Backend / Cloud: AWS / Networking and content delivery / README.md

Amazon VPC

Updated 7 min read index source
On this page15
  1. Overview
  2. Key Features
  3. Interview Topics
  4. Common Interview Questions
  5. Best Practices
  6. Use Cases
  7. Integration Patterns
  8. Security Considerations
  9. Cost Optimization
  10. Performance Optimization
  11. Disaster Recovery
  12. Migration Strategies
  13. Common Pitfalls
  14. Resources
  15. Interview angle

Amazon VPC

Overview

Amazon Virtual Private Cloud (Amazon VPC) enables you to launch AWS resources into a virtual network that you’ve defined. This virtual network closely resembles a traditional network that you’d operate in your own data center, with the benefits of using AWS’s scalable infrastructure.

Key Features

  • Isolated Network Environment: Create private, isolated network spaces
  • Custom IP Address Ranges: Define your own IP address ranges
  • Subnet Configuration: Create public and private subnets
  • Route Tables: Control traffic flow between subnets
  • Security Groups: Stateful firewall for instances
  • Network ACLs: Stateless firewall for subnets
  • Internet Gateway: Connect to the internet
  • NAT Gateway: Private subnet internet access
  • VPC Peering: Connect VPCs together
  • VPN Connections: Connect to on-premises networks

Interview Topics

1. VPC Fundamentals

  • VPC Components: Subnets, route tables, internet gateway
  • IP Addressing: CIDR blocks, subnet ranges
  • Availability Zones: Multi-AZ deployment
  • VPC Limits: Maximum resources per VPC
  • Default VPC: Pre-configured VPC for new accounts

2. Subnet Configuration

  • Public Subnets: Direct internet access
  • Private Subnets: No direct internet access
  • Subnet Sizing: IP address range planning
  • Availability Zone Distribution: Multi-AZ redundancy
  • Subnet Types: Standard, dedicated, isolated

3. Routing and Connectivity

  • Route Tables: Control traffic flow
  • Internet Gateway: Public internet access
  • NAT Gateway: Private subnet internet access
  • VPC Endpoints: Private AWS service access
  • Transit Gateway: Multi-VPC connectivity

4. Security Features

  • Security Groups: Instance-level firewall
  • Network ACLs: Subnet-level firewall
  • VPC Flow Logs: Network traffic monitoring
  • Network Access Control: VPC endpoint policies
  • Encryption: Data in transit and at rest

5. Advanced Networking

  • VPC Peering: Connect VPCs
  • VPN Connections: Site-to-site VPN
  • Direct Connect: Dedicated network connection
  • Transit Gateway: Hub-and-spoke architecture
  • VPC Endpoints: Private service access

Common Interview Questions

Basic Questions

  1. What is Amazon VPC and why would you use it?

    • Isolated network environment in AWS
    • Control over network configuration
    • Security and compliance requirements
    • Multi-tier application architecture

  2. What are the main components of a VPC?

    • Subnets (public and private)
    • Route tables
    • Internet Gateway
    • NAT Gateway
    • Security Groups and Network ACLs

  3. How do you create a VPC?

    bash 
    aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications ResourceType=vpc,Tags=[{Key=Name,Value=MyVPC}]

Advanced Questions

  1. How do you set up a VPC with public and private subnets?

    yaml 
    Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
  
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
  
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [1, !GetAZs '']
  
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  2. What is the difference between Security Groups and Network ACLs?

    • Security Groups: Stateful, instance-level, allow rules only
    • Network ACLs: Stateless, subnet-level, allow and deny rules
    • Security Groups: Applied to instances
    • Network ACLs: Applied to subnets

  3. How do you connect a VPC to the internet?

    • Create an Internet Gateway
    • Attach it to the VPC
    • Create a route table with route to 0.0.0.0/0
    • Associate route table with public subnets

Troubleshooting Questions

  1. What if instances in a private subnet can’t access the internet?

    • Check NAT Gateway configuration
    • Verify route table has route to NAT Gateway
    • Ensure NAT Gateway is in public subnet
    • Check security group rules

  2. How do you troubleshoot VPC connectivity issues?

    • Check route tables
    • Verify security group rules
    • Test network ACLs
    • Use VPC Flow Logs for monitoring

Best Practices

1. Network Design

  • Use appropriate CIDR blocks
  • Plan for future growth
  • Implement multi-AZ architecture
  • Use separate subnets for different tiers

2. Security

  • Implement least privilege access
  • Use security groups effectively
  • Configure network ACLs properly
  • Enable VPC Flow Logs

3. Performance

  • Choose appropriate instance types
  • Use placement groups for low latency
  • Optimize network configuration
  • Monitor network performance

4. Cost Optimization

  • Use appropriate NAT Gateway types
  • Optimize VPC endpoint usage
  • Monitor data transfer costs
  • Use reserved instances where possible

5. Monitoring

  • Enable VPC Flow Logs
  • Monitor network metrics
  • Set up CloudWatch alarms
  • Track resource usage

Use Cases

1. Multi-Tier Applications

  • Web tier in public subnets
  • Application tier in private subnets
  • Database tier in isolated subnets
  • Load balancer configuration

2. Hybrid Cloud

  • VPN connection to on-premises
  • Direct Connect for high bandwidth
  • Shared services architecture
  • Disaster recovery setup

