Cohort 3 | Project CloudIgnite Topics: Amazon VPC, Subnets (Public/Private), Route Tables, Internet Gateway, NAT Gateway, VPC Peering, Transit Gateway, VPC Endpoints/PrivateLink, Site-to-Site VPN, Direct Connect, Security Groups vs Network ACLs, Bastion Hosts, VPC Flow Logs, Lab 180 (Build a VPC from Scratch), VPC Troubleshooting Lab Duration: ~3 hours Amazon VPC = a logically isolated virtual network in AWS; it is Region-scoped and can span all Availability Zones in that Region, while a subnet lives in exactly one AZ A VPC CIDR block must be between /16 and /28 using RFC 1918 private ranges (10.x, 172.16–31.x, 192.168.x); AWS reserves 5 IPs per subnet (network, VPC router, DNS, future, broadcast) Public subnet = route table has ; private subnet = no IGW route (uses NAT Gateway for outbound-only) NAT Gateway must live in a public subnet, requires an Elastic IP, and supports TCP/UDP/ICMP — deploy across multiple AZs for HA VPC Peering is NOT transitive — A↔B and B↔C does NOT connect A and C; switch to Transit Gateway when you have many VPCs Gateway VPC Endpoint = free private connection to S3 and DynamoDB only; Interface Endpoint (PrivateLink) = paid private connection to other AWS services Security Group vs NACL: SG is instance-level, stateful, allow-only; NACL is subnet-level, stateless, allow + deny, rules evaluated lowest-number-first (first match wins) A Bastion host is a public-subnet EC2 used as a secure jump box to reach private-subnet instances over SSH VPC Fundamentals IP Addressing & CIDR Blocks Core VPC Components Routing & Gateways VPC Connectivity Options Network Security: Security Groups vs. Network ACLs Bastion Hosts Troubleshooting Connectivity DNS Options in a VPC Lab 180 — Build a VPC from Scratch Lab — Troubleshooting a Broken VPC (Café Web Server) Glossary Checkpoint Q&A Recap CLF-C02 Exam Relevance Summary Action Items & Housekeeping Amazon VPC (Virtual Private Cloud) = a logically isolated section of the AWS Cloud where you launch AWS resources in a virtual network that you define. This is the single most important definition to remember. A VPC can span all Availability Zones (AZs) within a single Region. You can create multiple subnets, and subnets live inside a single AZ (a subnet does not span AZs). When you create an AWS account, AWS provisions a default VPC for you (with public/private subnets, an internet gateway, etc.). In labs we build our own custom ("lab") VPC instead of using the default. A VPC is Region-scoped and can span every Availability Zone; each subnet lives inside exactly one AZ. CLF-C02 Relevant (High): Knowing what a VPC is, that it is Region-scoped, spans AZs, and is logically isolated is a core Cloud Technology (Domain 3) concept. A VPC CIDR block must be between /16 and /28 (defined by RFC 1918 conventions). Use private IP ranges only: addresses starting with 10.x, 172.x, or 192.168.x. Example used in lab: → roughly 65,000 addresses. Formula: 2^(32 − CIDR prefix) total addresses. - → 2^16 ≈ 65,536 - → 2^8 = 256 (8 usable bits) - → 2^5 = 32 - → 2^4 = 16 - → a single fixed address (0 usable bits) AWS shows the usable count automatically when you type a CIDR, so manual math is optional. AWS reserves the first 4 and the last 1 address in every subnet — you cannot use them: Example: a (32 addresses) gives only 27 usable addresses after subtracting the 5 reserved. Warning: Subnet CIDRs cannot overlap within the same VPC. In the lab, reusing then trying produced an "overlap" error — the fix is to size subnets correctly (e.g., ) so ranges don't collide. CLF-C02 Relevant (Medium): You don't need to do binary subnetting on the exam, but understanding CIDR notation, private IP ranges, and that AWS reserves addresses per subnet is useful background for the networking domain. Public vs. private subnet (key distinction): Public subnet → its route table has a route to an Internet Gateway → direct internet access. Private subnet → no IGW route → no direct internet; reaches the internet only via a NAT Gateway. Public subnets route 0.0.0.0/0 to the Internet Gateway; private subnets reach the internet outbound-only, via a NAT Gateway that lives in the public subnet. CLF-C02 Relevant (High): Subnets, route tables, internet gateways, and the public/private subnet distinction are frequently tested. Attaches to a VPC; enables direct, two-way internet connectivity for public subnets. The public route table needs a route: destination → target = IGW. Never add an IGW route to a private route table. Lets private subnet instances initiate outbound internet connections (e.g., software updates) while staying unreachable from the internet. NAT Gateway = AWS-managed (recommended). NAT Instance = you manage it yourself. Must be launched in a public subnet. Requires an Elastic IP address. Supports TCP, UDP, and ICMP. Has limited built-in redundancy; deploy NAT Gateways in multiple AZs for high availability. Private route table route: destination → target = NAT Gateway. The AWS-side endpoint for a VPN connection — used to connect a VPC to an on-premises network/data center. The customer-side physical device or software application of the VPN connection. A Site-to-Site VPN links your on-prem Customer Gateway to the AWS-side Virtual Private Gateway over an encrypted tunnel; Direct Connect