AWS VPC Overview & Component Breakdown

A Virtual Private Cloud is the backbone of every AWS network you build. Getting the topology right, from subnets to gateways to firewall layers, saves you from painful rework down the road. Below is a component-by-component breakdown of what lives inside a VPC and how traffic actually moves through it.

Component Breakdown

Below is a walkthrough of each element visible in the diagram, cross-referenced with the AWS documentation at docs.aws.amazon.com/vpc/latest/userguide/how-it-works.html.

1. The VPC Boundary (Outer Rectangle)

• Represents your isolated virtual network in the AWS Cloud.
• You choose the IPv4 CIDR block (e.g., 10.0.0.0/16) and optionally an IPv6 CIDR block.
• All subnets, gateways, and security controls live inside this boundary.

2. Internet Gateway (IGW)

• A scalable, redundant gateway that enables two-way communication between resources in the VPC and the public internet.
• Attached to the VPC (not to a specific subnet).
• Only public subnets (those with a route to the IGW) can receive inbound traffic from the internet.
• The IGW itself is stateless and does not perform NAT.

3. Public Subnet(s)

• A subnet whose route table contains a route to the Internet Gateway (0.0.0.0/0 → igw-xxxx).
• Resources here (e.g., EC2 instances, load balancers) can be assigned public IPv4 addresses and are directly reachable from the internet.
• Typically hosts: web servers, API gateways, load balancers, bastion hosts.

4. Private Subnet(s)

• A subnet whose route table does not have a direct route to the IGW.
• Resources here have no public IP and cannot be reached inbound from the internet.
• Outbound internet access is provided via the NAT Gateway (see below).
• Typically hosts: application servers, databases, internal microservices.

5. NAT Gateway

• A highly available, managed Network Address Translation service placed in a public subnet.
• Allows instances in private subnets to initiate outbound connections to the internet (e.g., yum update, S3 pulls) while blocking inbound connections from the internet.
• The private subnet’s route table points 0.0.0.0/0 → nat-xxxx.
• It is stateful (tracks connection state) and scales automatically.

6. Route Tables

• A set of rules that determine how network traffic is directed within and outside the VPC.
• Each subnet is associated with exactly one route table.
• The main route table is the default; you can create custom route tables for finer control.
• Key routes in the diagram:

7. Security Groups (Stateful Firewall - Instance Level)

• Act as a virtual firewall for individual EC2 instances / ENIs.
• Stateful: return traffic is automatically allowed regardless of rules.
• Default allow for outbound; default deny for inbound (you must explicitly open ports).
• Rules are additive (allow-only; no explicit deny rules).
• Can reference other security groups (e.g., “allow from the Web SG”).

8. Network ACLs (Stateless Firewall - Subnet Level)

• Act as a virtual firewall at the subnet level.
• Stateless: you must explicitly allow both inbound and outbound traffic (return traffic is not automatically permitted).
• Support allow and deny rules, evaluated by rule number (lowest first).
• Provide a second layer of defense beyond security groups.

9. Elastic IP (EIP) (if shown)

• A static public IPv4 address that you can associate with a resource in a public subnet.
• Remains with your account even if the underlying instance is stopped/restarted.
• Useful for NAT Gateways, load balancers, and any resource that needs a stable public address.

10. VPC Peering / VPN / Direct Connect (if shown at the edges)

• VPC Peering: private, low-latency connection between two VPCs (same or different accounts/regions).
• VPN Connection: encrypted tunnel (IPsec) between the VPC and an on-premises network.
• AWS Direct Connect: dedicated, private physical connection from on-premises to AWS.

How Traffic Flows (Simplified)

Internet
   │
   ▼
┌─────────────────────────────────────────────────┐
│  VPC  (10.0.0.0/16)                             │
│                                                 │
│  ┌──────────────┐       ┌──────────────────┐    │
│  │ Public Subnet│       │  Private Subnet  │    │
│  │ 10.0.1.0/24  │       │  10.0.2.0/24     │    │
│  │              │       │                  │    │
│  │  EC2 (web)   │       │  EC2 (app/db)    │    │
│  │  NAT GW      │       │                  │    │
│  └──────┬───────┘       └────────┬─────────┘    │
│         │                        │              │
│    Route Table A            Route Table B       │
│    0.0.0.0/0 → IGW         0.0.0.0/0 → NAT GW   │
│         │                        │              │
│    ┌────┴────┐                   │              │
│    │  IGW    │◄──────────────────┘              │
│    └─────────┘                                  │
│                                                 │
│  [Security Groups]  [Network ACLs]              │
└─────────────────────────────────────────────────┘

• Inbound (Internet → Public Subnet): Internet → IGW → Route Table A → Public Subnet → Security Group → Instance.
• Outbound (Private Subnet → Internet): Instance → Security Group → Route Table B → NAT GW → IGW → Internet.
• Inbound (Internet → Private Subnet): Blocked (no route to IGW; NAT GW does not accept inbound).

Key Takeaways

• Networking
• Cloud-Platform
• Technology

• Aws
• SysAdmin
• Troubleshooting