3. Microservices Architecture

  • Service isolation
  • Inter-service communication
  • Load balancing
  • Service discovery

4. Compliance and Security

  • Network isolation
  • Data protection
  • Audit logging
  • Access control

Integration Patterns

1. Load Balancer Integration

  • Application Load Balancer
  • Network Load Balancer
  • Classic Load Balancer
  • Target group configuration

2. Database Integration

  • RDS in private subnets
  • Multi-AZ deployment
  • Read replicas
  • Backup and recovery

3. Container Integration

  • ECS/EKS in VPC
  • Container networking
  • Service mesh
  • Load balancing

4. Serverless Integration

  • Lambda in VPC
  • API Gateway integration
  • Event-driven architecture
  • Function networking

Security Considerations

1. Network Security

  • Implement proper segmentation
  • Use security groups effectively
  • Configure network ACLs
  • Enable flow logging

2. Access Control

  • Implement least privilege
  • Use IAM roles and policies
  • Configure VPC endpoints
  • Monitor access patterns

3. Data Protection

  • Encrypt data in transit
  • Use private subnets for sensitive data
  • Implement proper backup
  • Monitor data access

4. Compliance

  • Maintain audit trails
  • Implement logging
  • Ensure regulatory compliance
  • Regular security assessments

Cost Optimization

1. NAT Gateway Optimization

  • Use appropriate NAT Gateway types
  • Optimize data transfer
  • Monitor usage patterns
  • Consider NAT instances for cost savings

2. VPC Endpoint Optimization

  • Use VPC endpoints for AWS services
  • Optimize endpoint usage
  • Monitor endpoint costs
  • Choose appropriate endpoint types

3. Network Optimization

  • Optimize subnet sizing
  • Use appropriate instance types
  • Monitor network costs
  • Implement cost allocation tags

4. Resource Optimization

  • Use reserved instances
  • Optimize instance sizing
  • Monitor resource usage
  • Implement auto-scaling

Performance Optimization

1. Network Performance

  • Choose appropriate instance types
  • Use placement groups
  • Optimize network configuration
  • Monitor network metrics

2. Latency Optimization

  • Use appropriate AZs
  • Implement caching
  • Optimize routing
  • Monitor latency metrics

3. Throughput Optimization

  • Choose appropriate bandwidth
  • Use enhanced networking
  • Optimize application design
  • Monitor throughput metrics

4. Scalability

  • Design for horizontal scaling
  • Implement auto-scaling
  • Use load balancing
  • Monitor scaling patterns

Disaster Recovery

1. Multi-Region Deployment

  • Deploy across regions
  • Implement failover procedures
  • Use Route 53 for routing
  • Monitor regional health

2. Backup Strategies

  • Backup VPC configuration
  • Implement cross-region replication
  • Maintain backup procedures
  • Test recovery processes

3. Recovery Procedures

  • Document recovery procedures
  • Test failover scenarios
  • Maintain recovery documentation
  • Train recovery teams

4. Monitoring and Alerting

  • Monitor VPC health
  • Implement alerting
  • Track recovery metrics
  • Maintain operational procedures

Migration Strategies

1. From On-Premises

  • Plan network architecture
  • Configure VPN/Direct Connect
  • Migrate applications gradually
  • Test connectivity thoroughly

2. From Other Cloud Providers

  • Map network architecture
  • Configure equivalent VPC
  • Migrate applications
  • Validate functionality

3. Application Migration

  • Plan network requirements
  • Configure VPC components
  • Migrate applications
  • Test thoroughly

Common Pitfalls

1. Network Design Issues

  • Insufficient IP address space
  • Poor subnet planning
  • Inadequate security design
  • Scalability limitations

2. Security Problems

  • Overly permissive security groups
  • Misconfigured network ACLs
  • Inadequate monitoring
  • Poor access control

3. Performance Issues

  • Suboptimal network configuration
  • Inadequate bandwidth
  • Poor routing design
  • Insufficient monitoring

4. Cost Management

  • Over-provisioned resources
  • Inefficient NAT Gateway usage
  • High data transfer costs
  • Poor resource optimization

Resources

Interview angle 5

  • “Sketch a production VPC.” - public subnets holding only the load balancer and NAT, private subnets for compute, isolated subnets for databases, across at least two Availability Zones. Nothing with data in it sits in a public subnet.
  • “Security group or NACL?” - security groups are stateful, attach to resources, allow-only, and are what you use day to day. NACLs are stateless, attach to subnets, support deny, and exist for coarse subnet-level blocks. Forgetting NACLs are stateless - so the return traffic needs its own rule - is the classic debugging trap.
  • “How do you reach AWS services privately?” - VPC endpoints. A gateway endpoint for S3 and DynamoDB is free and removes that traffic from the NAT Gateway; interface endpoints cover most other services at an hourly plus data cost. This is a security answer and a cost answer at the same time.
  • “Why is my NAT Gateway bill so large?” - everything leaving a private subnet to the internet, including traffic to S3 without a gateway endpoint, plus container image pulls. Per-GB processing charges add up fast.
  • “What is the cross-AZ cost trap?” - traffic between Availability Zones is billed in both directions. A chatty service accidentally spread across AZs, or a database replica read from the wrong zone, shows up as unexplained data-transfer spend.

Contents 1