VPC via SDK Basics

Eight short examples that build a real two-tier VPC - one public subnet, one private - entirely from code, then tear it down cleanly.

Each example shows the same operation in both Python (boto3) and TypeScript (AWS SDK for JavaScript v3), so the mechanics translate one to one. Run them in order; later steps reuse ids from earlier ones.

Prerequisites

Python: pip install boto3 (boto3 1.43.x, Python 3.10+). TypeScript: npm install @aws-sdk/client-ec2 (Node.js 18+).
Credentials via aws configure, environment variables, or an IAM role with ec2:*Vpc*, ec2:*Subnet*, ec2:*RouteTable*, ec2:*Route, ec2:*InternetGateway*, and ec2:CreateTags.
These examples create billable-adjacent resources (a VPC and subnets are free; only NAT gateways and elastic IPs cost money, and those are covered on a later page). Clean up with the last example.

Basic Examples

1. Create the VPC

CreateVpc allocates only the CIDR container - the outermost object everything else references.

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
resp = ec2.create_vpc(
    CidrBlock="10.0.0.0/16",
    TagSpecifications=[{"ResourceType": "vpc",
                        "Tags": [{"Key": "Name", "Value": "demo-vpc"}]}],
)
vpc_id = resp["Vpc"]["VpcId"]
print(vpc_id)

// --- TypeScript (AWS SDK v3) ---
import { EC2Client, CreateVpcCommand } from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
const resp = await ec2.send(new CreateVpcCommand({
  CidrBlock: "10.0.0.0/16",
  TagSpecifications: [{ ResourceType: "vpc",
    Tags: [{ Key: "Name", Value: "demo-vpc" }] }],
}));
const vpcId = resp.Vpc?.VpcId;
console.log(vpcId);

A /16 gives 65,536 addresses; size the block for growth since you cannot shrink it later.
Use a private range (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) that will not overlap networks you might peer with.
TagSpecifications tags the VPC at creation so it is never anonymous.
The returned VpcId feeds every following call.

2. Enable DNS Hostnames

Custom VPCs have enableDnsHostnames off by default; flip it so instances get public DNS names.

# --- Python (boto3) ---
ec2.modify_vpc_attribute(VpcId=vpc_id, EnableDnsHostnames={"Value": True})

// --- TypeScript (AWS SDK v3) ---
import { ModifyVpcAttributeCommand } from "@aws-sdk/client-ec2";
 
await ec2.send(new ModifyVpcAttributeCommand({
  VpcId: vpcId,
  EnableDnsHostnames: { Value: true },
}));

enableDnsSupport is already on by default; only enableDnsHostnames needs flipping.
You can only set one attribute per ModifyVpcAttribute call.
Without this, public instances resolve to IPs but get no ec2-...compute.amazonaws.com name.
The change is instant and applies to instances launched afterward.

3. Create a Public and a Private Subnet

CreateSubnet carves a smaller CIDR out of the VPC and pins it to one Availability Zone.

# --- Python (boto3) ---
public = ec2.create_subnet(
    VpcId=vpc_id, CidrBlock="10.0.1.0/24", AvailabilityZone="us-east-1a",
    TagSpecifications=[{"ResourceType": "subnet",
                        "Tags": [{"Key": "Name", "Value": "demo-public-1a"}]}],
)
private = ec2.create_subnet(
    VpcId=vpc_id, CidrBlock="10.0.2.0/24", AvailabilityZone="us-east-1b",
    TagSpecifications=[{"ResourceType": "subnet",
                        "Tags": [{"Key": "Name", "Value": "demo-private-1b"}]}],
)
public_id = public["Subnet"]["SubnetId"]
private_id = private["Subnet"]["SubnetId"]

// --- TypeScript (AWS SDK v3) ---
import { CreateSubnetCommand } from "@aws-sdk/client-ec2";
 
const pub = await ec2.send(new CreateSubnetCommand({
  VpcId: vpcId, CidrBlock: "10.0.1.0/24", AvailabilityZone: "us-east-1a",
  TagSpecifications: [{ ResourceType: "subnet",
    Tags: [{ Key: "Name", Value: "demo-public-1a" }] }],
}));
const priv = await ec2.send(new CreateSubnetCommand({
  VpcId: vpcId, CidrBlock: "10.0.2.0/24", AvailabilityZone: "us-east-1b",
  TagSpecifications: [{ ResourceType: "subnet",
    Tags: [{ Key: "Name", Value: "demo-private-1b" }] }],
}));
const publicId = pub.Subnet?.SubnetId;
const privateId = priv.Subnet?.SubnetId;

Subnet CIDRs must be non-overlapping subsets of the VPC CIDR.
Each subnet is bound to one AZ; use different AZs for availability.
AWS reserves the first four and the last address of every subnet, so a /24 yields 251 usable IPs.
The public/private distinction is not set here - it comes from routing in later steps.

