VPC and Network Security

• Your VPC is the 'inside network' now — flat-and-trusted inside it repeats the exact castle mistake in a new wrapper.
• Security groups are the highest-leverage control in the cloud: correct-by-default on a new instance saves everything downstream.
• East-west containment in the cloud is what stops one compromised pod from walking the whole account.

NACLs are the building fire doors and SGs are the individual office locks — different obstructions for different axes.

• A VPC carves an isolated address space; subnets put workloads in tiers (public/private/data).
• Security groups filter at the instance/eni level, stateful, allow-only: you define exactly who talks to each tier.
• NACLs filter at the subnet level, stateless, order-sensitive — the 'first line' sweep before the SG precision gate.
• Routing (IGW, NAT, peering) decides where traffic can even attempt to flow; route tables are policy surfaces.

• A data tier has SG rule 'allow 5432 from app-subnet only' — even a leaked pod credential reaches nothing else.
• A company runs private subnets with managed NAT so agents cannot egress unless the policy names a destination.
• An org adds an east-west audit SG rule to catch unexpected inter-tier traffic and alert on it.

• Default deny everywhere: no SG with 0.0.0.0/0 on any port you do not absolutely intend.
• Scope SG refs by security group or subnet, not by /0; source as specific as the flow requires.
• Put databases and admin planes in private subnets with no IGW; route egress through NAT/managed.
• Treat route tables and peering as policies that get code review like any other diff.

• A permissive 'allow all' SG 'while we debug' that outlives the debug by a year.
• Public subnet + public IP on the data tier because 'the app needs to talk to itself' — NAT or SG-to-SG is the answer.
• Forgetting that SGs are stateful and NACLs are not, then debugging phantom drops at the NACL.
• Peering two 'isolated' VPCs 'for backup' and quietly flattening the containment boundary.

• When 'SG allows but traffic fails', check the NACL (stateless both directions) and the route table next.
• Reachability analyzer tools (VPC Reachability Analyzer) model the whole path with one click — faster than mental ACL math.
• Use flow logs on the suspicious few interfaces only; they are louder than you expect.

• Flow logs are evidence too — retain them and correlate with CloudTrail for 'which IP when'.
• Segmentation without monitoring is theater: log every denied flow for a week when you tighten a tier.
• Only test cross-tier reachability with your own workload in staging, not production traffic rerouting.