backend / cloud aws / networking and content delivery / README.md

Amazon VPC

7 min read index source

Amazon VPC

Overview

Amazon Virtual Private Cloud (Amazon VPC) enables you to launch AWS resources into a virtual network that you’ve defined. This virtual network closely resembles a traditional network that you’d operate in your own data center, with the benefits of using AWS’s scalable infrastructure.

Key Features

  • Isolated Network Environment: Create private, isolated network spaces
  • Custom IP Address Ranges: Define your own IP address ranges
  • Subnet Configuration: Create public and private subnets
  • Route Tables: Control traffic flow between subnets
  • Security Groups: Stateful firewall for instances
  • Network ACLs: Stateless firewall for subnets
  • Internet Gateway: Connect to the internet
  • NAT Gateway: Private subnet internet access
  • VPC Peering: Connect VPCs together
  • VPN Connections: Connect to on-premises networks

Interview Topics

1. VPC Fundamentals

  • VPC Components: Subnets, route tables, internet gateway
  • IP Addressing: CIDR blocks, subnet ranges
  • Availability Zones: Multi-AZ deployment
  • VPC Limits: Maximum resources per VPC
  • Default VPC: Pre-configured VPC for new accounts

2. Subnet Configuration

  • Public Subnets: Direct internet access
  • Private Subnets: No direct internet access
  • Subnet Sizing: IP address range planning
  • Availability Zone Distribution: Multi-AZ redundancy
  • Subnet Types: Standard, dedicated, isolated

3. Routing and Connectivity

  • Route Tables: Control traffic flow
  • Internet Gateway: Public internet access
  • NAT Gateway: Private subnet internet access
  • VPC Endpoints: Private AWS service access
  • Transit Gateway: Multi-VPC connectivity

4. Security Features

  • Security Groups: Instance-level firewall
  • Network ACLs: Subnet-level firewall
  • VPC Flow Logs: Network traffic monitoring
  • Network Access Control: VPC endpoint policies
  • Encryption: Data in transit and at rest

5. Advanced Networking

  • VPC Peering: Connect VPCs
  • VPN Connections: Site-to-site VPN
  • Direct Connect: Dedicated network connection
  • Transit Gateway: Hub-and-spoke architecture
  • VPC Endpoints: Private service access

Common Interview Questions

Basic Questions

  1. What is Amazon VPC and why would you use it?

    • Isolated network environment in AWS
    • Control over network configuration
    • Security and compliance requirements
    • Multi-tier application architecture

  2. What are the main components of a VPC?

    • Subnets (public and private)
    • Route tables
    • Internet Gateway
    • NAT Gateway
    • Security Groups and Network ACLs

  3. How do you create a VPC?

    aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications ResourceType=vpc,Tags=[{Key=Name,Value=MyVPC}]

Advanced Questions

  1. How do you set up a VPC with public and private subnets?

    Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
  
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
  
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [1, !GetAZs '']
  
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  2. What is the difference between Security Groups and Network ACLs?

    • Security Groups: Stateful, instance-level, allow rules only
    • Network ACLs: Stateless, subnet-level, allow and deny rules
    • Security Groups: Applied to instances
    • Network ACLs: Applied to subnets

  3. How do you connect a VPC to the internet?

    • Create an Internet Gateway
    • Attach it to the VPC
    • Create a route table with route to 0.0.0.0/0
    • Associate route table with public subnets

Troubleshooting Questions

  1. What if instances in a private subnet can’t access the internet?

    • Check NAT Gateway configuration
    • Verify route table has route to NAT Gateway
    • Ensure NAT Gateway is in public subnet
    • Check security group rules

  2. How do you troubleshoot VPC connectivity issues?

    • Check route tables
    • Verify security group rules
    • Test network ACLs
    • Use VPC Flow Logs for monitoring

Best Practices

1. Network Design

  • Use appropriate CIDR blocks
  • Plan for future growth
  • Implement multi-AZ architecture
  • Use separate subnets for different tiers

2. Security

  • Implement least privilege access
  • Use security groups effectively
  • Configure network ACLs properly
  • Enable VPC Flow Logs

3. Performance

  • Choose appropriate instance types
  • Use placement groups for low latency
  • Optimize network configuration
  • Monitor network performance

4. Cost Optimization

  • Use appropriate NAT Gateway types
  • Optimize VPC endpoint usage
  • Monitor data transfer costs
  • Use reserved instances where possible

5. Monitoring

  • Enable VPC Flow Logs
  • Monitor network metrics
  • Set up CloudWatch alarms
  • Track resource usage

Use Cases

1. Multi-Tier Applications

  • Web tier in public subnets
  • Application tier in private subnets
  • Database tier in isolated subnets
  • Load balancer configuration

2. Hybrid Cloud

  • VPN connection to on-premises
  • Direct Connect for high bandwidth
  • Shared services architecture
  • Disaster recovery setup

3. Microservices Architecture

  • Service isolation
  • Inter-service communication
  • Load balancing
  • Service discovery

