AWS VPC and Networking In Depth

Understand the difference between public and private subnets at the routing level, not just the name. We'll cover the design rules that guide placement of each resource type.

Learn how to spread subnets across Availability Zones for fault tolerance. Includes a reference architecture for a typical three-tier, two-AZ layout.

Step-by-step guide to creating and attaching an Internet Gateway, then wiring it into route tables so public subnets can reach the internet.

Understand route table evaluation, longest-prefix matching, and how to associate route tables with specific subnets. Covers common misconfigurations.

Set up a NAT Gateway in a public subnet and configure routing so private subnets can download updates and call external APIs without being exposed.

Compare NAT Gateways to NAT Instances. Learn when a NAT Instance saves cost and how to deploy one with proper failover scripts.

Understand Elastic IP lifecycle, billing rules for unattached addresses, and how they interact with NAT Gateways and EC2 instances.

Full lab where you create a VPC spanning two Availability Zones, configure four subnets, attach an Internet Gateway, and set up route tables correctly.

Launch EC2 instances into public and private subnets. Test SSH access, ping external hosts, and confirm private instances cannot be reached from the internet.

Add a NAT Gateway to your architecture and verify that private subnet instances can reach external services for package updates and API calls.

Deep dive into how Security Groups evaluate traffic. Understand stateful behavior, implicit deny, and how multiple Security Groups stack on a single resource.

Learn how NACLs process rules in order, why you must define both inbound and outbound allow rules, and how numbered rules affect evaluation.

Problem-solving session comparing both tools side by side. Includes a decision framework for when to use Security Groups, NACLs, or both together.

Learn practical patterns for structuring rules: least-privilege defaults, port-based grouping, and how to reference other Security Groups as sources.

Enable Flow Logs at the VPC, subnet, or ENI level. Send them to CloudWatch Logs or S3 and understand the fields in each log record.

Run queries against Flow Log data to find rejected connections, unusual traffic patterns, and misconfigured rules. Includes common query templates.

Set up a hardened bastion host in a public subnet to SSH into private instances. Covers key-based auth, session manager as an alternative, and access logging.

Write IAM policies that control who can create, modify, or delete VPC resources. Includes example policies for networking admins, developers, and auditors.

Full lab applying Security Groups at the instance level and NACLs at the subnet level, then enabling Flow Logs and querying them in CloudWatch to verify the rules work.

Create a VPC peering connection between two VPCs in the same region. Configure route tables in both VPCs and verify connectivity with ping and curl.

Extend peering across AWS Regions. Learn about DNS resolution settings, non-overlapping CIDR requirements, and transitive routing limitations.

Understand when PrivateLink is a better choice than peering, especially for accessing services across accounts or organizations without exposing network paths.

Create Gateway Endpoints for S3 and DynamoDB. Learn how they add route table entries and keep traffic on the AWS backbone at no extra cost.

Deploy Interface Endpoints (PrivateLink-powered) for services like SQS, SNS, and CloudWatch. Covers DNS configuration and security group attachment.

Walk through Direct Connect architecture, virtual interfaces (public and private), and how it reduces latency and data transfer costs for hybrid setups.

Set up a VPN connection between a simulated on-premises network and your VPC. Covers Customer Gateway, Virtual Private Gateway, and tunnel configuration.

Learn how Transit Gateway simplifies routing between many VPCs and on-premises networks. Covers route tables, attachments, and route propagation.

Deploy a Client VPN endpoint so individual users can connect to VPC resources securely. Covers authentication options and split-tunnel vs. full-tunnel.

Lab creating peering between two VPCs, updating route tables, enabling DNS resolution, and testing connectivity between EC2 instances in each VPC.

Configure Gateway Endpoints, attach them to route tables, set endpoint policies, and test S3 access from a private subnet with no NAT Gateway.

Build a Transit Gateway, attach three VPCs, configure route propagation, and verify full mesh connectivity. Includes a troubleshooting checklist.

Understand how to design networks that span multiple AWS accounts. Use AWS Organizations for structure and RAM to share networking resources.

Step-by-step guide to sharing subnets from a central networking account. Covers ownership, permissions, and how shared subnets appear in member accounts.

Design route tables for complex architectures: asymmetric routing, service insertion points, and routing traffic through inspection VPCs.

Configure egress-only Internet Gateways so IPv6-enabled instances can initiate outbound connections but cannot be reached from the internet.

Learn how ALBs interact with subnets, security groups, and target groups. Covers multi-AZ placement, internal vs. internet-facing, and health check routing.

Deploy NLBs for TCP/UDP traffic. Compare with ALBs, understand static IP behavior, and configure cross-zone load balancing.

Design patterns for resilient VPC architectures: multi-AZ redundancy, failover routing, and avoiding single points of failure in networking components.

Write a CloudFormation template that builds a complete VPC with subnets, route tables, gateways, and security groups. Covers parameterization and stack updates.

Create the same VPC architecture using Terraform. Covers modules, state management, and how Terraform handles resource dependencies for networking.

Use AWS Reachability Analyzer to trace paths between a source and destination. Learn to read the analysis results and identify blocking components.

Run Network Access Analyzer to find unintended network access in your VPC. Covers common misconfigurations like overly permissive NACLs and missing routes.

Full lab using CloudFormation or Terraform to deploy a multi-AZ VPC with public and private subnets, NAT Gateways, ALB, security groups, and VPC endpoints.

Work through a series of broken VPC configurations. Use Reachability Analyzer, Flow Logs, and route table inspection to diagnose and fix each issue.