3. VPC, routing, security and connectivity

VPC: regional network boundary with CIDR(s). Plan non-overlapping private IPv4 CIDRs (RFC1918) across VPCs/on-prem to permit routing. A subnet is in one AZ. A route table sends traffic via local, Internet Gateway (IGW), NAT Gateway, VPN/virtual private gateway, Transit Gateway, peering, endpoints as appropriate. Route priority uses longest prefix match; route-target specifics also matter for certain services.

Public subnet = route to IGW for IPv4 0.0.0.0/0 (instance also needs public address for direct inbound/outbound). Private subnet = no route allowing inbound access from internet; private EC2 can reach internet for outbound updates through NAT Gateway in a public subnet, but NAT Gateway itself does not allow unsolicited inbound access. Put a NAT Gateway in each AZ to improve AZ resilience and avoid cross-AZ transfer, where justified by cost. IPv6 uses an egress-only internet gateway for outbound-only IPv6 access, rather than NAT Gateway.

Security groups are stateful allow-only rules, attached to ENIs and automatically allow response traffic. Network ACLs (NACLs) are stateless ordered allow/deny subnet rules; need ephemeral return ports explicitly. Default NACL allows all; custom NACL starts with deny-all. Choose SGs for fine-grained workload communication and NACLs for subnet-level coarse controls.

VPC endpoints: Gateway endpoint for S3 and DynamoDB, inserted via route tables, no hourly gateway endpoint charge. Interface endpoints (AWS PrivateLink) use ENIs/private IPs and security groups, billed by AZ-hour/data volume; ideal for private API connectivity to supported AWS services and third-party endpoints. AWS PrivateLink is service-level access; VPC peering is private network connectivity between two VPCs, non-transitive. Transit Gateway provides hub-and-spoke connectivity among many VPCs/on-prem networks; transitive routing. Site-to-Site VPN is encrypted over internet, faster to provision; Direct Connect is dedicated private connectivity with longer provisioning, not automatically encrypted (add VPN if encryption required). Client VPN supports end-user VPN access.

Route 53: authoritative DNS with simple, weighted (traffic split), latency (lowest latency), failover (health-check dependent primary/secondary), geolocation (user geography), geoproximity (location bias), and multivalue (simple healthy answer) policies. An Alias can point to AWS endpoints like ALB/CloudFront/root apex; CNAME generally cannot be used at DNS zone apex. Route 53 Resolver endpoints allow hybrid DNS queries. CloudFront caches HTTP(S) content at edge, protects origins and improves global read latency. Global Accelerator gives static anycast IP addresses and uses AWS global network to route TCP/UDP traffic to healthy regional endpoints; useful for noncacheable traffic. API Gateway creates/controls APIs.

Observability: VPC Flow Logs show connection metadata, not full packet payload. CloudTrail logs AWS API activity. CloudWatch metrics/logs monitor workloads. Network Firewall is a managed network-layer firewall. Route 53 Resolver DNS Firewall filters DNS queries. WAF protects HTTP(S) at supported layer-7 endpoints.

Lab 3 — two-AZ VPC (draw first)

VPC 10.20.0.0/16, public subnets 10.20.0.0/24, 10.20.1.0/24, application private subnets 10.20.10.0/24, 10.20.11.0/24, database private subnets 10.20.20.0/24, 10.20.21.0/24.
Public route: default to IGW. Application private route: default to same-AZ NAT Gateway if outbound internet needed. Database subnets: do not require general internet route.
Internet -> HTTPS ALB -> port 8080 app -> port 5432 database. SG ALB allows 443 from users; app SG allows 8080 from ALB SG; DB SG allows 5432 from app SG.
Add S3 gateway endpoint, no public bucket access, and diagram traffic staying within AWS.
Explain why NAT is not a substitute for a public application load balancer and why no SSH/DB inbound rule is needed.