PreviewLab2.5 hours
End-to-End Scenarios
Capstone end-to-end scenarios: NAT asymmetry, isolated S3 workloads, multi-tier SG wiring, VPC peering, and diagnose-without-hints debugging.
- This is the capstone lab. It assumes all previous labs are complete and understood.
- In a new terminal session, run the resume script at the end of Flow Logs + Troubleshooting.
- Each scenario is a complete end-to-end exercise: no guided hand-holding. You are given the goal, the constraints, and the verification steps. Build it yourself, then check.
- The "diagnose without hints" scenario at the end is the real mastery test.
Scenario 1: Private Subnet with Internet Access via NAT
Goal
Build a resource in the private subnet that can reach the internet but cannot be reached from the internet. Verify the asymmetry with Reachability Analyzer.
Constraints:
- NAT Gateway must be in the public subnet
- Private ENI must have no public IP
- Reachability Analyzer must confirm: private ENI → internet = reachable; internet → private ENI = not reachable
- Clean up NAT Gateway after verification (it costs per hour)
Estimated time: 45 minutes