Now the market's network has a door, and a server can go in each tier.

A public address

A route to the internet gateway is half of being reachable; the instance also needs a public IP. The default VPC's subnets hand one to every instance. A new subnet does not, until you tell it to:

aws ec2 modify-subnet-attribute --subnet-id $SUBNET --map-public-ip-on-launch

$SUBNET holds public-a's id here (SUBNET=$(aws ec2 describe-subnets --filters Name=tag:Name,Values=public-a --query "Subnets[0].SubnetId" --output text)). Run it for public-a and public-b, never for the private subnets.

A security group in the VPC

SG=$(aws ec2 create-security-group --group-name web --description "Market web" --vpc-id $VPC --query GroupId --output text)

A security group belongs to one VPC, and its name only has to be unique inside that VPC: two VPCs can each have a group called web. So outside the default VPC, commands name a group by its id, and the rule takes --group-id:

aws ec2 authorize-security-group-ingress --group-id $SG --protocol tcp --port 80 --cidr 0.0.0.0/0

Launching into a subnet

aws ec2 run-instances --image-id $AMI --instance-type t3.micro --subnet-id $SUBNET --security-group-ids $SG --user-data file://web.sh --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web}]'

--subnet-id decides where the instance lives and which block its private address comes from. In public-a it also gets a public IP, and the page answers on it.

The same command with private-a's id gives an instance with only a private address, such as 10.0.11.20. Nothing on the internet can reach it, not even CloudShell. That is the point: the app and, later, the database live there.