After this lesson, you will be able to: Design a VPC: public + private subnets, route tables, internet gateways, NAT gateways, and the security groups vs NACLs distinction.
VPC is the network foundation. Get it right once; revisit annually. This lesson covers the canonical design.
Standard production design: Public subnets (web tier): host the load balancer + bastion. Have an Internet Gateway route. Private subnets (app tier): EC2/ECS/Lambda. NO public IPs. Reach internet via NAT Gateway. Database subnets (data tier): RDS + ElastiCache. NO internet access at all. Spread subnets across AZs (a-c) for HA. Each tier in each AZ = 6 subnets minimum.
Internet Gateway (IGW): allows bidirectional internet traffic for resources with public IPs. One per VPC; free. NAT Gateway: lets resources in PRIVATE subnets initiate outbound internet calls (for apt-get, npm install, API calls). Hides their private IPs. NAT Gateway costs $0.045/hr + $0.045/GB ($30+/mo idle). Surprising cost line in many AWS bills. Alternative: NAT Instance (a small EC2 acting as NAT). Cheaper but you operate it. VPC Endpoints: traffic to AWS services (S3, DynamoDB) routes inside the AWS network, free, doesn't hit NAT. Always use endpoints for S3/DynamoDB.
Each subnet has a route table that decides where traffic for each destination goes. Public subnet route: 0.0.0.0/0 → IGW (default route to internet). Private subnet route: 0.0.0.0/0 → NAT (default route via NAT). Local routes (10.0.0.0/16) auto-created for VPC traffic. Read your route tables when 'why can't this Pod reach the internet' bites you.
Security Group: STATEFUL firewall on each ENI (network interface). Default DENY inbound, default ALLOW outbound. Rules: allow only (no deny). Track connections (response traffic always allowed). Network ACL (NACL): STATELESS firewall at the subnet level. Default ALLOW all in/out on the custom VPC; default subnets are wide open. Rules: numbered; allow OR deny; both directions explicit. Use SGs for almost everything. Use NACLs as a coarse extra layer (e.g. block traffic from a specific country at the subnet level).
App tier in public subnet. Defeats the point of the design. Apps go in private. No VPC Endpoints for S3 / DynamoDB. Every S3 request from a private subnet goes through NAT, accruing per-GB cost. Tiny CIDR. /24 is 256 IPs total. EKS Pods burn through them fast. Plan for /16. Single-AZ. Region-wide HA requires multi-AZ. Mixing dev + prod in one VPC. Use separate VPCs (or at minimum separate accounts via AWS Organizations).
Pick the right path.
Sign in and purchase access to unlock this lesson.