Cloud Networking

Every cloud resource lives inside a private, software-defined network that you design yourself - nothing is just floating on the open internet by default.

VPCs and subnets

A VPC (Virtual Private Cloud) is your own isolated slice of the provider's network - your own private IP address range, that nothing outside it can see into uninvited.

Inside a VPC, you carve out subnets - smaller ranges, usually split by purpose and availability zone:

VPC: 10.0.0.0/16
  ├── public subnet:  10.0.1.0/24   (load balancers, bastion hosts)
  └── private subnet: 10.0.2.0/24   (app servers, databases)

Public vs. private subnets

The difference isn't the IP range - it's the routing:

• A public subnet has a route to an internet gateway, so its resources can be reached from (and reach) the internet directly.
• A private subnet has no such route - nothing outside the VPC can initiate a connection to it.

The standard shape: put only what truly needs to face the internet (load balancers) in public subnets, and keep everything else - app servers, databases - private.

NAT gateways

A private subnet's instances still often need outbound access - to pull a package update, call an external API. A NAT gateway, sitting in a public subnet, lets private instances reach out to the internet while still blocking anything from initiating a connection in. One-way glass.

Security groups

A security group is a stateful firewall attached directly to an instance (not the subnet) - it's the cloud-native equivalent of a tool like ufw running locally: a list of allowed ports and source addresses, everything else implicitly denied.

Try it

ufw status

When you're ready, hit Mark complete and move to the next lesson.