AWS
Intermediate 16 min read AWS

AWS Networking and VPC

Your private network, the way AWS thinks about it

A VPC is a private network: CIDR blocks, subnets in AZs, route tables, gateways and security layers decide how traffic gets anywhere — and what gets to reach your resources at all.

VPCsubnetsroute tablesNATinternet gatewaysecurity groupsNACL
Prerequisites: AWS Service Map Cloud Networking
Before we start

What you will learn

  • Design a VPC with CIDR, subnets and route tables
  • Explain public vs private subnets and NAT/egress
  • Layer security groups and NACLs with correct intent
In 60 seconds

A VPC is your own isolated network inside AWS. Subnets carve it into zones, route tables decide how packets travel, and internet/nat gateways connect it to the world. Security groups (instance firewall) and NACLs (subnet firewall) control who gets in and out.

Introduction

What is this?

A VPC defines an isolated IP space (CIDR) for a region. You split it into subnets per availability zone, attach route tables telling traffic which gateway to use, and choose egress via an Internet Gateway (public internet) or NAT (outbound-only for private resources). Security groups filter per-instance; NACLs filter per-subnet. VPC endpoints connect to AWS services over private links; peering and Transit Gateway stitch VPCs together.

Motivation

Why do you need it?

  • Networks are the blast radius: one wrongly-opened security group makes a box internet-reachable.
  • Cost and latency follow placement: availability zones, NAT gatesways and least-cost AZ affinity matter.
  • Managed services (RDS, Lambda, EKS) all live inside VPCs; a shared network model ties them together.
  • Interview and architecture tasks almost always reduce to a VPC diagram.
Think about it

Mental model

Imagine

A gated office complex

Think of

A VPC

The perimeter gate (IGW) lets outsiders in; interior gates per floor (NACL) and per office (security group) control ever-finer access; service corridors (VPC endpoints) let staff move between buildings without leaving the campus.

Mechanics

How it works

  • You allocate a CIDR (e.g. 10.0.0.0/16) to the VPC; AWS reserves the first and last few addresses per subnet.
  • Subnets map to single AZs; route tables per subnet declare e.g. 0.0.0.0/0 → Internet Gateway or NAT Gateway.
  • An Internet Gateway is horizontally-scaled glue between VPC and AWS edge; public IPs flow through it.
  • NAT Gateway (or NAT instance) gives private subnets one-way internet egress.
  • Security groups are stateful, allow sets, evaluated at the instance; NACLs are stateless, layered on subnets.
  • VPC endpoints (interface/gateway) and PrivateLink keep traffic on AWS backbone for S3, DynamoDB, private services.

A canonical three-tier VPC.

VPC
Public subnet + IGW
Private subnet + NAT
Isolated subnet
Security layers
Hands-on

Examples

Describe the VPC graph read-only

Describe the VPC graph read-only
# VPCs, subnets, and route tables in one region
aws ec2 describe-vpcs --query 'Vpcs[].{id:VpcId,cidr:CidrBlock}' --output table
aws ec2 describe-subnets --query 'Subnets[].{id:SubnetId,vpc:VpcId,az:AvailabilityZone,cidr:CidrBlock}' --output table
aws ec2 describe-route-tables --query 'RouteTables[].{id:RouteTableId,vpc:VpcId}' --output table

Read-only describe calls show the whole topology: which subnets are where, and which VPC they serve.

Real world

In production

  • A startup uses one VPC with public ALB subnets, private app subnets and isolated RDS subnets; egress only through a NAT gateway.
  • A multi-account org peers VPCs into a central network account running Transit Gateway and shared DNS.
  • A data platform reaches S3 and DynamoDB purely via VPC endpoints, keeping all traffic off the public internet.
Guidelines

Best practices

  • Plan CIDR deliberately; overlapping ranges make peering and VPN impossible.
  • Split per tier (public/private/isolated) and per AZ so a single failure domain stays small.
  • Prefer security groups over NACLs for everything, and keep NACLs as coarse subnet guardrails.
  • Use VPC endpoints for S3/DynamoDB instead of driving long-haul through NAT.
Watch out

Common mistakes

  • Putting everything in a single /24 in one AZ — failure and inability to peer later.
  • Opening 0.0.0.0/0 on a DB port 'temporarily'.
  • Stateless NACL surprises: forgetting return/response rules for ephemeral ports.
  • Private subnets with no egress path, then wondering why installs fail.
Root cause analysis

Common issues

Error
Private instance can't reach the internet
Root cause

No NAT in the route table, or SG blocks 443/80 egress

Fix

Add 0.0.0.0/0 → NAT (in a public subnet) and permit egress on the SG; ensure NACL allows established return traffic.

Error
Can't SSH to instance with 22 open on SG
Root cause

NACL stateless rules or the keypair/IAM role is wrong

Fix

Verify NACL allows inbound 22 and ephemeral outbound; check the key pair and instance state.

Error
Lambda times out calling an external API
Root cause

VPC-attached Lambda has no NAT/endpoint egress

Fix

Attach a NAT gateway route or a VPC endpoint for the service, or run the Lambda outside the VPC.

When things break

Debugging tips

  • Walk the path: route table, then NACL (in+out), then security group (in+out), then the app's listener.
  • Use VPC Reachability Analyzer to model traffic between two resources and name the blocking layer.
  • Check that Lambda-in-VPC has a NAT/endpoint path or it will time out on internet calls.
  • If peering doesn't work, check overlapping CIDRs and the peering route in both route tables.
Interviews

Interview checkpoint

Practice

Hands-on lab

Map a VPC Topology (Read-Only or Terraform Plan)
30 min · intermediate
In progress
Objectives
  • Inspect VPCs, subnets and route tables for a region
  • Trace how each subnet reaches (or doesn't reach) the internet
  • Optionally render the same VPC as Terraform and run plan-only

Map a VPC Topology (Read-Only or Terraform Plan)

30 min · intermediate

0/5 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/2
1

Which component provides outbound internet for resources in a private subnet?

2

NACLs are stateful: allowed outbound traffic automatically allows the reply inbound.

Go deeper

Official documentation

AWS — VPC user guide
docs
AWS — Security groups
docs
AWS — NACL rules
docs