Day 5: Amazon VPC – Subnets, Route Tables, Gateways, and Network Security
Day 5 of my 90-day AWS challenge: how Amazon VPC gives you a private network in the cloud, including CIDR blocks, public and private subnets, route tables, internet gateways, and the difference between security groups and NACLs.
Recap of Day 4
Yesterday I learned how S3 stores data. Today I'm learning where all these resources actually live: the network. That service is Amazon VPC.
What is a VPC?
A VPC (Virtual Private Cloud) is your own logically isolated network inside AWS. You decide the IP address range, create subnets, and control how traffic moves in and out. A VPC belongs to one Region and spans multiple Availability Zones.
Key components
| Component | What it does |
|---|---|
| CIDR block | The IP range of the VPC, e.g. 10.0.0.0/16 |
| Subnet | A smaller slice of the VPC that lives in one Availability Zone |
| Route table | Rules that decide where network traffic is sent |
| Internet Gateway (IGW) | Connects the VPC to the internet |
| NAT Gateway | Lets private subnets reach the internet without being reachable from it |
Public vs. private subnets
- Public subnet: its route table has a route to an Internet Gateway, so resources can be reached from the internet (e.g., a web server)
- Private subnet: no direct route to the internet (e.g., a database)
Security groups vs. NACLs
| Security group | Network ACL (NACL) | |
|---|---|---|
| Level | Instance | Subnet |
| State | Stateful (return traffic is allowed automatically) | Stateless (return traffic needs its own rule) |
| Rules | Allow rules only | Allow and deny rules |
What I practiced today
- Looked at the default VPC that AWS creates in every Region
- Created a custom VPC with the CIDR block
10.0.0.0/16 - Created a public and a private subnet in different Availability Zones
- Attached an Internet Gateway and added a route to it in the public subnet's route table
- Cleaned up the resources when I was done
Key takeaways
- Put public-facing resources in public subnets and databases in private subnets
- Spread subnets across Availability Zones for resilience
- NAT Gateways are billed by the hour, so delete them after practicing
Up next: Day 6
Amazon RDS: managed relational databases.
Learning AWS too? Follow along and share what you're building. #90DaysOfAWS
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article