AWS
Intermediate 16 min read AWS

VPC, Subnets & Security Groups

A VPC is your isolated network inside AWS, defined by a CIDR block and divided into subnets. Learn internet gateways, NAT, route tables, and the two traffic-control layers — stateful security groups and stateless network ACLs — that decide what can reach your resources.

VPCsubnetCIDRinternet gatewayNATroute tablesecurity groupNACLavailability zone
Prerequisites: AWS Platform Overview EC2, SSH & IAM
Introduction

What is this?

A VPC (Virtual Private Cloud) is your isolated network inside AWS, defined by a CIDR block like 10.0.0.0/16. You divide it into subnets (typically one per availability zone), attach an internet gateway for public traffic and a NAT gateway for private outbound traffic, and control access with route tables, security groups (stateful, per instance) and network ACLs (stateless, per subnet). VPCs underpin EC2, RDS, EKS and every other service you run.

Motivation

Why do you need it?

  • Every resource you deploy lands in a subnet of a VPC, so networking mistakes take down entire environments.
  • Public versus private subnet design decides blast radius: databases and workers belong in private subnets.
  • Security groups are the first firewall layer for most AWS workloads — misconfigurations cause both breaches and outages.
  • Multi-AZ design (subnets spread across availability zones) is how you get high availability in AWS.
  • Peering and transit gateways connect environments without exposing them to the internet.
Think about it

Mental model

Imagine

A gated office campus

Think of

A VPC

The fence is the VPC boundary. Streets (subnets) divide the land into blocks. The front gate (internet gateway) is the only public way in or out. A guard at each building door (security group) checks who enters that specific building — stateful, remembering who came in. The security desk at the main road (network ACL) does a stateless check of every package crossing the boundary. The mailroom (NAT gateway) lets employees send outbound mail, but no one from outside can wander in.

Mechanics

How it works

  • You create a VPC with a private CIDR (RFC 1918), then carve subnets aligned to availability zones so each AZ has its own slice.
  • Each subnet has a route table; a route 0.0.0.0/0 to an internet gateway makes it public, while a route to a NAT gateway gives private subnets outbound-only internet.
  • Instances get a private IP from the subnet and optionally a public IP; the internet gateway translates between the public and private addresses.
  • Security groups act as stateful firewalls attached to the ENI: you define inbound allow rules, and return traffic is automatically permitted.
  • Network ACLs are stateless rules at the subnet boundary, evaluated before the security group, and require both inbound and outbound rules.

Traffic paths inside a VPC with public and private subnets.

VPC 10.0.0.0/16
Internet gateway
Public subnet 10.0.1.0/24
NAT gateway
Private subnet 10.0.2.0/24
Security groups + NACLs
Reference

Key commands

terraform init

Download the AWS provider and initialize the workspace.

terraform plan

Preview the VPC, subnets and routing that would be created.

terraform apply -auto-approve

Provision the networking resources.

ping -c 4 8.8.8.8

Verify outbound internet from a public-subnet host.

dig +short myapp.internal

Resolve a private DNS name inside the VPC.

Hands-on

Examples

Define a VPC, subnets and route in Terraform

Define a VPC, subnets and route in Terraform
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}
 
resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = true
}
 
resource "aws_subnet" "private" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "us-east-1b"
}
 
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
}
 
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
}

The VPC owns a /16. The public subnet gets a /24 in us-east-1a, auto-assigns public IPs, and its route table sends all outbound traffic (0.0.0.0/0) through the internet gateway. The private subnet in us-east-1b has no internet route — it would need a NAT gateway route to reach the internet outbound.

Real world

In production

  • Place web tiers and load balancers in public subnets; put databases and workers in private subnets with no inbound exposure.
  • Spread identical subnets across availability zones so an AZ failure takes out only one slice.
  • Use VPC peering or a transit gateway to connect environments while keeping each blast radius small.
  • Reach managed services (S3, DynamoDB) through VPC endpoints so traffic never traverses the public internet.
  • Centralize egress through a NAT gateway per AZ for cost control and a single audit point.
Guidelines

Best practices

  • Reserve generous CIDRs up front — you cannot grow a VPC, and renumbering is painful.
  • Keep at least two subnets per tier across availability zones.
  • Default to private subnets; only public-facing resources get direct internet routes.
  • Treat security groups as named firewall profiles and reference other security groups rather than raw IP ranges.
  • Review route tables and NACLs in code review like application code.
Watch out

Common mistakes

  • Overlapping CIDRs between VPCs that later need to be peered.
  • Adding a route table entry but forgetting the subnet association, so traffic falls to the main table.
  • Placing databases in public subnets because developers want to connect from home.
  • Assuming security groups filter at the subnet level — they attach to instances and ENIs.
  • Opening a security group to 0.0.0.0/0 for admin ports and calling it temporary.
Root cause analysis

Common issues

Error
Instance in a 'public' subnet cannot reach the internet
Root cause

No 0.0.0.0/0 route to an internet gateway, no public IP assigned, or the gateway is missing.

Fix

Confirm a public IP is assigned, the subnet route table has 0.0.0.0/0 to the IGW, and the IGW is attached to the VPC.

Error
Private instance cannot download packages
Root cause

The private subnet has no NAT route, so outbound-only traffic has nowhere to go.

Fix

Create a NAT gateway in a public subnet and add 0.0.0.0/0 to the private subnet's route table.

Error
Two instances in the same VPC cannot communicate
Root cause

The target security group denies the source, or a stateless NACL is missing a return rule.

Fix

Allow the source security group (or CIDR) on the target's security group and verify NACL inbound and outbound rules.

When things break

Debugging tips

  • Trace the path: ping the private IP, then the gateway, then a public address.
  • Check both the subnet route table and the main route table — missed associations are common.
  • Test TCP on the real port, not just ICMP — many firewalls allow ping but block the service.
  • Inspect NACLs: because they are stateless, a missing return rule breaks connections silently.
  • Use the VPC Reachability Analyzer to test a path without deploying anything.
Interviews

Interview checkpoint

Practice

Hands-on lab

Trace Network Paths Like a Network Engineer
25 min · intermediate
In progress
Objectives
  • Confirm the local network and DNS configuration
  • Test loopback, local and remote connectivity
  • Resolve hostnames with dig and nslookup
  • Inspect HTTP reachability and headers with curl

Trace Network Paths Like a Network Engineer

25 min · intermediate

0/5 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

Which component makes a subnet public?

2

Security groups are stateful: return traffic is allowed automatically.

3

A database in a private subnet needs to call an external API but cannot. What is missing?

Quick reference

Cheat sheet

VPC building blocks
VPC 10.0.0.0/16Isolated regional network
SubnetCIDR slice, mapped to one AZ
Internet gatewayPublic route to and from the internet
NAT gatewayOutbound-only internet for private subnets
Route tableDestination CIDR to next-hop mapping
Traffic controls
Security groupStateful, per instance or ENI
Network ACLStateless, per subnet
VPC peeringConnect VPCs without the internet
VPC endpointPrivate path to AWS services
Go deeper

Official documentation

What Is Amazon VPC?
docs
VPCs and Subnets
docs
Security Groups
docs
Network ACLs
docs
NAT Gateways
docs