Skip to content
DRDiwakar Rai

NotesVPC & Networking

VPC & Networking

VPC design, subnets, route tables, security groups vs NACLs, NAT, and endpoints — the networking foundation

Updated Sep 26, 2026

VPC & Networking Quick Notes


Building Blocks

  • VPC: Isolated virtual network in a Region.
  • Subnet: AZ-scoped slice of the VPC CIDR.
  • Public subnet: Default route 0.0.0.0/0 → Internet Gateway (IGW).
  • Private subnet: No IGW route; outbound via NAT Gateway (IPv4) when needed.
  • Route tables: Longest (most specific) prefix wins.

Security Groups vs NACLs


Security Group , NACL

Level: ENI / instance, Subnet

State: Stateful, Stateless

Rules: Allow only (implicit deny), Allow + deny

Return traffic: Allowed automatically, Must allow inbound and outbound

  • Classic 3-tier: ALB SG ← world:443 · App SG ← ALB SG · DB SG ← App SG on DB port.
  • Exam tip: SG source can reference another SG (or, in some patterns, an IGW id) — prefer SG-to-SG over wide CIDRs.

NAT

  • NAT Gateway: Managed PAT in a public subnet; private subnets route 0.0.0.0/0 to it.
  • HA pattern: One NATGW per AZ; each private RT points to the local AZ’s NAT.
  • Egress-only IGW: IPv6 outbound-only (NAT is an IPv4 idea).
  • NAT instance: Can use SGs, port forwarding, bastion dual-use — you manage the instance.

VPC Endpoints

Type, Services, How

Gateway, S3, DynamoDB, Prefix-list route in route table

Interface (PrivateLink), Most other AWS APIs, ENI in a subnet + SG

  • Need both S3 and DynamoDB privately → two gateway endpoints + two RT entries.
  • Private SQS without internet → interface endpoint (not gateway).
  • Provider: NLB + endpoint service.
  • Consumer: Interface endpoint in their VPC.
  • Fit: SaaS → customer private connectivity without peering or IGW.

DNS in the VPC

  • Private hosted zones need VPC DNS hostnames + DNS resolution enabled (enableDnsHostnames, enableDnsSupport).
  • Route 53 Resolver: Inbound (on-prem → AWS names) and outbound (VPC → on-prem DNS) endpoints for hybrid resolution.