Networking Basics: Amazon VPC and Subnets

In the physical world, if you want to build a secure office, you need a building with walls, locked doors, and specific rooms for different departments. In the cloud, Amazon Virtual Private Cloud (VPC) provides that same level of isolation. It allows you to launch AWS resources into a virtual network that you define, giving you complete control over your networking environment.

What is an Amazon VPC?

A VPC is a logically isolated section of the AWS Cloud. Think of it as your own private data center within AWS. You have full control over your IP address range, creation of subnets, configuration of route tables, and network gateways.

• Isolation: Your VPC is private to your AWS account.
• Customization: You define the IP address range using CIDR blocks.
• Security: You control who can access your resources using Security Groups and Network ACLs.

Understanding Subnets

A Subnet is a range of IP addresses in your VPC. You divide your VPC into subnets to organize your resources and apply security rules. Subnets are tied to specific Availability Zones (AZs).

1. Public Subnets

A subnet is considered "public" if its traffic is routed to an Internet Gateway (IGW). Use public subnets for resources that must be reached from the internet, such as web servers or load balancers.

2. Private Subnets

A subnet is "private" if it does not have a direct route to the internet gateway. These are used for backend systems like databases or application servers that should never be directly exposed to the public web.

Visualizing the VPC Architecture

[ AWS Region ]
      |
      |---- [ VPC (e.g., 10.0.0.0/16) ]
               |
               |---- [ Availability Zone A ]
               |          |-- Public Subnet (10.0.1.0/24) -> Internet Gateway
               |          |-- Private Subnet (10.0.2.0/24)
               |
               |---- [ Availability Zone B ]
                          |-- Public Subnet (10.0.3.0/24)
                          |-- Private Subnet (10.0.4.0/24)
    

Key Networking Components

• CIDR Block: Classless Inter-Domain Routing. It defines the size of your network (e.g., 10.0.0.0/16 provides 65,536 IP addresses).
• Internet Gateway (IGW): A gateway that allows communication between your VPC and the internet.
• Route Table: A set of rules (routes) used to determine where network traffic is directed.
• NAT Gateway: Allows instances in a private subnet to connect to the internet (for updates) but prevents the internet from initiating a connection with those instances.

Real-World Use Case: Three-Tier Application

Imagine you are building an e-commerce website. You would structure your VPC networking as follows:

• Public Subnet: Hosts the External Load Balancer and a "Bastion Host" for administrative access.
• Private Subnet 1: Hosts the Web/Application servers. These do not need direct internet access but receive traffic from the Load Balancer.
• Private Subnet 2: Hosts the Database (e.g., Amazon RDS). This is the most secure layer, accessible only by the application servers.

Common Mistakes to Avoid

• Overlapping CIDR Blocks: If you plan to connect two VPCs later (VPC Peering), ensure their IP ranges do not overlap.
• Ignoring Reserved IPs: AWS reserves the first four and the last IP address in every subnet. For a /24 subnet, you get 251 usable IPs instead of 256.
• Missing Route Table Updates: Creating an Internet Gateway is not enough; you must manually add a route (0.0.0.0/0) in your route table pointing to that gateway.
• Small CIDR Blocks: Choosing a range that is too small (like /28) can lead to running out of IP addresses quickly as your application scales.

Interview Notes: Networking Essentials

• Can a VPC span multiple Regions? No, a VPC is confined to a single AWS Region.
• Can a Subnet span multiple Availability Zones? No, a subnet must reside within a single Availability Zone.
• What is the difference between a Security Group and a Network ACL? Security Groups are stateful and operate at the instance level. Network ACLs are stateless and operate at the subnet level.
• How do you make a private subnet reach the internet? Use a NAT Gateway located in a public subnet.

Summary

Amazon VPC is the foundation of your AWS infrastructure. By mastering VPC CIDR blocks and Subnetting, you ensure your cloud environment is scalable, organized, and secure. Always remember the "Principle of Least Privilege" by keeping your databases in private subnets and only exposing what is absolutely necessary to the public internet via public subnets.

In the next lesson, we will dive deeper into Security Groups and Network ACLs to learn how to lock down your network traffic effectively.