👈

🌐 AWS Networking – COMPLETE EXPLANATION (END-TO-END)

🌐 AWS Networking – COMPLETE EXPLANATION (END-TO-END)

1️⃣ What Is Networking in AWS?

AWS Networking is about:

How resources inside AWS communicate with each other and with the internet—securely, reliably, and at scale.

In AWS, networking is built mainly around VPC (Virtual Private Cloud).

2️⃣ Core Building Block: VPC (Virtual Private Cloud)

What is a VPC?

A VPC is a logically isolated virtual network in AWS.

Think of it as:

Your own private data center network inside AWS

Key Properties of a VPC

✔ Private ✔ Customizable IP range ✔ Full control over routing & security ✔ Spans multiple AZs

VPC CIDR

When creating a VPC, you define:

10.0.0.0/16

This defines:

Total IP space
Max number of subnets
Network boundaries

3️⃣ Subnets – Dividing the VPC

What is a Subnet?

A Subnet is a smaller network inside a VPC, tied to one Availability Zone.

Why Subnets Exist

High availability
Traffic isolation
Security separation
Public vs private design

Example

VPC:        10.0.0.0/16
Public Sub: 10.0.1.0/24
Private Sub:10.0.2.0/24

4️⃣ Public vs Private Subnets (CRITICAL)

Public Subnet

A subnet is public if:

0.0.0.0/0 → Internet Gateway

Used for:

Load Balancers
Bastion Hosts
NAT Gateway

Private Subnet

A subnet is private if:

No route to IGW
Uses NAT for outbound internet

Used for:

App servers
Databases
Lambda (secure workloads)

5️⃣ Internet Gateway (IGW)

What is IGW?

An Internet Gateway allows:

Inbound + outbound internet access
For resources with public IPs

Traffic Flow

EC2 (Public IP)
 ↓
Route Table
 ↓
Internet Gateway
 ↓
Internet

📌 IGW does NOT provide security.

6️⃣ NAT Gateway (Private Internet Access)

What is NAT Gateway?

A NAT Gateway allows:

Private subnet resources to access the internet outbound only

Traffic Flow

Private EC2
 ↓
NAT Gateway
 ↓
Internet Gateway
 ↓
Internet

✔ Outbound allowed ❌ Inbound blocked

7️⃣ Route Tables – Traffic Direction

What is a Route Table?

A Route Table defines:

Where network traffic should go

Example Routes

10.0.0.0/16 → local
0.0.0.0/0   → IGW

📌 Subnets become public or private based on route tables.

8️⃣ Security Layer 1: NACL (Subnet Firewall)

What is NACL?

A Network ACL is:

Stateless
Subnet-level firewall

Key Points

✔ Allow + Deny rules ✔ Rule order matters ✔ Must allow return traffic explicitly

Traffic Order

Route Table
 ↓
NACL
 ↓
Security Group

9️⃣ Security Layer 2: Security Groups (Instance Firewall)

What is a Security Group?

A Security Group is:

Stateful
Instance-level firewall

Key Points

✔ Allow rules only ✔ Return traffic auto-allowed ✔ Best practice: SG-to-SG rules

🔟 Full Network Traffic Flow (IMPORTANT)

Internet → EC2

Internet
 ↓
IGW
 ↓
Route Table
 ↓
NACL
 ↓
Security Group
 ↓
EC2

📌 ALL must allow traffic

1️⃣1️⃣ IP Addressing in AWS

Private IP

Used inside VPC
Not internet-routable

Public IP

Internet-routable
Changes on stop/start

Elastic IP

Static public IP
Paid if unused

1️⃣2️⃣ DNS in AWS (Route 53)

What is Route 53?

AWS DNS service:

Converts domain names → IP addresses

Used for:

Websites
Load balancers
APIs

DNS Flow Example

example.com
 ↓
Route 53
 ↓
ALB / EC2 / API Gateway

1️⃣3️⃣ Load Balancing in AWS

Elastic Load Balancer (ELB)

Distributes traffic across:

Multiple EC2
Multiple AZs

Types

Type	Use Case
ALB	HTTP / HTTPS
NLB	TCP / UDP
CLB	Legacy

1️⃣4️⃣ VPC Peering & Connectivity

VPC Peering

Connect two VPCs
Private communication
No transitive routing

Transit Gateway

Hub-and-spoke networking
Large enterprise setups

1️⃣5️⃣ Serverless Networking (Lambda)

Lambda Outside VPC

No ENI
Internet access by default

Lambda Inside VPC

ENI created
Needs NAT for internet
Uses Security Groups

1️⃣6️⃣ Monitoring & Troubleshooting

VPC Flow Logs

Capture traffic info
Used for debugging & security

CloudWatch

Metrics & logs

1️⃣7️⃣ Common AWS Networking Exam Traps

❓ Public IP but no internet ➡ Route table / SG issue

❓ Private EC2 needs updates ➡ NAT Gateway

❓ Want to block IP explicitly ➡ NACL

❓ Lambda expensive suddenly ➡ NAT Gateway cost

1️⃣8️⃣ Real-World AWS Network Architecture

Internet
 ↓
CloudFront
 ↓
ALB (Public Subnet)
 ↓
App EC2 (Private Subnet)
 ↓
RDS (Private Subnet)

✔ Secure ✔ Scalable ✔ Highly available

1️⃣9️⃣ Mental Model (REMEMBER THIS)

VPC = Network
Subnets = Sections
Route Table = GPS
IGW/NAT = Gateways
NACL = Border check
SG = Door lock

2️⃣0️⃣ One-Line Exam Definition

AWS networking provides a secure, scalable, and isolated virtual network using VPC, subnets, routing, gateways, and security controls.

✅ FINAL SUMMARY (VERY IMPORTANT)

VPC is the foundation
CIDR defines IP space
Subnets divide networks
Route tables control paths
IGW & NAT handle internet
NACL & SG secure traffic
Everything works together