Regions, EC2 and VPC networking basics

Before you can run anything on AWS, you choose where it runs and how it connects to the network. These choices decide whether an application survives failures and whether it is exposed to the internet, which is why screenings test them closely.

Regions and Availability Zones

A region is a geographic area, and each region contains several Availability Zones. Each zone is one or more data centres with its own power and networking, connected to the others by fast links. Choose a region close to your users and one that meets any data location rules you have. Then spread important servers across at least two zones so a problem in one does not take the whole application down.

EC2 instances

EC2 gives you virtual servers. When you launch one, you pick an image (the operating system), an instance type (CPU and memory), a subnet, a security group and, if the instance needs other AWS services, an IAM role. Remember the shared responsibility model: AWS runs the hardware and virtualisation, while you patch the operating system and secure your application.

VPC and subnets

A VPC is your private network in a region. You divide it into subnets, and each subnet lives in one Availability Zone.

• A public subnet has a route table entry sending internet traffic to an internet gateway. Load balancers and bastion hosts often sit here.
• A private subnet has no direct route from the internet. Application servers and databases usually go here, reaching the internet for updates through a NAT gateway if needed.

A typical layout is a load balancer in public subnets in two zones, application servers in private subnets in the same two zones, and an RDS database in private subnets.

Security groups and network ACLs

A security group is a firewall attached to resources like instances. It has allow rules only, and it is stateful: if a request is allowed in, the reply is allowed out automatically.

Web servers: allow TCP 443 from the load balancer's security group
Database:    allow TCP 5432 from the web servers' security group

Referring to another security group instead of an IP range keeps rules correct when instances change. Network ACLs work at the subnet level, support allow and deny rules, and are stateless, so return traffic needs its own rule.

Common mistakes:

• Opening SSH (port 22) or a database port to 0.0.0.0/0.
• Putting the database in a public subnet.
• Running everything in one zone and calling it production.

Checklist: two zones, databases private, security groups that reference each other, and no admin port open to the whole internet.