4. Make the Public Subnet Auto-Assign Public IPs

Set MapPublicIpOnLaunch so instances in the public subnet get a public IPv4 automatically.

# --- Python (boto3) ---
ec2.modify_subnet_attribute(
    SubnetId=public_id, MapPublicIpOnLaunch={"Value": True},
)

// --- TypeScript (AWS SDK v3) ---
import { ModifySubnetAttributeCommand } from "@aws-sdk/client-ec2";
 
await ec2.send(new ModifySubnetAttributeCommand({
  SubnetId: publicId, MapPublicIpOnLaunch: { Value: true },
}));

This affects only instances launched after the change, not existing ones.
Leave it off for private subnets so their instances never get a public IP.
A public IP still needs a route to an internet gateway to be reachable - set up next.
You can override this per instance at launch with the AssociatePublicIpAddress network-interface flag.

Intermediate Examples

5. Create and Attach an Internet Gateway

An internet gateway is created independently, then attached to the VPC.

# --- Python (boto3) ---
igw = ec2.create_internet_gateway(
    TagSpecifications=[{"ResourceType": "internet-gateway",
                        "Tags": [{"Key": "Name", "Value": "demo-igw"}]}],
)
igw_id = igw["InternetGateway"]["InternetGatewayId"]
ec2.attach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id)

// --- TypeScript (AWS SDK v3) ---
import { CreateInternetGatewayCommand, AttachInternetGatewayCommand } from "@aws-sdk/client-ec2";
 
const igw = await ec2.send(new CreateInternetGatewayCommand({
  TagSpecifications: [{ ResourceType: "internet-gateway",
    Tags: [{ Key: "Name", Value: "demo-igw" }] }],
}));
const igwId = igw.InternetGateway?.InternetGatewayId;
await ec2.send(new AttachInternetGatewayCommand({ InternetGatewayId: igwId, VpcId: vpcId }));

A gateway is a two-step resource: create, then AttachInternetGateway.
Only one internet gateway can be attached to a VPC at a time.
The gateway does nothing until a route table points traffic at it.
To delete a VPC later you must DetachInternetGateway first.

6. Create a Public Route Table and Route

A new route table plus a 0.0.0.0/0 route to the gateway is what makes a subnet public.

# --- Python (boto3) ---
rt = ec2.create_route_table(VpcId=vpc_id)
rt_id = rt["RouteTable"]["RouteTableId"]
ec2.create_route(
    RouteTableId=rt_id, DestinationCidrBlock="0.0.0.0/0", GatewayId=igw_id,
)
ec2.associate_route_table(RouteTableId=rt_id, SubnetId=public_id)

// --- TypeScript (AWS SDK v3) ---
import { CreateRouteTableCommand, CreateRouteCommand, AssociateRouteTableCommand } from "@aws-sdk/client-ec2";
 
const rt = await ec2.send(new CreateRouteTableCommand({ VpcId: vpcId }));
const rtId = rt.RouteTable?.RouteTableId;
await ec2.send(new CreateRouteCommand({
  RouteTableId: rtId, DestinationCidrBlock: "0.0.0.0/0", GatewayId: igwId,
}));
await ec2.send(new AssociateRouteTableCommand({ RouteTableId: rtId, SubnetId: publicId }));

CreateRoute adds the default route; GatewayId is the internet gateway id.
AssociateRouteTable is the step that actually makes the subnet public.
The private subnet is left on the VPC's main route table, so it has no internet path - exactly what you want.
The local route (VPC CIDR to local) exists automatically; never add it yourself.

7. Verify with DescribeSubnets

Confirm your wiring by describing subnets and checking their attributes.

