Create a Virtual Private Cloud (VPC):

1. Go to the AWS Management Console and navigate to the VPC dashboard.

2. Click on "Create VPC" and follow the wizard to create a new VPC. Specify the CIDR block for your VPC (e.g., 10.0.0.0/16) and configure any additional settings.

Create Subnets:

1. Within your VPC, create at least two subnets: one public subnet and one private subnet.

2. Define the CIDR blocks for each subnet. For example:

• Public subnet: 10.0.1.0/24

• Private subnet: 10.0.2.0/24

3. Associate the public subnet with an Internet Gateway to enable internet access.

Create Route Tables:

1. Create separate route tables for the public and private subnets.

2. Associate the public subnet's route table with the internet gateway to enable internet access.

3. Associate the private subnet's route table with the local route only (no internet gateway).

RESOURCE MAP SHOULD LOOK LIKE THIS AFTER SETTING UP VPC

Now Launch two EC2 Instances:

1. Launch EC2 instances in both the public and private subnets.

2. Ensure that the instances in the private subnet have private IP addresses and no public IP addresses assigned.

Configure Security Groups:

1. Create and configure security groups for the instances:

• For the instance in the public subnet: Allow inbound SSH port(22) access from your IP address or IP range.

• For the instance in the private subnet: Allow inbound SSH access only from the security group associated with the bastion host.

Set up a Bastion Host

FYI

A bastion host is a server used to manage access to an internal or private network from an external network - sometimes called a jump box or jump server.

Here I am using Mobaxterm you can also use Putty or Ec2 Connect

Step 1

Open Mobaxterm

https://mobaxterm.mobatek.net/download-home-edition.html

Step 2

Select SSH connection

Step 3

Copy and paste your public ip address of public ec2 instance to mobaxterm

Step 4

Type sudo apt update to update all the packages( Linux guys already know)

Step 5

– run ec2metadata to confirm if its a public or private instance, if its public then public-ipv4 address will be displayed.

Step 5 Go to your AWS Instance and select your private instance and click connect

.

Step 6 Click on SSH client and follow these steps in your bastion host.

** your key will be different

Note the IP address of your host also changed

Confirm the connection by running ec2metadata command on terminal

Notice that you are no now connected to private instance and it doesn't have any public IPs available.