Skip to content

Commit 4e5a66a

Browse files
benjaminhonoriobenjaminhonorio
committed
feat: minor update and add references
1 parent 60ac299 commit 4e5a66a

1 file changed

Lines changed: 107 additions & 65 deletions

File tree

‎techbooks/phases/phase-1-mvp-launch.md‎

Lines changed: 107 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
**Situation:** TechBooks just got seed funding. The founder needs a working website in 2 weeks to demo to investors.
66

77
**Requirements:**
8+
89
- Simple website: browse books, place orders
910
- Admin panel for inventory management
1011
- Budget: ~$50/month
@@ -49,12 +50,12 @@ flowchart TB
4950

5051
### WHY Custom VPC Instead of Default VPC?
5152

52-
| Aspect | Default VPC | Custom VPC | WHY It Matters |
53-
|--------|-------------|------------|----------------|
54-
| **CIDR Block** | Fixed 172.31.0.0/16 | You choose (e.g., 10.0.0.0/16) | Avoid IP conflicts when connecting to on-premises or other VPCs |
55-
| **Subnets** | One per AZ, all public | You design public/private | Security: databases shouldn't be public |
56-
| **Learning** | Hides complexity | Forces understanding | You'll need this knowledge for the exam and real jobs |
57-
| **Production readiness** | Not recommended | Industry standard | Default VPC is for quick demos only |
53+
| Aspect | Default VPC | Custom VPC | WHY It Matters |
54+
| ------------------------ | ---------------------- | ------------------------------ | --------------------------------------------------------------- |
55+
| **CIDR Block** | Fixed 172.31.0.0/16 | You choose (e.g., 10.0.0.0/16) | Avoid IP conflicts when connecting to on-premises or other VPCs |
56+
| **Subnets** | One per AZ, all public | You design public/private | Security: databases shouldn't be public |
57+
| **Learning** | Hides complexity | Forces understanding | You'll need this knowledge for the exam and real jobs |
58+
| **Production readiness** | Not recommended | Industry standard | Default VPC is for quick demos only |
5859

5960
> **SAA Exam Tip:** Questions often test whether you understand that resources in private subnets can't be accessed directly from the internet - this is a security best practice.
6061
@@ -68,12 +69,12 @@ flowchart TB
6869

6970
The number after `/` tells you how many IP addresses you get:
7071

71-
| CIDR | IP Addresses | Use Case |
72-
|------|--------------|----------|
73-
| /16 | 65,536 | Large VPC (AWS max for VPC) |
74-
| /20 | 4,096 | Medium subnet |
75-
| /24 | 256 | Small subnet (common choice) |
76-
| /28 | 16 | Minimum for AWS subnet |
72+
| CIDR | IP Addresses | Use Case |
73+
| ---- | ------------ | ---------------------------- |
74+
| /16 | 65,536 | Large VPC (AWS max for VPC) |
75+
| /20 | 4,096 | Medium subnet |
76+
| /24 | 256 | Small subnet (common choice) |
77+
| /28 | 16 | Minimum for AWS subnet |
7778

