AWS VPC

Amazon VPC is the networking boundary for most AWS architectures. It gives you a private, logical network where you choose IP ranges, segment workloads into subnets, and control how traffic enters, leaves, and moves internally. For DevOps work, VPC knowledge matters because compute, databases, load balancers, and private service endpoints all depend on network design.

The first major split inside a VPC is usually public versus private subnets. A public subnet has a route to an Internet Gateway, which allows resources such as load balancers or bastion hosts to receive or send internet traffic directly. A private subnet does not expose instances directly to the internet. Instead, private workloads may reach external services through a NAT Gateway while remaining unreachable from inbound internet traffic.

Route tables are the traffic map. Every subnet is associated with a route table, and that table contains a default local route for traffic within the VPC. Public route tables often add 0.0.0.0/0 to the Internet Gateway. Private route tables often send 0.0.0.0/0 to a NAT Gateway. Small changes here can completely alter reachability, which is why networking mistakes are common when teams learn AWS.

Network isolation is not about making everything private for its own sake. It is about exposing only the parts of the system that must be reachable. A common pattern is public load balancers, private application servers, and private databases. That structure narrows attack surface while still allowing updates, package downloads, and outbound API calls.

Continue with AWS VPC Subnets, AWS VPC Route Tables, and AWS VPC NAT Gateway.

aws ec2 describe-vpcs --output table
aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-1234567890abcdef0 --output table
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-1234567890abcdef0 --output table

Operational note

When network troubleshooting gets confusing, reduce the problem to layers: subnet placement, route table association, security group rules, and the presence of the correct gateway or endpoint. AWS networking becomes much easier to reason about when you verify those four items in order instead of changing everything at once. Shared standards like this make future environments easier to launch, review, and support.