VPC Fundamentals

Summary: Amazon VPC (Virtual Private Cloud) is your own private, isolated network within AWS where you launch resources. It controls IP addressing, routing, and connectivity - both between your own subnets and out to the internet, other VPCs, and on-premises networks.

You should know about:

• VPC, subnets, internet gateways, and NAT gateways
• Security groups, Network ACLs (NACL), VPC Flow Logs
• VPC Peering, VPC Endpoints
• Site-to-Site VPN and Direct Connect

VPC and Subnets

• VPC - a private network for your resources; scoped to a Region
• Subnet - partitions a VPC’s network; scoped to a single Availability Zone
• Public subnet - accessible from the internet (has a route to an Internet Gateway)
• Private subnet - not accessible from the internet
• Route tables define how traffic flows between subnets and to/from the internet - each subnet is associated with one route table, and the routes in it determine whether that subnet is effectively public or private

VPC Diagram

A VPC is defined by a CIDR range (e.g. 10.0.0.0/16) and spans an entire Region, but each subnet inside it lives in one AZ. A common pattern is to create a public and a private subnet in each AZ, so the architecture stays highly available if one AZ goes down.

Internet Gateway and NAT Gateways

• Internet Gateway (IGW) - attached at the VPC level, lets VPC resources connect to the internet
• Public subnets have a route table entry pointing to the IGW
• NAT Gateway (AWS-managed) / NAT instance (self-managed) - sits in a public subnet and lets instances in private subnets initiate outbound internet connections while remaining unreachable from the internet

Network ACL & Security Groups

	Network ACL (NACL)	Security Group
Operates at	Subnet level	ENI / EC2 instance level
Rule types	ALLOW and DENY	ALLOW only
State	Stateless - return traffic must be explicitly allowed	Stateful - return traffic is automatically allowed
Rules can reference	IP addresses only	IP addresses and other security groups

NACL vs. Security Group statefulness is a classic exam trap: a security group automatically allows response traffic, but a NACL does not - you must explicitly allow both inbound and outbound.

VPC Flow Logs

Capture metadata about IP traffic going into your interfaces, at three levels:

• VPC Flow Logs
• Subnet Flow Logs
• Elastic Network Interface (ENI) Flow Logs

Useful for monitoring and troubleshooting connectivity issues, e.g.:

• Subnet to internet

• Internet to subnet

• Subnet to subnet

• Also captures traffic from AWS-managed interfaces: ELB, ElastiCache, RDS, Aurora, etc.

• Destinations: S3, CloudWatch Logs, Kinesis Data Firehose

VPC Peering

Connects two VPCs privately over AWS’s network so they behave as if they were on the same network.

• CIDR ranges of the two VPCs must not overlap
• Not transitive - a peering connection must be established explicitly between every pair of VPCs that need to communicate

Non-transitivity is the key exam trap for VPC Peering: if A↔B and B↔C are peered, A and C still cannot communicate unless you also create an A↔C peering connection.

VPC Endpoints

Let you connect to AWS services using AWS’s private network instead of the public internet - lower latency, better security, and traffic never leaves the AWS network. Only usable from within your VPC.

	VPC Endpoint Gateway	VPC Endpoint Interface
Mechanism	Target in a route table	ENI with a private IP in your subnet
Supported services	S3 and DynamoDB only	Most AWS services (including S3 and DynamoDB)

Site-to-Site VPN and Direct Connect

	Site-to-Site VPN	Direct Connect (DX)
Connects	On-premises to AWS	On-premises to AWS
Network path	Public internet	Private physical connection
Encryption	Automatic	Not automatic (private, but you add encryption if needed)
Setup time	Minutes	At least a month
Security/speed	Good	Private, secure, and fast

Typical 3-Tier Solution Architecture

A common pattern combining the pieces above:

• Route 53 resolves the domain and directs users to the entry point
• Public subnets hold a Multi-AZ ELB as the entry point
• Private subnets (one per AZ) hold the app tier - EC2 instances in an Auto Scaling Group
• Data subnet holds RDS (read/write data) and ElastiCache (session/cached data)

LAMP Stack on EC2

• Linux - OS for EC2 instances
• Apache - web server running on Linux (EC2)
• MySQL - database on RDS
• PHP - application logic (running on EC2)

Can add Redis/Memcached (ElastiCache) for caching. Application data and software are typically stored on the root EBS volume.

Other popular stacks worth recognizing: MEAN/MERN (MongoDB, Express, Angular/React, Node), Django (Python + Postgres), Ruby on Rails, and JAMstack (static frontend + APIs, e.g. S3/CloudFront + Lambda).

