Skip to content
Optimal Lab

DevOps · interactive

VPCs, subnets and security groups

A VPC is your private network in the cloud. Public subnets route to the internet gateway; private subnets don't, and reach out only through a NAT gateway. Security groups then allow specific ports from specific sources. Trace five flows.

Internet
Internet gateway

VPC 10.0.0.0/16

Public subnet 10.0.1.0/24 · route 0.0.0.0/0 → IGW

web serverNAT gateway

Private subnet 10.0.2.0/24 · route 0.0.0.0/0 → NAT

database
  1. Internet→
  2. Internet gateway→
  3. Public subnet→
  4. web SG: 443 from 0.0.0.0/0→
  5. web server

Allowed

The public subnet's route table sends 0.0.0.0/0 to the internet gateway, and the web security group allows 443 from anywhere.

Traffic

Step 1 of 4

  1. 1

    Route tables make subnets public or private

    A subnet is public only if its route table sends internet traffic to an internet gateway.

    Spread subnets across availability zones.

  2. 2

    NAT for private subnets

    Private resources can start connections out (updates, APIs) but can't be reached from outside.

    NAT gateways cost per GB: watch the bill.

  3. 3

    Security groups are stateful firewalls

    Allow rules by port and source. Referencing another security group (web SG) beats hard-coding IPs.

    Replies to allowed traffic are automatic.

  4. 4

    No open database ports

    Reach private hosts through SSM Session Manager or a bastion, never by opening 5432 to the world.

    VPC flow logs show what was rejected.

In production

Tools and technologies

Every cloud network is built from these pieces.

Not tied to one language — use these names when you search docs or design a system.