7879
### WHY Does This Matter?
7980

@@ -90,6 +91,7 @@ flowchart LR
9091
```
9192

9293
**Key insight:** AWS reserves 5 IPs per subnet:
94+
9395
- `.0` - Network address
9496
- `.1` - VPC router
9597
- `.2` - DNS server
@@ -104,15 +106,16 @@ So a `/24` subnet gives you **251 usable IPs**, not 256.
104106

105107
For Phase 1, we'll keep it simple but plan for growth:
106108

107-
| Component | CIDR | Purpose |
108-
|-----------|------|---------|
109-
| VPC | 10.0.0.0/16 | Room to grow |
110-
| Public Subnet (AZ-a) | 10.0.1.0/24 | Web servers, bastion hosts |
111-
| Public Subnet (AZ-b) | 10.0.2.0/24 | Future HA |
112-
| Private Subnet (AZ-a) | 10.0.10.0/24 | Databases (future) |
113-
| Private Subnet (AZ-b) | 10.0.20.0/24 | Future HA |
109+
| Component | CIDR | Purpose |
110+
| --------------------- | ------------ | -------------------------- |
111+
| VPC | 10.0.0.0/16 | Room to grow |
112+
| Public Subnet (AZ-a) | 10.0.1.0/24 | Web servers, bastion hosts |
113+
| Public Subnet (AZ-b) | 10.0.2.0/24 | Future HA |
114+
| Private Subnet (AZ-a) | 10.0.10.0/24 | Databases (future) |
115+
| Private Subnet (AZ-b) | 10.0.20.0/24 | Future HA |
114116

115117
**WHY this design?**
118+
116119
- `/16` VPC = plenty of room for future subnets
117120
- Separate ranges for public (1-9) and private (10-99) = easy to remember
118121
- Two AZs planned = ready for high availability in Phase 3
@@ -155,10 +158,10 @@ flowchart TB
155158

156159
### WHY This Matters
157160

158-
| Subnet Type | Route to Internet | Use Case | Security Level |
159-
|-------------|-------------------|----------|----------------|
160-
| **Public** | Via Internet Gateway | Web servers, bastion hosts | Lower (exposed) |
161-
| **Private** | Via NAT Gateway or none | Databases, app servers | Higher (hidden) |
161+
| Subnet Type | Route to Internet | Use Case | Security Level |
162+
| ----------- | ----------------------- | -------------------------- | --------------- |
163+
| **Public** | Via Internet Gateway | Web servers, bastion hosts | Lower (exposed) |
164+
| **Private** | Via NAT Gateway or none | Databases, app servers | Higher (hidden) |
162165

163166
> **SAA Exam Tip:** "How do you make a subnet public?" Answer: Add a route to an Internet Gateway in its route table + assign public IPs to instances.
164167
@@ -175,6 +178,7 @@ An **Internet Gateway** is a horizontally scaled, redundant, highly available VP
175178
Without an IGW, nothing in your VPC can reach the internet (and vice versa).
176179

177180
**Key characteristics:**
181+
178182
- One IGW per VPC (hard limit)
179183
- AWS manages it - no bandwidth constraints
180184
- No availability risk - it's highly available by design
@@ -206,13 +210,13 @@ flowchart LR
206210

207211
### Key Characteristics (Exam Favorites!)
208212

209-
| Feature | Security Group Behavior |
210-
|---------|------------------------|
211-
| **State** | Stateful - return traffic automatically allowed |
212-
| **Default inbound** | Deny all |
213-
| **Default outbound** | Allow all |
214-
| **Rules** | Allow only (no deny rules) |
215-
| **Scope** | Instance level |
213+
| Feature | Security Group Behavior |
214+
| -------------------- | ----------------------------------------------- |
215+
| **State** | Stateful - return traffic automatically allowed |
216+
| **Default inbound** | Deny all |
217+
| **Default outbound** | Allow all |
218+
| **Rules** | Allow only (no deny rules) |
219+
| **Scope** | Instance level |
216220

217221
### WHY Stateful Matters
218222

@@ -236,23 +240,19 @@ If security groups were **stateless** (like NACLs), you'd need to explicitly all
236240

237241
For Phase 1, our EC2 needs:
238242

239-
```
240-
Inbound Rules:
241-
┌──────────┬──────────┬─────────────────┬─────────────────────────┐
242-
│ Type │ Port │ Source │ WHY │
243-
├──────────┼──────────┼─────────────────┼─────────────────────────┤
244-
│ HTTP │ 80 │ 0.0.0.0/0 │ Web traffic │
245-
│ HTTPS │ 443 │ 0.0.0.0/0 │ Secure web traffic │
246-
│ SSH │ 22 │ YOUR_IP/32 │ Admin access (restrict!)│
247-
└──────────┴──────────┴─────────────────┴─────────────────────────┘
248-
249-
Outbound Rules:
250-
┌──────────┬──────────┬─────────────────┬─────────────────────────┐
251-
│ Type │ Port │ Destination │ WHY │
252-
├──────────┼──────────┼─────────────────┼─────────────────────────┤
253-
│ All │ All │ 0.0.0.0/0 │ Updates, API calls │
254-
└──────────┴──────────┴─────────────────┴─────────────────────────┘
255-
```
243+
**Inbound Rules:**
244+
245+
| Type | Port | Source | WHY |
246+
| ----- | ---- | ----------- | ------------------------ |
247+
| HTTP | 80 | 0.0.0.0/0 | Web traffic |
248+
| HTTPS | 443 | 0.0.0.0/0 | Secure web traffic |
249+
| SSH | 22 | YOUR_IP/32 | Admin access (restrict!) |
250+
251+
**Outbound Rules:**
252+
253+
| Type | Port | Destination | WHY |
254+
| ---- | ---- | ----------- | ------------------ |
255+
| All | All | 0.0.0.0/0 | Updates, API calls |
256256

257257
> **SAA Exam Tip:** Never allow SSH from 0.0.0.0/0 in production. This is a common "what's wrong with this architecture?" question.
258258
@@ -264,11 +264,11 @@ Outbound Rules:
264264

265265
For our MVP:
266266

267-
| Decision | Choice | WHY |
268-
|----------|--------|-----|
269-
| **Instance Type** | t3.micro | Free tier eligible, burstable, enough for 100 users/day |
270-
| **AMI** | Amazon Linux 2023 | Free, optimized for AWS, long-term support |
271-
| **Storage** | 20GB gp3 | gp3 is cheaper than gp2 with better baseline performance |
267+
| Decision | Choice | WHY |
268+
| ----------------- | ----------------- | -------------------------------------------------------- |
269+
| **Instance Type** | t3.micro | Free tier eligible, burstable, enough for 100 users/day |
270+
| **AMI** | Amazon Linux 2023 | Free, optimized for AWS, long-term support |
271+
| **Storage** | 20GB gp3 | gp3 is cheaper than gp2 with better baseline performance |
272272

273273
### Instance Types Decoded
274274

@@ -281,6 +281,7 @@ t3.micro
281281
```
282282

