AWS VPC and Networking
The security group against network ACL table is the single most tested comparison in AWS networking, because the stateful and stateless difference explains most blocked-traffic scenarios.
AWS VPC and Networking · firsttry.app/cheatsheets/aws-vpc-networking · original reference written from published exam objectives. Not affiliated with any certification body.
Security groups against network ACLs
| Property | Security group | Network ACL |
|---|---|---|
| Applies to | Instance or ENI | Subnet |
| State | Stateful. Return traffic allowed automatically | Stateless. Return traffic needs its own rule |
| Rules | Allow only | Allow and deny |
| Evaluation | All rules evaluated, any allow wins | In rule number order, first match wins |
| Default inbound | Deny everything | Default ACL allows everything |
| Common mistake | Forgetting the security group on the target | Blocking ephemeral return ports 1024 to 65535 |
VPC components
| Component | What it does |
|---|---|
| VPC | An isolated network in one region. CIDR /16 to /28 |
| Subnet | A range in one availability zone. AWS reserves five addresses |
| Public subnet | Has a route to an internet gateway |
| Private subnet | No route to an internet gateway |
| Internet gateway | Two-way internet access for the VPC |
| NAT gateway | Outbound only, for private subnets. Managed, per-AZ |
| Egress-only internet gateway | The IPv6 equivalent of a NAT gateway |
| Route table | Where traffic goes. One per subnet association |
| VPC endpoint (gateway) | Private access to S3 and DynamoDB, free |
| VPC endpoint (interface) | Private access to most other services, via PrivateLink |
Connecting outside the VPC
| Requirement | Option |
|---|---|
| Connect two VPCs | VPC peering. Non-transitive, no overlapping CIDRs |
| Connect many VPCs and on-premises | Transit Gateway |
| On-premises over the internet | Site-to-site VPN |
| On-premises, private and consistent | Direct Connect |
| Expose a service to another account privately | PrivateLink |
| Global DNS routing | Route 53 with a routing policy |
Route 53 routing policies
| Policy | Chooses by |
|---|---|
| Simple | One record, no logic |
| Weighted | A proportion you set |
| Latency | Lowest latency to the client |
| Failover | Primary while healthy, else secondary |
| Geolocation | Where the query came from |
| Geoproximity | Distance, with a bias you can adjust |
| Multivalue answer | Several healthy records at random |
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.