Setting up the environment

{
            "Sid": "NzcloudAdditionalPermissions",
            "Effect": "Allow",
            "Action": [
                "ebs:*",
                "elasticfilesystem:*",
                "iam:SimulatePrincipalPolicy",
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "iam:GetPolicy",
                "route53domains:ListDomains",
                "route53domains:CheckDomainAvailability",
                "support:DescribeTrustedAdvisorCheckResult",
                "support:DescribeTrustedAdvisorChecks",
                "s3:GetBucketEncryption",
                "s3:GetBucketLifecycle",
                "servicequotas:ListServiceQuotas"
            ],
            "Resource": "*"
        }

1. A VPC with DNS support and a DNS hostname.

   aws ec2 create-vpc --cidr-block ${VPC_CIDR}
   
   aws ec2 modify-vpc-attribute \
   	  --vpc-id ${VPC_ID} \
   	  --enable-dns-support "{\"Value\":true}"
   aws ec2 modify-vpc-attribute \
   	  --vpc-id ${VPC_ID} \
   	  --enable-dns-hostnames "{\"Value\":true}"

2. An internet gateway that is attached to the VPC.

   aws ec2 create-internet-gateway
   
   aws ec2 attach-internet-gateway \
       --vpc-id ${VPC_ID} \
       --internet-gateway-id ${INTERNETGATEWAY_ID}

3. A Public Route Table that is associated with the VPC, and a Route in that Route Table to the Internet Gateway.

   aws ec2 create-route-table --vpc-id ${VPC_ID}
   
   ---
   
   aws ec2 create-route \
   
   --route-table-id ${ROUTE_TABLE_PUBLIC} \
   
   --destination-cidr-block 0.0.0.0/0 \
   
   --gateway-id ${INTERNETGATEWAY_ID}

4. A Public Subnet for the VPC in the wanted ZONE that needs to be mapped to a REGION and associated with the Public Route Table.

   aws ec2 create-subnet \
       --vpc-id ${VPC_ID} \
       --availability-zone ${SUBNET_PUBLIC_1_ZONE} \
       --cidr-block ${SUBNET_PUBLIC_1_CIDR}
   
   aws ec2 associate-route-table \
       --subnet-id ${SUBNET_PUBLIC_1_ID} \
       --route-table-id ${ROUTE_TABLE_PUBLIC}
   aws ec2 modify-subnet-attribute \
       --subnet-id ${SUBNET_PUBLIC_1_ID} \
       --map-public-ip-on-launch \
       --region $REGION

   1. An address allocation (Elastic IP), and NAT Gateway for the public subnet that is attached to the address allocation.

      aws ec2 allocate-address \
          --domain vpc \
          --network-border-group $REGION
      
      aws ec2 create-nat-gateway \
          --subnet-id ${SUBNET_PUBLIC_1_ID} \
          --allocation-id $ELASTIC_IP_NAT_GATEWAY

   2. A Private Route Table and a route for the NAT Gateway.

      aws ec2 create-route-table 
          --vpc-id ${VPC_ID}
                
      aws ec2 create-route \
          --route-table-id ${ROUTE_TABLE_PRIVATE} \
          --destination-cidr-block 0.0.0.0/0 \
          --nat-gateway-id ${NATGATEWAY_ID}

5. Create at least three subnets with a different CIDR BLOCK and ZONE that are associated with the Private Route Table.

   aws ec2 create-subnet \
       --vpc-id ${VPC_ID} \
       --availability-zone ${SUBNET_PRIVATE_1_ZONE} \
       --cidr-block ${SUBNET_PRIVATE_1_CIDR}
   aws ec2 associate-route-table --route-table-id ${ROUTE_TABLE_PRIVATE} --subnet-id ${SUBNET_PRIVATE_1_ID}
   
   aws ec2 create-subnet \
       --vpc-id ${VPC_ID} \
       --availability-zone ${SUBNET_PRIVATE_2_ZONE} \
       --cidr-block ${SUBNET_PRIVATE_2_CIDR}
   aws ec2 associate-route-table --route-table-id ${ROUTE_TABLE_PRIVATE} --subnet-id ${SUBNET_PRIVATE_2_ID}
   
   aws ec2 create-subnet \
       --vpc-id ${VPC_ID} \
       --availability-zone ${SUBNET_PRIVATE_3_ZONE} \
       --cidr-block ${SUBNET_PRIVATE_3_CIDR}
   aws ec2 associate-route-table --route-table-id ${ROUTE_TABLE_PRIVATE} --subnet-id ${SUBNET_PRIVATE_3_ID}

6. Create a Route53.

   aws route53 create-hosted-zone \
       --name ${HOSTED_ZONE_PRIVATE_NAME} \
       --vpc VPCRegion=$REGION,VPCId=${VPC_ID} \
       --caller-reference ${HOSTED_ZONE_PRIVATE_CALLER_REF} \
       --hosted-zone-config PrivateZone=true

7. Create a Bastion Node with an SSH Key, a Security Group, and an ingress rule for SSH Access.

   aws ec2 create-key-pair \
   		--key-name $SSH_KEY_NAME \
   		--query 'KeyMaterial' \
   		--output text \
   		--region $REGION > $SSH_KEY
   
   aws ec2 create-security-group \
       --group-name SSHAccess \
       --description $DESCRIPTION \ # e.g. "SSH Access"
       --vpc-id $VPC_ID \
       --region $REGION
       
   aws ec2 authorize-security-group-ingress \
   		--group-id $SECURITY_GROUP_ID_BASTION \
   		--protocol tcp \
   		--port 22 \
   		--cidr $INGRESS_CIDR \ # e.g 0.0.0.0/0
   		--region $REGION
   
   aws ec2 run-instances \
       --image-id $AMI_ID \
       --count 1 \
       --instance-type $INSTANCE_TYPE \ # e.g. t2.medium
       --key-name $SSH_KEY_NAME \
       --security-group-ids $SECURITY_GROUP_ID_BASTION \
       --subnet-id ${SUBNET_PUBLIC_1_ID}