What You'll Learn
How to architect a production-ready AWS VPC — public vs private subnets, Internet Gateways, NAT Gateways, Route Tables, and Security Groups.
What is a VPC?
Amazon Virtual Private Cloud (VPC) lets you provision a logically isolated section of the AWS Cloud where you launch AWS resources in a virtual network that you define. It is the foundational networking layer for AWS.
Standard Production VPC Architecture (3-Tier)
Core VPC Components Explained
Internet Gateway (IGW)
A horizontally scaled, redundant component that allows communication between your VPC and the internet. You attach one IGW to your VPC.
NAT Gateway
Lives in the Public Subnet. Allows instances in private subnets to connect to the internet (e.g., to download OS updates) but prevents the internet from initiating connections to those instances.
Route Tables
A set of rules that determine where network traffic is directed.
- Public Route Table: Destination
0.0.0.0/0→ Targetigw-12345(Internet Gateway) - Private Route Table: Destination
0.0.0.0/0→ Targetnat-12345(NAT Gateway)
Security: Security Groups vs NACLs
Security Groups (SG)
- • Operates at the Instance level (EC2, RDS).
- • Stateful: If you allow incoming traffic, the return traffic is automatically allowed.
- • Allow rules only: You cannot create "deny" rules. By default, all inbound is denied.
- • Evaluate all rules before deciding.
Network ACLs (NACL)
- • Operates at the Subnet level.
- • Stateless: You must explicitly allow BOTH inbound and outbound traffic.
- • Allow AND Deny rules: You can explicitly block specific IPs.
- • Evaluated in order (lowest number first).
# Create VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/16
# outputs vpc-0abc123...
# Enable DNS Hostnames
aws ec2 modify-vpc-attribute --vpc-id vpc-0abc123 --enable-dns-hostnames
# Create Public Subnet
aws ec2 create-subnet --vpc-id vpc-0abc123 --cidr-block 10.0.1.0/24 --availability-zone us-east-1a
# Enable auto-assign public IP
aws ec2 modify-subnet-attribute --subnet-id subnet-0def456 --map-public-ip-on-launch
# Create Internet Gateway and attach to VPC
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway --vpc-id vpc-0abc123 --internet-gateway-id igw-012345
# Note: For production, NEVER do this manually. Use Terraform!