Lesson 5 of 7 · 10 min
Networking: VPCs, subnets and reaching things privately
Build a VPC that is correct by construction, and know why security groups and NACLs behave differently.
The anatomy of a VPC
A VPC is your own isolated network with a CIDR range you choose. Inside it, subnets divide that range and each lives in one Availability Zone.
A subnet is 'public' purely because its route table sends 0.0.0.0/0 to an internet gateway. There is no other flag. A private subnet has no such route, and reaches outward through a NAT gateway sitting in a public subnet — outbound only, never reachable from the internet.
Security groups versus network ACLs
| Security group | Network ACL | |
|---|---|---|
| Applies to | An instance or interface | A whole subnet |
| State | Stateful — replies allowed automatically | Stateless — each direction evaluated |
| Rules | Allow only | Allow and Deny, evaluated in order |
| Can reference | Another security group | CIDR ranges only |
Referencing security groups, not IPs
A security group rule can name another security group as its source. That keeps the rule correct as instances are created and destroyed, which IP-based rules cannot do behind an Auto Scaling group.
This is also how you express a tiered architecture cleanly: the database group allows only the application group, and the application group allows only the load balancer group.
Reaching AWS services privately
A gateway VPC endpoint exists for S3 and DynamoDB, works by adding a route table entry, and is free. An interface endpoint uses PrivateLink to place an elastic network interface in your subnet and is billed hourly plus per gigabyte, but works for most other services.
Beyond privacy, endpoints have a cost effect: a workload pulling terabytes from S3 through a NAT gateway pays per-gigabyte processing charges that a free gateway endpoint eliminates entirely.
Connecting networks
VPC peering is a one-to-one link and requires non-overlapping CIDRs. It does not scale — sixty VPCs would need a full mesh.
Transit Gateway is the hub-and-spoke answer at scale, and can be shared across accounts. PrivateLink is the option when CIDRs overlap or when you want to expose one service rather than join two networks.
Worth remembering
- The only real difference between a public and private subnet is the route table.
- Security groups are stateful; network ACLs are stateless and evaluate each direction.
- VPC endpoints keep AWS traffic off the internet and remove NAT gateway charges.
Test it now
VPC routing and security group questions are a large share of the bank.