Networking — VPC, Subnets & Security Groups

Networking — VPC, Subnets & Security Groups

Why Networking Matters

Without a VPC, your EC2 instances and RDS databases would be directly on the internet with no isolation. The VPC is the envelope that wraps your entire infrastructure.

VPC Architecture

Every AWS account gets a default VPC in each region with sensible defaults. For production, you create a custom VPC with deliberate subnet design.

Standard production VPC layout:

VPC: 10.0.0.0/16  (65,536 IPs)
│
├── Public Subnet A (10.0.1.0/24) — AZ us-east-1a
│   └── Load Balancer, Bastion Host, NAT Gateway
│
├── Public Subnet B (10.0.2.0/24) — AZ us-east-1b
│   └── Load Balancer (second AZ for HA)
│
├── Private Subnet A (10.0.3.0/24) — AZ us-east-1a
│   └── EC2 app servers, ECS tasks
│
├── Private Subnet B (10.0.4.0/24) — AZ us-east-1b
│   └── EC2 app servers (second AZ for HA)
│
├── DB Subnet A (10.0.5.0/24) — AZ us-east-1a
│   └── RDS primary
│
└── DB Subnet B (10.0.6.0/24) — AZ us-east-1b
    └── RDS Multi-AZ standby

Public vs. Private subnet — the only difference is routing:

How Traffic Flows

Inbound request to your web app:

1. Request hits the Internet Gateway
2. IGW routes to the Application Load Balancer in the public subnet
3. ALB forwards to EC2/ECS in the private subnet
4. App queries RDS in the DB subnet

Outbound from private subnet (e.g., npm install):

1. Private subnet routes 0.0.0.0/0 to the NAT Gateway (in public subnet)
2. NAT Gateway routes through the Internet Gateway
3. Response returns via NAT Gateway to the private instance

The private instance never gets a public IP — NAT handles the translation.

Security Groups in Practice

Security Groups are the primary layer you interact with daily. Key properties:

• Stateful: if you allow inbound on port 443, the response is automatically allowed outbound
• Allow rules only: you cannot explicitly deny in a security group (use NACLs for deny)
• Reference other groups: allow traffic from another security group (not just an IP range)

Example: three-tier security group design:

ALB Security Group:
  Inbound: 80/443 from 0.0.0.0/0
  Outbound: 3000 to App SG

App Security Group:
  Inbound: 3000 from ALB SG   ← references ALB SG, not IPs
  Outbound: 5432 to DB SG

DB Security Group:
  Inbound: 5432 from App SG   ← only the app can reach the DB
  Outbound: none needed

Referencing security groups by ID instead of IP ranges means your rules stay valid as instances scale up and change IPs.

NACLs vs. Security Groups

When to use NACLs: blocking a specific IP range at the subnet level (e.g., blocking a known attacker's IP block). For most architectures, security groups are sufficient.