is the dedicated private-line alternative. CLF-C02 Relevant (High): Internet Gateway vs. NAT Gateway (and "NAT must live in a public subnet + needs an Elastic IP") is a classic exam point. Virtual Private Gateway / Customer Gateway appear in VPN questions. A one-to-one connection wiring two VPCs together so their instances can communicate privately. NOT transitive: if A↔B and B↔C are peered, A and C are NOT automatically connected — you must peer them manually. (Exam favorite) A peering request must be accepted/approved by the other side (like approving a Bluetooth pairing). Gets unwieldy at scale: 5 VPCs need ~20 peering connections; 10 VPCs need ~90. That's when you switch to a Transit Gateway. Peering is one-to-one; A peered to B and B peered to C does not connect A and C — you must peer them directly. A central hub to connect multiple VPCs (and on-premises networks) together — avoids the mesh of many peering connections. More setup/effort than peering; use it when you have many VPCs (5, 10, 15+). Direct peering grows into an unwieldy mesh as VPCs multiply; a Transit Gateway is a central hub so each VPC connects just once. Use VPN whenever traffic must be encrypted over the internet to on-premises. Direct Connect = dedicated private network link to AWS (can be paired with VPN for encryption). Gateway Endpoint: connects privately to only S3 and DynamoDB, and is free. Interface Endpoint (PrivateLink): connects privately to other AWS services, and is not free. CLF-C02 Relevant (High): The instructor explicitly flagged VPC Peering (non-transitive), Transit Gateway, VPN-for-encryption, and Gateway-Endpoint-is-S3/DynamoDB-only as "important for your exam." Traffic crosses the subnet's stateless NACL first, then the instance's stateful Security Group, before it reaches the EC2. Rules are processed by number, lowest first. A common rule #100 that allows all traffic; the implicit mermaid flowchart TD P["Inbound packet on port 22"] --> R40{"Rule #40:
DENY port 22?"} R40 -->|matches first| BLOCK["DENIED
(lower number wins)"] R40 -.->|if #40 were absent| R100{"Rule #100:
ALLOW all?"} R100 -->|matches| OK["Allowed"] R100 -.-> STAR["Rule : deny all
(implicit default)"] mermaid flowchart LR ADMIN["Admin / user"] -->|"SSH (port 22)"| BAS subgraph VPC["VPC"] subgraph PUB["Public subnet"] BAS["Bastion host
(public IP)"] end subgraph PRIV["Private subnet"] PRIVEC2["Private EC2
(no public IP)"] end end BAS -->|"SSH over internal network"| PRIVEC2 .pem.ppk10.0.0.0/16us-west-2a/24us-west-2a/240.0.0.0/00.0.0.0/010.0.0.0/xlab passwordping google.commermaid flowchart TB NET["Internet"] <--> IGW["Internet Gateway"] subgraph VPC["Lab VPC 10.0.0.0/16 (DNS hostnames ON)"] subgraph PUB["Public subnet us-west-2a /24"] BAS["Bastion host
(public IP, SG: SSH)"] NAT["NAT Gateway
+ Elastic IP"] end subgraph PRIV["Private subnet us-west-2a /24"] PEC2["Private EC2
(SG: SSH from VPC CIDR)"] end RTPUB["Public route table:
0.0.0.0/0 to IGW"] RTPRIV["Private route table:
0.0.0.0/0 to NAT"] end IGW --> BAS BAS -->|"1. EC2 Instance Connect then SSH"| PEC2 PEC2 -->|"2. ping google.com"| NAT NAT --> IGW aws configureus-west-2jsondescribe-vpcsdescribe-instancessudo yum install nmapdescribe-route-tablescreate-routetruedescribe-network-aclsdelete-network-acl-entryAWSLogs/.../vpcflowlogs/us-west-2/.../head grep REJECTwc -lmermaid flowchart TD subgraph C1["Challenge 1: website unreachable"] direction TB a1["nmap shows no ports open"] --> a2["SG looks OK (80 / 8080)"] a2 --> a3["Route table: NO IGW route"] a3 --> a4["Fix: add 0.0.0.0/0 to IGW
Website works"] end subgraph C2["Challenge 2: SSH blocked"] direction TB b1["Check Network ACL"] --> b2["Rule #40 DENY port 22
(before allow-all #100)"] b2 --> b3["Fix: delete rule #40
SSH works"] end 10.0.0.0/16/16/28` | Connect instances in a VPC to on-premises over the internet, encrypted — which solution? → Site-to-Site VPN (encryption ⇒ VPN). Difference between Interface Endpoint and Gateway Endpoint? → Gateway Endpoint supports only S3 and DynamoDB (and is free); Interface Endpoint connects to other services. Why is Transit Gateway preferred for connecting many VPCs/VPNs? → It avoids the large number of point-to-point peering connections required at scale. Four ways to secure resources inside a VPC? → Security Groups, NACLs, private subnets, Bastion host. Default security group inbound/outbound behavior? → Allows all outbound, no inbound by default; SGs are stateful (allowed inbound auto-allows the return traffic). [ ] Submit both labs before leaving (instructor repeated this multiple times). [ ] Re-do / complete unfinished labs on Saturday — at least one student couldn't finish the NAT/SSH lab and will continue then. [ ] Knowledge Check (KC): postponed — instructor will run it the next day. [ ] Review VPC connectivity terms for the exam: peering (non-transitive), Transit Gateway, VPN (encryption), Gateway endpoint (S3/DynamoDB only). [ ] Upcoming topic: Amazon Aurora (was delayed earlier due to AWS Canvas issues) and continued database content. [ ] Instructor aims to finish the curriculum quickly; will be available in July for topic reviews/questions. Notes compiled from the June 18, 2026 session transcript for post-lecture review — AWS re/Start, Cohort 3: Project CloudIgnite.

Week 6 — Security & IAM