Amazon VPC

Virtual Private Cloud — Networking & Content Delivery

VPC Overview

Virtual Private Cloud (VPC) — A logically isolated section of the AWS Cloud where you launch AWS resources in a virtual network that you define.
Regional resource — A VPC spans all Availability Zones in a region but does not cross regions.
You have full control over your virtual networking environment: IP address ranges, subnets, route tables, and network gateways.
AWS creates a default VPC in each region with default subnets in each AZ (all are public subnets).
You can have up to 5 VPCs per region (soft limit, can be increased).
VPC CIDR range: min /28 (16 IPs) to max /16 (65,536 IPs).

Key Point:

Only private IP ranges are allowed in a VPC: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

Subnets

Subnets are sub-ranges of IP addresses within your VPC, tied to a specific Availability Zone.
AWS reserves 5 IP addresses (first 4 + last 1) in each subnet.

Public Subnet vs Private Subnet

Feature	Public Subnet	Private Subnet
Internet Access	Yes, via Internet Gateway	No direct internet access
Route Table	Route to Internet Gateway (0.0.0.0/0 → IGW)	Route to NAT Gateway for outbound (0.0.0.0/0 → NAT)
Use Cases	Web servers, load balancers, bastion hosts	Databases, application servers, backend services
Public IP	Instances can have public IPs	Instances only have private IPs

Exam Tip:

A subnet is public if its route table has a route to an Internet Gateway. A subnet is private if it does not.

Internet Gateway (IGW)

Allows resources in a public subnet to connect to the internet.
Attached at the VPC level (one IGW per VPC).
Scales horizontally, is highly available and redundant.
Must also update the route table to route 0.0.0.0/0 to the IGW.
Performs Network Address Translation (NAT) for instances with public IPv4 addresses.

NAT Gateway vs NAT Instance

Both allow instances in private subnets to access the internet for updates, patches, etc., while remaining unreachable from the internet.

Feature	NAT Gateway	NAT Instance
Managed by	AWS (fully managed)	You (self-managed EC2)
Availability	Highly available within AZ (create in each AZ for multi-AZ HA)	Use scripts to manage failover
Bandwidth	Up to 100 Gbps	Depends on EC2 instance type
Cost	Pay per hour + data processed	Pay per EC2 hour + data, type, size
Security Groups	Cannot be associated	Can be associated
Bastion Host	Cannot be used as one	Can be used as bastion host
Source/Dest Check	N/A	Must be disabled

Exam Tip:

NAT Gateway is the AWS-recommended solution. NAT Instance is a legacy approach. NAT Gateway must be placed in a public subnet and needs an Elastic IP.

Security Groups vs NACLs

Feature	Security Groups	Network ACLs (NACLs)
Level	Instance level (ENI)	Subnet level
State	Stateful — return traffic automatically allowed	Stateless — return traffic must be explicitly allowed
Rules	Allow rules only	Allow and Deny rules
Rule Evaluation	All rules evaluated before deciding	Rules evaluated in order (lowest number first)
Default	Default SG: denies all inbound, allows all outbound	Default NACL: allows all inbound and outbound
Applies to	Only if associated with an instance	Automatically applies to all instances in the subnet
Reference other SGs	Yes (can reference other security groups)	No (only CIDR ranges)

Key Point:

Security Groups = stateful + allow only. NACLs = stateless + allow & deny. This is a very common exam question.

VPC Flow Logs

Capture information about IP traffic going to and from network interfaces in your VPC.
Can be applied at three levels: VPC level, Subnet level, or ENI (Elastic Network Interface) level.
Log data can be sent to Amazon S3, CloudWatch Logs, or Kinesis Data Firehose.
Helps monitor and troubleshoot connectivity issues (e.g., why a subnet can't reach the internet, why an instance can't be reached).
Captures metadata (source/dest IP, ports, protocol, action: ACCEPT/REJECT), not packet contents.

