Core AWS Services Networking

In this article, we dive into AWS networking and explain how Virtual Private Clouds (VPCs), subnets, gateways, and related components work together to create a secure and isolated cloud infrastructure. Understanding these elements is crucial for designing scalable and reliable AWS architectures.

When you deploy applications on AWS, your workloads run on shared infrastructure. However, AWS ensures that each customer's resources remain secure and isolated. AWS provides each customer with a dedicated, isolated "mini private cloud" called a Virtual Private Cloud (VPC). This built-in isolation prevents unauthorized access between different customers' applications, ensuring a strong security posture.

Virtual Private Cloud (VPC)

A VPC is a logical, isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. It gives you complete control over your networking environment, allowing you to:

• Configure subnets, IP ranges, routing tables, network access control lists (NACLs)
• Define security groups for controlling traffic at the instance level
• Manage gateways to regulate traffic between your VPC and the internet

Each AWS account can have multiple VPCs. You can design your network architecture to include separate VPCs for development, staging, and production environments, or to assign different VPCs for various applications or teams.

VPCs and AWS Regions

VPCs are region-specific. When creating a VPC, you must choose a region (e.g., US East 1, US East 2, Australia) where your VPC and its resources will be deployed. This regional limitation means that resources within a VPC are confined to that specific region.

By default, a VPC serves as its own network boundary. Although inter-VPC communication can be configured if necessary, isolation is the default behavior to enhance security.

Subnets

Subnets are subdivisions of a VPC's IP address range (CIDR block), providing more granular control over where resources reside. When you create subnets, each is associated with a single Availability Zone. For example, consider the following subnets:

• Subnet 1: IP range 172.16.0.0/24
• Subnet 2: IP range 172.16.1.0/24

When you launch an EC2 instance or any AWS resource, it is deployed into a specific subnet and receives an IP address from that subnet's range.

Subnets can be classified as either public or private:

• Public Subnet: Directly exposed to the internet via an attached Internet Gateway. Ideal for web servers.
• Private Subnet: Not directly accessible from the internet, making it suitable for databases and internal resources.

Hybrid Deployments and CIDR Blocks

For hybrid deployments, you can extend your on-premises data center to AWS using VPN connections. When creating a VPC, you must define a CIDR block—a range of IP addresses available to your VPC. For example, specifying a CIDR block of 192.168.0.0/16 allocates addresses from 192.168.0.0 to 192.168.255.255.

CIDR = 192.168.0.0/16
192.168.0.0 - 192.168.255.255

Resources launched within a VPC must receive an IP address within this range. Additionally, any subnets you create must have CIDR ranges that fall within the VPC's block. AWS supports valid block sizes ranging from /16 to /28. For instance, 192.168.10.0/24 is valid within 192.168.0.0/16, while a block like 10.100.1.0/24 would be rejected.

Internet Connectivity for Subnets

By default, subnets are private and not accessible from the internet. To enable internet connectivity, you need to associate your subnet with an Internet Gateway. The Internet Gateway is attached to the VPC and allows bi-directional traffic between the internet and public subnets.

For scenarios where you need outbound internet access without exposing your resources to unsolicited inbound traffic, you can use a NAT (Network Address Translation) gateway. A NAT gateway enables resources in a private subnet to initiate outbound requests to the internet while blocking incoming connections that were not initiated internally. The NAT gateway is deployed within a public subnet and works in concert with the Internet Gateway.

When a resource in a private subnet requires internet access, it sends the request to the NAT gateway, which then forwards it to the Internet Gateway. The response follows the reverse path back to the originating resource.

Secure Connectivity to Private Resources

Managing or monitoring resources in a private subnet requires secure connectivity. To achieve this, AWS offers VPN gateways (also known as Virtual Private Gateways). These gateways establish an encrypted VPN connection over the internet, enabling secure access to private resources.

Alternatively, AWS Direct Connect provides a dedicated, high-speed connection between your on-premises network and AWS at a designated Direct Connect location. This option offers lower latency and enhanced security compared to traditional internet connectivity.

Summary

To recap, here are the essential points covered in this article:

• A Virtual Private Cloud (VPC) offers a secure, isolated networking environment in AWS where you can control IP addressing, subnets, and traffic flow.
• Each VPC is linked to a single region and is defined by a CIDR block, with subnets carved out of that block.
• Subnets are designated as public (with direct internet access via an Internet Gateway) or private (requiring a NAT gateway for internet access).
• Secure connectivity to private resources is enabled through VPN gateways or AWS Direct Connect.

This comprehensive overview provides the foundational knowledge required for designing secure, scalable, and high-performing AWS cloud architectures. Explore more about AWS networking and best practices in our related guides and documentation.