The Secret Life of AWS: The Walled Garden

#aws#cloudcomputing#EC2#VPC

Understanding subnets, gateways, and why your database belongs in the private zone

Part 5 of The Secret Life of AWS

Timothy sat at the large oak table in the West Wing, staring at a diagram of a maze. He looked frustrated.

"I have my servers (EC2)," he said, tallying on his fingers. "I have my storage (S3). But I don't understand how they talk to each other. Or how I keep them safe."

Margaret walked over carrying a fresh pot of tea. She poured a cup for Timothy and set it down gently.

"You are missing the foundation, Timothy," she said softly. "You have built the furniture, but you have not built the room. Today, we discuss the VPC."

She walked to the chalkboard and wiped it clean.

The VPC (Your Private Network)

Margaret drew a large, solid rectangle on the board.

"The VPC stands for Virtual Private Cloud," she began. "Think of it as your own private slice of the AWS network. It is logically isolated from every other customer."

She tapped the rectangle. "Inside this box, you set the rules. You decide which IP addresses to use. You decide who can come in and who can go out. It is your sanctuary."

"So if I don't put my server in a VPC..." Timothy started.

"You cannot," Margaret corrected gently. "Every EC2 instance must live inside a VPC. AWS gives you a 'Default VPC' to start with, which is fine for learning—like moving into a furnished apartment. But for any real application, we build our own custom VPC. We design our own house."

CIDR Blocks (The Address Space)

"Now," Margaret continued, "we need to give this network a set of addresses. We call this the CIDR Block."

She wrote 10.0.0.0/16 inside the box.

"This notation defines the range of IP addresses available for your resources. The /16 tells us that we have roughly 65,000 internal IP addresses to use."

Timothy frowned at the numbers. "That seems like a lot."

"It is better to have too many than too few," Margaret smiled. "These are Private IPs. They only work inside this rectangle. The outside world cannot route to them directly. That is your first layer of safety."

Subnets (The Rooms)

Margaret drew a line down the center of the rectangle, splitting it into two smaller boxes.

"We never dump all our resources into one big pile," she explained. "We organize them into Subnets."

She labeled the left box Public Subnet and the right box Private Subnet.

"This is the most important architectural pattern you will learn," she said, underlining the words.

1. Public Subnet: "This is for resources that must talk to the internet directly. Like your Web Server."
2. Private Subnet: "This is for resources that should never be touched by the outside world. Like your Database."

"So my database hides in the back?" Timothy asked.

"Ideally, yes. We want the database to be accessible only by your web server, never by a stranger on the internet."

Route Tables & Gateways (The Plumbing)

"But Margaret," Timothy asked, "if the database is hidden in the Private Subnet, how does it get software updates? It has no connection to the internet."

"That is where the plumbing comes in," Margaret said. She started drawing lines connecting the boxes.

1. The Internet Gateway (IGW)
She drew a door on the edge of the Public Subnet leading to the outside.
"For the Public Subnet, we attach an Internet Gateway. This is the front door. It allows traffic to flow in and out freely."

2. The NAT Gateway
She drew a small box inside the Public Subnet.
"For the Private Subnet, we cannot use the front door. Instead, we use a NAT Gateway."

"NAT stands for Network Address Translation," she explained. "Think of it as a proxy. Your database sends a request to the NAT Gateway. The NAT Gateway goes out to the internet, gets the update, and brings it back to the database. The internet sees the NAT Gateway, but it never sees the database."

"It is a one-way street," Timothy realized. "The database can reach out, but the internet cannot reach in."

"Precisely," Margaret beamed. "It is elegant, is it not?"

Defense in Depth (NACLs vs Security Groups)

Timothy looked at the diagram. "So the Subnet is safe. Does that mean I don't need the Security Groups we talked about before?"

"Heavens no," Margaret said quickly. "We use both. We call it Defense in Depth."

• Network ACLs (NACLs): "These are the guards at the entrance to the Subnet (the Room). They check traffic before it even enters the area."
• Security Groups: "These are the bouncers standing right next to the Instance (the Desk). They are the final check."

"If the Guard misses something," Timothy said, "the Bouncer catches it."

"Exactly."

The Cost of Privacy

Margaret set down the chalk and picked up her tea.

"However, there is one detail I must warn you about. The NAT Gateway."

"Is it expensive?" Timothy asked, sensing the tone.

"It is not free," Margaret said. "Unlike the Internet Gateway, which is just a logical door, the NAT Gateway is a managed resource. You pay an hourly charge for it to exist, and you pay for the data that passes through it."

She looked at him kindly. "Many new engineers spin up a NAT Gateway in a test account and forget about it. Then they are surprised by the bill. If you are just practicing, Timothy, remember to delete it when you are done."

The Lesson

Timothy looked at the board. The empty box was now a structured system: A CIDR block defining the space, Subnets dividing the purpose, and Gateways managing the flow.

"It feels much safer," Timothy said. "Putting the database in the private subnet... it feels like locking it in a safe."

"That is exactly what it is," Margaret agreed. "The Cloud is powerful, Timothy, but it is shared. The VPC is how we carve out our own quiet corner of it."

She patted him on the shoulder. "Finish your tea. Tomorrow, we will talk about what happens when you need to grow that network to the other side of the world."

---

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.