What you will learn today
- Amazon VPC, subnets, route tables, Internet Gateway, NAT Gateway
- Security Groups and Network ACLs
- Route 53, CloudFront, Global Accelerator, and API Gateway
- VPN, Direct Connect, Transit Gateway, and PrivateLink
- Serverless architecture and application integration (SQS, SNS, EventBridge, Step Functions)
1. Amazon VPC (Virtual Private Cloud)
A VPC is your own logically isolated virtual network in an AWS Region. You choose IP ranges, subnets, routing, and gateways.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
AWS Region
+------------------------------ VPC 10.0.0.0/16 ------------------------------+
| |
| AZ-a AZ-b |
| +------------------------+ +------------------------+ |
| | PUBLIC subnet 10.0.1.0 | | PUBLIC subnet 10.0.2.0 | |
| | [Web server] [NAT GW] | | [Web server] | |
| +-----------+------------+ +-----------+------------+ |
| +------------------------+ +------------------------+ |
| | PRIVATE subnet 10.0.3.0| | PRIVATE subnet 10.0.4.0| |
| | [App] [Database] | | [App] [Database] | |
| +------------------------+ +------------------------+ |
| |
+----------------------------------+--------------------------------------------+
|
[ Internet Gateway ]
|
Internet
| VPC | Isolated virtual network | Spans all AZs in a Region; defined by a CIDR block (for example 10.0.0.0/16) |
| Subnet | A range of IPs inside one AZ | Public subnet has a route to an Internet Gateway; private subnet does not |
| Route table | Rules (routes) that decide where traffic goes | Each subnet is associated with a route table |
| Internet Gateway (IGW) | Connects the VPC to the internet | Horizontally scaled, highly available, no charge itself |
| NAT Gateway | Lets private instances reach the internet outbound only (for updates) | Lives in a public subnet; managed by AWS; hourly and data processing charges |
| Elastic IP | Static public IPv4 address | Charged when not attached (and for public IPv4 addresses generally) |
| Default VPC | VPC created in every Region for your account | Has public subnets so you can launch quickly |
| VPC Flow Logs | Capture traffic information for network interfaces | Troubleshooting, security analysis |
| VPC Peering | Private connection between two VPCs (same or different Region/account) | Not transitive (A-B and B-C does not give A-C) |
| VPC Endpoints | Private access to AWS services without using the internet | Gateway endpoints (S3 and DynamoDB, free) and Interface endpoints (powered by PrivateLink, hourly charge) |
| AWS PrivateLink | Private connectivity to services across VPCs and accounts, traffic stays on the AWS network | "Expose or consume a service privately" |
| AWS Transit Gateway | Central hub connecting many VPCs and on-premises networks | Replaces complex peering meshes |
Public vs private subnet
| Route to IGW | Yes | No |
| Directly reachable from internet | Yes (if it has a public IP and security rules allow) | No |
| Typical resources | Web servers, load balancers, NAT Gateway | Application servers, databases |
| Internet access for updates | Through IGW | Through NAT Gateway (outbound only) |
Analogy: The VPC is your gated community. A public subnet is the shopfront near the main gate. A private subnet is the residential block inside. The Internet Gateway is the main gate, and the NAT Gateway is a courier who goes out to fetch things for residents without letting strangers in.
Flow of traffic to a web application
1
2
User --> Route 53 (DNS) --> CloudFront --> Load Balancer (public subnet)
--> EC2 web/app (private subnet) --> RDS database (private subnet)
2. Security Groups vs Network ACLs (classic exam question)
1
2
3
4
5
Internet --> [ Internet Gateway ] --> [ Network ACL ] (subnet boundary)
|
[ Security Group ] (instance boundary)
|
[ EC2 ]
| Works at | Instance (network interface) level | Subnet level |
| State | Stateful: return traffic is automatically allowed | Stateless: you must allow inbound and outbound explicitly |
| Rule types | Allow rules only | Allow and Deny rules |
| Rule evaluation | All rules evaluated | Rules evaluated in number order, first match wins |
| Default (new) | Denies all inbound, allows all outbound | Default NACL allows all in and out |
| Applies to | Only instances it is associated with | All instances in the subnet |
| Use for | Primary instance firewall | Extra layer, block specific IPs |
Analogy: The NACL is the security gate at the apartment complex entrance; it can ban specific people. The security group is the lock on your own apartment door; it only lists who may enter, and anyone you let in can leave freely.
Exam clues: "Block a specific IP address" = NACL. "Stateful" = Security group. "Subnet level" = NACL. "Instance level" = Security group.
