VPC & Networking in AWS

Designing Secure, Scalable, and Isolated Network Architectures

🌐 What is a Virtual Private Cloud (VPC)?

A Virtual Private Cloud (VPC) is a logically isolated section of AWS where you can launch AWS resources (like EC2, RDS, Lambda) in a custom-defined network—with full control over IP addressing, subnets, routing, and security.

Think of it as your own virtual data center in AWS.

Core Components of a VPC

Default VPC vs Custom VPC

ASCII Diagram – Custom VPC Layout (Typical 2-Tier App)

                   +----------------------+
                   |     Internet         |
                   +----------+-----------+
                              |
                    +---------v----------+
                    |  Internet Gateway  |
                    +---------+----------+
                              |
                +-------------+--------------+
                |                            |
        +-------v--------+          +--------v-------+
        | Public Subnet 1|          | Public Subnet 2|
        |  (Web Servers) |          | (ALB/NAT GW)   |
        +-------+--------+          +--------+-------+
                |                            |
        +-------v--------+          +--------v-------+
        | Private Subnet1|          | Private Subnet2|
        | (App/DB Layer) |          | (RDS, EC2)     |
        +----------------+          +----------------+

                   +----------------------+
                   |     Internet         |
                   +----------+-----------+
                              |
                    +---------v----------+
                    |  Internet Gateway  |
                    +---------+----------+
                              |
                +-------------+--------------+
                |                            |
        +-------v--------+          +--------v-------+
        | Public Subnet 1|          | Public Subnet 2|
        |  (Web Servers) |          | (ALB/NAT GW)   |
        +-------+--------+          +--------+-------+
                |                            |
        +-------v--------+          +--------v-------+
        | Private Subnet1|          | Private Subnet2|
        | (App/DB Layer) |          | (RDS, EC2)     |
        +----------------+          +----------------+

How to Create a Custom VPC (Step-by-Step)

✅ Via AWS Console:

1. Go to VPC Dashboard → Create VPC
2. Choose VPC Only or VPC + Subnets (Wizard)
3. Enter:
   • Name: my-production-vpc
   • IPv4 CIDR: 10.0.0.0/16
   • Tenancy: Default
4. Click Create

✅ Create Subnets:

• Public Subnet: 10.0.1.0/24
• Private Subnet: 10.0.2.0/24

✅ Add an Internet Gateway:

1. Create and attach to the VPC
2. Update route table for public subnet → Route to IGW

✅ Add NAT Gateway (for Private Subnet):

1. Deploy in public subnet
2. Associate Elastic IP
3. Route traffic from private subnet → NAT Gateway

🛡️ Security in VPC – SG vs NACL

Example Security Group:

Inbound: TCP 22 (SSH) from MyIP
Inbound: TCP 80 (HTTP) from 0.0.0.0/0
Outbound: ALL

Inbound: TCP 22 (SSH) from MyIP
Inbound: TCP 80 (HTTP) from 0.0.0.0/0
Outbound: ALL

Example NACL Rules:

• Allow TCP 80 from 0.0.0.0/0 (Inbound)
• Deny all other traffic (Explicit)

NAT Gateway vs Internet Gateway

Route Tables Explained

A route table controls how traffic is routed from subnets.

Example Routes:

VPC Peering & PrivateLink

✅ VPC Peering

• Connect two VPCs privately (no internet/GW needed)
• Same or different accounts/regions
• Add route entries in both VPCs

✅ AWS PrivateLink

• Access services like S3, Kinesis privately over interface VPC endpoints
• No need to route traffic over public internet

Advanced Network Architectures

✅ VPC with Multiple AZs and Load Balancer:

              [Internet]
                   |
            [Route 53 DNS]
                   |
       [Application Load Balancer]
                /       \
    [EC2 in Public AZ-A] [EC2 in Public AZ-B]
                \       /
         [Private Subnet with RDS in Multi-AZ]

              [Internet]
                   |
            [Route 53 DNS]
                   |
       [Application Load Balancer]
                /       \
    [EC2 in Public AZ-A] [EC2 in Public AZ-B]
                \       /
         [Private Subnet with RDS in Multi-AZ]

✅ Best for fault tolerance & multi-AZ failover.

✅ Hybrid Cloud with VPN:

[On-Prem Firewall]----[AWS VPN Gateway]---[Private Subnet]

[On-Prem Firewall]----[AWS VPN Gateway]---[Private Subnet]

Use Site-to-Site VPN or Direct Connect for hybrid models.

Monitoring & Troubleshooting Tools

Best Practices for VPC Design

1. Use CIDR blocks with growth room (e.g., /16)
2. Split VPC into public/private subnets
3. One AZ failure should not affect all resources
4. Always use NAT Gateway + Private Subnet for app/database layers
5. Use Network ACLs for subnet-wide protection
6. Add flow logs for security audits and troubleshooting
7. Tag your resources (Environment, Owner, CostCenter)
8. Use VPC Endpoints for secure S3/DynamoDB access
9. Place RDS/Databases in private subnets

Summary