- [Alana] Let's take a look at our current VPC state. In the last video we left off with a VPC with an internet gateway attached to it and two subnets, one public, one private and one Availability Zone. However, Morgan was kind enough to build additional resources in the background to make sure our application was highly available. So now we have two additional subnets, one public, one private in a different AZ for a total of four subnets. She also created an EC2 instance hosting our employee directory inside of the public subnet in AZ A. But we're missing one large component here. Say we have a user and that user wants to access our employee directory. Eventually that internet traffic would flow through the internet gateway, but then where would it go? Just because the traffic entered through the door of the VPC, it doesn't mean it ever made it to the right room. What we need to do is provide a path for the internet traffic to not only enter the door, but also make sure the traffic reaches the right room. Or in other words, enter the internet gateway and find the right subnet. The way that we provide that path is through route tables. A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. These route tables can be applied on either the subnet level or at the VPC level. When you create a brand new VPC, AWS creates a route table called the main route table and applies it to the entire VPC. AWS assumes that when you create a new VPC with subnets, you want traffic to flow between those subnets. In the last video when we talked about VPCs being isolated, this is what we meant. The default configuration of the main route table is to allow traffic between all subnets local to the VPC. Let's get a quick look at the main route table of the VPC we just built out in the last video. Hey, Morgan, do you mind showing us a quick example of the main route table? - [Morgan] Sure thing, Alana. Let's hop into the console. Here in the VPC console, we'll click on route tables on the side panel that will bring up all of the route tables that exist in this region. If we scroll to the side, you can see the main column and the VPC column. We're going to look for the main route table for the app-vpc which is this one here. When we click on it, we can bring up the bottom panel and then click on routes. Here we can see the local route that has a destination of the VPC IP range. This means that all of the components inside of our VPC can communicate with one another, locally by default. This local route will be present in every route table that you create. Alright, that's the main route table. Okay, what's next, Alana? - [Alana] While the main route table controls the routing for your entire VPC, you may want to be more granular about how you route your traffic to specific subnets. Remember we mentioned that subnets can be used to group your resources together based on whether they are publicly or privately accessible? Well the subnet itself doesn't provide that access. Whether a subnet has access to the public internet or not depends on its associated route table. If a route from the internet gateway to the subnet exists, it has public access. If the route table doesn't have a route between the subnet and internet gateway, then it doesn't have public access. So we call subnets public or private, but it's really the route table that provides that access. So for your subnets, you'll create custom route tables. Inside these custom route tables, you'll have that default local route inside of it that allows traffic to flow freely within the VPC. But then you'll need to create additional routes. So, the subnet with the internet-facing resources, in this case our EC2 instance with the employee directory website on it, will need a route to the internet gateway. Alright, Morgan, we need your help again. Do you mind creating a custom route table and associating it to our public subnet? - [Morgan] Sure can. Let's go ahead and get started. Let's create the route table for our public subnet. Back in the VPC console once again, we'll click on route tables on the side panel and then create route table. We'll give it a name such as app-route-table-public, choose the app-vpc and then click create. Okay, our route table is now created. But we're not done yet. We still have to edit the routes to allow traffic to flow from the internet gateway. To do this, we'll click on the ID of the route table and then we'll go to the route section in the bottom summary table. We'll click edit routes, add route, put 0.0.0.0/0 for the destination, meaning it can take and deliver traffic from anywhere and then we'll specify the target as an internet gateway. This will bring up available internet gateways to attach it to and from here we'll select the app-igw. We're done with the routes so we'll click save. Now the route table is created, but we need to associate it with a subnet. If we only want this route table to apply to our public subnets, we'll need to associate it with our two public subnets only. To do this, we'll click on the subnet associations tab, select edit subnet associations and choose the public subnets we created earlier. Then click save. So you can see here that the subnet itself isn't providing the public access. It's the configuration of the routes. Alright, we've hooked up our public subnets to a route table that allows internet traffic from the IGW to our employee directory application. If we wanted to create a route table for the private subnets, we would follow similar steps. You'd create the route table, make sure there's no route to the internet gateway this time and then associate it to the private subnets. We'll let you do this part in the exercise at the end of this week. Okay, now we've configured a route to the internet gateway. We'll configure additional firewall rules later on. Okay, back to you Alana. - [Alana] Nice job, Morgan. So this is our final state of the diagram. One VPC, four subnets, one public, one private in both Availability Zones. Our two public subnets are associated with a route table that allows traffic flow from the internet gateway. Our private subnets don't have a route table associated to them yet, so they follow the rules of the main route table. Local traffic only.
