Cloud Networking: VPCs, Subnets, Security Groups & Load Balancers

Q: What's the difference between a security group and a NACL?

A security group is a stateful firewall attached to a resource (instance/ENI): allow rules only, and return traffic is automatically permitted. A network ACL is a stateless firewall at the subnet level: it has allow and deny rules and evaluates each direction independently. Security groups are your everyday tool; NACLs add a coarse subnet-wide guardrail (e.g. blocking a bad IP range).

Q: When do I need a NAT gateway?

When resources in a private subnet need outbound internet access (to call APIs, pull packages, fetch updates) but must not be reachable from the internet. The NAT gateway sits in a public subnet and translates their outbound traffic. Isolated subnets (like database tiers) intentionally have no NAT — they shouldn't reach the internet at all.

Q: Application load balancer or network load balancer?

Use an Application Load Balancer (L7) for HTTP/HTTPS when you need path/host-based routing, TLS termination, and request-level features. Use a Network Load Balancer (L4) for raw TCP/UDP, extreme throughput, ultra-low latency, or static IPs. Most web apps use an ALB; NLBs suit high-performance or non-HTTP protocols.

Q: How do I connect two VPCs or reach cloud services privately?

Use VPC peering (or a transit gateway for many VPCs) to route privately between networks, and VPC endpoints / Private Link to reach provider services (S3, etc.) without going over the public internet. Both keep traffic on the cloud backbone, reducing exposure and often egress cost.

Cloud Networking

Cloud networking is how you connect and secure your resources inside a cloud provider. At its center is the VPC (Virtual Private Cloud) — your own isolated network — divided into subnets, governed by route tables and firewalls, and fronted by load balancers. Getting the topology right is what keeps databases off the public internet and traffic flowing to healthy instances.

The mental model is a layered network: public-facing entry points (load balancers, NAT) in one tier, application servers in a private tier with no direct internet exposure, and databases in an isolated tier reachable only from the app. Defense in depth, by design.

TL;DR

Use VPCs to isolate environments.
Put databases and internal services in private/isolated subnets.
Use load balancers for high availability and routing.
Security groups are your first line of defense — least privilege.

Quick Example

The canonical three-tier VPC layout:

Core Concepts

VPC

An isolated network within the cloud provider. Subnets divide its IP range, route tables control traffic flow, and internet gateways provide external access.

Subnet types

Public — has a route to the internet gateway.
Private — no direct internet access (outbound via NAT).
Isolated — no NAT, no internet at all (databases live here).

Load balancer types

Application (L7) — HTTP/HTTPS, path/host routing.
Network (L4) — TCP/UDP, very high performance.
Gateway — fronts third-party appliances.

Building a VPC (Terraform)

Security Groups

Scope database access to only the app tier — never the whole internet:

Common Patterns

Application load balancer with path routing

VPC peering & private endpoints

Best Practices

Tier your subnets — public (entry), private (app), isolated (data).
Never expose databases to 0.0.0.0/0; restrict by security group source.
Spread across AZs — subnets and load balancer targets in multiple zones.
Use private endpoints for cloud services to avoid internet egress.
Terminate TLS at the load balancer with a managed certificate. See HTTPS & TLS.

Common Mistakes

Database open to the world

Single-AZ deployment

FAQ

What's the difference between a security group and a NACL?

A security group is a stateful firewall attached to a resource (instance/ENI): allow rules only, and return traffic is automatically permitted. A network ACL is a stateless firewall at the subnet level: it has allow and deny rules and evaluates each direction independently. Security groups are your everyday tool; NACLs add a coarse subnet-wide guardrail (e.g. blocking a bad IP range).

When do I need a NAT gateway?

When resources in a private subnet need outbound internet access (to call APIs, pull packages, fetch updates) but must not be reachable from the internet. The NAT gateway sits in a public subnet and translates their outbound traffic. Isolated subnets (like database tiers) intentionally have no NAT — they shouldn't reach the internet at all.

Application load balancer or network load balancer?

Use an Application Load Balancer (L7) for HTTP/HTTPS when you need path/host-based routing, TLS termination, and request-level features. Use a Network Load Balancer (L4) for raw TCP/UDP, extreme throughput, ultra-low latency, or static IPs. Most web apps use an ALB; NLBs suit high-performance or non-HTTP protocols.

How do I connect two VPCs or reach cloud services privately?

Use VPC peering (or a transit gateway for many VPCs) to route privately between networks, and VPC endpoints / Private Link to reach provider services (S3, etc.) without going over the public internet. Both keep traffic on the cloud backbone, reducing exposure and often egress cost.