The building blocks
| Component | What it does |
|---|---|
| VPC | An isolated virtual network in a region, defined by a CIDR block (e.g. 10.0.0.0/16). |
| Subnet | A CIDR slice within one Availability Zone. Public = routes to an internet gateway; private = does not. |
| Internet Gateway (IGW) | Lets resources in public subnets reach the internet. |
| NAT Gateway | Lets private subnet resources make outbound internet connections without being reachable inbound. |
| Route Table | Rules that decide where subnet traffic goes. |
Security groups vs network ACLs
| Security Group | Network ACL (NACL) |
|---|---|
| Operates at the instance (ENI) level | Operates at the subnet level |
| Stateful — return traffic auto-allowed | Stateless — must allow return traffic explicitly |
| Allow rules only | Allow and deny rules |
| All rules evaluated | Rules evaluated in number order, first match wins |
The one-liner
Security group = stateful, instance-level, allow-only. NACL = stateless, subnet-level, allow + deny. This single distinction answers many exam questions.
Exam traps
- Expecting NACL to be stateful. It isn't — open the ephemeral return ports too.
- NAT gateway for inbound. NAT is outbound-only for private subnets; inbound needs a load balancer/IGW path.
- One subnet across AZs. A subnet lives in exactly one Availability Zone.
Test yourself
4 quick questions — tap an answer to check it instantly. Nothing is sent anywhere.
1. Security groups are…
Answer: B. Security groups are stateful and operate at the instance (ENI) level.
2. Which can have explicit DENY rules?
Answer: B. NACLs support allow and deny; security groups are allow-only.
3. A NAT gateway provides…
Answer: B. NAT gateways give private subnets outbound internet without inbound exposure.
4. A subnet exists in…
Answer: B. Each subnet lives in exactly one Availability Zone.
Sources
- Amazon Web Services — Amazon VPC User Guide.
- AWS official documentation and the AWS Certified Solutions Architect exam guide.
Reference summary only. "AWS" is a trademark of Amazon. Confirm current details in the official AWS documentation.