AWS Cloud Practitioner Study Notes · Part 18
AWS Network Components: VPC, Subnets, Routing, and Security
AWS Cloud Practitioner study notes explaining Regions, VPCs, subnets, route tables, gateways, firewalls, endpoints, and VPC connectivity.
AWS networking questions become easier when you understand how the components fit together. A Region contains Availability Zones. A VPC provides an isolated network inside one Region. Subnets divide that VPC across Availability Zones, while route tables and gateways determine where traffic can go.
This is Part 18 of the AWS Cloud Practitioner Study Notes series. Part 4 introduced Regions and Availability Zones, while Part 16 covered the EC2 compute that commonly runs inside these network components.
The network hierarchy
The basic relationship looks like this:
AWS Region
├── Availability Zone A
│ └── VPC
│ ├── Public subnet
│ └── Private subnet
└── Availability Zone B
└── VPC subnetsA VPC can span multiple Availability Zones in one Region, but a subnet belongs to exactly one Availability Zone. To improve availability, create subnets in multiple Availability Zones and distribute workload resources across them.
1. Region
An AWS Region is a geographical area containing multiple Availability Zones. Examples include Singapore (ap-southeast-1), Malaysia (ap-southeast-5), and N. Virginia (us-east-1).
Choose a Region based on factors such as:
- Where users and systems are located
- Data residency and regulatory requirements
- Service and instance availability
- Latency
- Pricing
Resources are generally Region-specific. A VPC is created in one Region, and its subnets and Availability Zones belong to that Region.
2. Availability Zone
An Availability Zone is one or more discrete data centres with redundant power, networking, and connectivity. Availability Zones in a Region are designed to be physically separate while connected by low-latency, high-bandwidth networking.
Use multiple Availability Zones to reduce the effect of a failure in one zone. For example, an application can run EC2 instances in two private subnets located in different Availability Zones, with a load balancer distributing traffic between them.
For the exam:
- Region: geographical area containing multiple AZs
- Availability Zone: isolated location used to improve availability and fault tolerance
3. Virtual Private Cloud (VPC)
An Amazon VPC is a logically isolated virtual network dedicated to an AWS account. You define its IP address range and control how resources communicate with each other, the internet, other VPCs, and on-premises networks.
A VPC gives you control over:
- IPv4 and IPv6 CIDR ranges
- Subnets
- Route tables
- Gateways and endpoints
- Security groups and network ACLs
- DNS settings
A VPC is Regional: it can contain subnets in multiple Availability Zones within that Region. It does not span Regions. To connect VPCs in different Regions, use an appropriate connectivity option such as inter-Region VPC peering or Transit Gateway-related designs.
4. Subnet
A subnet is a range of IP addresses inside a VPC. Each subnet belongs to one Availability Zone, and AWS resources such as EC2 instances are launched into a subnet.
Public subnet
A subnet is considered public when its associated route table has a route to an Internet Gateway. For IPv4 internet communication, resources also need a public IPv4 address or Elastic IP and security rules that allow the required traffic.
Common public-subnet resources include:
- Internet-facing load balancers
- Bastion hosts, where still appropriate
- Public web servers that genuinely require direct internet access
Private subnet
A subnet without a route to an Internet Gateway is private. Resources in private subnets are not directly reachable from the public internet. They can still access the internet outbound through a NAT Gateway, or access supported AWS services privately through VPC endpoints.
Common private-subnet resources include:
- Application servers
- Databases
- Internal APIs
- Workers and background processors
“Public” and “private” describe routing, not merely the subnet name. A subnet becomes public because of its route table and Internet Gateway route.
5. Route table
A route table contains destination-and-target rules that determine where traffic is sent. Every subnet is associated with a route table, either explicitly or through the VPC’s main route table.
Example routes:
| Destination | Target | Meaning |
|---|---|---|
| VPC CIDR | local | Communicate within the VPC |
0.0.0.0/0 | Internet Gateway | Route IPv4 internet traffic from a public subnet |
0.0.0.0/0 | NAT Gateway | Route outbound IPv4 internet traffic from a private subnet |
| S3 prefix list | Gateway endpoint | Access Amazon S3 privately |
AWS selects the most specific matching route. A route table does not itself grant permission; security groups and network ACLs still control whether traffic is allowed.
6. Internet Gateway
An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that enables communication between a VPC and the internet. It must be attached to the VPC and referenced by a subnet route table.
For an EC2 instance to communicate over the IPv4 internet through an IGW, the design normally needs:
- An Internet Gateway attached to the VPC
- A subnet route to the IGW
- A public IPv4 address or Elastic IP on the resource
- Security group and network ACL rules that allow the traffic
Attaching an IGW alone does not make every subnet or instance public.
7. NAT Gateway
A NAT Gateway allows resources in a private subnet to initiate connections to the internet without accepting unsolicited inbound connections from the internet. A common path is:
Private EC2 → private route table → NAT Gateway
→ public subnet route table → Internet Gateway → InternetUse it when private instances need to download operating-system updates, install packages, call public APIs, or reach external services. The NAT Gateway is placed in a public subnet and uses an Internet Gateway for its own internet connectivity.
