Amazon VPC, Route 53 and connecting to AWS: subnets, gateways, security groups, network ACLs, VPN and Direct Connect

Why this matters

Every server, database and container you run on AWS sits on a network, and that network decides who can reach it. A database that is accidentally reachable from the internet is one of the most common ways company data leaks. Understanding how AWS networks are put together is how you tell a safe design from a risky one, even if you never build one yourself.

A manager signing off a project needs to know whether the office will reach AWS over the internet or over a private line, because the two differ in cost, setup time and reliability. A salesperson needs to explain why a customer's website name points at AWS and what happens when a server stops responding. A junior engineer needs to know which firewall to change when traffic is blocked. The vocabulary in this lesson — subnets, gateways, security groups, DNS, VPN — turns up in nearly every AWS conversation.

The lesson

AWS network services

AWS groups its networking under "Networking and Content Delivery". The services in scope for this exam, in plain terms:

• Amazon VPC: your own private network inside AWS.
• Amazon Route 53: the AWS DNS service, which turns names into addresses.
• AWS VPN (Site-to-Site VPN and Client VPN) and AWS Direct Connect: ways to connect your own networks and people to AWS.
• AWS Transit Gateway: a central hub joining many VPCs and on-premises networks.
• AWS PrivateLink: private access to services without crossing the internet.
• Amazon CloudFront and AWS Global Accelerator: faster delivery to users through the AWS edge network, covered with edge locations in lesson 13.
• Amazon API Gateway: a managed front door for application APIs.

This lesson concentrates on the VPC, its security, Route 53 and connectivity.

The parts of a VPC: subnets, route tables and gateways

Amazon Virtual Private Cloud (Amazon VPC) lets you launch resources into a logically isolated virtual network that you define. It is not a separate physical building or cable; it is a software-defined network running on AWS's shared infrastructure, walled off from other customers. You choose its private IP address range, and a VPC spans one AWS Region.

A subnet is a smaller range of IP addresses carved out of the VPC. Each subnet sits entirely inside one Availability Zone; it cannot stretch across zones or Regions. That is why a highly available design places subnets, and copies of its servers, in at least two zones.

A route table is a set of rules that tells traffic leaving a subnet where to go. The routes are what make a subnet public or private:

• A public subnet has a route to an internet gateway. Web servers with public addresses go here.
• A private subnet has no such route, so nothing on the internet can reach its resources directly. Databases and application servers go here.

The gateways each have one job:

• Internet gateway: attached to the VPC, it allows two-way traffic between the internet and resources with public addresses in public subnets.
• NAT gateway: placed in a public subnet, it lets instances in a private subnet start outbound connections, for example to download software updates, while refusing connections that start from the internet. NAT stands for network address translation.
• Virtual private gateway: the AWS end of a Site-to-Site VPN connection on a VPC.

Three more connection pieces appear in scenarios:

• VPC peering joins two VPCs privately, one pair at a time.
• AWS Transit Gateway acts as a central hub for many VPCs and on-premises networks, so a growing network does not become a tangled mesh of separate peering links.
• VPC endpoints let resources reach AWS services without an internet gateway, a NAT device or public addresses. An interface endpoint is powered by AWS PrivateLink; S3 and DynamoDB can also be reached through a gateway endpoint.

Security in a VPC: security groups, network ACLs and Amazon Inspector

A VPC has two built-in firewalls, and the exam expects you to tell them apart.

A security group is a virtual firewall around an individual instance (strictly, around its network interface).

• It is stateful: if a request is allowed in, the reply is allowed out automatically, and the other way round.
• It contains allow rules only. Anything not allowed is denied, but you cannot write a rule that blocks one particular address.
• A new security group allows no inbound traffic and allows all outbound traffic until you change it.

A network ACL (network access control list) filters traffic at the subnet boundary, for every resource in that subnet.

