AWS SA - Associate VPC

VPC

Your private isolated network in AWS. Full control over IP ranges, subnets, routing.

CIDR Block

Defines VPC IP range. Must be /16 to /28. Use private ranges only.

Default VPC

Auto-created. CIDR 172.31.0.0/16. Ready to use immediately.

Subnets

AZ-level IP ranges. Public = IGW route. Private = no IGW route.

AWS Reserved IPs

5 IPs reserved per subnet. Always subtract 5 from total.

Internet Gateway (IGW)

Allows internet access. Attach to VPC + route table + instance needs public IP.

NAT Gateway

Private subnet outbound internet only. Lives in public subnet. Uses Elastic IP.

Route Tables

Rules controlling where traffic goes. One per subnet. Longest prefix wins.

Security Groups

Stateful. Instance level. Allow rules only. Return traffic auto-allowed.

NACLs

Stateless. Subnet level. Allow and deny. Rules evaluated in order. First match wins.

Ephemeral Ports

1024-65535. Must explicitly allow in NACLs for return traffic.

NACL vs Security Group

NACL = subnet + stateless + deny. SG = instance + stateful + allow only.

VPC Peering

Direct VPC connection. Not transitive. No overlapping CIDRs. Update both route tables.

Transit Gateway

Hub and spoke. Connects VPCs + VPN + Direct Connect. Replaces peering meshes.

CloudHub

Hub and spoke VPN only. Connects multiple on-premises sites via VPN.

Transit Gateway vs CloudHub

TGW = VPCs + VPN + DX at scale. CloudHub = VPN sites only.

Site-to-Site VPN

IPSec encrypted tunnel over internet. VGW (AWS) + CGW (customer).

Client VPN

Individual user access. OpenVPN + TLS. Scales automatically.

Direct Connect

Private dedicated connection. NOT encrypted. Consistent performance.

VPN over Direct Connect

Best combo. DX = performance. VPN = encryption. Together = both.

Direct Connect Gateway

Connect multiple VPCs across regions via one DX connection. No VPC-to-VPC traffic.

Public VIF

Access public AWS services (S3, DynamoDB) over Direct Connect.

Private VIF

Access VPC resources (EC2, RDS) over Direct Connect.

Gateway Endpoint

Free. S3 and DynamoDB only. Uses route tables. No IGW needed.

Interface Endpoint

Costs money. Most AWS services. Creates ENI in subnet. Powered by PrivateLink.

PrivateLink

Private service sharing between VPCs. NLB + interface endpoint. Traffic never leaves AWS.

VPC Flow Logs

Captures traffic metadata. Not packet content. Troubleshooting/monitoring.

Traffic Mirroring

Copies actual packet content for deep inspection. Not Flow Logs.

Elastic IP

Static public IPv4. Doesn't change. Regional. Limit 5 per account.

Bastion Host

Jump server in public subnet to reach private instances. SSH/RDP.

Session Manager

Preferred EC2 access. No inbound ports. IAM controlled. Logs sessions.

Egress-only IGW

IPv6 outbound only. Like NAT Gateway but for IPv6.