Cisco Modeling Labs on AWS
Terraform networking lab with cost guardrails
Terraform that builds the AWS environment needed to run Cisco Modeling Labs — VPC networking, restricted SSH/HTTPS access, a nested-virtualization-capable instance, and a monthly budget guardrail.
Architecture
Architecture illustration of the Cisco Modeling Labs AWS lab: Terraform provisions a VPC with a public subnet, internet gateway, a security group restricted to a management IP, and an EC2 instance with nested virtualization, alongside a monthly AWS budget.
1. Define
2. Network
3. Restrict
4. Compute
5. Govern
Select any component marked with a dot to see what it does in this system.
- Region
- ca-central-1
- Network
- VPC + public subnet
- Ingress
- 443/22, mgmt IP only
- Cost guardrail
- USD 80/mo budget
Problem
Running Cisco Modeling Labs needs a large, nested-virtualization-capable instance. That is expensive enough that an accidentally long-running lab is a real cost problem, and permissive security groups on a publicly reachable box are a real exposure problem.
What I built
- A VPC at 10.0.0.0/16 with a public subnet at 10.0.1.0/24, internet gateway and route table.
- A security group exposing only TCP 443 and TCP 22, both restricted to a specified management IP rather than open to the internet.
- An EC2 c8i.8xlarge instance (32 vCPU, 64 GiB) with nested virtualization enabled and 200 GB gp3 storage, in ca-central-1.
- SSH key pair management and a shell wrapper for repeatable Terraform runs.
- An AWS monthly budget of USD 80 as a cost guardrail on the account.
Engineering decisions
The interesting constraint was keeping a deliberately powerful instance from becoming either a security or a billing incident: least-privilege ingress locked to a single management IP, and a budget defined in the same Terraform that provisions the compute, so the guardrail cannot be forgotten separately from the resource that needs it.
Outcome
The AWS side of the lab is reproducible from code. Cisco Modeling Labs itself is installed separately on top of the provisioned instance.
Next project
Plane to Slack Notifier