Networking: VPCs, Subnets and Load Balancers

VPC basics

A VPC is your private network in a region, for example 10.0.0.0/16 (see the Networking Fundamentals track for CIDR). Inside it you create subnets, each in one availability zone.

• Public subnet: has a route to an internet gateway; resources can have public IPs.
• Private subnet: no direct route from the internet. Outbound access (for updates) goes through a NAT gateway.

A standard layout

Only the load balancer faces the internet. App servers accept traffic only from the load balancer's security group; the database only from the app servers'.

NAT gateways cost money per hour and per GB. For small projects, VPC endpoints for S3 (free gateway type) avoid sending S3 traffic through NAT.

Application Load Balancer (ALB)

An ALB receives HTTPS traffic, terminates TLS with a free certificate from ACM (AWS Certificate Manager) and forwards requests to healthy targets.

• Target group: the servers or containers behind it, with a health check such as GET /api/health.
• Listener rules: route by host or path, for example /api/* to one service and everything else to another.
• Redirect HTTP 80 to HTTPS 443 at the listener.

Because the ALB is a proxy, configure your app to trust X-Forwarded-For and X-Forwarded-Proto from exactly one hop.

Route 53

Route 53 hosts DNS zones. Its alias records point the root domain at an ALB or CloudFront distribution (something a normal CNAME cannot do), and health-checked failover records can switch traffic to a standby region.

CloudFront

CloudFront is AWS's CDN. Put it in front of S3 for static assets, or in front of the ALB for the whole site, to cache content near users and absorb traffic spikes. Use Origin Access Control so the S3 bucket stays private and only CloudFront can read it.

Check yourself

• What makes a subnet public?
• Why should only the load balancer have a public address?
• Which record type points a root domain at an ALB?