table retains the VPC local route and adds 0.0.0.0/0 targeting the IGW. For direct Internet access, the EC2 instance must reside in the public subnet and have a public IP address.
Transcript
00:00 Hello and welcome to this lecture.
00:01 Now is the time where we see what we just learned.
00:04 So in this particular exercise,
00:07 we are going to create a VPC
00:09 and a single Public subnet,
00:11 then we want to launch an EC2 instance
00:15 in a public subnet
00:16 and we want to connect it.
00:17 So this is typically the first step in AWS
00:19 whenever you want to launch EC2 instance,
00:22 but we are not doing that in a default VPC.
00:24 instead, we will set up a network for this.
00:27 So if you look at this diagram,
00:29 essentially, this is what we are going to do.
00:32 We will create one VPC with the CIDR 10.100.0.0.16.
00:37 Then we will create an internet gateway,
00:40 attach it to the VPC.
00:41 Then we'll create one subnet
00:43 in one of the availability zone
00:45 and then we will create a route table for the subnet
00:49 and make it a public subnet by adding a route for internet.
00:54 Once that is done,
00:55 we will launch an EC2 instance,
00:57 we'll assign a public IP
00:58 because you know that EC2 instance must have public IP
01:02 if it has to be reachable from the internet.
01:05 And once that is done,
01:06 we will connect to this instance using SSH key peer.
01:11 Now this will be a Linux machine
01:13 and that's where we'll be using SSH for the connection.
01:17 So the route table will look something like this
01:19 as you understand this,
01:21 this is a local route which comes by default
01:23 and we will add the second rule,
01:25 what you see here.
01:27 Now, if I want to just list down the steps,
2. Exercise Plan
时间范围：01:30–03:01
总结 / Summary
中文
实操计划依次包括：清理可能造成混淆的默认 VPC（Default VPC）、创建自定义 VPC、创建并附加互联网网关（Internet Gateway）、创建子网并启用自动分配公有 IPv4（auto-assign public IPv4）、创建并关联自定义路由表、启动 EC2、通过安全组（Security Group）允许 SSH/22，最后使用密钥对（key pair）和公有 IP 连接实例。
English
The exercise plan covers removing a potentially confusing Default VPC, creating a custom VPC, creating and attaching an Internet Gateway, creating a subnet with automatic public IPv4 assignment, creating and associating a custom route table, launching an EC2 instance, allowing SSH/22 through a Security Group, and connecting with a key pair and public IP.
Transcript
01:30 again first thing we will do is delete our default VPC,
01:34 just to make sure that,
01:35 you know, it don't interfere with your VPCs
01:40 in the sense like when you go through the console,
01:42 maybe by mistake,
01:44 you might select the default VPC while creating a subnet
01:47 and then you'll wonder where my subnet gone.
01:50 So initially,
01:50 people who are new to AWS makes those kinds of mistakes.
01:54 So in order to make sure you don't do that,
01:58 we will delete default VPC
01:59 and as you know,
02:00 we can anytime go back
02:01 and create a default VPC as required.
02:03 Then we will create a VPC
02:05 as you can see here,
02:06 we'll create internet gateway,
02:07 we'll attach internet gateway to the VPC,
02:10 we will create one subnet
02:12 with the CIDR range 10.100.0.0.24.
02:16 Now this is created in Mumbai
02:17 and we will select one of the easy available in the Mumbai.
02:21 We will also set this parameter
02:23 that is auto send public IP to enable
02:27 so that when instance is launched,
02:29 it will automatically get the public IP.
02:31 If you don't do that,
02:33 then while launching the instance,
02:34 you can still do that,
02:36 but by default,
02:37 it won't have the public IP address.
02:39 Then again,
02:40 you will not use the main route table,
02:42 as you know, we will create a custom route table,
02:45 we will add a route for the internet gateway
02:48 and then we will associate this route table
02:51 with the subnet.
02:52 So essentially this is what we are going to do
02:56 in this exercise.
02:58 So let's go to our AWS console.
3. Create the VPC
时间范围：03:01–04:08
总结 / Summary
中文
控制台实操先删除用于演示的旧 VPC，然后创建名为 MyVPC 的自定义 VPC（custom VPC），IPv4 CIDR 设置为 10.100.0.0/16。删除默认 VPC 只是为了降低资源选择错误的风险，后续仍可按需要重新创建。
English
The console walkthrough removes older demonstration VPCs and creates a custom VPC named MyVPC with the IPv4 CIDR 10.100.0.0/16. Removing the Default VPC is only intended to reduce the risk of selecting the wrong network during the exercise; it can be recreated later if needed.
Transcript
03:01 I have these two VPCs.
