AWS Networking Services: The Cloud Practitioner Mind Map

AWS networking questions become much easier when each service has a clear job. Start with the VPC, divide it into subnets, control traffic with route tables, choose the right connectivity option, and then apply security controls at the correct layer.

This is Part 28 of the AWS Cloud Practitioner Study Notes. Part 24 introduced VPCs, CIDR ranges, and subnets; Part 25 compared the main gateways; Part 26 focused on security groups and network ACLs; and Part 27 covered private access to AWS services.

The AWS networking mind map

Think about the services in five groups:

Group	Services	Main question
Network foundation	VPC, subnet, CIDR, route table, ENI, Elastic IP	Where do resources live and how are they addressed?
Internet and service access	Internet Gateway, NAT Gateway, VPC endpoint	How does traffic reach the Internet or an AWS service?
VPC and office connectivity	VPC peering, Transit Gateway, Site-to-Site VPN, Direct Connect	How do networks connect to one another?
Network controls	Security group, Network ACL, Network Firewall	Where should traffic be allowed, denied, or inspected?
Edge protection	AWS WAF, AWS Shield	How do I protect a public application from web attacks and DDoS?

1. Amazon VPC: the network boundary

An Amazon VPC is a logically isolated virtual network in an AWS Region. You choose its IP address range, usually with an IPv4 CIDR such as 10.0.0.0/16, and place resources such as EC2, RDS, and ECS inside its subnets.

A VPC spans the Availability Zones in its Region, but it does not span Regions. Its subnets, route tables, gateways, endpoints, and security controls form the network design for the workloads inside it.

Exam shortcut: “Create an isolated network in AWS” usually points to Amazon VPC.

2. Subnets: divide the VPC

A subnet is a range of IP addresses inside a VPC. Each subnet belongs to exactly one Availability Zone. A resilient design normally creates subnets in more than one Availability Zone and distributes resources across them.

A subnet is public when its associated route table has a route to an Internet Gateway. A subnet is private when it does not have that direct route. The names alone do not determine whether a subnet is public or private.

Typical placement:

VPC: 10.0.0.0/16
├── Public subnets  → internet-facing load balancer, carefully chosen public resources
└── Private subnets → application servers, workers, databases

3. Route tables: decide where traffic goes

A route table contains destination-and-target rules. Every subnet is associated with one route table, either explicitly or through the VPC’s main route table. AWS selects the most specific matching route.

Common routes include:

Destination	Target	Purpose
VPC CIDR	local	Communication inside the VPC
0.0.0.0/0	Internet Gateway	IPv4 Internet path from a public subnet
0.0.0.0/0	NAT Gateway	Outbound IPv4 Internet path from a private subnet
S3 prefix list	Gateway endpoint	Private access to Amazon S3
Another VPC CIDR	Peering or Transit Gateway	Private network-to-network traffic

A route table chooses a path; it does not replace security groups, NACLs, IAM permissions, or application authentication.

4. Internet Gateway: public Internet connectivity

An Internet Gateway (IGW) is a highly available VPC component that allows communication between a VPC and the Internet. It must be attached to the VPC and referenced by a route table.

For an IPv4 EC2 instance to use the Internet through an IGW, the design normally needs:

• An Internet Gateway attached to the VPC
• A subnet route such as 0.0.0.0/0 → Internet Gateway
• A public IPv4 address or Elastic IP on the resource
• Security group and NACL rules that allow the required traffic

Attaching an IGW alone does not make every subnet or instance public.

Exam shortcut: “Public website” or “Internet-facing load balancer” usually points to an Internet Gateway.

5. NAT Gateway: outbound access from private subnets

A NAT Gateway allows resources in a private subnet to initiate IPv4 connections to the Internet without allowing unsolicited inbound connections through that NAT path.

The common flow is:

Private EC2 → private route table → NAT Gateway
           → public subnet route table → Internet Gateway → Internet

Use a NAT Gateway when private resources need to download updates, install packages, call public APIs, or reach external services. A public NAT Gateway is placed in a public subnet. In a multi-AZ design, place NAT capacity close to the private subnets that use it to improve resilience and avoid unnecessary cross-AZ traffic.

Exam shortcut: “Private subnet needs outbound Internet access” usually points to a NAT Gateway.

6. VPC endpoints: private access to AWS services

VPC endpoints let resources access supported AWS services without using an Internet Gateway or NAT device for that service path.

• Gateway endpoints: used for Amazon S3 and DynamoDB, and added as route-table targets.
• Interface endpoints: use AWS PrivateLink and create endpoint network interfaces with private IP addresses in selected subnets. They support many AWS services and generally have hourly and data-processing charges.

For example, a private EC2 instance can use an S3 gateway endpoint rather than sending S3 traffic through a NAT Gateway. The endpoint does not replace IAM permissions or an S3 bucket policy.

