Amazon Web Services services
3 / 24
Amazon Web Services

Networking — VPC, Subnets & Security Groups

Carve out a private, isolated network and control exactly what can reach each resource.

A VPC is your own private network, defined by a CIDR block.

A corporate office building. The VPC is the building; subnets are floors; the lobby (public subnet) faces the street while secure labs (private subnets) do not. Security guards at each room door (security groups) check IDs, and the rule that "anyone you let in can leave" is statefulness.

Key Concepts

1
    VPC 10.0.0.0/16
      public  10.0.1.0/24  (AZ-a)  route to Internet Gateway
      private 10.0.2.0/24  (AZ-a)  route to NAT Gateway
      private 10.0.3.0/24  (AZ-a)  no internet route at all
2
A subnet lives in exactly one AZ, so spreading across AZs means a subnet in each.
3
Public versus private is just the route table. A subnet is public because it has a route to an Internet Gateway — nothing else about it differs.
4
NAT lets private subnets reach out without being reachable. Outbound updates and API calls work; inbound connections cannot start. NAT Gateway is charged hourly and per GB processed, which is a line item that surprises people.
5
The two firewalls differ in one important way.
    Security Group   on the resource (ENI). STATEFUL: allow inbound
                     and the reply is automatically permitted.
                     Allow rules only -- no deny.
    Network ACL      on the subnet. STATELESS: you must allow the
                     return traffic explicitly. Supports DENY.
6
Stateful versus stateless is the question asked. Forgetting the return rule on a NACL is the classic symptom: the request arrives, the reply is dropped, and the connection hangs.
7
Security groups can reference each other, which is better than hard-coding IP ranges:
8
    app-sg   inbound 443 from alb-sg
    db-sg    inbound 5432 from app-sg
9
Instances can then move and scale without touching the rules.
10
Reaching outside the VPC.
    VPC Peering       one-to-one, no transitive routing
    Transit Gateway   hub-and-spoke for many VPCs and on-premises
    PrivateLink       reach a service privately, no internet path
    VPC Endpoints     S3 and DynamoDB without a NAT Gateway
11
That last one is a real saving. A gateway endpoint for S3 removes NAT data processing charges for every byte your private subnets read from S3.
12
What the interviewer is probing.1. "What makes a subnet public?" Probing: the actual mechanism. Stalls: "A setting on the subnet." Moves up: a route to an Internet Gateway in its route table — nothing else about the subnet differs.
13
2. "Security group versus NACL?" Probing: stateful versus stateless, which is the question. Stalls: "Both are firewalls." Moves up: security groups are stateful and allow-only, attached to an ENI; NACLs are stateless with deny rules at the subnet, so you must allow the return traffic explicitly.
14
3. "A private instance can reach the internet but nothing can reach it. How?" Probing: NAT. Stalls: "It has a public IP." Moves up: a NAT Gateway in a public subnet — outbound connections work, inbound cannot be initiated.
15
4. "How do you cut NAT data charges for S3 traffic?" Probing: VPC endpoints, which is a real saving. Stalls: "You cannot." Moves up: a gateway endpoint for S3 routes privately and removes NAT data processing charges entirely for those bytes.
Use cases:vpcsubnetssecurity-groupnat