AWS Private Cloud Lab
Production-style AWS stack with zero public EC2 exposure. Application traffic enters through an internet-facing ALB; instance management runs exclusively through SSM Session Manager and VPC endpoints. No SSH keys, no bastion host, no NAT gateway.
Why this exists
Most secure EC2 tutorials still leave SSH port 22, a bastion in a public subnet, or a NAT gateway so instances can reach AWS APIs. Each of those is attack surface or cost you accept by default.
This lab asks a tighter question: can you run a web app on private compute and manage the host without any of those? Application ingress through ALB only. Shell access through SSM only. AWS API reachability through VPC endpoints only.
Architecture
Traffic flow: Client → ALB → Private EC2 → VPC Endpoints (SSM / S3)
Control plane: IAM instance profile, SSM Session Manager, interface endpoints for SSM and an S3 gateway endpoint.
Data plane: Internet-facing ALB listener → target group → Apache on Amazon Linux 2023 in a private subnet. Security groups allow ALB → EC2 on app ports only.
What was validated
systemctl, curl localhost)Failure modes (by design)
Tradeoffs
VPC endpoints add cost and wiring
Interface endpoints for SSM and an S3 gateway endpoint replace what a NAT gateway would have done for AWS API traffic — cheaper at small scale, but you own the endpoint configuration.
ALB adds complexity
For a single instance it is overhead. The point of the lab is the pattern: compute stays private, ingress is deliberate.
Not for every workload
Anything that needs direct host-level access from arbitrary clients, or heavy outbound internet from private subnets without endpoints, needs a different design.
Stack