4. Compliance and Security

  • Network isolation
  • Data protection
  • Audit logging
  • Access control

Integration Patterns

1. Load Balancer Integration

  • Application Load Balancer
  • Network Load Balancer
  • Classic Load Balancer
  • Target group configuration

2. Database Integration

  • RDS in private subnets
  • Multi-AZ deployment
  • Read replicas
  • Backup and recovery

3. Container Integration

  • ECS/EKS in VPC
  • Container networking
  • Service mesh
  • Load balancing

4. Serverless Integration

  • Lambda in VPC
  • API Gateway integration
  • Event-driven architecture
  • Function networking

Security Considerations

1. Network Security

  • Implement proper segmentation
  • Use security groups effectively
  • Configure network ACLs
  • Enable flow logging

2. Access Control

  • Implement least privilege
  • Use IAM roles and policies
  • Configure VPC endpoints
  • Monitor access patterns

3. Data Protection

  • Encrypt data in transit
  • Use private subnets for sensitive data
  • Implement proper backup
  • Monitor data access

4. Compliance

  • Maintain audit trails
  • Implement logging
  • Ensure regulatory compliance
  • Regular security assessments

Cost Optimization

1. NAT Gateway Optimization

  • Use appropriate NAT Gateway types
  • Optimize data transfer
  • Monitor usage patterns
  • Consider NAT instances for cost savings

2. VPC Endpoint Optimization

  • Use VPC endpoints for AWS services
  • Optimize endpoint usage
  • Monitor endpoint costs
  • Choose appropriate endpoint types

3. Network Optimization

  • Optimize subnet sizing
  • Use appropriate instance types
  • Monitor network costs
  • Implement cost allocation tags

4. Resource Optimization

  • Use reserved instances
  • Optimize instance sizing
  • Monitor resource usage
  • Implement auto-scaling

Performance Optimization

1. Network Performance

  • Choose appropriate instance types
  • Use placement groups
  • Optimize network configuration
  • Monitor network metrics

2. Latency Optimization

  • Use appropriate AZs
  • Implement caching
  • Optimize routing
  • Monitor latency metrics

3. Throughput Optimization

  • Choose appropriate bandwidth
  • Use enhanced networking
  • Optimize application design
  • Monitor throughput metrics

4. Scalability

  • Design for horizontal scaling
  • Implement auto-scaling
  • Use load balancing
  • Monitor scaling patterns

Disaster Recovery

1. Multi-Region Deployment

  • Deploy across regions
  • Implement failover procedures
  • Use Route 53 for routing
  • Monitor regional health

2. Backup Strategies

  • Backup VPC configuration
  • Implement cross-region replication
  • Maintain backup procedures
  • Test recovery processes

3. Recovery Procedures

  • Document recovery procedures
  • Test failover scenarios
  • Maintain recovery documentation
  • Train recovery teams

4. Monitoring and Alerting

  • Monitor VPC health
  • Implement alerting
  • Track recovery metrics
  • Maintain operational procedures

Migration Strategies

1. From On-Premises

  • Plan network architecture
  • Configure VPN/Direct Connect
  • Migrate applications gradually
  • Test connectivity thoroughly

2. From Other Cloud Providers

  • Map network architecture
  • Configure equivalent VPC
  • Migrate applications
  • Validate functionality

3. Application Migration

  • Plan network requirements
  • Configure VPC components
  • Migrate applications
  • Test thoroughly

Common Pitfalls

1. Network Design Issues

  • Insufficient IP address space
  • Poor subnet planning
  • Inadequate security design
  • Scalability limitations

2. Security Problems

  • Overly permissive security groups
  • Misconfigured network ACLs
  • Inadequate monitoring
  • Poor access control

3. Performance Issues

  • Suboptimal network configuration
  • Inadequate bandwidth
  • Poor routing design
  • Insufficient monitoring

4. Cost Management

  • Over-provisioned resources
  • Inefficient NAT Gateway usage
  • High data transfer costs
  • Poor resource optimization

Resources

Interview angle

  • “Sketch a production VPC.” - public subnets holding only the load balancer and NAT, private subnets for compute, isolated subnets for databases, across at least two Availability Zones. Nothing with data in it sits in a public subnet.
  • “Security group or NACL?” - security groups are stateful, attach to resources, allow-only, and are what you use day to day. NACLs are stateless, attach to subnets, support deny, and exist for coarse subnet-level blocks. Forgetting NACLs are stateless - so the return traffic needs its own rule - is the classic debugging trap.
  • “How do you reach AWS services privately?” - VPC endpoints. A gateway endpoint for S3 and DynamoDB is free and removes that traffic from the NAT Gateway; interface endpoints cover most other services at an hourly plus data cost. This is a security answer and a cost answer at the same time.
  • “Why is my NAT Gateway bill so large?” - everything leaving a private subnet to the internet, including traffic to S3 without a gateway endpoint, plus container image pulls. Per-GB processing charges add up fast.
  • “What is the cross-AZ cost trap?” - traffic between Availability Zones is billed in both directions. A chatty service accidentally spread across AZs, or a database replica read from the wrong zone, shows up as unexplained data-transfer spend.