3. Connecting on-premises networks to AWS
1
2
3
4
5
6
7
Corporate data center
|
|-- Site-to-Site VPN ---- encrypted tunnel over the PUBLIC internet ---> VPC
|
|-- AWS Direct Connect -- dedicated PRIVATE fiber line (not internet) -> VPC
|
Individual remote user ---- AWS Client VPN ------------------------------> VPC
| AWS Site-to-Site VPN | Encrypted IPsec tunnel over the internet | Variable (internet-dependent) | Minutes | Low | Quick, secure connection, backup for Direct Connect |
| AWS Direct Connect | Dedicated private network connection from your site to AWS | Consistent, low latency, high bandwidth (1, 10, 100 Gbps) | Weeks | Higher | Large, steady data transfer, hybrid workloads |
| AWS Client VPN | Individual users connect with a VPN client | Internet-dependent | Minutes | Per connection | Remote workforce |
| AWS Transit Gateway | Hub for VPCs, VPNs, and Direct Connect | High | Moderate | Hourly + data | Many networks |
Exam clues: "Private, dedicated, consistent bandwidth, not over the internet" = Direct Connect. "Quick, encrypted over the internet" = Site-to-Site VPN. Direct Connect is not encrypted by default; combine it with a VPN if needed.
4. DNS and content delivery
Amazon Route 53
A highly available and scalable DNS service. It translates names (example.com) to IP addresses, registers domains, and performs health checks.
| Simple | One record, one answer | Single resource |
| Weighted | Split traffic by percentage | A/B testing, gradual rollouts |
| Latency-based | Send users to the lowest-latency Region | Global apps |
| Failover | Primary and secondary with health checks | Disaster recovery |
| Geolocation | Route by user location | Language, compliance |
| Geoproximity | Route by distance, with bias | Shift traffic between Regions |
| Multivalue answer | Return several healthy records | Basic load distribution |
Analogy: Route 53 is the phone book: you look up a name and get a number.
Amazon CloudFront (CDN)
CloudFront is a content delivery network that caches copies of your content at edge locations worldwide to cut latency.
1
2
3
4
User in Chennai --> nearest Edge Location (cache HIT? serve immediately)
| cache MISS
v
Origin (S3 bucket, ALB, EC2, custom server)
| Origins | S3, ALB, EC2, API Gateway, any HTTP server |
| Benefits | Lower latency, reduced load on origin, DDoS protection with Shield Standard, AWS WAF integration |
| Security | HTTPS, signed URLs/cookies, Origin Access Control to keep S3 private |
| Caching | Controlled by TTL; content cached at edge until expiry |
| Pricing | Pay for data transfer out and requests |
AWS Global Accelerator
| Caches content | Yes | No |
| Best for | Static and dynamic web content | TCP/UDP apps, gaming, VoIP, IoT; fast failover |
| How it helps | Serves from edge cache | Routes users over the AWS global network to the best endpoint via static anycast IPs |
Elastic Load Balancing (recap from Day 3)
| HTTP/HTTPS, Layer 7 | TCP/UDP, Layer 4, static IP | Third-party appliances |
5. Amazon API Gateway
A fully managed service to create, publish, secure, monitor, and scale APIs (REST, HTTP, WebSocket).
1
2
3
Mobile / web client --> API Gateway --> Lambda function --> DynamoDB
(auth, throttling,
caching, monitoring)
| Front door for | Lambda, EC2, other AWS services, on-premises apps |
| Security | IAM, Amazon Cognito, Lambda authorizers, API keys |
| Control | Throttling, usage plans, caching, request validation |
| Pricing | Pay per API call and data transferred; no minimum fee |
6. Serverless architecture
Serverless means you do not provision, patch, or scale servers. AWS runs the infrastructure, scales automatically, and you pay only for actual use.
| No server management | No OS patching or capacity planning |
| Automatic scaling | From zero to peak and back |
| Pay for value | Billed per request, duration, or data processed |
| Built-in high availability | Multi-AZ by default |
| Compute | AWS Lambda, AWS Fargate |
| API | Amazon API Gateway, AWS AppSync (GraphQL) |
| Storage | Amazon S3, Amazon EFS |
| Database | Amazon DynamoDB, Aurora Serverless |
| Messaging | Amazon SQS, Amazon SNS |
| Orchestration and events | AWS Step Functions, Amazon EventBridge |
| User identity | Amazon Cognito |
| Analytics | Amazon Athena, AWS Glue, Kinesis Data Firehose |
Typical serverless web application
1
2
3
4
5
6
7
8
9
10
11
12
13
Users
|
v
CloudFront (CDN) ----> S3 (static website: HTML, CSS, JS)
|
v
API Gateway <--- Cognito (sign-up / sign-in)
|
v
Lambda (business logic)
|
+--> DynamoDB (data)
+--> SNS / SQS (notifications, queues)
Application integration (decoupling) services
| Amazon SQS (Simple Queue Service) | Queue (pull) | Producers send messages; consumers poll and process; messages wait safely | "Decouple", "buffer", "queue" |
| Amazon SNS (Simple Notification Service) | Pub/sub (push) | One message published to a topic is pushed to many subscribers (email, SMS, Lambda, SQS) | "Notifications", "fan-out", "email/SMS" |
| Amazon EventBridge | Event bus | Routes events from AWS services, SaaS apps, and schedules to targets using rules | "React to events", "cron schedules" |
| AWS Step Functions | Workflow | Orchestrates multiple services in a visual state machine | "Coordinate steps", "workflow" |
| Amazon MQ | Managed message broker | ActiveMQ and RabbitMQ compatible | "Migrate existing brokers" |
| AWS AppSync | GraphQL API | Managed GraphQL with real-time data | "GraphQL" |
SQS vs SNS
| Model | Queue | Publish/subscribe |
| Delivery | Consumers pull | Service pushes to subscribers |
| Messages stored | Yes, until processed | No (delivered immediately) |
| Recipients | Typically one consumer group | Many subscribers |
Analogy: SQS is a mailbox where messages wait until you pick them up. SNS is a loudspeaker announcing to everyone subscribed at the same moment.