# --- Python (boto3) ---
resp = ec2.describe_subnets(
    Filters=[{"Name": "vpc-id", "Values": [vpc_id]}],
)
for s in resp["Subnets"]:
    print(s["SubnetId"], s["CidrBlock"],
          s["AvailabilityZone"], s["MapPublicIpOnLaunch"])

// --- TypeScript (AWS SDK v3) ---
import { DescribeSubnetsCommand } from "@aws-sdk/client-ec2";
 
const resp = await ec2.send(new DescribeSubnetsCommand({
  Filters: [{ Name: "vpc-id", Values: [vpcId!] }],
}));
for (const s of resp.Subnets ?? []) {
  console.log(s.SubnetId, s.CidrBlock, s.AvailabilityZone, s.MapPublicIpOnLaunch);
}

Filter by vpc-id to scope the results to your VPC.
MapPublicIpOnLaunch should be true on the public subnet and false on the private one.
AvailableIpAddressCount tells you how much room is left in each subnet.
Use DescribeRouteTables similarly to confirm the 0.0.0.0/0 route.

8. Tear Down in Reverse Order

Delete dependents before the VPC, or the final delete fails.

# --- Python (boto3) ---
ec2.disassociate_route_table  # (do via the association id from DescribeRouteTables)
ec2.delete_route_table(RouteTableId=rt_id)
ec2.detach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id)
ec2.delete_internet_gateway(InternetGatewayId=igw_id)
ec2.delete_subnet(SubnetId=public_id)
ec2.delete_subnet(SubnetId=private_id)
ec2.delete_vpc(VpcId=vpc_id)

// --- TypeScript (AWS SDK v3) ---
import {
  DeleteRouteTableCommand, DetachInternetGatewayCommand,
  DeleteInternetGatewayCommand, DeleteSubnetCommand, DeleteVpcCommand,
} from "@aws-sdk/client-ec2";
 
await ec2.send(new DeleteRouteTableCommand({ RouteTableId: rtId }));
await ec2.send(new DetachInternetGatewayCommand({ InternetGatewayId: igwId, VpcId: vpcId }));
await ec2.send(new DeleteInternetGatewayCommand({ InternetGatewayId: igwId }));
await ec2.send(new DeleteSubnetCommand({ SubnetId: publicId }));
await ec2.send(new DeleteSubnetCommand({ SubnetId: privateId }));
await ec2.send(new DeleteVpcCommand({ VpcId: vpcId }));

Disassociate a custom route table (via its association id) before deleting it; you cannot delete the main route table directly.
Detach the internet gateway before deleting it, and before deleting the VPC.
A VPC will not delete while any subnet, gateway, or ENI still references it.
Deleting the VPC removes its default security group, main route table, and default NACL automatically.

Related: VPC via SDK Best Practices - a CIDR plan and tagging scheme to apply to the resources above.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).

Prerequisites

Python: pip install boto3 (boto3 1.43.x, Python 3.10+). TypeScript: npm install @aws-sdk/client-ec2 (Node.js 18+).
Credentials via aws configure, environment variables, or an IAM role with ec2:*Vpc*, ec2:*Subnet*, ec2:*RouteTable*, ec2:*Route, ec2:*InternetGateway*, and ec2:CreateTags.
These examples create billable-adjacent resources (a VPC and subnets are free; only NAT gateways and elastic IPs cost money, and those are covered on a later page). Clean up with the last example.

Basic Examples

1. Create the VPC

CreateVpc allocates only the CIDR container - the outermost object everything else references.

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
resp = ec2.create_vpc(
    CidrBlock="10.0.0.0/16",
    TagSpecifications=[{"ResourceType": "vpc",
                        "Tags": [{"Key": "Name", "Value": "demo-vpc"}]}],
)
vpc_id = resp["Vpc"]["VpcId"]
print(vpc_id)

// --- TypeScript (AWS SDK v3) ---
import { EC2Client, CreateVpcCommand } from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
const resp = await ec2.send(new CreateVpcCommand({
  CidrBlock: "10.0.0.0/16",
  TagSpecifications: [{ ResourceType: "vpc",
    Tags: [{ Key: "Name", Value: "demo-vpc" }] }],
}));
const vpcId = resp.Vpc?.VpcId;
console.log(vpcId);

A /16 gives 65,536 addresses; size the block for growth since you cannot shrink it later.
Use a private range (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) that will not overlap networks you might peer with.
TagSpecifications tags the VPC at creation so it is never anonymous.
The returned VpcId feeds every following call.

2. Enable DNS Hostnames

Custom VPCs have enableDnsHostnames off by default; flip it so instances get public DNS names.