Exam Tip:

VPC Flow Logs capture network traffic metadata. They are used for troubleshooting and security analysis. GuardDuty analyzes them for threat detection.

VPC Peering

Privately connect two VPCs using AWS's network, making them behave as if they were in the same network.
Non-transitive — if VPC A peers with VPC B, and VPC B peers with VPC C, VPC A cannot communicate with VPC C through VPC B. A direct peering connection is required.
Can be cross-account and cross-region.
CIDR ranges must not overlap.
Must update route tables in both VPCs to enable communication.

Exam Tip:

VPC Peering is non-transitive. For connecting many VPCs in a hub-and-spoke model, use Transit Gateway instead.

VPC Endpoints

Allow you to connect to AWS services using a private network instead of the public internet. This removes the need for an IGW or NAT to access supported AWS services.

Gateway Endpoints

Supported for Amazon S3 and DynamoDB only.
Free of charge.
Provisioned as a target in a route table (does not use ENI).

Interface Endpoints (powered by AWS PrivateLink)

Supported for most other AWS services.
Provisions an Elastic Network Interface (ENI) with a private IP as an entry point.
Costs per hour + per GB of data processed.
Supports security groups.
Can also be used for S3 (as an alternative to gateway endpoint).

Key Point:

Gateway Endpoint = S3 & DynamoDB (free). Interface Endpoint = most other services (paid, uses PrivateLink). Both keep traffic private within AWS.

AWS PrivateLink (VPC Endpoint Services)

Most secure and scalable way to expose a service to thousands of VPCs (your own or other accounts).
Does not require VPC Peering, Internet Gateway, NAT, or route tables.
Service provider side: requires a Network Load Balancer (NLB).
Consumer side: requires an Elastic Network Interface (ENI) or a Gateway Load Balancer Endpoint.

Exam Tip:

If the exam asks how to expose a service to hundreds or thousands of VPCs securely, the answer is AWS PrivateLink.

Hybrid Connectivity: On-Premises to AWS

Site-to-Site VPN

Encrypted connection over the public internet.
Quick to set up (minutes).
AWS side: Virtual Private Gateway (VGW) attached to VPC.
On-premises side: Customer Gateway (CGW) device/software.
Lower cost, but bandwidth is limited by internet connection.

AWS Direct Connect

Dedicated private physical connection from on-premises to AWS.
Takes at least 1 month to establish (requires physical infrastructure setup).
Data travels over a private network, not the internet.
Higher bandwidth, lower latency, more consistent network experience.
More expensive than VPN but better performance.
Supports both public and private resources on the AWS end.
Not encrypted by default (but can set up VPN over Direct Connect for encryption).

AWS Client VPN

Connect from your computer to AWS using OpenVPN.
Allows you to connect to your EC2 instances over a private IP as if you were in the private VPC network.
Goes over the public internet.

Feature	Site-to-Site VPN	Direct Connect
Connection	Over public internet (encrypted)	Dedicated private connection
Setup Time	Minutes	1+ month
Cost	Lower	Higher
Bandwidth	Limited by internet	Up to 100 Gbps
Latency	Variable	Consistent & low
Encryption	Yes (IPSec)	Not by default

Exam Tip:

Direct Connect = private, dedicated, 1+ month setup. Site-to-Site VPN = encrypted, public internet, fast setup. If the question mentions "quick" or "immediately," choose VPN. If it mentions "dedicated" or "consistent," choose Direct Connect.

AWS Transit Gateway

Provides transitive peering between thousands of VPCs and on-premises networks using a hub-and-spoke (star) model.
One single gateway to connect: VPCs, VPN connections, Direct Connect gateways.
Regional resource, but can work cross-region.
Works with Resource Access Manager (RAM) to share across accounts.
Supports IP Multicast (only AWS service that does).
Route tables can be used to control which VPCs can communicate with each other.

Key Point:

Transit Gateway is the go-to solution for connecting many VPCs and on-premises networks through a single, centralized hub. It solves the non-transitive limitation of VPC Peering.