Networking in AWS: VPC, Subnets, Routing, and Security Groups
Understand how the network of your cloud resources works.
When we create an EC2 instance on AWS, where does it live? How does it communicate with the internet, and how do other resources reach it?
The answer is networking. On AWS, the foundation of this structure is Amazon VPC, and understanding its pieces helps you build more organized and secure environments.
Amazon VPC
Amazon VPC (Virtual Private Cloud) is an isolated virtual network inside AWS, where you define which resources exist, how they communicate, and who can access them. A simple way to picture it is as your own "plot of land" in the cloud, with defined boundaries.
When you create a VPC, you define an IP address range in CIDR format, such as
10.0.0.0/16. It belongs to a Region, but it can span multiple Availability Zones.When does it make sense?
- Separating environments (development, testing, and production);
- Isolating applications from other projects;
- Controlling what is exposed to the internet.
Subnets
A subnet is a subdivision of the VPC and lives in a single Availability Zone. For high availability, it is common to create subnets in more than one zone.
- Public subnet: has a route to the internet. Ideal for web servers and load balancers.
- Private subnet: has no direct route to the internet. Ideal for databases and application servers.
Route Tables
What defines whether a subnet is public or private is the route table associated with it. It indicates where traffic should be sent, and every route table already comes with a local route for communication within the VPC.
- Internet Gateway: connects the VPC to the internet. A subnet with a
0.0.0.0/0route to it is public (and the resource also needs a public IP). - NAT Gateway: allows resources in private subnets to reach out to the internet (for updates, for example), without anyone from outside being able to initiate a connection to them.
Security Groups
A Security Group is a virtual firewall associated with a resource, such as an EC2 instance.
- It only has allow rules, and all inbound traffic is denied by default;
- It is stateful: if inbound traffic is allowed, the response goes out automatically;
- It can use another Security Group as a source, as in "only the application server can access the database."
There are also Network ACLs, which act as a firewall at the subnet level, are stateless, and support deny rules. They work as an extra layer.
So, what's the difference?
| Component | What it does | Where it acts |
|---|---|---|
| VPC | Isolated virtual network | Region |
| Subnet | Subdivision of the VPC | Availability Zone |
| Route Table | Defines where traffic goes | Subnet |
| Internet Gateway | Connects the VPC to the internet | VPC |
| NAT Gateway | Outbound internet access without exposure | Subnet |
| Security Group | Resource-level firewall | Instance |
Wrapping up
Understanding networking on AWS shows that connectivity and security are built in layers. The VPC sets the boundaries, subnets organize the resources, routes define the paths, and Security Groups decide who can communicate with whom.
In practice, this means we can leave only what is necessary exposed to the internet: the load balancer sits in public subnets, while the application and the database sit in private subnets, each accepting traffic only from the previous layer.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article