CS Techie
Comments
courseAWS
AWS lesson

AWS VPC Networking Overview

Amazon Virtual Private Cloud (VPC) is a foundational networking service in AWS. It allows you to provision logically isolated virtual networks within AWS, where you can launch and manage AWS resources with fine-grained control over networking.


VPC Diagram

Core Concepts

  • VPC: A virtual network dedicated to your AWS account.
  • Subnets: Logical segments of a VPC. Each subnet is tied to a single Availability Zone (AZ).
    • Public subnet: Has a route to the internet via an Internet Gateway (IGW).
    • Private subnet: No direct access from the internet; often used for databases or application servers.
  • CIDR Blocks: IP address ranges assigned to the VPC and subnets (e.g., 10.0.0.0/16).


Key Networking Components

  • Route Table
    Defines how traffic from subnets is routed (to IGW, NAT Gateway, peering connection, etc.).

  • Internet Gateway (IGW)
    Enables resources in a public subnet to communicate with the internet.

  • NAT Gateway/Instance
    Allows instances in private subnets to access the internet (for updates, downloads) without being exposed to inbound internet connections.

  • Elastic IP
    A static, public IPv4 address for instances or NAT gateways.

  • VPC Peering
    Connects two VPCs privately using AWS backbone network. No transitive peering is supported.

  • Transit Gateway (TGW)
    A central hub for connecting multiple VPCs and on-premises networks, simplifying complex topologies.

  • VPN & Direct Connect

    • VPN: Securely connects VPC with on-premises networks via IPSec tunnels.
    • Direct Connect: Dedicated private connection between data center and AWS.

  • Security Controls

    • Security Groups (SG): Stateful, instance-level firewalls controlling inbound/outbound traffic.
    • Network ACLs (NACLs): Stateless, subnet-level traffic rules, useful for additional restrictions.


Typical VPC Design

  • Multi-tier architecture:
    • Public subnet → Load balancer, bastion hosts.
    • Private subnet → Application servers.
    • Isolated subnet → Databases, sensitive workloads.
  • High availability: Create subnets across multiple AZs.
  • Hybrid Cloud: Extend your VPC to data centers via VPN/Direct Connect.


Best Practices

  • Use CIDR blocks that don’t overlap with on-premises networks.
  • Segment workloads by subnets and use least-privilege SG/NACL rules.
  • Enable VPC Flow Logs for visibility into traffic.
  • For scalability, consider Transit Gateway over many peering links.
  • Use IPv6 if you expect high growth in IP needs.