
Amazon VPC (Virtual Private Cloud) is an isolated virtual network in AWS where you launch resources.
VPC components:
Subnets — segments of the VPC IP range; tied to one AZ; can be public or private
Public subnet — has route to internet gateway; resources can be internet-accessible
Private subnet — no direct internet access; databases, application servers
Internet Gateway (IGW) — allows internet access for public subnets
NAT Gateway — allows private subnet resources to initiate internet connections (not inbound)
Route Tables — control where traffic is directed
Security controls:
Security Groups — virtual firewall for EC2 instances; stateful; default deny; rules allow specific traffic
Network ACLs (NACLs) — subnet-level firewall; stateless; allow AND deny rules; evaluated in order
VPC Peering: Connect two VPCs privately. Non-transitive (A↔B and B↔C does not mean A↔C).
AWS Transit Gateway: Hub-and-spoke to connect many VPCs and on-premises networks.
Reference:
TaskLoco™ — The Sticky Note GOAT