Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Your own private network in AWS: its address range, a subnet in each Availability Zone, and the rules for what reaches what.
Where VPC takes you6 steps, all open
A VPC is your own logically isolated network in AWS. You choose its address range, cut it into subnets, and the instances, databases and load balancers you launch go into those subnets.
A subnet's route table decides what it is. A subnet with a route to an internet gateway is public. One without is private, and needs a NAT device to reach the internet. Anything that should not be reached from the internet belongs in a private subnet.
Security groups, network ACLs, internet gateways and gateway endpoints cost nothing extra. NAT gateways and public IPv4 addresses are charged.
The campus has its own address plan. Each building stands on one site, and a sign at its door says where each road leads; a building with a sign to the main gate is public. A guard at every office door remembers who went out and lets their replies back in. A checkpoint at the building entrance checks everyone, both ways, against a numbered list, and remembers nobody.
CIDR blockSubnetRoute tableInternet gatewaySecurity groupNetwork ACLThe load balancer is the only thing in the public subnets. The app servers sit in private subnets in two zones and accept traffic only from the load balancer's security group. The database is in its own private subnets and accepts traffic only from the app servers' security group. Backups reach S3 through a gateway endpoint, so they need no NAT gateway and add nothing to the bill for it.
A new security group allows all outbound traffic until you change it.
The subnet's rules, lowest number first. The first match decides.
Is there a route for this destination? For the internet, it has to point at an internet gateway.
The internet gateway translates the instance's private address to its public IPv4 or Elastic IP address.
Stateless: the reply needs a rule of its own, usually for the ephemeral ports.
Stateful: a reply to traffic it let out is always let back in.
Pick a case to follow the packet through each check.
Security groups first. They are the main control, and a rule can name another security group, so the database accepts only the app tier and the app tier only the load balancer. Network ACLs are a coarser second layer for a whole subnet, useful for denying a specific range of addresses.
What neither filters. Security groups and network ACLs do not filter traffic to the Amazon DNS server, DHCP, the instance metadata service or the Amazon Time Sync Service.
Flow logs record the IP traffic going to and from network interfaces, and publish it to CloudWatch Logs, S3 or Data Firehose. They are collected outside the path of your traffic, so they never slow it down.
Keep it private. Put anything that should not be reached from the internet in private subnets, and reach AWS services through VPC endpoints rather than over the internet.
Free to use: security groups, network ACLs, internet gateways and gateway endpoints cost nothing extra.
Charged: every NAT gateway, by the hour and by the gigabyte it processes; every public IPv4 address, by the hour; and data sent over a peering connection between Availability Zones, in both directions.
Flow logs are charged as vended logs, for ingesting and storing them at their destination.
Keep traffic off the meters. A gateway endpoint takes S3 and DynamoDB traffic off the NAT gateway.
Prices change, so none are printed here. Check the VPC pricing page on aws.amazon.com.
| Subnet | Its route table | The internet | Use it for |
|---|---|---|---|
| Public | A route to an internet gateway | Both ways, for resources with a public address | Load balancers, NAT gateways |
| Private | No route to an internet gateway | Out only, through a NAT device | App servers and databases |
| VPN-only | A route to a Site-to-Site VPN through a virtual private gateway | None | Systems only your own network should reach |
| Isolated | No routes outside the VPC | None | Resources that talk only within the VPC |
must not be reachable from the internet, but must download patchesA private subnet with a route to a NAT gateway
Out through the NAT gateway; nothing can start a connection in.
block traffic from one malicious IP addressA network ACL deny rule
Security groups can only allow. They cannot deny.
responses to outbound requests are being droppedA network ACL with no inbound rule for the replies
Network ACLs are stateless; a security group would have let the reply back.
VPC B and VPC C are both peered with VPC A but cannot talkPeering is not transitive
Peer B and C directly, or connect all three through a transit gateway.
reach S3 from a private subnet without a NAT gatewayA gateway endpoint for S3
No extra charge; it adds a route using the S3 prefix list.
web servers should accept traffic only from the load balancerReference the load balancer's security group
The rule follows whatever the load balancer's addresses are.
how many addresses can you use in a /24 subnet251
256 minus the five AWS reserves in every subnet.
see which connections a security group rejectedVPC Flow Logs
They record the IP traffic to and from each network interface.
A company is moving a three-tier web application into a new VPC across two Availability Zones. Customers must reach the web tier only through an Application Load Balancer. The application servers and the database must not be reachable from the internet, but the application servers must call a partner's API on the internet. Which design meets these requirements?
Instances in a private subnet must write nightly backups to S3. There is no NAT gateway, and the traffic must not go out through an internet gateway. What goes in the gap?
/16 to /28, for a VPC or a subnet.Next: EC2Virtual machines you choose, size and run yourself: the most flexible compute on AWS, and the most work.
Open EC2Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.