AWS VPC Networking

An Amazon Virtual Private Cloud (VPC) is a logically isolated network in an AWS Region that you configure for your resources. Subnets, route tables, gateways, and security controls determine how resources communicate with each other, the internet, and other services.

A VPC has an IP address range, expressed as a CIDR block, such as `10.0.0.0/16`. You divide that range into subnets. Each subnet belongs to one Availability Zone, while a VPC can span multiple Availability Zones in the same Region. AWS provides a local route so resources in the VPC can communicate across subnets, subject to network controls.

A route table determines where traffic from an associated subnet is sent. A subnet is commonly called public when its route table sends internet-bound IPv4 traffic to an Internet Gateway (IGW). For an instance to be reachable from the public internet, it also needs a public IP address and rules that allow the traffic. A private subnet has no direct route to an IGW.

Private resources can make outbound internet connections through a NAT Gateway placed in a public subnet, provided their subnet's route table points to it. NAT allows return traffic for connections initiated by private resources; it does not make those resources directly reachable from the internet. For supported AWS services, a VPC endpoint can provide a private route without sending traffic over the public internet.

Security groups and network ACLs filter traffic at different levels. A security group is associated with network interfaces and is stateful: responses to allowed connections are permitted automatically. A network ACL applies at the subnet boundary and is stateless, so inbound and outbound rules must account for both directions.

Key points

• A VPC is scoped to one AWS Region; its subnets are each scoped to one Availability Zone.
• CIDR blocks define VPC and subnet IP ranges.
• Route tables direct traffic; a public subnet requires an internet route through an IGW, and internet-facing IPv4 instances also need public addressing.
• A NAT Gateway supports outbound connections from private subnets without allowing unsolicited inbound connections.
• Security groups are stateful controls on network interfaces; network ACLs are stateless controls at subnet boundaries.

Interview questions

What is a VPC, and how do VPCs, subnets, and Availability Zones relate?

A VPC is an isolated virtual network in an AWS Region, with an IP range defined by a CIDR block. Subnets split that range into smaller ranges and each subnet belongs to one Availability Zone. A VPC can have subnets in multiple Availability Zones. This lets an application distribute resources across zones while keeping them in one VPC.

What makes a subnet public or private?

The route table associated with the subnet determines its network paths. A subnet is generally considered public when it has a route for internet-bound traffic to an Internet Gateway. A resource also needs suitable addressing and security rules to communicate with the public internet. A subnet without a direct route to an Internet Gateway is generally private.

How can a private EC2 instance access the internet for updates without being directly exposed?

A common setup places a NAT Gateway in a public subnet and gives it a route to an Internet Gateway. The private subnet's route table sends internet-bound traffic to that NAT Gateway. The private instance can initiate outbound connections and receive their responses, but the NAT Gateway does not provide direct inbound access from the internet. Security groups and other controls should still be configured appropriately.

How do security groups differ from network ACLs?

Security groups are associated with network interfaces and are stateful: when a connection is allowed, its response traffic is allowed automatically. Network ACLs apply at the subnet boundary and are stateless, so inbound and outbound rules are evaluated separately. Network ACL rules are numbered and evaluated in order. In practice, security groups are commonly used for resource-level access rules, while network ACLs can provide an additional subnet-level filter.

How would you privately connect an application in a VPC to a supported AWS service?

I would consider a VPC endpoint for the service, if that service and endpoint type are supported for the use case. An endpoint provides a private path from the VPC to the service, avoiding the need to send that traffic over the public internet. The endpoint type affects how it is configured and how traffic is routed. I would also check the relevant endpoint policy, service permissions, and security rules.