03:02 What I'll do,
03:03 I'll just delete both of these VPCs
03:06 so that I know that there are no more VPCs.
03:10 I'll just acknowledge that
03:12 and I will say delete default VPC.
03:18 Now this is a new console.
03:19 So in your case,
03:21 if you are still using the older version of the UI,
03:24 you might not see similar things,
03:26 but essentially all the controls are the same.
03:29 I also have some other VPC,
03:31 which I had created earlier.
03:34 So I will also delete this VPC.
03:39 Okay now you can see,
03:40 I don't have any VPC,
03:41 I'm in the Mumbai region.
03:43 Next I'm going to do is to just create a VPC
03:47 with some name,
03:48 I'll call it my VPC with the IP address range 10.100.00.16
03:54 and rest of the settings,
03:55 I'm keeping as default.
03:57 I don't want IPv6 addresses as of now.
04:00 I just want IPv4 addresses in this VPC.
04:04 So that's it
04:05 and I'll create VPC.
4. Create and Attach the Internet Gateway
时间范围：04:08–04:56
总结 / Summary
中文
创建互联网网关（Internet Gateway, IGW）后，必须把它显式附加（attach）到 MyVPC。仅创建 IGW 并不会自动提供互联网连接；它必须同时被 VPC 附加，并在子网使用的路由表中成为互联网路由目标。
English
After creating an Internet Gateway (IGW), it must be explicitly attached to MyVPC. Merely creating an IGW does not provide Internet connectivity: it must be attached to the VPC and referenced as the target of an Internet route in the subnet's route table.
Transcript
04:07 VPC gets created immediately.
04:10 As we know,
04:12 every VPC has subnets
04:15 and we can also attach internet gateway
04:18 so that should be the next step.
04:20 I'm just creating one internet gateway.
04:23 Maybe I'll just call it "MyVPCIGW".
04:27 Whatever name you want to give,
04:28 you can
04:30 and just create that.
04:33 Once internet gateway is created,
04:34 you have to attach it to the VPC.
04:37 So let's say attached to the VPC
04:39 and select your VPC
04:41 and that's it.
04:42 So if you look at this architecture diagram,
04:45 we had--
04:46 or a network diagram, rather.
04:47 We just created this VPC
04:49 and we created internet gateway
04:51 and attach it.
04:52 Now, next we need to create subnet.
5. Create the Public Subnet
时间范围：04:56–06:11
总结 / Summary
中文
在指定可用区（Availability Zone, AZ）创建 10.100.0.0/24 子网，并启用自动分配公有 IPv4 地址（auto-assign public IPv4 address）。子网创建后默认仍使用 VPC 主路由表（main route table）；启用公有地址只解决实例地址分配，尚未建立互联网路由。
English
A 10.100.0.0/24 subnet is created in a selected Availability Zone, and automatic public IPv4 assignment is enabled. The new subnet still uses the VPC main route table by default. Enabling public address assignment handles instance addressing but does not yet create an Internet route.
Transcript
04:56 So I'm just going to the subnet.
04:57 There are no sub networks right now.
04:59 I'm just creating the first one
05:01 and I want to make it public
05:03 so I'll just name it like that.
05:06 So public subnet.
05:08 So that just her name,
05:09 does not really mean it would be a public,
05:11 unless you are corresponding group tables.
05:14 Make sure you select the right VPC.
05:16 Many times people make some mistakes
05:19 where they select the wrong VPC
05:20 and then they don't find that subnet.
05:23 Now at this moment,
05:24 you will select which EC2 subnet will be created in.
05:27 Right?
05:28 And that means your EC2 instance will also be created
05:31 in that given AZ.
05:32 So I'm selecting the first AZ (mumbles) 1A
05:35 and the CIDR block I'll be giving 10.100.0.0.24.
05:41 I'm just creating that.
05:44 So subnet is created automatically.
05:47 Just one more thing I'll be doing
05:48 is just setting up
05:49 the auto assign public IP settings to be enabled
05:52 so that it automatically gets the public IP address
05:56 when the instances launched.
05:58 Okay, I have done that,
06:00 but as of now,
06:01 this subnet is still referring
06:03 to the main route table of the VPC.
06:06 I want to create a dedicated route table for this subnet.
6. Create and Associate the Public Route Table
时间范围：06:11–07:51
总结 / Summary
中文
为公有子网创建专用路由表（route table），在自动生成的 10.100.0.0/16 本地路由之外添加 0.0.0.0/0 → IGW，然后通过子网关联（subnet association）把该路由表显式关联到目标子网。只创建路由表但不关联子网，路由不会生效。
English
A dedicated route table is created for the public subnet. In addition to the automatically generated 10.100.0.0/16 local route, it receives 0.0.0.0/0 → IGW and is explicitly associated with the target subnet. Creating a route table without associating it to the subnet does not make its routes effective there.
