How to associate an EC2 instance with a custom VPC

Before we begin, a quick note: the screenshots in this tutorial are in Brazilian Portuguese (pt-BR). However, the navigation flow, configuration options, and steps follow the same logic in the English version of the AWS Console. Sorry for any inconvenience, and I hope you enjoy the tutorial!

Portuguese version: Como associar uma instância EC2 a uma VPC personalizada

In this lab you create an isolated network in AWS and launch an EC2 instance inside it. When you finish, three resources are tied together: VPC VPC-01, subnet my-subnet-01, and instance my-server. The instance should not land in the account's default network.

A VPC (Virtual Private Cloud) is the virtual network for your account in one Region. You define the IP address range, the subnets, and the traffic rules. An EC2 instance does not "connect to the cloud" in the abstract. It gets a network interface, and that interface has to live in a subnet. The subnet belongs to a VPC.

AWS already creates a default VPC in each Region. If you launch an EC2 instance without changing the network settings, it goes into that default VPC. That is fine for a quick test. For a lab, it dumps everything into the same address block. A custom VPC fixes that: you create a network just for this exercise and, in the launch wizard, you put the instance in that network.

The address range for this network is 10.0.0.0/24. That notation is CIDR. It describes 256 private IP addresses, from 10.0.0.0 to 10.0.0.255. They do not work as addresses on the public internet. They are for machines talking inside the VPC. Section 1 shows exactly where to type this value.

You do not attach the VPC after the instance exists. You do it in the Launch Wizard: select VPC-01 and subnet my-subnet-01 before you click Launch instance. The instance's network interface is born in that subnet, and therefore in the custom VPC.

Before any other click, check the Region in the upper-right corner of the console. This lab uses US East (N. Virginia), code us-east-1. In the screenshots that label is Estados Unidos (Norte da Virgínia). If the selector shows São Paulo or another Region, open the list and switch. VPCs and EC2 instances do not cross Regions.

Resource IDs (vpc-…, subnet-…, ami-…) change by account and by date. Follow the names and the values in the table, not the IDs in the screenshots. If a capture shows a twelve-digit number in the Owner field (Proprietário), ignore it. That is the AWS account ID, not a lab parameter.

This article does not configure an internet gateway, a route table, or SSH. The goal is to create the VPC and place the EC2 instance in it.

1. Create the custom VPC

The first object is the network. Without it, the EC2 wizard has no custom destination to offer.

In the search bar at the top of the console, type VPC. Open the VPC service (Isolated Cloud Resources).

You land on the VPC dashboard. In the left menu, click Your VPCs (Suas VPCs in the screenshot). That page lists networks in the current Region. You may see the default VPC and other test networks. Do not use them. In the upper-right corner, click Create VPC (Criar VPC).

The wizard asks which creation mode to use. VPC and more (VPC e muito mais) creates the VPC and already adds subnets, a path to the internet, and the matching routes. That is the shortcut. VPC only (Somente VPC) creates the VPC and nothing else. Subnets are on you. This lab uses VPC only so the subnet shows up as an explicit step, at the moment EC2 needs it. Select VPC only.

Before you fill in the addresses, the field notation: CIDR is how you write an IP range. In 10.0.0.0/24, the first 24 bits identify the network and the remaining 8 bits identify hosts: 256 addresses, from 10.0.0.0 to 10.0.0.255. The 10. prefix is private. It only exists inside the VPC. The console accepts blocks between /16 and /28. /24 is the size for this lab.

There are two ways to supply that block. IPv4 CIDR manual input (Entrada manual de CIDR IPv4) lets you type the range. The other option, IPAM, needs an AWS address manager this lab does not use. Select IPv4 CIDR manual input.

Fill in the rest as follows:

• Name tag: VPC-01. In AWS the visible name of a VPC is the Name tag. Without it, the list shows only a vpc-… identifier.
• IPv4 CIDR: 10.0.0.0/24.
• IPv6 CIDR block: leave No IPv6 CIDR block (Nenhum bloco CIDR IPv6).
• Tenancy: leave Default (Padrão). The instance uses ordinary shared EC2 hardware, not a dedicated host.
• VPC encryption control: leave None (Nenhuma). This lab does not use the paid encryption-monitoring feature.

Click the yellow Create VPC (Criar VPC) button in the lower-right corner. The console opens the details for VPC-01. Confirm the state is Available. To see the list, use Your VPCs in the left menu.