Tight vs loose coupling
1
2
TIGHT: [Web] ------------> [Order service] (if Order service is down, Web fails)
LOOSE: [Web] --> [ SQS ] --> [Order service] (messages wait, nothing is lost)
7. Networking summary: which service for which job?
| Isolated private network in AWS | VPC |
| Give private servers outbound-only internet | NAT Gateway |
| Connect VPC to the internet | Internet Gateway |
| Firewall at instance level | Security group |
| Firewall at subnet level, with deny rules | Network ACL |
| Translate domain names, route traffic, health check | Route 53 |
| Cache content at the edge | CloudFront |
| Improve performance of non-HTTP global apps | Global Accelerator |
| Distribute traffic among servers | Elastic Load Balancing |
| Encrypted tunnel over internet to on-premises | Site-to-Site VPN |
| Dedicated private line to on-premises | Direct Connect |
| Connect many VPCs and sites in a hub | Transit Gateway |
| Private connection between two VPCs | VPC Peering |
| Access S3 privately without internet | VPC endpoint (gateway) |
| Private access to a service across VPCs/accounts | PrivateLink |
| Build and manage APIs | API Gateway |
1
2
3
4
5
6
7
Networking decision flow
Need to connect to on-premises?
|-- quickly / low cost / over the internet ----> Site-to-Site VPN
|-- steady, high bandwidth, consistent ---------> Direct Connect
|-- many VPCs and networks together -----------> Transit Gateway
Need two VPCs to talk privately? -----------------> VPC Peering (or Transit Gateway)
Need to reach S3/DynamoDB without internet? ------> Gateway VPC endpoint
8. Exam traps for Day 5
| Security groups can deny traffic | They have allow rules only |
| NACLs are stateful | NACLs are stateless |
| NAT Gateway allows inbound internet connections | It allows outbound only for private subnets |
| VPC spans one AZ | A VPC spans a Region; a subnet is in one AZ |
| Direct Connect uses the internet | It is a dedicated private connection |
| VPC peering is transitive | It is not transitive |
| CloudFront and Global Accelerator are the same | CloudFront caches; Global Accelerator does not |
| Route 53 only does DNS | It also registers domains and does health checks |
| SNS stores messages for later pickup | That is SQS; SNS pushes immediately |
| Serverless means no servers exist | Servers exist, but AWS manages them |
9. Key takeaways
- VPC is your private network; public subnets route to an IGW, private subnets use a NAT Gateway for outbound access.
- Security group = stateful, instance level, allow only. NACL = stateless, subnet level, allow and deny.
- VPN = internet, quick. Direct Connect = dedicated, consistent.
- Route 53 = DNS. CloudFront = CDN. API Gateway = APIs.
- Serverless = Lambda, API Gateway, DynamoDB, S3, SQS, SNS, Step Functions, EventBridge.
10. Day 5 practice questions
| 1 | Which acts as a stateless firewall at the subnet level? | Network ACL |
| 2 | Which service provides a dedicated private connection between on-premises and AWS? | AWS Direct Connect |
| 3 | Which service delivers content with low latency using edge locations? | Amazon CloudFront |
| 4 | Which gateway lets private subnet instances reach the internet outbound only? | NAT Gateway |
| 5 | Which service creates and manages APIs in front of Lambda functions? | Amazon API Gateway |
| 6 | Which service translates domain names to IP addresses? | Amazon Route 53 |
| 7 | Which Route 53 routing policy sends users to the Region with the lowest delay? | Latency-based routing |
| 8 | Which service connects many VPCs and on-premises networks through a central hub? | AWS Transit Gateway |
| 9 | Which service lets you access a service privately without traffic crossing the public internet? | AWS PrivateLink (VPC endpoints) |
| 10 | Which service decouples applications with a message queue? | Amazon SQS |
| 11 | Which service sends one message to many subscribers such as email and SMS? | Amazon SNS |
| 12 | Which service coordinates multiple AWS services into a visual workflow? | AWS Step Functions |
Up next on Day 6: AI/ML, Analytics, Monitoring and Governance.
Loading article