Transcript
06:10 So let me go to the route table
06:13 and let me create a new route table.
06:17 I will call it again, my VPC
06:19 and this is a route table for public traffic.
06:22 So I call it public.
06:24 I'll select my BPC and create it.
06:29 And now I have this route table.
06:31 I need to modify this.
06:33 As you know,
06:34 every route table will come with a default route,
06:36 which is a local for the VPC.
06:39 I will just edit this
06:40 and add one route which says,
06:42 if the traffic is for the internet,
06:45 it has to go through IGW.
06:50 That's it.
06:51 You can also select from the dropdown
06:54 and just save the routes.
06:55 But as of now,
06:56 if you expect it to work right, it won't
07:00 because we just created one route table,
07:02 which is not attached to anything right now.
07:05 Many times we create route table,
07:07 but we forget to attach it to the corresponding subnets.
07:10 So right now this is kind of isolated route table
07:14 within that VPC.
07:15 So next thing you want to make sure,
07:17 you attach it to the subnet.
07:18 So come here to submit association.
07:21 It say, edit subnet associations
07:23 and select the subnet that you had created.
07:26 Right?
07:27 And just save it.
07:28 Now at this moment,
07:30 now my subnet--
07:32 if you go to your subnets
07:34 and just go to the route
07:36 it will show you the route for the internet
07:38 because we have attached this subnet that we have created
07:42 with this table as well.
07:45 So I think we are done with the network setup,
07:49 whatever is shown here.
7. Launch an EC2 Instance
时间范围：07:51–11:16
总结 / Summary
中文
启动 EC2 实例时选择正确的 VPC 和公有子网（public subnet），确认自动分配公有 IP（auto-assign public IP）已启用，并选择 Amazon Linux、符合免费套餐的实例类型及现有或新建密钥对（key pair）。安全组（Security Group）允许 SSH 端口 22，并把来源限制为当前客户端 IP（My IP），以减少不必要的暴露。
English
When launching the EC2 instance, the correct VPC and public subnet are selected, automatic public IP assignment is confirmed, and Amazon Linux, a free-tier-compatible instance type, and an existing or new key pair are chosen. The Security Group allows SSH on port 22 with the source restricted to the current client address (My IP) to reduce unnecessary exposure.
Transcript
07:51 Next step is to go and launch EC2 instance
07:54 in this public subnet.
07:56 So for that,
07:57 we need to launch an EC2 console here.
08:02 Now, as you know, for connecting to EC2,
08:04 we also need a key peer.
08:07 Now I had created a key peer earlier.
08:10 I have two key peers there.
08:11 So I'll be using one of those key peers.
08:14 If you don't have a key peer,
08:15 you can just create a new key peer.
08:17 It will ask you to download the private key
08:19 and it will keep the public key here.
08:22 So in my case,
08:22 I already have this demo Mumbai key peer created.
08:26 So let me go to the instances
08:28 and let me just launch an instance.
08:34 Now, in this case,
08:35 I will launch a T2 micro,
08:38 which is a free instance for first 12 months,
08:42 comes in a free deal.
08:44 Maybe my network is little slow
08:47 so just bear with me
08:52 or let me just refresh.
08:53 Sometimes it works.
09:05 Okay so I'm selecting the Linux on instance,
09:10 Amazon Linux 2 which comes by default
09:13 and now I'm going to select the instance types
09:16 and then I'll select the next storage
09:19 and network as well.
09:23 Okay, I'm selecting T2 micro.
09:25 Let's go to the instance.
09:26 Now this is a page where you will select the network.
09:29 So make sure you select the right VPC and right subnet.
09:32 So I'm selecting my BPC
09:35 and I'm also selecting my public subnet.
09:37 Now, in my case,
09:38 there is only one VPC.
09:39 That's where these values are populated.
09:41 If there are multiple VPCs,
09:43 you might have different VPC selected by default.
09:46 And now you also can see
09:48 auto send public IP is enabled by default.
09:50 If you see disabled,
09:52 you can also enable it from here as well.
09:55 If you did not set up that
09:57 at the subnet level auto send public IP settings.
10:00 So that's it at this page.
10:02 We just want to go and add a storage.
10:05 Now for this EC2 instance,
10:07 we are going with the default eight GB storage.
10:11 As a tag, make sure you always add at least this name tag
10:15 and you call it, let's say EC2A,
10:17 That is my first instance.
10:19 And next comes the security group, right?
