The first step is to logically partition the VPC into separate subnets based on our requirements. Next we apply security groups (firewalls) to each of the subnets to accept connections on fixed TCP ports (from predefined subnets). The main purpose of having separate subnets is to secure the hosts by restricting access to them. For example, we host the RDS MYSQL database server in a private subnet that accepts connections on port 3306 only. This access is restricted to be from two public subnets. The VPC and the subnets created within the VPC are listed here:

• Subnet at 172.31.112.0/20 that hosts the bastion host and accepts SSH connection from trusted sources only.
• Public subnets hosting the EC2 instances in the auto-scaling group for the application. It accepts HTTP and HTTPS connections from any source.
• Private subnets at 172.31.80.0/20 and 172.31.96.0/20 to host the database servers and accept MYSQL connections only from defined public and bastion security groups.

The default VPC subnets configured in Chapter 5, Designing for and Implementing High Availability, were 172.31.16.0/20 in AZ us-east-1a and 172.31.48.0/20 in AZ us-east-1c. We will continue to use them as our public subnets.