VPC-01 still has no subnet. AWS splits each Region into Availability Zones: separate data centers in the same Region. The subnet, created later, picks one of those zones and hands IP addresses to the EC2 network interface. Without a subnet, the instance has no zone and no IP in this VPC. Next we start the launch. The subnet will be created when the EC2 wizard asks for it.

2. Start launching the EC2 instance

With the VPC created, the next resource is the virtual machine. Do not click Launch instance yet. First we fill in the name, image, type, and key. Networking is the following section.

In the search bar, type EC2 and open the EC2 service (Virtual Servers in the Cloud).

In the left menu of the dashboard, click Instances (Instâncias). You see the virtual machines in N. Virginia.

In the upper-right corner of the list, click Launch instances (Executar instâncias). If the table already has other machines, ignore them. They are not part of this lab.

The Launch Wizard opens. Under Name and tags (Nome e tags), in the Name field, type my-server. That text becomes the Name tag. It is not the Linux hostname and it is not DNS.

Under Application and OS Images (Amazon Machine Image) (Imagens de aplicação e de sistema operacional), on the Quick Start (Início rápido) tab, choose Amazon Linux. Confirm Amazon Linux 2023. In Architecture (Arquitetura), if it is set to 64-bit (Arm), open the list and switch to 64-bit (x86). After the switch, check again that the selected image is still Amazon Linux 2023: the console may reload the AMI. The t2.micro type in this lab does not exist on Arm. The default user for that image is ec2-user. The ami-… ID changes by Region and by image updates. Pick the Amazon Linux 2023 the console shows today. Do not copy the ID from the screenshot.

Under Instance type (Tipo de instância), select t2.micro (1 vCPU, 1 GiB of memory). If the list does not show t2.micro, turn on the All generations (Todas as gerações) toggle next to the field. The console shows the on-demand price for the Region. Read the value on the screen. It changes. This article does not record the number.

Before networking, the wizard requires a key pair (Par de chaves). That is two files: the public key is stored on the instance; the private key stays on your computer. The Launch instance button stays blocked while the field is empty, even in this lab, where we will not open SSH. The key pair exists because the console requires it. Connecting to the instance from the internet is not part of this walkthrough.

• If the list is empty, click Create new key pair (Criar novo par de chaves), pick a name, download the .pem file, and select the pair you just created. Keep the .pem out of Git.
• If you already have a pair and you still have the file, select that pair.
• The screenshot in this lab shows the name aws-server. You do not need to reuse that name. You need a pair selected, with the file in your possession.

Do not launch the instance yet. The network block still points at the Region's default VPC, with public IP enabled and an offer to create a new security group (launch-wizard-…) with SSH open to any address. The next section swaps that network for VPC-01.

3. Select VPC-01 in the Launch Wizard

If you click Launch instance now, my-server is born in the default VPC. VPC-01 stays empty. The association starts here, on the Edit (Editar) button.

Scroll to Network settings (Configurações de rede). On the right side of that block, click Edit.

The block expands. Open the VPC list. Select VPC-01, with CIDR 10.0.0.0/24. The default VPC stays in the list, marked as default: that is AWS's default, not the network for this lab.

When you change the VPC, the wizard looks for subnets inside it. VPC-01 still has none. Two red warnings appear: No subnet found (Nenhuma sub-rede encontrada) and a requirement to set Auto-assign public IP (Atribuir IP público automaticamente). Both are expected. The public IP is set after the subnet exists. The real blocker now is the subnet.

The firewall also switches to Select existing security group (Selecionar grupo de segurança existente), with the default group of VPC-01. A security group belongs to one VPC. The launch-wizard-… group from the default VPC cannot be used on this network. Leave the default group of VPC-01. We come back to it after the subnet.

On the right, click Create new subnet (Criar nova sub-rede). The link opens the subnet wizard in another browser tab. Do not close the Launch Wizard tab, and do not reload that tab with F5: the my-server form is lost. Leave it open.

In the new tab, the VPC ID field starts at Select a VPC (Selecionar uma VPC). The shortcut does not fill in VPC-01 for you. Open the list and select VPC-01 again.

After that selection, the rest of the subnet form is enabled.

4. Create subnet my-subnet-01

A subnet is a slice of the VPC in one Availability Zone. The VPC covers the us-east-1 Region. The subnet picks a zone, in this lab us-east-1a. The instance inherits that zone. There is no such thing as EC2 "only in the VPC": the network interface needs a subnet.

In Subnet name (Nome da sub-rede), type my-subnet-01.

