Start with the request path
Imagine a public website and a database that should remain internal. I would draw the requests between them before creating subnets. Every connection should have a purpose, which gives each route and access rule a reason to exist.
Plan addressing and locations
A subnet belongs to one Availability Zone. Consider the wider network when choosing address ranges, especially if other networks may connect later. Overlap can make future connectivity harder to design and troubleshoot.
Explain every gateway
For each connection, identify source, destination, route and access rules. A VPC does not automatically supply every internet or private service connection. Test one path at a time and record why each gateway or endpoint is required.
Try it yourself
Draw a small application network and annotate public entry, internal traffic and service access. Explain the boundary between each.
A common question
Does a VPC give every instance internet access?
No. Connectivity depends on addressing, routing, gateways and access controls, along with the resource configuration.
References & video notes
Use the video to follow the topic with me. Console screens and older offers can change, so check the current AWS documentation before performing a lab.
Keep learning
- Public and private IP addresses in AWS
- EC2 security groups: allow the right connections
- Elastic IP addresses: when a stable public address helps