Lab 02 - VPC Network ACL
Difficulty: Intermediate Service: Amazon VPC
Cost: This lab uses a t2.micro instance (Free Tier eligible). If left running outside the Free Tier, the cost is approximately $0.30/day. Delete the stack when you are done.
Scenario
Your team deployed a web server on EC2 in a custom VPC. The CloudFormation stack completed successfully. The instance is running, the security group allows HTTP on port 80, the Internet Gateway is attached, and the route table has a working route to the internet. But the page still won’t load.
What Was Deployed
| Resource | Purpose |
|---|---|
AWS::EC2::VPC |
Custom VPC for the lab (10.0.0.0/16) |
AWS::EC2::Subnet |
Subnet with auto-assign public IP enabled |
AWS::EC2::InternetGateway |
Internet Gateway — created and attached to the VPC |
AWS::EC2::RouteTable |
Route table with a 0.0.0.0/0 route to the Internet Gateway |
AWS::EC2::NetworkAcl |
Network ACL associated with the subnet |
AWS::EC2::SecurityGroup |
Inbound rule allowing HTTP on port 80 |
AWS::EC2::Instance |
t2.micro running a web server |
The stack deployed without errors. The instance is running and the web server is active.
Deploy the Lab
- Open the AWS CloudFormation console
- Click Create stack > With new resources (standard)
- Select Upload a template file and upload lab-02-nacl.yaml
- Enter a stack name (e.g.,
brokenlabs-vpc-lab-02) and click Next > Next > Submit - Wait for the stack status to reach CREATE_COMPLETE (takes 2–3 minutes)
- Open the stack Outputs tab — you will see
InstanceId,InstancePublicIP, andWebPageURL
The Problem
Open the WebPageURL from the stack Outputs in your browser.
Expected: the AWS Broken Labs welcome page loads. Actual: the browser displays:
This site can't be reached
ERR_CONNECTION_TIMED_OUT
The instance is running and healthy. The security group allows HTTP. The route table has a valid route to the Internet Gateway. The page still never arrives.
Fix the Lab
The security group and route table both look correct. Something else in the VPC networking stack is filtering traffic before it reaches the instance.
Need help? Open hints.md for progressive hints.
Cleanup
- Open CloudFormation, select your stack, and click Delete
- Wait for the stack to reach DELETE_COMPLETE (or disappear from the list)
- Verify in the EC2 console that the instance no longer appears (or shows Terminated)