The NAT Gateway does not make a private EC2 instance publicly addressable. Return traffic is allowed for connections initiated from the private resource, but the internet cannot start a new connection directly to that resource through the NAT Gateway.
8. Security group
A security group is a virtual firewall for an associated resource, commonly an EC2 network interface. It controls inbound and outbound traffic using allow rules.
Security groups are:
- Stateful: return traffic is automatically allowed for an allowed connection
- Allow-only: you add allow rules, but not explicit deny rules
- Applied at the resource or network-interface level
- Evaluated together when multiple rules apply
For example, a web server’s security group might allow HTTPS on TCP port 443 from the load balancer’s security group. A database security group might allow TCP 5432 only from the application server’s security group.
9. Network ACL
A Network Access Control List (NACL) is a firewall for a subnet. It applies to traffic entering and leaving every resource in that subnet.
NACLs are:
- Stateless: inbound and outbound traffic must be allowed separately
- Allow-and-deny: explicit deny rules are supported
- Evaluated in rule-number order until a matching rule is found
- Subnet-level controls
The exam comparison is straightforward:
| Characteristic | Security group | Network ACL |
|---|---|---|
| Scope | Resource or network interface | Subnet |
| State | Stateful | Stateless |
| Rules | Allow only | Allow and deny |
| Return traffic | Automatically allowed | Must be explicitly allowed |
Security groups are normally the primary resource-level control. NACLs can provide an additional subnet-level guardrail.
10. Elastic IP
An Elastic IP is a static public IPv4 address that can be associated with an AWS resource. It is useful when a public endpoint must retain a stable IPv4 address, such as a self-managed public server or a network appliance.
For highly available architectures, do not treat a single EC2 instance and Elastic IP as a substitute for a load balancer or automated failover. The address is stable, but the server behind it still needs recovery and availability planning.
11. Elastic Network Interface (ENI)
An Elastic Network Interface is a virtual network interface in a VPC. It can have private IP addresses, an optional public or Elastic IP association, a MAC address, and security group associations.
An ENI is the network attachment through which an EC2 instance communicates. Secondary ENIs can support designs such as separate network paths, appliance architectures, or multiple IP addresses, subject to the instance and service limits.
12. VPC endpoints
VPC endpoints provide private connectivity from a VPC to supported AWS services or endpoint services without requiring an Internet Gateway or NAT device for that path.
Two important endpoint types are:
- Gateway endpoints: used for Amazon S3 and DynamoDB. The endpoint is added as a route-table target and has no additional endpoint charge.
- Interface endpoints: powered by AWS PrivateLink. They create endpoint network interfaces with private IP addresses in selected subnets and support many AWS services. Hourly and data-processing charges apply.
For example, a private EC2 instance can use an S3 gateway endpoint instead of sending S3 traffic through a NAT Gateway. This can improve the network design and avoid unnecessary NAT processing for that traffic.
13. VPC peering
VPC peering creates a direct private network connection between two VPCs in the same or different Regions. After the connection is accepted, both sides need route-table entries for the other VPC’s CIDR range, and security controls must allow the traffic.
Important limitations:
- The VPC CIDR blocks cannot overlap.
- Peering is a one-to-one relationship.
- Peering is not transitive: VPC B cannot reach VPC C through VPC A merely because A peers with both.
VPC peering is useful for a small number of direct VPC connections. A larger network may need a central routing hub.
14. AWS Transit Gateway
AWS Transit Gateway acts as a central network hub for connecting many VPCs and on-premises networks. Instead of building a growing mesh of individual peering connections, attach VPCs to the Transit Gateway and control connectivity with Transit Gateway route tables.
Conceptually:
VPC A ─┐
VPC B ─┼── Transit Gateway ── VPN or Direct Connect ── On-premises network
VPC C ─┘Transit Gateway is a strong exam answer when the requirement emphasises connecting many VPCs or using a central hub. It does not remove the need for correct VPC route tables, attachment configuration, security rules, and Transit Gateway route-table configuration.
Cloud Practitioner decision cues
- Geographical location with multiple AZs: Region
- Isolated data-centre location: Availability Zone
- Isolated virtual network: VPC
- Network segment in one AZ: Subnet
- Traffic destination and next hop: Route table
- Public internet connectivity: Internet Gateway
- Outbound internet from a private subnet: NAT Gateway
- Stateful resource firewall: Security group
- Stateless subnet firewall with deny rules: NACL
- Stable public IPv4 address: Elastic IP
- Virtual network card: ENI
- Private AWS service access: VPC endpoint
- Direct private connection between two VPCs: VPC peering
- Central hub for many VPCs and networks: Transit Gateway
Conclusion
AWS networking is a set of layers. Regions contain Availability Zones; VPCs provide Regional network isolation; subnets place resources in individual Availability Zones; route tables choose paths; gateways and endpoints provide connectivity; and security groups and NACLs control traffic.
For the exam, identify the layer described by the question. “Stateful instance firewall” means security group, “stateless subnet firewall” means NACL, “outbound-only internet for private resources” means NAT Gateway, and “many VPCs through a central hub” means Transit Gateway.