Your Private Network in the Cloud (AWS VPC)

Security in layers

Security groups vs network ACLs – and other clouds

Use both: security groups for precise per-resource rules, NACLs for broad subnet-wide guard rails.

Worked examples

Address plan, Terraform and CLI

The campus-jobs network from the animated sessions, as a real design you can deploy.

Example 1 – IP address plan

VPC campus-jobs            10.0.0.0/16    65,536 addresses
├─ public-a   us-east-1a   10.0.1.0/24    load balancer, NAT gateway A
├─ public-b   us-east-1b   10.0.2.0/24    load balancer, NAT gateway B
├─ private-a  us-east-1a   10.0.3.0/24    app servers / EKS nodes
├─ private-b  us-east-1b   10.0.4.0/24    app servers / EKS nodes
├─ data-a     us-east-1a   10.0.5.0/24    RDS primary
└─ data-b     us-east-1b   10.0.6.0/24    RDS standby
Each /24 = 256 addresses; AWS reserves 5 per subnet → 251 usable.
Room to grow: 10.0.7.0 – 10.0.255.255 is still free.

Example 2 – The whole VPC as code (open-source Terraform AWS VPC module; works with OpenTofu)

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "campus-jobs"
  cidr = "10.0.0.0/16"

  azs              = ["us-east-1a", "us-east-1b"]
  public_subnets   = ["10.0.1.0/24", "10.0.2.0/24"]
  private_subnets  = ["10.0.3.0/24", "10.0.4.0/24"]
  database_subnets = ["10.0.5.0/24", "10.0.6.0/24"]

  enable_nat_gateway     = true
  one_nat_gateway_per_az = true   # survives the loss of one zone
  enable_dns_hostnames   = true

  enable_flow_log                      = true
  create_flow_log_cloudwatch_log_group = true
  create_flow_log_cloudwatch_iam_role  = true
}

Example 3 – Security groups chained tier by tier

resource "aws_security_group" "alb" {
  name   = "alb-sg"
  vpc_id = module.vpc.vpc_id
  ingress {
    description = "HTTPS from the internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "app" {
  name   = "app-sg"
  vpc_id = module.vpc.vpc_id
  ingress {
    description     = "App port, only from the load balancer"
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "db" {
  name   = "db-sg"
  vpc_id = module.vpc.vpc_id
  ingress {
    description     = "PostgreSQL, only from the app servers"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.app.id]
  }
}

Example 4 – Inspect the network with the AWS CLI

aws ec2 describe-vpcs --filters Name=tag:Name,Values=campus-jobs
aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-0abc123 \
  --query "Subnets[].[CidrBlock,AvailabilityZone,MapPublicIpOnLaunch]" --output table
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-0abc123 \
  --query "RouteTables[].Routes[]" --output table
aws ssm start-session --target i-0abc123def4567890   # shell access with no open ports

Further learning

Free official documentation & open-source references

Primary sources and free hands-on resources to go deeper.

• What is Amazon VPC? – official AWS VPC user guide
• Security groups – AWS documentation
• Network ACLs – AWS documentation
• NAT gateways – AWS documentation
• Route tables – AWS documentation
• VPC Flow Logs – AWS documentation
• AWS Site-to-Site VPN – AWS documentation
• Gateway endpoints for Amazon S3 – AWS documentation
• AWS Systems Manager Session Manager – AWS documentation
• Terraform AWS VPC module (GitHub) – open-source module used in Example 2
• OpenTofu – open-source infrastructure-as-code tool compatible with Terraform
• cidr.xyz – free, open-source visual CIDR calculator
• Azure Virtual Network overview – Microsoft documentation
• Google Cloud VPC overview – Google Cloud documentation