Amazon VPC Basics: Subnets, Gateways, Security Groups, and Network ACLs

An Amazon Virtual Private Cloud (VPC) is a logically isolated section of the AWS network where you launch resources into a private IP address range that you define. Inside a VPC, subnets divide that address space, gateways control what can reach the internet, and two different firewall layers (security groups and network ACLs) filter traffic. CLF-C02 does not expect you to design networks, but it does expect you to know what each of these building blocks does and how they differ.

What a VPC is and how it is scoped

When you create a VPC, you choose a private IP address range using CIDR notation (Classless Inter-Domain Routing, the slash notation like 10.0.0.0/16 that defines a block of addresses). Everything you launch inside the VPC, such as EC2 instances or database instances, gets an address from that range. By default, nothing outside the VPC can reach anything inside it, which is the whole point: it is your private, isolated slice of AWS.

Scope matters on the exam. A VPC lives inside a single AWS Region and can span all of the Availability Zones in that Region. A subnet, by contrast, lives inside exactly one Availability Zone. That asymmetry is why highly available architectures place subnets in multiple Availability Zones within one VPC. If the Region and Availability Zone distinction is fuzzy, review AWS Regions and Availability Zones first, because VPC questions assume it.

Subnets: public vs private

A subnet is a segment of the VPC’s IP range where you actually place resources. The public/private distinction is the one CLF-C02 cares about:

• A public subnet has a route to an internet gateway, so resources in it (with public IP addresses) can be reached from the internet. Web servers and load balancers live here.
• A private subnet has no direct route to the internet. Databases and application servers live here, unreachable from outside.

What makes a subnet public or private is not a checkbox but its route table, the set of rules that decides where network traffic from the subnet is directed. If the route table sends internet-bound traffic to an internet gateway, the subnet is public. If it does not, the subnet is private.

Gateways: IGW, NAT, and private connections

Three connectivity components come up repeatedly:

• An internet gateway (IGW) attaches to the VPC and allows two-way traffic between the internet and resources in public subnets. One VPC, one internet gateway.
• A NAT gateway (Network Address Translation) lets resources in a private subnet initiate outbound connections to the internet (to download patches, for example) while still blocking inbound connections from the internet. Remember the direction: outbound only. The NAT gateway itself sits in a public subnet.
• VPC peering connects two VPCs so they can route traffic to each other privately using their internal IP addresses, without traversing the public internet.

For connecting a VPC to an on-premises network, know two options at the definition level: AWS Site-to-Site VPN creates an encrypted tunnel over the public internet (fast to set up, internet-dependent performance), while AWS Direct Connect provides a dedicated private physical connection into AWS (consistent performance, higher cost, weeks to provision). VPC endpoints are the third private-connectivity idea: they let resources inside a VPC reach supported AWS services such as Amazon S3 without the traffic ever leaving the AWS network.

Security groups vs network ACLs

This is the single most tested VPC topic at the Cloud Practitioner level. Both are virtual firewalls, but they operate at different layers and with different behavior:

Feature	Security group	Network ACL
Operates at	Instance (resource) level	Subnet level
Rule types	Allow rules only	Allow and deny rules
State	Stateful: return traffic automatically allowed	Stateless: return traffic needs an explicit rule
Rule evaluation	All rules evaluated together	Rules processed in number order, first match wins
Default behavior	Deny all inbound, allow all outbound	Default NACL allows all traffic both ways

Stateful vs stateless is the concept to internalize, not just memorize. A security group remembers connections: if it allows an inbound request, the response is allowed back out automatically. A network ACL (NACL) has no memory: inbound and outbound rules are checked independently, so allowing a request in does not allow the response out unless an outbound rule permits it.

The other high-yield discriminator is deny capability. Security groups cannot contain deny rules; they can only permit traffic, and everything not permitted is implicitly blocked. If a scenario requires explicitly blocking a specific IP address, a security group cannot do it and a network ACL can. Defense in depth uses both together: the NACL screens traffic at the subnet boundary, then the security group screens it again at the instance.

Note that these controls filter network traffic by IP, port, and protocol. Blocking malicious web requests by their content (SQL injection patterns, for instance) is a job for AWS WAF, a different layer entirely, covered in AWS Shield vs AWS WAF.

How the CLF-C02 exam tests this

• A scenario states that servers in a private subnet must download software updates from the internet but must never accept inbound connections from it. The answer is a NAT gateway. An internet gateway is the distractor, and it is wrong because it enables inbound access too.
• A scenario asks which firewall is stateful, works at the instance level, or supports only allow rules. The answer is the security group. Flip any of those attributes (stateless, subnet level, supports deny rules) and the answer becomes the network ACL.
• A scenario requires traffic between two VPCs, or between a VPC and an on-premises data center, to avoid the public internet. Two VPCs points to VPC peering; on-premises with dedicated consistent bandwidth points to Direct Connect; on-premises with quick encrypted setup points to Site-to-Site VPN.
• A scenario asks how instances in a VPC can reach Amazon S3 without traffic leaving the AWS network. The answer is a VPC endpoint.

Quick reference

• VPC: your isolated private network in AWS; spans one Region, all of its Availability Zones.
• Subnet: a slice of the VPC in exactly one Availability Zone; public if its route table points to an internet gateway.
• Internet gateway: two-way internet access for public subnets.
• NAT gateway: outbound-only internet access for private subnets.
• Security group: instance level, stateful, allow rules only.
• Network ACL: subnet level, stateless, allow and deny rules, evaluated in numbered order.
• VPC peering connects VPCs privately; VPN and Direct Connect connect on-premises networks; VPC endpoints reach AWS services privately.