VPCs, subnets, traffic controls and private connectivity

One line in a route table decides public from private

A VPC is your own network inside a Region, cut into subnets that each live in one Availability Zone. The entire public-versus-private distinction comes down to a single entry: a subnet is PUBLIC if its route table sends 0.0.0.0/0 to an internet gateway, and private if it does not. Nothing else about the subnet makes it one or the other, which is why "attach an internet gateway and route the private subnets to it" is a contradiction in terms rather than a design.

A route table chooses a next hop by DESTINATION address, and that is worth stating because a question will offer a route as a way to block an attacker. There is no source-based routing here, so you cannot route one client away; the tool that expresses "everyone except this address" belongs to the firewalls below.

The guest list and the blacklist

A security group is attached to an instance's network interface, contains allow rules only, and is stateful: traffic you permitted in is permitted back out without a matching rule. Every rule is evaluated together and anything not allowed is denied by default. That last property is the most common misconception on this objective in either direction — there is no deny rule to add, so you cannot subtract one address from a rule that allows the world.

A network ACL sits on the SUBNET, is stateless, and holds both allow and deny rules evaluated in number order until one matches. It is therefore the only one of the two that can express "keep the site public but refuse this one address", and it applies to everything in the subnet at once. Removing the rule that allows port 443 from the world would also work, in the sense that it stops the attacker and every genuine visitor together. For a flood at real scale the purpose-built tools are AWS WAF and AWS Shield.

Getting out, and staying on the AWS network

Instances in a private subnet that must fetch operating system patches need a way out that is not also a way in, and that is a NAT gateway: it translates connections the private instances START and returns the replies, while offering nothing an outside party can connect to. It lives in a public subnet, is scoped to one Availability Zone — so a resilient design has one per zone — and is billed per hour plus per gigabyte processed. Giving each server a public address instead satisfies the outbound half of the requirement and breaks the inbound half completely.

VPC endpoints give private access to AWS services without an internet gateway, a NAT gateway or a public address, and there are two kinds whose difference shows up on the bill. GATEWAY endpoints exist for Amazon S3 and DynamoDB, are entries in a route table, and carry no charge — which is why several terabytes a month of S3 traffic currently leaving through a NAT gateway is both a security answer and a cost answer. INTERFACE endpoints, powered by AWS PrivateLink, put a network interface with a private address in your subnet for most other services and are billed per hour and per gigabyte.

Reaching a VPC from your own building

A stem that mentions terabytes a day, performance that must not vary, traffic that never touches the public internet, and an accepted lead time of several weeks is describing AWS Direct Connect in four separate clauses. A stem that wants encryption, cheaply, this afternoon is describing an AWS Site-to-Site VPN. A common production arrangement is both, with the VPN standing by as the backup for the dedicated circuit.

Two neighbours are offered against these and neither reaches outside AWS. VPC peering connects one VPC to another, including across accounts and Regions, and has no concept of a data centre. AWS Transit Gateway is a hub that simplifies connecting many VPCs and on-premises links together, and it still needs a Direct Connect or a VPN underneath it to reach the building at all.

DNS is a layer above the load balancer

Amazon Route 53 is the authoritative DNS service, and it answers one question: which address does this name resolve to. Its routing policies — simple, weighted, latency-based, failover, geolocation, geoproximity and multivalue — are how you express a global answer, and its health checks are what stop it handing out an endpoint that has stopped responding. It also registers domains.

Elastic Load Balancing answers a different question one level down: which of my healthy targets gets this request, inside one Region. Sending visitors to whichever of two Regional deployments answers them fastest therefore takes BOTH — a latency-based policy with health checks to choose the Region, and a load balancer inside each Region to spread the requests across instances and zones. A question offering only one of the two is testing whether the layers are separate in your head.