7. Security groups and Network ACLs

A security group is a stateful, allow-only virtual firewall associated with a resource’s network interface. Return traffic for an allowed connection is automatically permitted. A common design allows HTTPS from a load balancer security group to an application security group, then allows database traffic only from the application security group.

A Network Access Control List (NACL) is a stateless firewall at the subnet boundary. It supports both allow and deny rules. Because it is stateless, inbound and outbound return traffic must be allowed separately, and rules are evaluated in number order.

Characteristic	Security group	Network ACL
Scope	Resource or network interface	Subnet
State	Stateful	Stateless
Rules	Allow only	Allow and deny
Typical role	Primary resource-level control	Coarse subnet guardrail or explicit deny

8. ENI and Elastic IP

An Elastic Network Interface (ENI) is a virtual network interface. It can have private IP addresses, security group associations, a MAC address, and an optional public or Elastic IP association. An EC2 instance uses its ENI to communicate with the VPC.

An Elastic IP is a static public IPv4 address that can be associated with a supported AWS resource. It is useful when a public endpoint must retain a stable IPv4 address, but it is not a replacement for a load balancer or a high-availability design.

9. VPC Peering and Transit Gateway

VPC peering creates a direct private connection between two VPCs. The CIDR ranges must not overlap, both sides need routes, and peering is not transitive.

VPC A ↔ VPC B

AWS Transit Gateway is a central network hub for connecting many VPCs, Site-to-Site VPNs, and Direct Connect networks. It is a better fit for a larger hub-and-spoke topology than maintaining a growing mesh of one-to-one peering connections.

VPC A ─┐
VPC B ─┼─ Transit Gateway ── office network
VPC C ─┘

Exam shortcut: Two VPCs suggests VPC peering; many VPCs suggests Transit Gateway.

10. Site-to-Site VPN and Direct Connect

AWS Site-to-Site VPN creates encrypted tunnels over the public Internet between an on-premises network and AWS. The AWS side can terminate on a Virtual Private Gateway or Transit Gateway, depending on the architecture.

AWS Direct Connect provides a dedicated network connection from a data centre or office to AWS. It offers more consistent private connectivity than an Internet-based VPN, but it requires circuit planning and provider coordination.

Requirement	Common choice
Encrypted connection over the public Internet	Site-to-Site VPN
Dedicated, consistent private connection	Direct Connect
Many VPCs and hybrid connections	Transit Gateway, often with VPN or Direct Connect attachments

11. Network Firewall, WAF, and Shield

These services protect different layers:

• AWS Network Firewall: a managed network firewall for inspecting and filtering traffic in a VPC. It is suited to deeper network-level inspection and centralised VPC controls.
• AWS WAF: a web application firewall that evaluates HTTP and HTTPS requests. It can help protect applications from patterns such as SQL injection, cross-site scripting, bots, and unwanted requests. It is commonly associated with CloudFront, an Application Load Balancer, or API Gateway.
• AWS Shield: managed DDoS protection. Shield Standard is included automatically, while Shield Advanced provides additional protection and features for eligible resources.

The exam distinction is:

Network traffic inspection → AWS Network Firewall
HTTP/HTTPS application requests → AWS WAF
DDoS attacks → AWS Shield

How everything fits together

A production web application might use this layered design:

Internet
  │
AWS Shield
  │
AWS WAF
  │
Internet-facing load balancer in public subnets
  │
Application servers in private subnets
  │
Database in private subnets
  ├── NAT Gateway → external services and updates
  └── VPC endpoint → private AWS service access

The VPC supplies isolation, subnets provide placement, route tables select paths, gateways connect networks, and security controls restrict traffic. Each service solves a different part of the design.

CLF-C02 memory map

• Need a private network? → VPC
• Need to divide the network? → Subnet
• Need to decide where packets go? → Route table
• Need public Internet connectivity? → Internet Gateway
• Need outbound Internet from a private subnet? → NAT Gateway
• Need private access to S3 or DynamoDB? → Gateway VPC endpoint
• Need private access to many AWS services? → Interface VPC endpoint
• Need to protect a resource? → Security group
• Need to protect a subnet? → Network ACL
• Need to connect two VPCs? → VPC peering
• Need to connect many VPCs? → Transit Gateway
• Need an encrypted office-to-AWS tunnel? → Site-to-Site VPN
• Need a dedicated office-to-AWS connection? → Direct Connect
• Need web-request filtering? → AWS WAF
• Need DDoS protection? → AWS Shield

Conclusion

The most useful way to study AWS networking is to identify the destination and the required direction of traffic. A public resource needs an Internet Gateway path, a private resource usually uses a NAT Gateway for outbound Internet access, and a private AWS service path may use a VPC endpoint. For network relationships, choose peering for a small direct connection, Transit Gateway for a central hub, VPN for encrypted Internet transport, and Direct Connect for dedicated connectivity.

Sources

• Amazon VPC basics
• Subnet route tables
• Enable Internet access for a VPC using an Internet Gateway
• AWS VPC security groups and network ACLs
• How AWS Transit Gateway works