← All projects

AWS Private Cloud Lab

Completed Feb 23, 2026 · 5 min read

Production-style AWS stack with zero public EC2 exposure. Application traffic enters through an internet-facing ALB; instance management runs exclusively through SSM Session Manager and VPC endpoints. No SSH keys, no bastion host, no NAT gateway.

0
public ec2 ips
0
inbound mgmt ports
3
vpc endpoints

Why this exists

Most secure EC2 tutorials still leave SSH port 22, a bastion in a public subnet, or a NAT gateway so instances can reach AWS APIs. Each of those is attack surface or cost you accept by default.

This lab asks a tighter question: can you run a web app on private compute and manage the host without any of those? Application ingress through ALB only. Shell access through SSM only. AWS API reachability through VPC endpoints only.

Architecture

Traffic flow: Client → ALB → Private EC2 → VPC Endpoints (SSM / S3)

Control plane: IAM instance profile, SSM Session Manager, interface endpoints for SSM and an S3 gateway endpoint.

Data plane: Internet-facing ALB listener → target group → Apache on Amazon Linux 2023 in a private subnet. Security groups allow ALB → EC2 on app ports only.

What was validated

Private EC2 launched with no public IP
Apache served traffic only through the ALB
Shell access via SSM Session Manager — no SSH keys, no bastion
Local service confirmed on-instance (systemctl, curl localhost)
No inbound management ports open on the instance

Failure modes (by design)

Direct EC2 access blocked — no public IP, no SSH security group rule
App unreachable without ALB — only the load balancer path serves HTTP
SSM breaks if VPC endpoints go away — private instances cannot reach SSM over the public internet

Tradeoffs

VPC endpoints add cost and wiring

Interface endpoints for SSM and an S3 gateway endpoint replace what a NAT gateway would have done for AWS API traffic — cheaper at small scale, but you own the endpoint configuration.

ALB adds complexity

For a single instance it is overhead. The point of the lab is the pattern: compute stays private, ingress is deliberate.

Not for every workload

Anything that needs direct host-level access from arbitrary clients, or heavy outbound internet from private subnets without endpoints, needs a different design.


Stack

AWSVPCALBSSMIAMVPC Endpoints
← Previous
BGP Mesh with Private ASNs
Next →
Network Design Lab