Virtual Private Cloud

An on-demand configurable pool of shared resources allocated within a public cloud environment, providing a certain level of isolation between the different organizations using the resources. It is a regional resource. If you have two aws regions, they will have two VPCs.

Each VPC in its region has a set of IPS that are called a CIDR range. (eg. 10.0.0.0/16)

Subnets

Allow you to partition your network inside your VPC. Subnets are defined at the AZ level.

Public subnets are accessible and can access the internet.

Private subnets are not accessible from the internet. 

Route tables define access to the internet and between subnets.

Internet Gateways

Public subnets have a route to the Internet Gateway. 

NAT Gateways

NAT Gateways (aws-managed) and NAT Instances (self-managed) allow your instances in your Private Subnets to access the internet while remaining private.

Security Groups

A firewall that controls traffic to and from an Elastic Network Interface or EC2 Instance. Security Groups can only have Allow rules and the rules include IP addresses and/or other security groups.

Network ACL (NACL)

A firewall which controls traffic from and to a subnet and are attached at the subnet level. They can have Allow and Deny rules and the rules only include IP addresses.

VPC Flow Logs

Monitors connectivity issues. Capture IP traffic from Subnets, Elastic Network Interfaces as well ass network information from AWS managed interfaces. 

VPC Peering

Connects to VPCs privately using AWS network and causes them to behave as if they were on the same network. They cannot have overlapping CIDRs (IP address ranges).

The connection is not transitive, ie. it must be established for each VPC that needs to communicate with the other. 

VPC Endpoints

Allow you to connect to aws services using a private network instead of the public www network. This provides lower latency and enhanced security.

VPC Endpoint Gateway - connects to S3 and DynamoDB from the VPC.

VPC Endpoint Interface - connects to the rest of aws services.

Site to Site VPN 

Encrypted connection to an on-premisses VPN to AWS that goes over the internet. 

Direct Connect

A physical connection that is private, fast and secure. 

Neither Site to Site VPN nor Direct Connect can access VPC endpoints. 

Compare security groups and network ACLs

Security group
Operates at the instance level
Network ACL
Operates at the subnet level

Security group
Supports allow rules only
Network ACL
Supports allow rules and deny rules

Security group
Is stateful: Return traffic is automatically allowed, regardless of any rules
Network ACL
Is stateless: Return traffic must be explicitly allowed by rules

Security group
We evaluate all rules before deciding whether to allow traffic
Network ACL
We process rules in order, starting with the lowest numbered rule, when deciding whether to allow traffic

Security group
Applies to an instance only if someone specifies the security group when launching the instance, or associates the security group with the instance later on
Network ACL
Automatically applies to all instances in the subnets that it's associated with (therefore, it provides an additional layer of defense if the security group rules are too permissive)

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html