AWS Networking & Security

VPC Architecture Overview

VPC Deep Dive

A VPC is a logically isolated section of the AWS cloud where you launch resources. You define its IP range using CIDR notation.

CIDR Blocks & Subnets

Public vs. Private Subnets

• Public subnet — Route table has a route to an Internet Gateway (IGW). Resources can have public IPs and be reached from the internet.
• Private subnet — No direct internet route. Resources can reach the internet outbound through a NAT Gateway (in a public subnet), but can't be reached from outside.

# Create a VPC
VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
  --query 'Vpc.VpcId' --output text)

# Create public subnet
PUB_SUBNET=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.1.0/24 --availability-zone us-east-1a \
  --query 'Subnet.SubnetId' --output text)

# Create private subnet
PRIV_SUBNET=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.2.0/24 --availability-zone us-east-1a \
  --query 'Subnet.SubnetId' --output text)

# Create and attach Internet Gateway
IGW_ID=$(aws ec2 create-internet-gateway \
  --query 'InternetGateway.InternetGatewayId' --output text)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW_ID \
  --vpc-id $VPC_ID

Security Groups vs. NACLs

Both filter network traffic, but they work differently:

# Create a security group for a web server
SG_ID=$(aws ec2 create-security-group \
  --group-name web-server-sg \
  --description "Allow HTTP/HTTPS from anywhere, SSH from my IP" \
  --vpc-id $VPC_ID \
  --query 'GroupId' --output text)

# Allow HTTPS from anywhere
aws ec2 authorize-security-group-ingress --group-id $SG_ID \
  --protocol tcp --port 443 --cidr 0.0.0.0/0

# Allow SSH from a specific IP only
aws ec2 authorize-security-group-ingress --group-id $SG_ID \
  --protocol tcp --port 22 --cidr 203.0.113.50/32

IAM Policies in Depth

IAM policies are JSON documents that define permissions. They follow the principle of least privilege — grant only the access needed.

Policy Structure

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-data-bucket",
        "arn:aws:s3:::my-data-bucket/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

Common IAM Patterns

Route 53 & CloudFront

Route 53 is AWS's DNS service. CloudFront is the CDN that caches content at 400+ edge locations worldwide.

Route 53 Routing Policies

• Simple — One record, one destination
• Weighted — Split traffic by percentage (A/B testing, blue-green deploys)
• Latency — Route to the Region with lowest latency for the user
• Failover — Primary/secondary with health checks
• Geolocation — Route based on user's country/continent

# Create a CloudFront distribution for an S3 static site
aws cloudfront create-distribution \
  --origin-domain-name my-bucket.s3.amazonaws.com \
  --default-root-object index.html

Interview Questions