4.3.1. Automation with AWS CLI/SDKs for Networking

The AWS CLI and AWS SDKs empower network specialists to programmatically manage AWS network resources, enabling automation of configuration, monitoring, and troubleshooting tasks.

Scenario: You need to automate the creation of new VPCs with predefined subnets and route table configurations for new projects. Additionally, you want to write a custom script to periodically check network performance metrics from CloudWatch.

For network specialists, automating repetitive network management tasks is crucial for efficiency and consistency. The AWS CLI and AWS SDKs provide the programmatic interfaces to interact with AWS networking services.

Key Uses for Automating Networking with AWS CLI /SDKs:

• AWS CLI: A unified tool to manage AWS services from the command line. Ideal for scripting common network tasks.
  • Examples: aws ec2 create-vpc, aws ec2 create-subnet, aws ec2 associate-route-table, aws ec2 authorize-security-group-ingress.
  • Benefits: Quick execution, easily integrated into shell scripts, useful for troubleshooting and one-off tasks.
• AWS SDKs (Software Development Kits): Language-specific libraries that make it easy to use AWS services in your application code or custom scripts. For building more complex, programmatic automation.
  • Examples: Using Boto3 (Python SDK) to write a script that periodically checks VPC Flow Logs for suspicious activity and automatically updates Network ACLs or Security Groups.
  • Benefits: Enables complex logic, advanced error handling, and integration with broader automation frameworks.
• Use Cases:
  • Automating VPC creation and configuration.
  • Managing Security Group rules.
  • Updating route tables dynamically.
  • Performing network diagnostic checks.
  • Automating VPN or Direct Connect setup.

Practical Implementation: Automating VPC Creation with AWS CLI

#!/bin/bash

# Define variables
VPC_CIDR="10.0.0.0/16"
PUBLIC_SUBNET_CIDR="10.0.1.0/24"
PRIVATE_SUBNET_CIDR="10.0.2.0/24"
AZ="us-east-1a"
PROJECT_NAME="MyNewProject"

echo "Creating VPC for $PROJECT_NAME..."

# Create VPC
VPC_ID=$(aws ec2 create-vpc --cidr-block $VPC_CIDR --tag-specifications "ResourceType=vpc,Tags=[{Key=Name,Value=${PROJECT_NAME}-VPC}]" --query Vpc.VpcId --output text)
echo "VPC created: $VPC_ID"

# Create Internet Gateway and attach to VPC
IGW_ID=$(aws ec2 create-internet-gateway --tag-specifications "ResourceType=internet-gateway,Tags=[{Key=Name,Value=${PROJECT_NAME}-IGW}]" --query InternetGateway.InternetGatewayId --output text)
echo "Internet Gateway created: $IGW_ID"
aws ec2 attach-internet-gateway --vpc-id $VPC_ID --internet-gateway-id $IGW_ID
echo "Internet Gateway attached to VPC."

# Create Public Subnet
PUBLIC_SUBNET_ID=$(aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block $PUBLIC_SUBNET_CIDR --availability-zone $AZ --tag-specifications "ResourceType=subnet,Tags=[{Key=Name,Value=${PROJECT_NAME}-PublicSubnet}]" --query Subnet.SubnetId --output text)
echo "Public Subnet created: $PUBLIC_SUBNET_ID"

# Create Private Subnet
PRIVATE_SUBNET_ID=$(aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block $PRIVATE_SUBNET_CIDR --availability-zone $AZ --tag-specifications "ResourceType=subnet,Tags=[{Key=Name,Value=${PROJECT_NAME}-PrivateSubnet}]" --query Subnet.SubnetId --output text)
echo "Private Subnet created: $PRIVATE_SUBNET_ID"

# Create Public Route Table and associate with Public Subnet
PUBLIC_RT_ID=$(aws ec2 create-route-table --vpc-id $VPC_ID --tag-specifications "ResourceType=route-table,Tags=[{Key=Name,Value=${PROJECT_NAME}-PublicRT}]" --query RouteTable.RouteTableId --output text)
echo "Public Route Table created: $PUBLIC_RT_ID"
aws ec2 create-route --route-table-id $PUBLIC_RT_ID --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID
aws ec2 associate-route-table --subnet-id $PUBLIC_SUBNET_ID --route-table-id $PUBLIC_RT_ID
echo "Public Route Table configured."

# Create NAT Gateway (in public subnet)
EIP_ALLOC_ID=$(aws ec2 allocate-address --domain vpc --query AllocationId --output text)
NAT_GW_ID=$(aws ec2 create-nat-gateway --subnet-id $PUBLIC_SUBNET_ID --allocation-id $EIP_ALLOC_ID --tag-specifications "ResourceType=natgateway,Tags=[{Key=Name,Value=${PROJECT_NAME}-NATGW}]" --query NatGateway.NatGatewayId --output text)
echo "NAT Gateway created: $NAT_GW_ID. Waiting for it to become available..."
aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT_GW_ID
echo "NAT Gateway available."

# Create Private Route Table and associate with Private Subnet
PRIVATE_RT_ID=$(aws ec2 create-route-table --vpc-id $VPC_ID --tag-specifications "ResourceType=route-table,Tags=[{Key=Name,Value=${PROJECT_NAME}-PrivateRT}]" --query RouteTable.RouteTableId --output text)
echo "Private Route Table created: $PRIVATE_RT_ID"
aws ec2 create-route --route-table-id $PRIVATE_RT_ID --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT_GW_ID
aws ec2 associate-route-table --subnet-id $PRIVATE_SUBNET_ID --route-table-id $PRIVATE_RT_ID
echo "Private Route Table configured."

echo "VPC setup for $PROJECT_NAME complete!"

⚠️ Common Pitfall: Hardcoding values or credentials in scripts. Always use environment variables, AWS Secrets Manager, or IAM roles for sensitive information.

Key Trade-Offs:

• Scripting Flexibility vs. IaC Robustness: CLI/SDK scripts offer immediate flexibility for specific tasks. IaC tools (like CloudFormation) provide a more robust, declarative, and auditable way to manage entire infrastructure stacks.

Reflection Question: How do the AWS CLI (for scripting common tasks) and AWS SDKs (for building custom automation scripts) fundamentally empower you as a Network Specialist to programmatically manage AWS network resources, enabling efficient and consistent automation of network operations?