Building blocks:
- VPC — isolated network in a region (e.g., 10.0.0.0/16)
- Subnet — partition of the VPC, tied to a single AZ (e.g., 10.0.1.0/24 in eu-west-2a)
- Route table — controls traffic flow within a VPC and to external destinations
- Internet Gateway (IGW) — allows public internet traffic in and out
- NAT Gateway — allows private subnets to reach the internet outbound (no inbound)
- VPC Endpoint — private connection to AWS services without internet (S3, DynamoDB use Gateway endpoints; everything else uses Interface endpoints)
Public vs private subnet — the canonical definition:
- Public subnet = has a route in its route table to an Internet Gateway. Instances with public IPs in this subnet are reachable from the internet.
- Private subnet = no route to an IGW. Instances can only access the internet via a NAT Gateway (outbound only) or VPC endpoints.