Amazon VPC Components
Amazon VPC Components are the individual networking building blocks that make up an Amazon VPC on Amazon Web Services, covering how traffic enters, exits, and moves between subnets, and how it is filtered, shared, and logged. Several of the connectivity pieces here, such as endpoints, are provided through AWS PrivateLink.
Key points
- Subnets — a range of IP addresses within a VPC; a subnet must reside in a single Availability Zone, and AWS resources are deployed into subnets after they are created.
- Route Tables — each subnet in a VPC must be associated with a route table that directs inbound and outbound traffic for the subnet’s resources; a local route in the route table enables communication between VPC subnets.
- Internet Gateway — a VPC component whose purpose is to allow communication between the VPC and the Internet.
- NAT Gateway — placed inside a public subnet, it allows instances in a private subnet to have outbound internet access (for example, downloading patches and updates) while preventing inbound connections initiated from the internet; a route from the private subnet to the NAT gateway must be configured.
- Bastion Hosts — EC2 instances deployed in a public subnet of a VPC that allow access to EC2 instances deployed within a private subnet, typically reachable via inbound SSH or RDP requests from approved public IP addresses but unable to send outbound requests themselves.
- Security Groups — control incoming and outgoing traffic for an EC2 instance based on port and protocol type; stateful, evaluated at the instance level; support ALLOW rules only — there is no explicit DENY rule, so traffic not explicitly allowed is implicitly denied.
- Network ACLs (NACLs) — a stateless VPC firewall at the subnet level; responses to allowed inbound traffic are subject to the rules for outbound traffic and vice versa; rules are numbered and evaluated in order starting from the lowest number, and the first rule that matches is applied — a rule can explicitly ALLOW or explicitly DENY traffic.
- VPC Peering — connects two separate VPCs, in the same region or different regions, as a one-to-one connection; cannot be established between VPCs with overlapping IP address ranges; the connection routes traffic privately over AWS infrastructure rather than through a Direct Connect co-location or a VPN, offering high availability and avoiding a bandwidth bottleneck. Distinct from AWS Transit Gateway, which connects many VPCs and on-premises networks through a central hub rather than one-to-one connections.
- VPC Endpoints — Interface Endpoints, provided via AWS PrivateLink, serve as an entry point for traffic destined to an AWS service or a VPC endpoint service; Gateway Endpoints are entries in a route table that route traffic only to Amazon S3 and DynamoDB, and do not use PrivateLink. AWS has since added further endpoint types built on PrivateLink: Gateway Load Balancer endpoints send traffic to a fleet of virtual appliances for inspection, and Resource endpoints and Service network endpoints (backed by VPC Lattice) give private access to an individually shared resource or to a whole service network.
- VPC Flow Logs — provide log information on the inbound and outbound traffic of the network interfaces in a VPC.
- Customer Gateway — the on-premises side of a Site-to-Site VPN connection; must be configured correctly to establish the VPN connection successfully.
- Virtual Private Gateway — the AWS side of a VPN connection, paired with a customer gateway to form the secure tunnel between an on-premises network and AWS.