← All notes

AWS - VPC & Networking

March 30, 2025
  • VPC - Virtual Private Cloud: Private network to deploy your resources
  • Subnets allow you to partition your network inside your VPC
  • A public subnet is subnet that is accessible from the internet
  • A private subnet is a subnet that is not accessible from the internet
  • To define access to the internet and between subnets, we use Route Tables

Internet Gateway & NAT Gateways

  • Internet Gateways helps our VPC instances connect with the internet

  • Public Subnets have a route to the internet gateway

  • NAT Gateways (AWS-managed) & NAT Instances (self-managed) allow your instances in your Private Subnets to access the internet while remaining private

VPC Flow Logs

  • Capture information about IP traffic going into your interfaces:
    • VPC Flow Logs
    • Subnet Flow Logs
    • Elastic Network Interface Flow Logs
  • Helps to monitor & troubleshoot connectivity issues. Example:
    • Subnets to internet
    • Subnets to subnets
    • Internet to subnets
  • Captures network information from AWS managed interfaces too: Elastic Load Balancers, ElastiCache, RDS, Aurora, etc...
  • VPC Flow logs data can go to S3, CloudWatch Logs, and Amazon Data Firehose

VPC Peering

  • Connect two VPC, Privately using AWS' network
  • Make them behave as if they were in the same network
  • Must not have overlapping CIDR (IP address range)
  • VPC Peering connection is not transitive (must be established for each VPC that need to communicate with on another)

VPC Endpoints

  • Endpoints allow you to connect to AWS Services using a private network instead of the public www network
  • This gives you enhance security and lower latency to access AWS services
  • VPC Endpoint Gateway: S3 & DynamoDB
  • VPC Endpoint Interface: most services (including S3 & DynamoDB)

AWS PrivateLink (VPC Endpoint Services)

  • Most secure & scalable way to expose a service to 1000s of VPCs
  • Does not require PC peering, internet gateway, NAT, route tables...

Network ACL & Security Groups

  • NACL (Network ACL)
    • A firewall which controls traffic from and to subnet
    • Can have ALLOW and DENY rules
    • Are attached at the Subnet level
    • Rules only include IP addresses
  • Security Groups
    • A firewall that controls traffic to and from an EC2 Instance
    • Can have only ALLOW rules
    • Rules include IP addresses and other security groups

IP Addresses in AWS

  • IPv4 - Internet Protocol Version 4 (4.3 billion Addresses)
    • Public IPv4 - can be used on the internet
    • EC2 instance gets a new a public IP address every time you stop then start it
    • Private IPv4 - can be used on private networks (LAN) such as internal AWS networking (e.g., 192.168.1.1)
    • Private IPv4 is fixed for EC2 instances even if you start/stop them
  • Elastic IP - allows you to attach a fixed public IPv4 address to EC2 instance
  • Note: all public IPv4 on AWS will be charged $0.005 per hour (including EIP)
    • Free Tier: 750 hours usage per month
  • IPv6 - Internet Protocol Version 6 (3.4 × 10^38 Addresses)
    • Every IP address is public in AWS (no private range)
    • Free