Suggested:
A clear, beginner-friendly guide to AWS networking — VPCs, subnets, Internet and NAT gateways, Security Groups vs NACLs, VPC peering, endpoints, PrivateLink, VPN, Direct Connect, and Transit Gateway.
AWS networking has a reputation for being the intimidating part of learning the cloud, and it's easy to see why — there are a lot of services with similar-sounding names. The thing that helped me most was to build the picture in layers: start with the box everything lives in, then add the pieces that let traffic flow, then the pieces that connect your network to the outside world. Here's the whole landscape in that order.
Table of contents [Show]
A VPC (Virtual Private Cloud) is your own private, isolated network inside an AWS region. Everything else in this guide lives inside it. A VPC spans all the Availability Zones in its region, and you define its address range using CIDR notation, such as 10.0.0.0/16.
Inside a VPC, resources use private IP addresses that aren't reachable from the internet. Public IP addresses are internet-reachable. An Elastic IP is a public IPv4 address you own and can hold onto even after stopping and starting an instance, which is what you reach for when you need a fixed public address.
A subnet is a subdivision of your VPC, and each subnet lives in exactly one Availability Zone. The important distinction is between two kinds:
An Internet Gateway (IGW) attaches to your VPC and lets resources in public subnets reach the internet and be reached from it.
A NAT Gateway handles the opposite need. It lets resources in private subnets reach out to the internet — to download updates, for example — without letting anything on the internet reach in. It's strictly one-way outbound, and it's fully managed by AWS.
AWS gives you two layers of traffic control, and telling them apart is one of the most common points of confusion.
A Security Group operates at the instance level and is stateful, meaning if you allow traffic out, the return traffic is automatically allowed back in. Security groups can only allow traffic, never explicitly deny it.
A Network ACL (NACL) operates at the subnet level and is stateless, meaning return traffic must be explicitly allowed by its own rule. NACLs can both allow and deny, and they evaluate rules in numbered order, stopping at the first match.
A quick memory hook: Security group is Stateful, while the NACL is the stateless, subnet-level firewall that can say "deny."
VPC Flow Logs capture information about the IP traffic moving in and out of your network interfaces. They're your main tool for troubleshooting connectivity problems and for security monitoring, and you can enable them at the VPC, subnet, or individual network-interface level.
VPC Peering privately connects two VPCs so they can communicate as though they were one network. Two rules matter: the two VPCs' CIDR ranges must not overlap, and peering is not transitive — if VPC A is peered with B, and B is peered with C, A still cannot reach C without its own direct peering connection.
A VPC Endpoint lets your resources connect to AWS services privately, keeping the traffic on the AWS network instead of routing it over the public internet. There are two types:
PrivateLink is the most secure and scalable way to expose a service running in your VPC to many other VPCs — potentially thousands — without VPC peering, internet gateways, or NAT. It's the go-to when you want to privately share your own service with other VPCs or other accounts.
If you need to link your on-premises data center to AWS, you have two main options.
A Site-to-Site VPN connects your on-premises network to AWS over the public internet, with the traffic encrypted. It's quick to set up but offers less consistent performance because it rides the public internet.
Direct Connect (DX) is a physical, dedicated private connection running from your data center straight into AWS. It offers higher bandwidth, more consistent performance, and more security — but it takes weeks or months to establish. The shorthand: VPN is quick and over the internet, while Direct Connect is physical, private, and slow to set up.
Client VPN connects individual users' computers — laptops and desktops — to your AWS VPC and on-premises network over an encrypted OpenVPN connection. Think of it as the way remote workers securely reach the private network.
Peering VPCs one by one gets messy fast. Transit Gateway solves this by acting as a single central hub that connects thousands of VPCs and on-premises networks in a hub-and-spoke design. Unlike VPC peering, Transit Gateway supports transitive routing, so everything connected through the hub can reach everything else.
Once you can place each service into one of those buckets, the whole networking picture stops feeling like a pile of acronyms and starts feeling like a map.
A beginner-friendly guide to AWS monitoring services. Learn what CloudWatch, CloudTrail, EventBridge, X-Ray, and the Health Dashboard actually do — and how to tell them apart.
Confused by all the AWS database services? This beginner-friendly guide explains RDS, Aurora, DynamoDB, Redshift, ElastiCache, Athena, Glue, and more — by the job each one is built for.