In Availability Zone (Zona de disponibilidade), open the list. Do not leave No preference (Sem preferência): AWS would pick the zone, and the lab would be hard to repeat. Find the row whose zone name is us-east-1a. Next to it is a use1-az… code. That code is different in every account. Do not pick by the use1-az1 column in the screenshot. Pick by the text us-east-1a.

The IPv4 VPC CIDR block (Bloco CIDR IPv4 da VPC) should show 10.0.0.0/24. The subnet has to fit inside that range.

The IPv4 subnet CIDR block (Bloco CIDR IPv4 da sub-rede) field comes filled with 10.0.0.0/28. /28 is 16 addresses. AWS reserves five addresses in every subnet (network address, internal router, DNS, a future reservation, and broadcast). In a /28 that leaves 11 usable. Do not leave /28. Delete it and type 10.0.0.0/24, the same block as the VPC. Only then does the subnet get 251 available addresses (256 minus the five reserved), matching this lab.

In the lower-right corner, click Create subnet (Criar sub-rede). Wait for the green success banner. The list should show my-subnet-01, state Available, IPv4 CIDR 10.0.0.0/24, and 251 available addresses. If you see /28 and about 11 addresses, the subnet was created with the form default. Select the row, open Actions (Ações), choose Delete subnet (Excluir sub-rede), confirm, and create it again with 10.0.0.0/24.

A /24 subnet inside a /24 VPC uses the entire space. There is no room left for a second subnet in another zone unless you add another CIDR to the VPC. For this one-zone lab, that is expected.

Leave this tab as a check and go back to the Launch Wizard tab (title Launch an instance / Executar uma instância). Do not press F5 on that tab.

5. Return to the Launch Wizard and launch the instance

In the Launch Wizard, find the Subnet (Sub-rede) field. If the list is still empty, click the circular refresh icon to the right of the VPC field or the Subnet field. Do not reload the page. my-subnet-01 should appear, in zone us-east-1a, with CIDR 10.0.0.0/24. Select it.

Under Auto-assign public IP, choose Disable (Desabilitar). The red warning on that option goes away. The instance gets a private IP in 10.0.0.0/24. It does not get a public address. Without a public address, you cannot SSH from your home network. That does not undo the association: the interface is still in my-subnet-01 and in VPC-01.

For the instance to talk to the internet in this design, you would still need an internet gateway, a route to the whole internet (written 0.0.0.0/0, "any IPv4 address"), and a public address (or NAT). With public IP set to Disable, a gateway and a route are not enough by themselves. This lab does not create those objects. The target here is the custom VPC, not public access.

Under Firewall (security groups) (Firewall (grupos de segurança)), keep Select existing security group and the default group of VPC-01. Do not switch back to creating a group with SSH sourced from 0.0.0.0/0 in this lab: that source, the same "any address" as the internet route, opens port 22 to the entire internet.

A security group is the traffic filter on the network interface. The default group of a new VPC, in the AWS documentation, allows traffic from the group itself and allows outbound traffic. It does not open SSH to the internet on its own. Reading the inbound rules later, under EC2 → Security groups (Grupos de segurança), is optional and is not part of the association.

In the summary on the right, check: Amazon Linux 2023, t2.micro, firewall default, one 8 GiB volume, key pair selected. Click Launch instance (Executar instância).

The console shows a launch confirmation, usually with the instance ID. On that screen, click View all instances (Ver todas as instâncias). If that button is missing, use Instances in the left menu. Do not use the browser Back button: you can land on an empty form again.

In the list, click the name my-server. The state moves from pending to running in a few seconds. Open the Networking (Rede) tab. The VPC should be VPC-01 and the subnet should be my-subnet-01. This article does not include a screenshot of that page after the click. The success criterion for the association is exactly that VPC and subnet pair in the instance details.

What you built

From largest to smallest, the chain is:

1. VPC VPC-01 defines the 10.0.0.0/24 block in Region us-east-1.
2. Subnet my-subnet-01 uses that block in zone us-east-1a.
3. The network interface of my-server gets a private IP in that subnet.
4. The default group of VPC-01 filters traffic on that interface.

Creating the VPC by itself does not move the EC2 instance. Launching EC2 without Edit on the network settings leaves the instance in the default VPC. The association happens when the VPC-01 subnet is selected in the Launch Wizard at the moment you click Launch instance.

my-server is on the custom network. From the screenshots in this lab, it is not reachable from the internet. Exposing SSH would take a gateway, a route, a public address, and an inbound rule you chose on purpose. That is a different exercise.

Official references for the concepts used here: What is Amazon VPC?, Create a VPC, Subnet CIDR blocks, and Launch an Amazon EC2 instance.