# --- Python (boto3) ---
ec2.modify_vpc_attribute(VpcId=vpc_id, EnableDnsHostnames={"Value": True})

// --- TypeScript (AWS SDK v3) ---
import { ModifyVpcAttributeCommand } from "@aws-sdk/client-ec2";
 
await ec2.send(new ModifyVpcAttributeCommand({
  VpcId: vpcId,
  EnableDnsHostnames: { Value: true },
}));

enableDnsSupport is already on by default; only enableDnsHostnames needs flipping.
You can only set one attribute per ModifyVpcAttribute call.
Without this, public instances resolve to IPs but get no ec2-...compute.amazonaws.com name.
The change is instant and applies to instances launched afterward.

3. Create a Public and a Private Subnet

CreateSubnet carves a smaller CIDR out of the VPC and pins it to one Availability Zone.

# --- Python (boto3) ---
public = ec2.create_subnet(
    VpcId=vpc_id, CidrBlock="10.0.1.0/24", AvailabilityZone="us-east-1a",
    TagSpecifications=[{"ResourceType": "subnet",
                        "Tags": [{"Key": "Name", "Value": "demo-public-1a"}]}],
)
private = ec2.create_subnet(
    VpcId=vpc_id, CidrBlock="10.0.2.0/24", AvailabilityZone="us-east-1b",
    TagSpecifications=[{"ResourceType": "subnet",
                        "Tags": [{"Key": "Name", "Value": "demo-private-1b"}]}],
)
public_id = public["Subnet"]["SubnetId"]
private_id = private["Subnet"]["SubnetId"]

// --- TypeScript (AWS SDK v3) ---
import { CreateSubnetCommand } from "@aws-sdk/client-ec2";
 
const pub = await ec2.send(new CreateSubnetCommand({
  VpcId: vpcId, CidrBlock: "10.0.1.0/24", AvailabilityZone: "us-east-1a",
  TagSpecifications: [{ ResourceType: "subnet",
    Tags: [{ Key: "Name", Value: "demo-public-1a" }] }],
}));
const priv = await ec2.send(new CreateSubnetCommand({
  VpcId: vpcId, CidrBlock: "10.0.2.0/24", AvailabilityZone: "us-east-1b",
  TagSpecifications: [{ ResourceType: "subnet",
    Tags: [{ Key: "Name", Value: "demo-private-1b" }] }],
}));
const publicId = pub.Subnet?.SubnetId;
const privateId = priv.Subnet?.SubnetId;

Subnet CIDRs must be non-overlapping subsets of the VPC CIDR.
Each subnet is bound to one AZ; use different AZs for availability.
AWS reserves the first four and the last address of every subnet, so a /24 yields 251 usable IPs.
The public/private distinction is not set here - it comes from routing in later steps.

4. Make the Public Subnet Auto-Assign Public IPs

Set MapPublicIpOnLaunch so instances in the public subnet get a public IPv4 automatically.

# --- Python (boto3) ---
ec2.modify_subnet_attribute(
    SubnetId=public_id, MapPublicIpOnLaunch={"Value": True},
)

// --- TypeScript (AWS SDK v3) ---
import { ModifySubnetAttributeCommand } from "@aws-sdk/client-ec2";
 
await ec2.send(new ModifySubnetAttributeCommand({
  SubnetId: publicId, MapPublicIpOnLaunch: { Value: true },
}));

This affects only instances launched after the change, not existing ones.
Leave it off for private subnets so their instances never get a public IP.
A public IP still needs a route to an internet gateway to be reachable - set up next.
You can override this per instance at launch with the AssociatePublicIpAddress network-interface flag.

Intermediate Examples

5. Create and Attach an Internet Gateway

An internet gateway is created independently, then attached to the VPC.

# --- Python (boto3) ---
igw = ec2.create_internet_gateway(
    TagSpecifications=[{"ResourceType": "internet-gateway",
                        "Tags": [{"Key": "Name", "Value": "demo-igw"}]}],
)
igw_id = igw["InternetGateway"]["InternetGatewayId"]
ec2.attach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id)

// --- TypeScript (AWS SDK v3) ---
import { CreateInternetGatewayCommand, AttachInternetGatewayCommand } from "@aws-sdk/client-ec2";
 
const igw = await ec2.send(new CreateInternetGatewayCommand({
  TagSpecifications: [{ ResourceType: "internet-gateway",
    Tags: [{ Key: "Name", Value: "demo-igw" }] }],
}));
const igwId = igw.InternetGateway?.InternetGatewayId;
await ec2.send(new AttachInternetGatewayCommand({ InternetGatewayId: igwId, VpcId: vpcId }));

A gateway is a two-step resource: create, then AttachInternetGateway.
Only one internet gateway can be attached to a VPC at a time.
The gateway does nothing until a route table points traffic at it.
To delete a VPC later you must DetachInternetGateway first.

