VPC and Networking

# Create VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=my-vpc}]'

# Enable DNS hostnames (required for Route 53 private hosted zones)
aws ec2 modify-vpc-attribute \
  --vpc-id vpc-0abc123 \
  --enable-dns-hostnames

aws ec2 describe-vpcs
aws ec2 delete-vpc --vpc-id vpc-0abc123

# Public subnet (us-east-1a)
aws ec2 create-subnet \
  --vpc-id vpc-0abc123 \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-1a}]'

# Private subnet
aws ec2 create-subnet \
  --vpc-id vpc-0abc123 \
  --cidr-block 10.0.10.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-1a}]'

# Auto-assign public IPs on launch (for public subnets)
aws ec2 modify-subnet-attribute \
  --subnet-id subnet-0abc123 \
  --map-public-ip-on-launch

aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-0abc123"
aws ec2 delete-subnet --subnet-id subnet-0abc123

# Create and attach
aws ec2 create-internet-gateway \
  --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=my-igw}]'

aws ec2 attach-internet-gateway \
  --internet-gateway-id igw-0abc123 \
  --vpc-id vpc-0abc123

# Detach and delete
aws ec2 detach-internet-gateway \
  --internet-gateway-id igw-0abc123 --vpc-id vpc-0abc123
aws ec2 delete-internet-gateway --internet-gateway-id igw-0abc123

# Create route table
aws ec2 create-route-table --vpc-id vpc-0abc123 \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=public-rt}]'

# Add default route to IGW (makes it a "public" route table)
aws ec2 create-route \
  --route-table-id rtb-0abc123 \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id igw-0abc123

# Add route via NAT Gateway
aws ec2 create-route \
  --route-table-id rtb-0private \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-0abc123

# Associate subnet with route table
aws ec2 associate-route-table \
  --route-table-id rtb-0abc123 \
  --subnet-id subnet-0abc123

aws ec2 describe-route-tables --filters "Name=vpc-id,Values=vpc-0abc123"

# Allocate Elastic IP first
aws ec2 allocate-address --domain vpc   # note AllocationId

# Create NAT Gateway in public subnet
aws ec2 create-nat-gateway \
  --subnet-id subnet-0public \
  --allocation-id eipalloc-0abc123 \
  --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=my-nat}]'

# Wait for it to be available
aws ec2 wait nat-gateway-available --nat-gateway-ids nat-0abc123

aws ec2 describe-nat-gateways
aws ec2 delete-nat-gateway --nat-gateway-id nat-0abc123

aws ec2 create-network-acl --vpc-id vpc-0abc123

# Allow inbound HTTPS (rule 100, lower = higher priority)
aws ec2 create-network-acl-entry \
  --network-acl-id acl-0abc123 \
  --rule-number 100 \
  --protocol 6 --port-range From=443,To=443 \
  --cidr-block 0.0.0.0/0 --rule-action allow --ingress

# Deny specific IP (rule number < allow rule)
aws ec2 create-network-acl-entry \
  --network-acl-id acl-0abc123 \
  --rule-number 50 \
  --protocol -1 \
  --cidr-block 203.0.113.5/32 --rule-action deny --ingress

# Associate with subnet
aws ec2 replace-network-acl-association \
  --association-id aclassoc-0abc123 \
  --network-acl-id acl-0abc123

# Request peering (same or cross-account)
aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-0abc123 \
  --peer-vpc-id vpc-0def456

# Accept (in peer account/region)
aws ec2 accept-vpc-peering-connection \
  --vpc-peering-connection-id pcx-0abc123

# Add routes in each VPC to route through peering connection
aws ec2 create-route \
  --route-table-id rtb-0abc \
  --destination-cidr-block 10.1.0.0/16 \
  --vpc-peering-connection-id pcx-0abc123

# Gateway endpoint (S3, DynamoDB — free)
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc123 \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-0abc123

# Interface endpoint (PrivateLink — paid per hour + data)
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc123 \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.us-east-1.secretsmanager \
  --subnet-ids subnet-0abc123 \
  --security-group-ids sg-0abc123 \
  --private-dns-enabled

aws ec2 describe-vpc-endpoints --filters "Name=vpc-id,Values=vpc-0abc123"

# Application Load Balancer (HTTP/HTTPS, L7)
aws elbv2 create-load-balancer \
  --name my-alb \
  --type application \
  --subnets subnet-0pub1 subnet-0pub2 \
  --security-groups sg-0abc123

# Target group
aws elbv2 create-target-group \
  --name my-tg \
  --protocol HTTP --port 80 \
  --vpc-id vpc-0abc123 \
  --target-type instance \
  --health-check-path /health

# Register targets
aws elbv2 register-targets \
  --target-group-arn arn:aws:elasticloadbalancing:... \
  --targets Id=i-0abc123,Port=80

# HTTP listener
aws elbv2 create-listener \
  --load-balancer-arn arn:aws:elasticloadbalancing:... \
  --protocol HTTP --port 80 \
  --default-actions Type=forward,TargetGroupArn=arn:...

aws elbv2 describe-load-balancers
aws elbv2 describe-target-health --target-group-arn arn:...

# List hosted zones
aws route53 list-hosted-zones

# Create public hosted zone
aws route53 create-hosted-zone \
  --name example.com \
  --caller-reference $(date +%s)

# Upsert A record
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234 \
  --change-batch '{
    "Changes": [{
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "api.example.com",
        "Type": "A",
        "TTL": 300,
        "ResourceRecords": [{"Value": "1.2.3.4"}]
      }
    }]
  }'

# Alias record to ALB
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234 \
  --change-batch file://alias-record.json