AWS Networking Basics

Every AWS account gets a default VPC (Virtual Private Cloud) — your own private network inside AWS.

The Lego bricks

VPC   10.0.0.0/16   ("the neighbourhood")
├── Public Subnet   10.0.1.0/24  (facing internet)
│     └── EC2 instances that need public IPs
├── Private Subnet  10.0.2.0/24  (behind a NAT)
│     └── Databases, internal APIs
├── Internet Gateway   (door to the internet)
└── NAT Gateway        (private subnet → internet, one-way)

Security Groups vs NACLs

	Security Group	Network ACL
Attaches to	Instance	Subnet
Rules	Allow-only (implicit deny)	Allow + Deny
State	Stateful (return traffic auto)	Stateless
Beginner advice	Use this 99% of the time	Only if you need extra layer

A public subnet in plain YAML (CloudFormation)

Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties: { CidrBlock: 10.0.0.0/16 }
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true

Real-world tip

You almost never expose databases to the internet — put them in a private subnet and connect through the app tier. This alone prevents 90% of accidental data leaks.