Consist of Subnets, Route Tables, Internet Gateway (IGW, limit one per VPC), NAT Gateway, VPC Endpoints, Network Access Control Lists (NACLs), and Security Groups (cannot span VPCs)
By default, creating VPCs in console creates Route Table, NACL, and Security Group
Peering
Works cross-region
IPv4 CIDR blocks cannot overlap
Does not act like a Transit VPC (aka cannot transitively peer VPCs)
AZs are randomly assigned letters, us-west-2a in one account isn't necessarily the same as us-west-2a in another
Subnets
AWS reserves first four and last IP addresses in each subnet CIDR block
Each must be associated with only one NACL, defaults to default NACL
NACLs
Basically a firewall, whereas security groups work at instance level, NACLs work at subnet level
Each subnet must be associated with only one NACL, defaults to default NACL
Default NACL allows all inbound and outbound traffic
Stateless, responses to allowed inbound traffic are subject to outbound rules and vice versa
Since client chooses ephemeral port when initiating connection, NACLs must allow traffic on appropriate ports in outbound rules
List of inbound and outbound allow and deny rules evaluated in order starting with lowest number, as soon as rule matches, it applies and remaining rules aren't checked
Put deny rules first
Default created with VPC allows all in and outbound traffic
Newly created disallow all in and outbound traffic
Can block specific IPs, unlike Security Groups
Entry max default 20, can be increased up to 40
NATs
Provide internet traffic to instances in private subnets
Prefer Gateways to Instances for management and scaling benefits
Create in multiple AZs for high availability
Must be in public subnet with private subnet route to corresponding NAT
Must disable source/destination checks on Instances and increase instance size for performance
Bastion Host/Jump Box/Proxy Server
Provide SSH and RDP connections to instances in private subnet
Must be in public subnet
SSH agent forwarding allows users to use their local SSH keys to connect to instances in private subnet, SSH keys remain on user workstation
VPC Endpoints
Provide private subnet connections to AWS services and PrivateLink services without leaving AWS network
