Amazon VPC – Virtual Private Cloud

1. How deep you need to go

The deck opens this section with a warning and a reassurance. VPC is something you should know in depth for the AWS Certified Solutions Architect Associate and AWS Certified SysOps Administrator. At the AWS Certified Cloud Practitioner level, you only need to know about:

• VPC, Subnets, Internet Gateways and NAT Gateways
• Security Groups, Network ACLs (NACL), VPC Flow Logs
• VPC Peering, VPC Endpoints
• Site-to-Site VPN and Direct Connect
• Transit Gateway

The slides describe this as an overview, worth less than 1 or 2 questions at your exam, and note that AWS creates a “default VPC” for you. There is a summary at the end of the section — it is fine if you do not understand it all on the first pass.

Exam tip

Do not over-invest here. Learn the one-line definition of each item in the list above and which problem it solves; that is the depth CLF-C02 asks for.

2. IP addresses in AWS

IPv4

Internet Protocol version 4 provides 4.3 billion addresses.

• Public IPv4 — can be used on the Internet. An EC2 instance gets a new public IP address every time you stop then start it (that is the default behaviour).
• Private IPv4 — can be used on private networks (LAN) such as internal AWS networking, e.g. 192.168.1.1. Private IPv4 is fixed for EC2 instances even if you start/stop them.
• Elastic IP — allows you to attach a fixed public IPv4 address to an EC2 instance.
• All public IPv4 on AWS is charged $0.005 per hour, including Elastic IPs.

IPv6

Internet Protocol version 6 provides 3.4 × 10^38 addresses.

• Every IP address is public in AWS — there is no private range.
• Example: 2001:db8:3333:4444:cccc:dddd:eeee:ffff.
• Free.

Exam tip

Two number facts worth memorising: public IPv4 costs $0.005 per hour (even an unused Elastic IP), and IPv6 is free. The closing slides repeat that an Elastic IP has an ongoing cost if not in use.

3. VPC and subnets

• VPC — Virtual Private Cloud: a private network to deploy your resources. It is a regional resource.
• Subnets allow you to partition your network inside your VPC. A subnet is an Availability Zone resource.
• A public subnet is a subnet that is accessible from the internet.
• A private subnet is a subnet that is not accessible from the internet.
• To define access to the internet and between subnets, you use Route Tables.

The deck’s diagram places a VPC inside one Region, spanning Availability Zone 1 and Availability Zone 2, each holding a public subnet and a private subnet, with a VPC CIDR range of 10.0.0.0/16.

Real-world example

The classic layout the diagram implies: web servers in the public subnets of two AZs so they can be reached from the internet, and databases in the private subnets of the same two AZs so they cannot.

4. Internet Gateway and NAT Gateways

• Internet Gateways help your VPC instances connect with the internet. Public subnets have a route to the internet gateway.
• NAT Gateways (AWS-managed) and NAT Instances (self-managed) allow your instances in private subnets to access the internet while remaining private.

Exam tip

Direction is the whole story. An Internet Gateway makes a subnet reachable from the internet; a NAT Gateway lets private instances reach out to the internet without becoming reachable themselves. NAT Gateway = AWS-managed, NAT Instance = you manage it.

5. Network ACLs and Security Groups

	NACL (Network ACL)	Security Group
What it protects	A subnet	An EC2 instance
Attached at	The subnet level	The instance / ENI level
Rule types	ALLOW and DENY rules	ALLOW rules only
Rules can reference	IP addresses only	IP addresses and other security groups
State	Stateless	Stateful

Both are firewalls: the NACL controls traffic from and to a subnet, the Security Group controls traffic to and from an EC2 instance. The stateless/stateful distinction comes from the section’s closing slides: NACL — stateless, subnet rules for inbound and outbound; Security Groups — stateful, operate at the EC2 instance level or ENI.

Exam tip

“I need to block a specific malicious IP address” → NACL, because only a NACL has DENY rules. “I need to let the web tier talk to the database tier” → Security Group, because only a Security Group can reference another Security Group.

6. VPC Flow Logs

VPC Flow Logs capture information about IP traffic going into your interfaces, at three levels:

• VPC Flow Logs
• Subnet Flow Logs
• Elastic Network Interface Flow Logs

They help monitor and troubleshoot connectivity issues — for example subnets to internet, subnets to subnets, and internet to subnets. They also capture network information from AWS-managed interfaces: Elastic Load Balancers, ElastiCache, RDS, Aurora, and others.

VPC Flow Logs data can go to S3, CloudWatch Logs and Amazon Data Firehose.

Real-world example

An instance in a private subnet cannot reach a database and nobody can say why. Flow Logs show the traffic being rejected, which pins the problem on a NACL or Security Group rule rather than the application.

7. VPC Peering

• Connect two VPCs privately, using AWS’ network.
• Makes them behave as if they were in the same network.
• They must not have overlapping CIDR (IP address ranges).
• A VPC Peering connection is not transitive — it must be established for each pair of VPCs that need to communicate with one another.

The slide’s diagram makes the non-transitivity explicit: peering A↔B and B↔C does not give you A↔C; you must also create the A↔C peering.

Exam tip

Two absolutes: no overlapping CIDR ranges, and peering is not transitive. Both show up as single-fact questions.

