Networking: VPC and Route 53

Networking: VPC and Route 53

An Amazon VPC is a regional logical network. Subnets divide its address space by Availability Zone, route tables choose traffic paths, security groups filter resource traffic, and gateways connect the VPC to the internet, other networks, or AWS services.

Core ideas

• A public subnet has a route to an internet gateway; a private subnet does not directly expose instances merely because of its name.
• Security groups are stateful and attach to supported resources; network ACLs are stateless subnet controls.
• NAT gateways enable selected outbound IPv4 access from private subnets without accepting unsolicited inbound connections.
• Route 53 provides authoritative DNS, health checks, routing policies, and domain registration.

Design and operating model

Allocate non-overlapping address space, spread workload tiers across Zones, minimize public entry points, and use private service endpoints where appropriate. Centralize shared connectivity carefully, log accepted and rejected flows, and document DNS ownership and failover behavior.

Example

Resources:
  AppVpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.20.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
  AppSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref AppVpc
      CidrBlock: 10.20.1.0/24
      AvailabilityZone: ap-south-1a

Run examples in a disposable training account and replace Regions, identifiers, policies, resource sizes, and names with reviewed values. Verify commands with the current AWS CLI and service documentation before production use.

Production guidance

• Do not use 0.0.0.0/0 inbound unless a reviewed public endpoint truly requires it.
• Plan egress filtering and cost: NAT gateways and cross-zone or cross-region transfer can be material.
• Test DNS TTL, health-check, and failover assumptions during controlled exercises.

The chapter quiz follows the lesson and checks both service vocabulary and architecture decisions.