The market's shop gets a network of its own, shop. The web server's script is in ~/web.sh, and the role flow-logs exists.

1. A VPC named shop with the block 10.20.0.0/16 and four subnets:

   Name	Zone	Block
   web-a	us-east-1a	10.20.1.0/24
   web-b	us-east-1b	10.20.2.0/24
   app-a	us-east-1a	10.20.11.0/24
   app-b	us-east-1b	10.20.12.0/24

   web-a and web-b are public and hand out public IPs to new instances; both are graded. app-a and app-b are not public.

2. A t3.micro named web in web-a, built by ~/web.sh, answering on port 80 at its public IP.

3. A t3.micro named app in app-a with no public IP, and both app subnets able to reach the internet, outbound only.

4. A flow log on the VPC recording all traffic, accepted and rejected, into the log group /shop/flow.