• It is stateless: each direction is checked separately, so a reply needs its own outbound rule. If a network ACL allows HTTPS in but has no outbound rule for the replies, clients never get an answer.
• It supports both allow and deny rules, so it is the tool for blocking a known malicious IP range for a whole subnet.
• Its rules are numbered and evaluated in order, lowest number first; the first match wins.

A simple memory aid: security groups are for the instance and remember conversations; network ACLs are for the subnet and check every packet both ways. Using both gives layered defence.

Amazon Inspector works at a different level. It automatically and continually scans workloads such as Amazon EC2 instances for software vulnerabilities and for unintended network exposure, such as a port reachable from the internet that should not be. Contrast it with Amazon GuardDuty, which detects threats by analysing activity and logs but does not scan the software on an instance for vulnerabilities. Both are covered further in lesson 8.

Under the shared responsibility model (lesson 6), AWS secures the physical network and the hardware. Configuring security groups, network ACLs and route tables is the customer's job: security in the cloud.

Understanding the purpose of Amazon Route 53

DNS (the Domain Name System) is the internet's directory: it translates a name such as www.example.com into the IP address of the server that answers. Amazon Route 53 is AWS's highly available DNS service, and that translation is its core job. The name nods to port 53, the network port DNS uses.

Route 53 does three things that scenarios ask about:

• Domain registration: you can buy and manage domain names through it.
• Health checks: it checks whether endpoints are responding and stops sending users to ones that fail.
• Routing policies: rules for which answer to give. Latency-based routing sends each user to the Region that gives them the lowest latency; failover routing sends traffic to a standby when the primary is unhealthy; weighted routing splits traffic by percentage; geolocation routing answers by the user's location.

Keep the neighbours apart. Amazon CloudFront caches content at edge locations close to users; it does not answer DNS queries. AWS Global Accelerator also routes users around unhealthy endpoints, over the AWS global network using fixed IP addresses, but it does not register domains or act as DNS. If a question mentions domain names or DNS, the answer is Route 53.

Connecting to AWS: AWS VPN and AWS Direct Connect

Companies with their own data centres or offices need to link them to their VPCs. There are two families of option.

AWS VPN covers two services. A VPN (virtual private network) creates an encrypted tunnel across a network you do not trust, such as the internet.

• AWS Site-to-Site VPN connects a whole network, such as a data centre or branch office, to a VPC through encrypted tunnels over the existing internet connection. It is quick to set up and inexpensive, but because it rides the public internet, its performance can vary.
• AWS Client VPN is a managed service for individual people. Employees working from home connect from their own laptops to resources in the VPC.

AWS Direct Connect is a dedicated private network connection between your premises and AWS. Traffic does not travel over the public internet, so performance is more consistent, which suits large, steady data transfers and latency-sensitive systems. It takes longer to arrange than a VPN, because a physical connection has to be provisioned. Direct Connect is private but does not encrypt traffic by default; companies that need encryption can run a VPN across it.

The two are often combined. A Site-to-Site VPN is a common lower-cost backup path for Direct Connect: if the dedicated link fails, traffic moves to the encrypted tunnel over the internet.

On the exam, "dedicated", "private connection", "not over the public internet" or "consistent performance" point to Direct Connect. "Quickly", "low cost", "encrypted" and "existing internet connection" point to Site-to-Site VPN. "Remote employees" or "individual users" point to Client VPN. "Many VPCs and on-premises networks through one hub" points to Transit Gateway.

What the exam is really asking

Network questions usually test one distinction at a time. Public or private subnet is decided by the route to an internet gateway. Inbound from the internet means an internet gateway; outbound only from a private subnet means a NAT gateway. Stateful, instance-level and allow-only means a security group; stateless, subnet-level and able to deny means a network ACL. Vulnerability scanning means Amazon Inspector. Names and DNS mean Route 53. A whole site over the internet means Site-to-Site VPN; single users mean Client VPN; a dedicated private line means Direct Connect.