Your private slice of the network

lesson 5-1 · ~10 min · 13/27

Quiz

Warm-up from lesson 4-2: a brand-new S3 bucket, a brand-new security group, an identity with no policies. What do they have in common?

VPC: your own private network

Without private networking, every machine you rent would sit directly on the shared internet, and your database would be one bad firewall rule away from the whole world. AWS's answer: every instance you launch lands inside a VPC (Virtual Private Cloud), your own private network within a region. Machines inside can talk to each other, and nothing outside can even reach the network without you wiring up a path. Docker gave you a miniature of this: containers on one Docker network reach each other by name while the outside world sees only published ports.

A VPC covers a range of private IP addresses, written in CIDR notation: 10.0.0.0/16. Read the /16 as "the first 16 bits are fixed as the network's name, the remaining 32−16 = 16 bits enumerate the machines". So a /16 holds 2¹⁶ = 65,536 addresses, and a bigger slash number means a smaller network.

You then divide the VPC into subnets, smaller ranges that each live in exactly one availability zone (lesson 1-2). A typical layout: one public and one private subnet in AZ a, the same pair in AZ b.

The standard VPC layout: public and private subnet pairs mirrored across two AZs. Gold marks what can face the internet, everything else is unreachable from outside.

Code exercise · bash

How many machines fit in a subnet? 2^(32 − prefix) addresses, and AWS reserves 5 per subnet for itself. Run the math for a /24.

Code exercise · bash

Your turn. You are sizing subnets for a design review and need a quick table. Loop over the prefixes 28, 24, 20, and 16 (in that order) and print one line per prefix in the format shown in the expected output.