8. VPC Endpoints and AWS PrivateLink

VPC Endpoints

• Endpoints allow you to connect to AWS services using a private network instead of the public www network.
• This gives you enhanced security and lower latency when accessing AWS services.
• VPC Endpoint Gateway — S3 and DynamoDB.
• VPC Endpoint Interface — most services, including S3 and DynamoDB.

AWS PrivateLink (VPC Endpoint Services)

• The most secure and scalable way to expose a service to 1000s of VPCs.
• Does not require VPC peering, internet gateway, NAT or route tables.
• Requires a Network Load Balancer (in the service VPC) and an ENI (in the customer VPC).

Exam tip

Remember the pair: Gateway endpoint = S3 and DynamoDB only. And PrivateLink is for reaching a third-party or your own service in another VPC, while a VPC endpoint is for reaching an AWS service.

9. Connecting on-premises to AWS

Site-to-Site VPN

• Connect an on-premises VPN to AWS.
• The connection is automatically encrypted.
• It goes over the public internet.
• On-premises you must use a Customer Gateway (CGW); on the AWS side you must use a Virtual Private Gateway (VGW).

Direct Connect (DX)

• Establish a physical connection between on-premises and AWS.
• The connection is private, secure and fast.
• It goes over a private network.
• It takes at least a month to establish.

AWS Client VPN

• Connect from your computer using OpenVPN to your private network in AWS and on-premises.
• Allows you to connect to your EC2 instances over a private IP, just as if you were in the private VPC network.
• Goes over the public Internet.

Exam tip

“We need this connection up quickly” → Site-to-Site VPN, over the internet, encrypted. “We need consistent, private, high bandwidth and can wait” → Direct Connect, at least a month to establish. “One developer’s laptop needs to reach private instances” → Client VPN.

10. Transit Gateway

Network topologies can become complicated once you have many VPCs and on-premises sites.

Transit Gateway exists for having transitive peering between thousands of VPCs and on-premises, in a hub-and-spoke (star) connection:

• One single Gateway provides this functionality.
• It works with Direct Connect Gateway and VPN connections.

Real-world example

Instead of creating a separate VPC Peering connection for every pair among dozens of VPCs — which is where the non-transitivity from section 7 becomes painful — you attach each VPC and your Direct Connect Gateway to one Transit Gateway.

11. VPC closing comments

The deck closes with the definition list to memorise:

• VPC — Virtual Private Cloud.
• Subnets — tied to an AZ, network partition of the VPC.
• Internet Gateway — at the VPC level, provides Internet access.
• NAT Gateway / Instances — give internet access to private subnets.
• NACL — stateless, subnet rules for inbound and outbound.
• Security Groups — stateful, operate at the EC2 instance level or ENI.
• VPC Peering — connect two VPCs with non-overlapping IP ranges, non-transitive.
• Elastic IP — fixed public IPv4, ongoing cost if not in use.
• VPC Endpoints — provide private access to AWS services within a VPC.
• PrivateLink — privately connect to a service in a third-party VPC.
• VPC Flow Logs — network traffic logs.
• Site-to-Site VPN — VPN over the public internet between an on-premises DC and AWS.
• Client VPN — OpenVPN connection from your computer into your VPC.
• Direct Connect — direct private connection to AWS.
• Transit Gateway — connect thousands of VPCs and on-premises networks together.

Flow Logs land in the same destinations you met in Cloud Monitoring, and the firewall services that sit on top of a VPC are covered in Security & Compliance.

Quick recap

Concept	What to remember for the exam
Public IPv4	Changes every time an EC2 instance is stopped and started; charged $0.005 per hour
Private IPv4	Fixed for an EC2 instance across start/stop; used on internal networks
Elastic IP	Fixed public IPv4 attached to an instance; ongoing cost when not in use
IPv6	Every address is public in AWS, no private range, free
VPC	Private network for your resources; regional resource
Subnet	Partition of a VPC; Availability Zone resource; public = reachable from the internet, private = not
Route Tables	Define access to the internet and between subnets
Internet Gateway	VPC level; public subnets have a route to it
NAT Gateway / NAT Instance	Let private-subnet instances reach the internet while staying private; Gateway is AWS-managed, Instance is self-managed
NACL	Subnet-level, stateless, ALLOW and DENY, IP addresses only
Security Group	Instance/ENI-level, stateful, ALLOW only, can reference other security groups
VPC Flow Logs	IP traffic at VPC, subnet and ENI level, including ELB, ElastiCache, RDS and Aurora; destinations S3, CloudWatch Logs, Amazon Data Firehose
VPC Peering	Private connection between two VPCs; no overlapping CIDR, not transitive
VPC Endpoints	Private access to AWS services; Gateway = S3 and DynamoDB, Interface = most services
AWS PrivateLink	Expose a service to thousands of VPCs; needs a Network Load Balancer and an ENI; no peering, IGW, NAT or route tables
Site-to-Site VPN	Encrypted, over the public internet; Customer Gateway on-premises, Virtual Private Gateway on AWS
Direct Connect	Physical, private, fast; takes at least a month to establish
Client VPN	OpenVPN from your computer to private IPs in the VPC, over the internet
Transit Gateway	One hub-and-spoke gateway for transitive connectivity across thousands of VPCs and on-premises; works with Direct Connect Gateway and VPN