Before VPCs, every EC2 instance you launched was on a shared flat network where every AWS customer's resources could theoretically reach every other customer's resources. That is obviously not acceptable for production workloads. Razorpay cannot have their payment processing servers on the same network as someone else's crypto miner. **VPC (Virtual Private Cloud)** is a logically isolated section of AWS where you launch resources in a virtual network you define and control. Your VPC is completely isolated from other customers' VPCs and from the public internet by default - you explicitly open connectivity only where needed.
Before you create a single resource, you must decide on your IP address space. This decision is permanent - you cannot change the primary CIDR of a VPC. Get it wrong and you will eventually either run out of IPs or have non-overlapping VPCs that cannot be peered.
Traffic from the internet cannot reach resources in your VPC by default. An **Internet Gateway (IGW)** is the door between your VPC and the public internet. Without it, nothing in your VPC can be reached from outside, and nothing inside can reach the internet. A subnet is only "public" if: 1. An IGW is attached to the VPC 2. The subnet's route table has a route `0.0.0.0/0 -> IGW` 3. The resources in the subnet have public IP addresses
Your app servers in private subnets need to download packages, call external APIs, and send data to S3. But they must not be directly reachable from the internet. **NAT Gateway** solves this - it allows outbound connections from private subnets while blocking inbound connections from the internet. App server (10.0.10.50) | | Outbound request to api.github.com v Route: 0.0.0.0/0 -> NAT Gateway | NAT Gateway (in public subnet, has Elastic IP) | | Translates source IP from 10.0.10.50 to Elastic IP v api.github.com sees the request from your Elastic IP | Response returns to Elastic IP -> NAT Gateway -> 10.0.10.50
A **route table** is a set of rules that determines where network traffic goes. Every subnet must be associated with a route table. The route table is checked for every packet that needs to be forwarded.
Security groups and NACLs both control traffic, but at different layers with different behaviors. Knowing when to use each prevents security holes.
Before VPCs, every EC2 instance you launched was on a shared flat network where every AWS customer's resources could the...
Before you create a single resource, you must decide on your IP address space. This decision is permanent - you cannot c...
Traffic from the internet cannot reach resources in your VPC by default. An Internet Gateway (IGW) is the door between y...
Your app servers in private subnets need to download packages, call external APIs, and send data to S3. But they must no...
A route table is a set of rules that determines where network traffic goes. Every subnet must be associated with a route...
Security groups and NACLs both control traffic, but at different layers with different behaviors. Knowing when to use ea...
Your production VPC and your data analytics VPC need to communicate. Both are private. VPC Peering connects them over AW...
Build a VPC with public, private app, and private data tiers across 2 AZs. This is the standard architecture for every p...
Resource Key fact IGW One per VPC Needed for public subnets NAT Gateway One per AZ (for HA) In public subnet, routes pri...
Aligns directly with DevOps, Site Reliability (SRE), and Platform Engineering job descriptions.