Setup a secure VPC and web server

Setting up a secure Virtual Private Cloud (VPC) and a web server on AWS involves several steps to ensure that your infrastructure is not only functional but also secure. The process will include configuring network security, setting up the VPC, deploying a web server (e.g., Apache or Nginx), and securing your web server by applying best practices for firewalls, SSH access, and using SSL/TLS for encryption.

In this guide, we will walk you through the steps to set up a secure VPC and a web server on AWS.

Introduction to VPCs and Web Servers
Planning the VPC Infrastructure
Creating the VPC
Setting up Subnets and Routing
Configuring Security Groups
Creating an EC2 Instance for the Web Server
Setting Up the Web Server (Apache or Nginx)
Configuring SSL/TLS for HTTPS
Securing SSH Access
Testing the Setup
Conclusion

1. Introduction to VPCs and Web Servers

A Virtual Private Cloud (VPC) is a logically isolated section of AWS where you can launch AWS resources in a virtual network that you define. A VPC allows you to control aspects like IP address ranges, subnets, routing tables, and network gateways.

A web server is a computer that hosts a website and serves web pages to users over the internet. It can be deployed on a virtual machine or an EC2 instance in AWS. In this case, we will set up an EC2 instance that runs a web server (Apache or Nginx).

When setting up a VPC and web server, security is a top concern. We will ensure secure communication and restrict unauthorized access by configuring proper security groups, applying network access control, and setting up SSL for encrypted communications.

2. Planning the VPC Infrastructure

Before creating the VPC, consider the following:

CIDR Block: A VPC is defined by its IP address range. You’ll need to choose an appropriate CIDR block (e.g., 10.0.0.0/16), which allows you to have multiple subnets and ample IP addresses.
Subnets: A VPC typically contains multiple subnets. You’ll want at least one public subnet (for your web server) and possibly a private subnet (for databases, etc.). Ensure proper IP address allocation.
Internet Gateway: The web server will need an Internet Gateway (IGW) to connect to the internet. This will be attached to your VPC.
Security Groups and Network ACLs: Properly configure firewalls to control access to your web server and VPC.
Route Tables: Ensure routing is set up so traffic can flow from the internet to your web server.

3. Creating the VPC

In AWS, navigate to the VPC Dashboard and follow the steps to create a new VPC:

Go to VPC in the AWS Console.
Click Create VPC.
Configure the VPC:
- Name: MySecureVPC
- IPv4 CIDR block: 10.0.0.0/16 (or any other range suitable for your use case)
- Tenancy: Default (unless you require dedicated instances)
Click Create. This creates the VPC itself.

4. Setting Up Subnets and Routing

Now, you’ll create subnets to organize your resources:

Create a Public Subnet:
- Name: PublicSubnet
- CIDR Block: 10.0.1.0/24 (for example)
- Availability Zone: Select a suitable Availability Zone (AZ) like us-west-2a.
- Public IP: Enable auto-assign public IP for instances in this subnet.
Create a Private Subnet (Optional, for backend services like databases):
- Name: PrivateSubnet
- CIDR Block: 10.0.2.0/24
- Availability Zone: Select the same or another AZ.
Create and Attach an Internet Gateway (IGW):
- Go to Internet Gateways in the VPC Dashboard.
- Create an Internet Gateway and attach it to your VPC.
Modify Route Tables:
- For the public subnet, associate the route table with the Internet Gateway to route traffic to/from the internet.
- For the private subnet, you may not need internet access or you can route traffic via a NAT Gateway if you need outgoing internet access for private resources.

5. Configuring Security Groups

Security groups act as virtual firewalls to control the inbound and outbound traffic to your EC2 instances.

Create a Security Group for the Web Server:
- Go to Security Groups in the VPC Dashboard.
- Click Create Security Group.
- Name the security group WebServerSG.
- Allow inbound traffic for HTTP (port 80) and HTTPS (port 443).
  - Inbound Rule: Allow HTTP (80) and HTTPS (443) from anywhere (0.0.0.0/0), but restrict SSH (22) to your IP or a specific range for security.
- Outbound traffic should be open to all, as the server needs to fetch updates and communicate with other services.
Attach the Security Group to your EC2 Instance once it’s created.

6. Creating an EC2 Instance for the Web Server

Launch an EC2 Instance in the public subnet to act as your web server.
- Choose an Amazon Machine Image (AMI): Select an appropriate AMI (e.g., Amazon Linux 2 or Ubuntu 20.04).
- Instance Type: Choose an appropriate size (e.g., t2.micro for small, low-traffic websites).
- Configure Instance:
  - Choose the Public Subnet for your web server.
  - Attach the Security Group (WebServerSG).
- Add Storage: The default 8GB of SSD storage is typically sufficient for basic web hosting.
- Configure a Key Pair: Choose an existing SSH key or create a new one to allow access to the EC2 instance.
After launching the instance, note the public IP address or Elastic IP assigned to the instance.

7. Setting Up the Web Server (Apache or Nginx)

Once the EC2 instance is running, connect to it using SSH:

ssh -i "your-key.pem" ec2-user@<public-ip>

Install a web server:

For Apache: sudo yum update -y sudo yum install -y httpd sudo systemctl start httpd sudo systemctl enable httpd
For Nginx: sudo yum update -y sudo amazon-linux-extras install nginx1.12 -y sudo systemctl start nginx sudo systemctl enable nginx

Verify that the web server is running by visiting the public IP address of your EC2 instance in your browser. You should see the default Apache or Nginx welcome page.

8. Configuring SSL/TLS for HTTPS

To secure your web traffic, install SSL/TLS on your web server using Let’s Encrypt (a free SSL certificate provider).

Install Certbot: sudo yum install -y certbot
Obtain an SSL Certificate:
- For Apache: sudo certbot --apache
- For Nginx: sudo certbot --nginx
Follow the prompts to get and configure the SSL certificate for your domain. Ensure your domain is pointed to the public IP of your EC2 instance via Route 53 or another DNS provider.
Test HTTPS: After obtaining the SSL certificate, visit your domain using https:// to ensure the certificate is working and the site is encrypted.

9. Securing SSH Access

To secure SSH access to your EC2 instance:

Restrict SSH access: Modify the security group to restrict SSH (port 22) to only your specific IP or range of trusted IPs.
Disable Root SSH Access: For better security, edit the /etc/ssh/sshd_config file and ensure the following: PermitRootLogin no
Use SSH Key Pairs: Only use SSH keys for authentication. Do not rely on password authentication for SSH access.
Configure Fail2Ban: Install Fail2Ban to prevent brute-force attacks. sudo yum install fail2ban -y sudo systemctl enable fail2ban sudo systemctl start fail2ban

10. Testing the Setup

Web Server Access: Test that the web server is accessible via your public IP or domain name, and verify that HTTPS is working by accessing your site with https://.
SSH Access: Ensure you can SSH into the EC2 instance using the key pair.
Firewall Rules: Test the security groups by attempting to access the web server using ports 80, 443, and 22 to ensure they are correctly configured.

In this guide, you have learned how to set up a secure VPC and a web server on AWS. By creating a VPC, subnets, configuring security groups, and installing a web server, you have built a scalable and secure infrastructure for your web application. Additionally, by securing your SSH access, configuring SSL/TLS encryption, and restricting unnecessary access, you’ve ensured that your environment is secure for production use.

This setup can serve as a foundation for building more complex and highly available architectures. You can expand it by adding load balancers, auto-scaling groups, or integrating other AWS services for monitoring, backups, and scaling as your application grows.

Table of Contents