10:22 Now, you need to think what security group
10:25 you will be having.
10:27 I mean, what rules you will be having, right?
10:30 So think, right?
10:31 I need to SSH to this machine on port 22.
10:35 Now for that,
10:36 we need to allow this from some IP address,
10:40 which could be my IP address where I'm sitting right now.
10:45 So it automatically detects that IP address,
10:46 but if you want to open it for the world,
10:48 you can make it anywhere.
10:50 That's where it allows both IPv4 and IPv6 internet address.
10:54 Right?
10:55 So let's keep it secure using my IP address.
10:58 And if you are hosting a web server,
11:00 you would really need more rules like port 80, like that.
11:03 So that's it.
11:05 And we will launch the instance.
11:06 At the last screen it will ask for the key peers.
11:10 So in my case,
11:11 I already have this key peer.
11:13 I just acknowledge
11:14 and launch the instance.
8. Connect to the EC2 Instance
时间范围：11:16–12:48
总结 / Summary
中文
实例进入运行状态后，使用其公有 IP 地址（public IP address）和密钥对通过 SSH 连接。Windows/PuTTY 场景可能需要把私钥转换为相应格式并在客户端配置中选择；连接成功同时验证了公有地址、互联网网关路由和安全组规则均已正确配置。
English
After the instance reaches the running state, its public IP address and key pair are used for SSH access. A Windows/PuTTY workflow may require converting and selecting the private key in the appropriate client format. A successful connection verifies that public addressing, the Internet Gateway route, and Security Group rules are all configured correctly.
Transcript
11:15 So that's it about launching the instance.
11:18 Now, the last thing we want to do
11:20 once the instance is up and running,
11:22 we want to make sure we can connect to this instance
11:25 from my workstation.
11:28 So this will take hardly
11:30 maybe a minute or so for instance to be in running state.
11:33 So I'm just pausing this video till that time.
11:36 Okay, my instance is running.
11:37 Status check is still initializing,
11:40 but that's okay.
11:41 Before that,
11:42 even if it is not a status check two by two,
11:45 we can still connect to this instance.
11:47 So for connecting to this instance or internet,
11:49 what I need is it's public IP
11:52 and that's what I'm going to copy it.
11:54 And now from a local client on my machine,
11:57 I can SSH to this machine.
11:59 So I'm right now is--
12:00 I'm using the windows machine
12:02 and that's where I can use a putty
12:05 to connect to my instance.
12:06 I'm just putting its public IP.
12:08 And the next thing I'll be doing is loading my SSH key,
12:13 which I had downloaded earlier.
12:16 This one
12:17 and I'm just opening the connection.
12:19 So it will--
12:22 if the instance is up and running,
12:23 it will just connect me to the instance.
12:25 So it asks me for accepting the server key
12:30 so that it is a known server we know.
12:33 and the default user for this Amazon Linux machine
12:36 is EC2-user.
12:39 You just enter that
12:40 and you are into this instance.
12:42 So that's what this exercise is all about.
12:45 If you look at our architecture again,
9. Architecture Review
时间范围：12:48–13:06
总结 / Summary
中文
最终架构由 VPC、单个公有子网、具有公有和私有 IP 的 EC2、附加到 VPC 的互联网网关以及包含本地与默认互联网路由的子网路由表组成。只有这些组件同时正确配置，实例才能从互联网建立 SSH 连接。
English
The completed architecture consists of a VPC, one public subnet, an EC2 instance with public and private IP addresses, an Internet Gateway attached to the VPC, and a subnet route table containing both local and default Internet routes. All components must be configured together for the instance to accept an SSH connection from the Internet.
Transcript
12:47 we did everything that is mentioned in this diagram, right?
12:52 So if you want to do the same,
12:55 it is included as an exercise.
12:57 So I strongly recommend if you haven't done that earlier,
13:01 please do this exercise.
13:02 Thanks for watching.
整讲总结 / Overall Summary
中文
创建可从互联网访问的公有子网（public subnet）需要完整链路：规划 VPC 与子网 CIDR、创建并附加互联网网关（Internet Gateway）、在自定义路由表（custom route table）中配置 0.0.0.0/0 → IGW、把路由表关联到子网、给 EC2 分配公有 IP，并由安全组（Security Group）允许所需端口。缺少其中任一项都可能导致连接失败。
English
Building an Internet-reachable public subnet requires a complete path: plan the VPC and subnet CIDRs, create and attach an Internet Gateway, configure 0.0.0.0/0 → IGW in a custom route table, associate the table with the subnet, assign a public IP to the EC2 instance, and allow the required port in its Security Group. Omitting any one component can break connectivity.
返回顶部 ↑