World map

 

BM

World A3: The Mall's Roads · Boss challenge

Draw the mall's roads

You will learn: to plan a whole VPC for Kedai Kancil, with public and private rows, and let only the web in.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Boss: Kedai Kancil moves into the mall. A web front, app servers and an order database. Your rules: only the web faces the street, and every wing has a spare. Ready?

Try it

Room 1: three wings. One public row and one private row in each. Public rows need 20 addresses. Private rows need 200.

Give each row of units its own block of addresses. Nothing may overlap.

VPC (the mall's land)

10.20.0.0/16

65,536 addresses in this VPC.

The brief

  • Public subnet (faces the street): 3, one per zone, each with at least 20 usable addresses.
  • Private subnet (the back rooms): 3, one per zone, each with at least 200 usable addresses.
Address map: 10.20.0.0 to 10.20.0.255
    Public subnet (faces the street) · ap-southeast-5a

    Needs at least 20 usable addresses.

    No subnet yet. Pick a size.

    Public subnet (faces the street) · ap-southeast-5b

    Needs at least 20 usable addresses.

    No subnet yet. Pick a size.

    Public subnet (faces the street) · ap-southeast-5c

    Needs at least 20 usable addresses.

    No subnet yet. Pick a size.

    Private subnet (the back rooms) · ap-southeast-5a

    Needs at least 200 usable addresses.

    No subnet yet. Pick a size.

    Private subnet (the back rooms) · ap-southeast-5b

    Needs at least 200 usable addresses.

    No subnet yet. Pick a size.

    Private subnet (the back rooms) · ap-southeast-5c

    Needs at least 200 usable addresses.

    No subnet yet. Pick a size.

    Try it

    Room 2: road signs and residents. Sort each one into its row.

    Drag a card into a box. Or tap the card, then tap the box.

        Try it

        Room 3: the load balancer’s door. Shoppers in on HTTPS from anywhere. No SSH for anyone.

        Set the door guard's rules. Only the right visitors get in.

        Visitors

        • Shoppershould get inTCP 443 from 198.51.100.20Its replies go back to ports 49152–65535.
        • Shopper on a phoneshould get inTCP 443 from 203.0.113.77Its replies go back to ports 32768–61000.
        • Stranger (SSH)keep outTCP 22 from 192.0.2.77Its replies go back to ports 32768–61000.

        Unit door · security group (the server)

        Allow rules only. It remembers who came in, so replies always go out.

        In

        No In rules yet: nothing gets in.

        Out: all traffic (a new group starts this way).

        Predict

        Room 4: the database needs a security patch from the internet. How does it get it?

        Try it

        Room 5: the database’s door. Only servers in the app group, sg-app, may use port 5432. Not even the load balancer.

        Set the door guard's rules. Only the right visitors get in.

        Visitors

        • App servershould get inTCP 5432 from 10.20.1.15, a server in sg-appIts replies go back to ports 32768–61000.
        • Load balancerkeep outTCP 5432 from 10.20.0.5, a server in sg-lbIts replies go back to ports 32768–61000.
        • Strangerkeep outTCP 5432 from 192.0.2.77Its replies go back to ports 32768–61000.

        Unit door · security group (the server)

        Allow rules only. It remembers who came in, so replies always go out.

        In

        No In rules yet: nothing gets in.

        Out: all traffic (a new group starts this way).

        Check

        Last room: the bill. Which parts of your plan cost money while the shop sleeps?

        One at a time: does it keep costing money while it sits idle?

        1 of 6

        NAT gateway with no traffic

        On the bill (costs even when idle)

        Nothing here yet.

        Free shelf (free when idle)

        Nothing here yet.

        You did it!

        You can now plan Kedai Kancil’s whole VPC: rows, road signs, guards and the bill.