AWS VPC (Virtual Private Cloud)
Amazon VPC allows you to provision a logically isolated section of the AWS Cloud. You have complete control over your virtual networking environment, including the selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.
🏗️ The Networking Blueprint
A VPC is essentially your own private data center in the cloud. Within it, you define the architecture of how your resources talk to each other and the internet.
🧱 Key Components
1. Subnets
A range of IP addresses in your VPC.
- Public Subnet: Direct access to the internet via an Internet Gateway. Best for Web Servers.
- Private Subnet: No direct internet access. Best for Databases and Back-end services.
2. Internet Gateway (IGW)
The "front door" that allows your VPC to communicate with the internet. Without an IGW, your VPC is a walled garden.
3. Route Tables
A set of rules (routes) that act like a GPS, determining where network traffic from your subnets or gateways is directed.
4. NAT Gateway
Allows instances in a Private Subnet to connect to the internet (for software updates, etc.) while preventing the internet from initiating a connection with those instances.
🛡️ The Security Layers
AWS networking provides two distinct layers of defense. Understanding the difference is critical for DevOps security.
| Feature | Security Group (SG) | Network ACL (NACL) |
|---|---|---|
| Level | Instance Level (1st Layer) | Subnet Level (2nd Layer) |
| State | Stateful: Return traffic is auto-allowed. | Stateless: Return traffic must be explicitly allowed. |
| Evaluation | Evaluates all rules before deciding. | Evaluates rules in numbered order. |
| Rules | Allow rules only. | Allow and Deny rules. |
🚀 Advanced Connectivity
- VPC Peering: A networking connection between two VPCs that enables you to route traffic between them privately.
- VPC Endpoints: Allows you to privately connect your VPC to supported AWS services (like S3 or DynamoDB) without requiring an internet gateway or NAT device.
- Site-to-Site VPN: Connects your on-premise data center to your AWS VPC over an encrypted tunnel.
[!IMPORTANT] Performance Tip While Security Groups are easy to manage, large VPC architectures with high traffic noise often use Network ACLs to block specific malicious IP ranges at the subnet boundary before they even reach the instances.