Understanding AWS Networking: VPC, Internet Gateway, and NAT Gateway

As I continue my journey toward the AWS Certified Solutions Architect – Associate (SAA-C03) certification, one of the topics that has required the most attention is Amazon VPC networking.

At first, concepts such as public subnets, private subnets, Internet Gateways, NAT Gateways, and route tables can seem like separate components. However, once you understand how traffic moves through a VPC, everything starts to connect.

This is the third article in my AWS learning series, and today I want to share what I learned about VPC, Internet Gateway, and NAT Gateway.

What is an Amazon VPC?

An Amazon Virtual Private Cloud (VPC) is a logically isolated network within AWS where we can deploy resources such as Amazon EC2 instances, databases, load balancers, and other services.

When designing a VPC, we define an IP address range using CIDR notation and divide the network into different subnets.

A common architecture separates resources into:

- Public subnets for resources that need direct connectivity with the internet.
- Private subnets for resources that should not be directly accessible from the internet.

This separation is an important part of designing secure AWS architectures.

What makes a subnet public?

One lesson that helped me understand AWS networking is that simply calling a subnet “public” does not make it public.

The subnet's route table must contain a route that sends internet-bound traffic to an Internet Gateway (IGW).

A typical IPv4 route looks like this:

"0.0.0.0/0 → Internet Gateway"

The Internet Gateway is attached to the VPC and provides a path between the VPC and the internet.

For example, a public-facing Application Load Balancer could be deployed across public subnets and use the Internet Gateway to receive traffic from users.

What about private subnets?

Private subnets normally do not have a direct route to the Internet Gateway.

This is useful for resources such as application servers or databases that should not be directly exposed to the internet.

But there is an important question:

What happens if an EC2 instance inside a private subnet needs to download updates or communicate with an external API?

This is where the NAT Gateway becomes important.

NAT Gateway

A NAT Gateway allows resources in a private subnet to initiate outbound connections without allowing unsolicited inbound connections directly from the internet.

A common architecture looks like this:

Internet
↓
Internet Gateway
↓
Public Subnet
→ NAT Gateway
↓
Private Subnet
→ EC2 instances

The private subnet's route table can contain:

"0.0.0.0/0 → NAT Gateway"

The NAT Gateway then forwards the traffic through the public subnet and Internet Gateway.

This allows the private EC2 instances to reach the internet while keeping them from being directly exposed.

Internet Gateway vs NAT Gateway

One of the distinctions I am keeping in mind for the SAA-C03 exam is:

Internet Gateway

Used to provide internet connectivity for resources that can communicate directly with the internet.

NAT Gateway

Used when resources in private subnets need outbound connectivity while remaining private from unsolicited internet connections.

Thinking about the direction of traffic makes the difference much easier to remember.

A More Secure Architecture

A simple multi-tier application could use:

Public Subnets

- Application Load Balancer
- NAT Gateway

Private Application Subnets

- EC2 instances
- Auto Scaling Group

Private Database Subnets

- Amazon RDS

Users connect to the public load balancer.

The load balancer sends traffic to application servers located in private subnets.

Those servers can access the internet through the NAT Gateway when necessary, while the database remains isolated in private database subnets.

This architecture combines security, availability, and network segmentation.

Key Lessons for the SAA-C03

The main lessons I am taking from this topic are:

1. A VPC provides the network foundation for AWS resources.
2. Subnets divide the VPC into smaller network segments.
3. Route tables determine where network traffic goes.
4. An Internet Gateway provides a path between a VPC and the internet.
5. A NAT Gateway allows private resources to initiate outbound connections.
6. Public and private subnet design is an important part of building secure AWS architectures.
7. Understanding the complete traffic path is more useful than simply memorizing AWS service definitions.

One of the things I am learning while preparing for the AWS Solutions Architect Associate certification is that AWS networking becomes much easier when I stop looking at each service individually and instead ask:

Where does the traffic come from, where does it need to go, and which component allows it to get there?

That way of thinking has helped me understand VPC architectures much more clearly.

I will continue documenting what I learn as I progress through my AWS certification journey.

Next: Article 4/4 – Choosing the Right Amazon EBS Volume: gp3 vs io2 vs st1 vs sc1

#AWS #AmazonWebServices #AWSCertified #SolutionsArchitect #SAA #CloudComputing #AmazonVPC #Networking #NATGateway #InternetGateway #Cybersecurity #CloudSecurity #AWSCommunity