Amazon VPC
- What it is
- Virtual Private Cloud — a logically isolated section of the AWS Cloud where you launch resources in a network you define.
- You control the IP range (CIDR block), subnets, route tables, and gateways.
- Core components
- Subnets — a slice of the VPC’s IP range, always inside exactly one Availability Zone.
- Public subnet — has a route to an internet gateway.
- Private subnet — no direct inbound route from the internet.
- Internet Gateway (IGW) — allows two-way internet traffic for public subnets.
- NAT Gateway — lets private-subnet resources reach out to the internet without being reachable from it.
- Route tables — decide where traffic for a destination goes.
- VPC endpoints — reach AWS services (S3, DynamoDB) privately, without traversing the internet.
- VPC peering / Transit Gateway — connect VPCs to each other.
- Subnets — a slice of the VPC’s IP range, always inside exactly one Availability Zone.
- Two layers of firewall (a favorite exam distinction)
- security groups — instance level, stateful, allow rules only.
- network ACLs — subnet level, stateless, allow and deny rules.
- Default posture
- Every account gets a default VPC per Region. Resources in a VPC are isolated from other customers by default.