6. Create a Public Route Table and Route

A new route table plus a 0.0.0.0/0 route to the gateway is what makes a subnet public.

# --- Python (boto3) ---
rt = ec2.create_route_table(VpcId=vpc_id)
rt_id = rt["RouteTable"]["RouteTableId"]
ec2.create_route(
    RouteTableId=rt_id, DestinationCidrBlock="0.0.0.0/0", GatewayId=igw_id,
)
ec2.associate_route_table(RouteTableId=rt_id, SubnetId=public_id)

// --- TypeScript (AWS SDK v3) ---
import { CreateRouteTableCommand, CreateRouteCommand, AssociateRouteTableCommand } from "@aws-sdk/client-ec2";
 
const rt = await ec2.send(new CreateRouteTableCommand({ VpcId: vpcId }));
const rtId = rt.RouteTable?.RouteTableId;
await ec2.send(new CreateRouteCommand({
  RouteTableId: rtId, DestinationCidrBlock: "0.0.0.0/0", GatewayId: igwId,
}));
await ec2.send(new AssociateRouteTableCommand({ RouteTableId: rtId, SubnetId: publicId }));

CreateRoute adds the default route; GatewayId is the internet gateway id.
AssociateRouteTable is the step that actually makes the subnet public.
The private subnet is left on the VPC's main route table, so it has no internet path - exactly what you want.
The local route (VPC CIDR to local) exists automatically; never add it yourself.

7. Verify with DescribeSubnets

Confirm your wiring by describing subnets and checking their attributes.

# --- Python (boto3) ---
resp = ec2.describe_subnets(
    Filters=[{"Name": "vpc-id", "Values": [vpc_id]}],
)
for s in resp["Subnets"]:
    print(s["SubnetId"], s["CidrBlock"],
          s["AvailabilityZone"], s["MapPublicIpOnLaunch"])

// --- TypeScript (AWS SDK v3) ---
import { DescribeSubnetsCommand } from "@aws-sdk/client-ec2";
 
const resp = await ec2.send(new DescribeSubnetsCommand({
  Filters: [{ Name: "vpc-id", Values: [vpcId!] }],
}));
for (const s of resp.Subnets ?? []) {
  console.log(s.SubnetId, s.CidrBlock, s.AvailabilityZone, s.MapPublicIpOnLaunch);
}

Filter by vpc-id to scope the results to your VPC.
MapPublicIpOnLaunch should be true on the public subnet and false on the private one.
AvailableIpAddressCount tells you how much room is left in each subnet.
Use DescribeRouteTables similarly to confirm the 0.0.0.0/0 route.

8. Tear Down in Reverse Order

Delete dependents before the VPC, or the final delete fails.

# --- Python (boto3) ---
ec2.disassociate_route_table  # (do via the association id from DescribeRouteTables)
ec2.delete_route_table(RouteTableId=rt_id)
ec2.detach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id)
ec2.delete_internet_gateway(InternetGatewayId=igw_id)
ec2.delete_subnet(SubnetId=public_id)
ec2.delete_subnet(SubnetId=private_id)
ec2.delete_vpc(VpcId=vpc_id)

// --- TypeScript (AWS SDK v3) ---
import {
  DeleteRouteTableCommand, DetachInternetGatewayCommand,
  DeleteInternetGatewayCommand, DeleteSubnetCommand, DeleteVpcCommand,
} from "@aws-sdk/client-ec2";
 
await ec2.send(new DeleteRouteTableCommand({ RouteTableId: rtId }));
await ec2.send(new DetachInternetGatewayCommand({ InternetGatewayId: igwId, VpcId: vpcId }));
await ec2.send(new DeleteInternetGatewayCommand({ InternetGatewayId: igwId }));
await ec2.send(new DeleteSubnetCommand({ SubnetId: publicId }));
await ec2.send(new DeleteSubnetCommand({ SubnetId: privateId }));
await ec2.send(new DeleteVpcCommand({ VpcId: vpcId }));

Disassociate a custom route table (via its association id) before deleting it; you cannot delete the main route table directly.
Detach the internet gateway before deleting it, and before deleting the VPC.
A VPC will not delete while any subnet, gateway, or ENI still references it.
Deleting the VPC removes its default security group, main route table, and default NACL automatically.

Related: VPC via SDK Best Practices - a CIDR plan and tagging scheme to apply to the resources above.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).

VPC via SDK Basics

Buscar en la documentación

VPC via SDK Basics