EC2 and VPC
6 pages · ~4 min✓ Reviewed
Builds on IAM. Next up: S3.
Regions, AZs and the VPC Mental Model
1. Scope Map
| Thing | Scope |
|---|---|
| Region | isolated area, 3+ AZs |
| AZ | one or more data centres |
| VPC | one Region, spans all its AZs |
| Subnet | exactly one AZ |
| IAM | global |
- Primary CIDR between /16 and /28, e.g.
10.0.0.0/16 - Keep it clear of other VPCs and on-prem ranges
2. Surviving an AZ Failure
- VPC10.0.0.0/16
- SubnetAZ-a
- SubnetAZ-b
- One subnet per AZ, in at least 2 AZs
- Spread instances across them
3. Mistakes
- Overlapping CIDRs block VPC peering and VPN
- Primary CIDR cannot be changed later
- Default VPC used for production
4. Interview Point
- Subnet regional or zonal? Zonal: one AZ.
- Survive an AZ failure? Subnets and instances in 2+ AZs.
- Why CIDR for peering? Overlapping ranges cannot be routed.
Subnets, Route Tables, IGW and NAT
1. What Makes a Subnet Public
- Public subnet: route
0.0.0.0/0→ IGW - Private: no IGW route; the label comes from the route
- One route table per subnet; longest prefix wins
localVPC-CIDR route: always present, undeletable
2. IGW vs NAT
| IGW | NAT gateway | |
|---|---|---|
| Cost | Free | Hourly + per GB |
| Traffic | In and out | Outbound only |
| Needs | Public or Elastic IP | Route 0.0.0.0/0 → nat-id |
| Placement | VPC-wide, scales out | Zonal: public subnet + EIP |
3. Example and HA
| Subnet | Destination | Target |
|---|---|---|
| Public | 0.0.0.0/0 | igw-xxx |
| Private | 0.0.0.0/0 | nat-xxx |
- Zonal NAT: one per AZ for HA
- Regional NAT: one per VPC, spans AZs itself
4. Mistakes and Interview Point
- Zonal NAT in a private subnet: no internet
- No public IP in a public subnet: no internet
- What makes a subnet public? An IGW route
- NAT vs IGW? NAT is outbound-only; IGW is two-way
- Why a NAT per AZ? A zonal NAT fails with its AZ
Security Groups vs NACLs
1. Two Firewalls
- SG on the ENI/instance
- Stateful: replies auto-allowed
- Allow only; default deny in, allow all out
- NACL on the subnet
- Stateless: allow replies, ports
1024-65535 - Numbered rules, lowest first, first match wins
- Implicit deny at the end
2. Compare
| SG | NACL | |
|---|---|---|
| Level | Instance | Subnet |
| State | Stateful | Stateless |
| Rules | Allow only | Allow + deny |
| Evaluated | All rules | In order |
| Block one IP | No | Yes |
3. Example and Mistake
- Internet
- Web SG443 from 0.0.0.0/0
- DB SG5432 from web-SG id
Mistake
A custom NACL without the outbound ephemeral range breaks replies.
EC2 Instance Types, AMIs and Pricing Models
1. Instance Families
| Letter | Type |
|---|---|
| T, M | General purpose |
| C | Compute |
| R, X | Memory |
| I, D | Storage |
| P, G | GPU |
m7g.large= family + generation + sizeg= Graviton (Arm)- T-types burst on CPU credits; standard mode throttles when empty, unlimited (T3/T4g default) bills surplus
- Unlimited mode (T3/T3a/T4g/T8i) bills surplus
2. AMIs
- Regional template: root snapshot, launch permissions, block device mapping
- Copy to another Region; share by account ID
- Instance store lost on stop; EBS persists
3. Pricing
| Model | Deal |
|---|---|
| On-Demand | Per second, no commitment |
| Savings Plan / Reserved | Up to ~72% off, 1 or 3 years |
| Spot | Up to ~90% off, 2-minute reclaim; fault-tolerant |
| Dedicated Host | Licensing, compliance |
- Mix: baseline Savings Plan, spikes On-Demand, batch/CI Spot
- Launch with SG, key pair, subnet, IAM instance profile, not keys
Mistakes
Stopped instances still pay for EBS; unattached Elastic IPs bill; Spot is wrong for stateful databases.
- Spot vs Reserved? Spot: cheaper, interruptible. Reserved: steady load
- AMI regional? Yes; copy it to reuse elsewhere
- Credits out? Standard: throttles to baseline. Unlimited (T3/T3a/T4g default): keeps bursting, surplus billed
AWS EC2 and VPC Cheat Sheet
1. Subnets and Scope
- Public subnet: 0.0.0.0/0 -> IGW
- Private outbound:
0.0.0.0/0-> zonal NAT in a public subnet - Regional NAT gateway: no public subnet needed
| Resource | Scope |
|---|---|
| VPC | Regional |
| Subnet | One AZ |
| SG | Instance |
| NACL | Subnet |
| AMI | Regional |
2. SG vs NACL
| SG | NACL | |
|---|---|---|
| State | Stateful | Stateless |
| Rules | Allow only | Allow and deny, ordered |
| Return traffic | Automatic | Ephemeral ports 1024-65535 |
3. Pricing and Checklist
- On-Demand: flexible
- Savings Plan / Reserved: steady load
- Spot: interruptible, 2-minute notice
- Dedicated Host: licence or compliance
- Non-overlapping CIDRs, 2+ AZs
- One zonal NAT per AZ, or one regional NAT
- SG-to-SG references, IAM roles not keys
- IGW route plus public IP before internet access
Interview Point
Internet to private DB: IGW (not attached), route table (no route), NACL (deny, no ephemeral ports), SG (no allow rule), instance (not listening).
Check yourself
The subnet route table has 0.0.0.0/0 -> igw-xxx and the SG allows 443, yet the instance cannot reach the internet. Why?
- It has no public or Elastic IP; an IGW route alone is not enough.
- Attach an Elastic IP.
A custom NACL allows inbound 443 and outbound 443 only. The SG is open. Why do clients time out?
- NACLs are stateless: replies leave on the client's ephemeral port.
- Allow outbound 1024-65535.
A private instance routes 0.0.0.0/0 to a zonal NAT gateway, but the NAT gateway sits in a private subnet. What happens?
- Still no internet: the NAT gateway has no IGW route.
- Place it in a public subnet with an Elastic IP.