283283
**Common families for SAA exam:**
284+
284285
- **T** (t3, t3a): Burstable, general purpose, cost-effective
285286
- **M** (m5, m6i): General purpose, balanced
286287
- **C** (c5, c6i): Compute optimized
@@ -314,12 +315,14 @@ flowchart LR
314315

315316
When you launch an EC2 instance, you can get a public IP two ways:
316317

317-
| Feature | Auto-Assigned Public IP | Elastic IP (EIP) |
318-
|---------|------------------------|------------------|
319-
| **Persistence** | Changes on stop/start | Stays the same forever |
320-
| **Cost** | Free while running | Free if attached to running instance |
321-
| **DNS** | Changes with IP | Can stay consistent |
322-
| **Reassignment** | Not possible | Can move between instances |
318+
| Feature | Auto-Assigned Public IP | Elastic IP (EIP) |
319+
| ---------------- | ------------------------ | -------------------------- |
320+
| **Persistence** | Changes on stop/start | Stays the same forever |
321+
| **Cost** | ~$3.60/month ($0.005/hr) | ~$3.60/month ($0.005/hr) |
322+
| **DNS** | Changes with IP | Can stay consistent |
323+
| **Reassignment** | Not possible | Can move between instances |
324+
325+
> **Note (Feb 2024 Change):** AWS now charges $0.005/hour for ALL public IPv4 addresses, whether auto-assigned or Elastic IP, attached or not. This was a significant pricing change to encourage IPv6 adoption.
323326
324327
**The Problem with Auto-Assigned IPs:**
325328