Configuration & Limits

• VPC: regional resource, defined by a CIDR range
• Subnet: AZ-scoped resource, partitions a VPC
• VPC Peering: CIDR ranges must not overlap

Exam Tips & Gotchas

• NACLs are stateless (must allow inbound and outbound explicitly); Security Groups are stateful (return traffic auto-allowed)
• VPC Peering is not transitive - each pair of VPCs needs its own peering connection
• VPC Endpoint Gateway only supports S3 and DynamoDB; Endpoint Interface supports most other services
• Direct Connect takes at least a month to provision - not suitable for urgent connectivity needs
• Site-to-Site VPN is quick to set up but travels over the public internet (encrypted); Direct Connect is private but slow to provision

Integrations

• EC2 - instances are launched into VPC subnets and secured with security groups
• RDS, Aurora, ElastiCache - typically placed in private/data subnets, reachable via VPC endpoints or peering
• ELB - sits in public subnets as the entry point for a 3-tier architecture
• Route 53 - resolves domain names to the entry point (e.g. an ELB) of a VPC-based architecture

Review Questions

What's the difference between a VPC and a subnet in terms of scope?

A: A VPC is a regional resource. A subnet is scoped to a single Availability Zone and partitions the VPC’s network.

What determines whether a subnet is public or private?

A: Its route table - a public subnet has a route to an Internet Gateway; a private subnet does not.

How do private subnet instances get outbound internet access without being reachable from the internet?

A: Via a NAT Gateway (AWS-managed) or NAT instance (self-managed) sitting in a public subnet.

What's the key difference between Network ACLs and Security Groups?

A: NACLs operate at the subnet level, support ALLOW and DENY rules, and are stateless. Security Groups operate at the ENI/instance level, support ALLOW rules only, and are stateful (return traffic is automatically allowed).

Is VPC Peering transitive?

A: No. If VPC A is peered with B, and B is peered with C, A and C still cannot communicate - a direct A↔C peering connection must be created explicitly.

What's the difference between a VPC Endpoint Gateway and a VPC Endpoint Interface?

A: A Gateway endpoint is a route table target and only supports S3 and DynamoDB. An Interface endpoint is an ENI with a private IP and supports most other AWS services (including S3 and DynamoDB).

How do Site-to-Site VPN and Direct Connect differ?

A: Site-to-Site VPN connects on-premises to AWS over the public internet with automatic encryption and quick setup. Direct Connect is a private physical connection - faster and more secure, but takes at least a month to establish.

What is an ENI?

A: An Elastic Network Interface - a virtual network card attached to an EC2 instance, holding its private IP, MAC address, and security group associations.

At what level is an Internet Gateway attached, and what makes a subnet actually use it?

A: The IGW is attached at the VPC level (one per VPC). A subnet only becomes public when its route table has an entry pointing at the IGW - attaching the IGW alone isn’t enough.

Where does a NAT Gateway have to sit, and why?

A: In a public subnet. It needs its own route to the Internet Gateway in order to forward outbound traffic on behalf of instances in private subnets, which stay unreachable from the internet.

How are NACL rules evaluated, and what do default vs. custom NACLs allow?

A: Rules are evaluated in order by rule number, lowest first, and the first match wins (later rules aren’t considered). The default NACL allows all inbound and outbound traffic; a newly created custom NACL denies everything until you add rules.

At what three levels can VPC Flow Logs be captured, and where can they be sent?

A: VPC level, subnet level, and ENI level. Destinations: S3, CloudWatch Logs, or Kinesis Data Firehose. They also capture traffic from AWS-managed interfaces (ELB, ElastiCache, RDS, Aurora).

What's the CIDR requirement for VPC Peering?

A: The two VPCs’ CIDR ranges must not overlap. (And peering is not transitive - every pair needs its own connection.)

Why use a VPC Endpoint at all?

A: To reach AWS services over AWS’s private network instead of the public internet - lower latency, better security, and traffic never leaves the AWS network. Only usable from inside your VPC.

Is Direct Connect encrypted?

A: Not automatically. It’s a private physical connection, so it doesn’t traverse the public internet, but you must add encryption yourself if you need it. Site-to-Site VPN, by contrast, encrypts automatically because it does cross the public internet.

Lay out a typical 3-tier architecture across subnets.

A: Route 53 resolves the domain → a Multi-AZ ELB in the public subnets is the entry point → EC2 instances in an Auto Scaling Group in private subnets run the app tier → a data subnet holds RDS (persistent data) and ElastiCache (session/cached data).

What does LAMP stand for and where does each piece run on AWS?

A: Linux (EC2 OS), Apache (web server on EC2), MySQL (on RDS), PHP (app logic on EC2). Application data and software typically live on the root EBS volume; add ElastiCache for caching.