🎯 By the end of this module you should be able to…
- Explain what a VPC is and choose a sensible CIDR block for one.
- Distinguish a public subnet from a private subnet by what its route table contains.
- Describe the job of an internet gateway, a NAT gateway, a route table and an elastic IP.
- Compare security groups and network ACLs, including stateful versus stateless behaviour.
- Design a two-tier, two-AZ VPC and explain each component.
- Launch a web server into a public subnet and reach it from the internet.
- Name the options for connecting a VPC to other networks: peering, Transit Gateway, VPN, Direct Connect, endpoints.
What a VPC is
An Amazon Virtual Private Cloud is a logically isolated section of the AWS cloud where you launch resources into a network that you define. Everything from Module 1 and Module 2 reappears here with an AWS name on it.
| Traditional network | AWS equivalent |
|---|---|
| Your office LAN | A VPC |
| VLAN / network segment | A subnet |
| Router and its routing table | A route table |
| The internet-facing router | An internet gateway |
| Host firewall on a server | A security group |
| Firewall on the subnet boundary | A network ACL |
| Leased line to head office | Direct Connect or Site-to-Site VPN |
Choosing the CIDR block
VPC 10.0.0.0/16 → 65,536 addresses, room to grow
Public AZ-a 10.0.1.0/24 → 251 usable (AWS reserves 5)
Public AZ-b 10.0.2.0/24
Private AZ-a 10.0.11.0/24
Private AZ-b 10.0.12.0/241. A subnet lives in exactly one Availability Zone and its CIDR can never be changed after creation. 2. If two VPCs have overlapping CIDR blocks they can never be peered. Pick a scheme for the whole organisation before you create the first VPC.
In 10.0.1.0/24: .0 network, .1 VPC router, .2 DNS,
.3 reserved for future use, .255 broadcast. So you get 251 usable addresses,
not 254.
The components, and what each one does
- 🚪Internet Gateway (IGW)
One per VPC. Horizontally scaled, redundant, and free. A subnet becomes public the moment
its route table has a route
0.0.0.0/0 → igw-xxxx. That route is the definition. - 🗺️Route table Every subnet is associated with exactly one. It always contains a local route for the VPC CIDR, which cannot be removed and is why every subnet can talk to every other subnet by default.
- 🔁NAT Gateway Lives in a public subnet with an Elastic IP. Lets private instances reach the internet outbound (to download patches) while nothing on the internet can start a connection inward. It is a managed, chargeable service — and a classic surprise line on a bill.
- 📌Elastic IP A static public IPv4 address you own. You are now charged for public IPv4 addresses whether or not they are attached, so release the ones you are not using.
- 🔌VPC endpoints Reach S3, DynamoDB and other AWS services privately, without going over the internet at all. Gateway endpoints (S3, DynamoDB) are free; interface endpoints are charged per hour.
VPC security: security groups and NACLs
| Security group | Network ACL | |
|---|---|---|
| Operates at | The elastic network interface — an instance | The subnet boundary |
| Rules | Allow only | Allow and deny |
| State | Stateful — a reply to an allowed request is automatically allowed | Stateless — you must allow the return traffic explicitly |
| Evaluation | All rules are evaluated together | Rules processed in number order; the first match wins |
| Default | Deny all inbound, allow all outbound | The default NACL allows everything both ways |
| Applies to | Only the instances it is attached to | Every instance in the subnet, automatically |
Stateful means the security group remembers that you allowed the request, so the reply gets back without a matching outbound rule. Stateless means the NACL has no memory: if you allow inbound port 80 you must also allow outbound on the ephemeral port range 1024–65535, or the response never leaves.
A sensible web-server security group
| Direction | Type | Port | Source / destination | Why |
|---|---|---|---|---|
| Inbound | HTTP | 80 | 0.0.0.0/0 | Public website |
| Inbound | HTTPS | 443 | 0.0.0.0/0 | Public website over TLS |
| Inbound | SSH | 22 | Your own IP /32 | Administration — never 0.0.0.0/0 |
| Outbound | All | All | 0.0.0.0/0 | Default; lets the server fetch updates |
A security group can reference another security group as its source. So the database group
allows port 3306 from sg-webservers, not from a CIDR. Add a web server later and it is
covered automatically — no rule edit, no drift.