@@ -373,17 +376,20 @@ flowchart LR
373376
linkStyle default stroke:#000,stroke-width:2px
374377
```
375378

376-
**Cost Warning:**
379+
**Cost (as of Feb 2024):**
380+
381+
| Scenario | Cost |
382+
| ---------------------------------------------- | ------------------------ |
383+
| Any public IPv4 address (EIP or auto-assigned) | ~$3.60/month ($0.005/hr) |
384+
| EIP **not** attached to any instance | ~$3.60/month ($0.005/hr) |
385+
| EIP attached to stopped instance | ~$3.60/month ($0.005/hr) |
377386

378-
| Scenario | Cost |
379-
|----------|------|
380-
| EIP attached to running instance | Free |
381-
| EIP **not** attached to any instance | ~$3.65/month |
382-
| EIP attached to stopped instance | ~$3.65/month |
387+
**Free Tier Exception:** For accounts in their first 12 months, the Free Tier includes **750 hours/month of in-use public IPv4 addresses** for EC2. This covers approximately one public IP running 24/7. Usage beyond 750 hours is charged at $0.005/hr.
383388

384-
> **SAA Exam Tip:** AWS charges for unused Elastic IPs to discourage hoarding of the limited IPv4 address space. This is a common exam question: "How do you reduce costs?" → Release unused EIPs.
389+
> **SAA Exam Tip:** AWS charges for ALL public IPv4 addresses to discourage IPv4 usage and encourage IPv6 adoption. Common exam questions: "How do you reduce costs?" → Release unused EIPs, use private IPs with NAT Gateway, or adopt IPv6.
385390
386391
**When NOT to use Elastic IP:**
392+
387393
- Behind a Load Balancer (the LB has its own DNS name)
388394
- Using Route 53 with health checks (can auto-failover)
389395
- Auto Scaling groups (instances are disposable)
@@ -429,20 +435,24 @@ flowchart TB
429435
### Must-Know Topics
430436

431437
1. **VPC Fundamentals**
438+
432439
- VPC is region-scoped
433440
- Subnets are AZ-scoped
434441
- One IGW per VPC
435442

436443
2. **CIDR Calculations**
444+
437445
- /16 = 65,536 IPs
438446
- /24 = 256 IPs (251 usable in AWS)
439447
- Always subtract 5 for AWS reserved
440448

441449
3. **Public vs Private**
450+
442451
- Public subnet = route to IGW
443452
- Private subnet = no direct internet route
444453

445454
4. **Security Groups**
455+
446456
- Stateful
447457
- Allow rules only
448458
- Instance level
@@ -459,6 +469,7 @@ flowchart TB
459469
**Business trigger:** TechBooks is getting 500 visitors/day! The single MySQL database on EC2 is showing strain, and you're nervous about losing data.
460470

461471
**Next decisions:**
472+
462473
- Separate the database to RDS
463474
- Implement automated backups
464475
- Move database to private subnet
@@ -477,3 +488,34 @@ Before moving to Phase 2, try building this in AWS:
477488
6. SSH into your instance and install Nginx
478489

479490
**Verification:** You should be able to see the Nginx welcome page from your browser.
491+
492+
---
493+
494+
## References
495+
496+
Official AWS documentation used to validate this content:
497+
498+
### VPC & Networking
499+
500+
- [What is Amazon VPC?](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)
501+
- [Subnet CIDR blocks](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-sizing.html) - Reserved IPs per subnet
502+
- [Internet Gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html) - IGW characteristics and NAT behavior
503+
- [Amazon VPC Quotas](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html) - One IGW per VPC limit
504+
- [Infrastructure Security - Compare Security Groups and Network ACLs](https://docs.aws.amazon.com/vpc/latest/userguide/infrastructure-security.html)
505+
506+
### Security
507+
508+
- [Security Groups](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html)
509+
- [Network ACLs](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) - Stateless behavior
510+
511+
### EC2 & Compute
512+
513+
- [Burstable Performance Instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-credits-baseline-concepts.html) - CPU credits and unlimited mode
514+
- [EC2 Free Tier Usage](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-free-tier-usage.html) - t3.micro eligibility
515+
- [EBS General Purpose SSD Volumes](https://docs.aws.amazon.com/ebs/latest/userguide/general-purpose.html) - gp3 vs gp2 comparison
516+
517+
### Pricing
518+
519+
- [AWS Public IPv4 Address Charge (Feb 2024)](https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address-charge-public-ip-insights/)
520+
- [AWS Free Tier - 750 hours Public IPv4](https://aws.amazon.com/about-aws/whats-new/2024/02/aws-free-tier-750-hours-free-public-ipv4-addresses/)
521+
- [Elastic IP Address Concepts](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eip-overview.html)

0 commit comments

Comments
 (0)