An SSH port open to 0.0.0.0/0 is found by automated scanners within minutes. Restrict it to your IP, or better still use AWS Systems Manager Session Manager, which needs no inbound port at all.
Building a VPC and launching a web server
The order matters. Each step depends on the one before it.
| # | Step | What you specify |
|---|---|---|
| 1 | Create the VPC | Name, CIDR 10.0.0.0/16, enable DNS hostnames |
| 2 | Create subnets | Two public and two private, each pinned to a different AZ |
| 3 | Create and attach an internet gateway | Attach it to the VPC |
| 4 | Create a public route table | Add 0.0.0.0/0 → igw, associate the public subnets |
| 5 | Enable auto-assign public IPv4 | On the public subnets |
| 6 | Create a NAT gateway | In a public subnet, with an Elastic IP |
| 7 | Create a private route table | Add 0.0.0.0/0 → nat, associate the private subnets |
| 8 | Create security groups | Web tier (80/443/22) and database tier (3306 from the web SG) |
| 9 | Launch the instance | Amazon Linux, public subnet, web SG, a key pair, user data |
| 10 | Test | Browse to the public IP; you should see your page |
User data that installs Apache at first boot
#!/bin/bash
dnf update -y
dnf install -y httpd
systemctl enable --now httpd
TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" \
-H "X-aws-ec2-metadata-token-ttl-seconds: 300")
AZ=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
http://169.254.169.254/latest/meta-data/placement/availability-zone)
echo "<h1>Hello from $(hostname -f)</h1><p>AZ: $AZ</p>" > /var/www/html/index.htmlThat is the instance metadata service, and it is a link-local address from Module 2. Every EC2 instance can query it for its own instance ID, its AZ, and the temporary credentials of its attached IAM role. Version 2 (IMDSv2) requires the token you see above, and should always be enforced.
When it does not work — debug in this order
Connecting a VPC to other networks
🔗 VPC Peering
A one-to-one private link between two VPCs, in any account or Region. Simple and cheap, but not transitive — if A peers with B and B peers with C, A still cannot reach C. CIDRs must not overlap.
🕸️ Transit Gateway
A hub that many VPCs, VPNs and Direct Connect links attach to. Replaces a mesh of peerings once you have more than a handful of VPCs. Charged per attachment and per GB.
🔒 Site-to-Site VPN
An encrypted IPsec tunnel from your office router to a virtual private gateway. Quick to set up, runs over the public internet, so performance varies.
🔌 Direct Connect
A dedicated private circuit into AWS. Consistent latency, higher bandwidth, lower data-transfer cost at volume. Takes weeks to provision and costs more.
🛡️ VPC Endpoints
Reach S3, DynamoDB, SNS and many other services without leaving the AWS network. Gateway endpoints for S3 and DynamoDB are free; interface endpoints (PrivateLink) are charged hourly.
📋 VPC Flow Logs
Record accepted and rejected traffic to CloudWatch Logs or S3. The first thing to enable when "it cannot connect" and nobody knows why — and one of the three sources GuardDuty watches in Module 10.
Another VPC, a few of them → peering. Many VPCs and on-premises → Transit Gateway. Office over the internet, quickly → Site-to-Site VPN. Office with predictable performance → Direct Connect. An AWS service privately → VPC endpoint.
Key takeaways
- ✅A VPC is your own logically isolated network; subnets are its segments and each lives in one AZ.
- ✅A subnet is public if and only if its route table sends 0.0.0.0/0 to an internet gateway.
- ✅NAT gateway = outbound internet for private subnets, inbound blocked. It costs money.
- ✅Security groups are stateful and allow-only; NACLs are stateless and support deny.
- ✅Reference a security group as a source instead of typing CIDRs.
- ✅Never open port 22 to 0.0.0.0/0.
- ✅Peering is not transitive; Transit Gateway is the hub answer.
- ✅169.254.169.254 is the instance metadata service — enforce IMDSv2.