Every AWS workload runs inside an Amazon VPC, a logically isolated virtual network with a CIDR-defined IP range, subnets, route tables, gateways, and security rules you control. A subnet becomes public by having a route to an Internet Gateway, giving instances public IPs and reachability from the internet. A private subnet has no IGW route, so instances need a NAT Gateway, a managed service in a public subnet, to initiate outbound internet traffic such as updates while preventing unsolicited inbound connections. NAT Gateways are billed per hour plus per GB processed.
Traffic control happens at two layers. Security groups are stateful firewalls attached at the ENI/instance level: default security groups allow all outbound and no inbound traffic, rules can reference other security groups or CIDRs, and return traffic is automatically permitted because of statefulness. Network ACLs (NACLs) sit at the subnet level and are stateless; rules are evaluated by rule number, default NACLs allow all, and return traffic requires explicit rules. Each subnet can belong to only one NACL.
VPC endpoints let you connect privately to AWS services without traversing the public internet. Interface endpoints, powered by AWS PrivateLink, attach elastic network interfaces with private IPs in your VPC and forward traffic to AWS services, other VPCs, or on-premises networks over private connectivity. Gateway endpoints are free and available for S3 and DynamoDB, using a simple route table entry. VPC Flow Logs capture information about IP traffic to and from ENIs in the VPC and are stored in CloudWatch Logs or S3 for troubleshooting, security analysis, and anomaly detection.
In front of compute, AWS provides three load balancers. The Application Load Balancer (ALB) is a Layer 7 balancer that routes HTTP/HTTPS/gRPC traffic by path, host, query string, or header, supports WebSockets, sticky sessions, AWS WAF, OIDC auth, and target groups of EC2, IP, or Lambda. The Network Load Balancer (NLB) is a Layer 4 balancer for TCP/UDP/TLS with ultra-low latency, preserved source IPs, static IPs, and PrivateLink service provider integration. The Classic Load Balancer (CLB) is the legacy generation, and AWS recommends migrating to ALB or NLB. ALB and NLB route requests to target groups, sets of EC2 instances, IPs, Lambdas, or containers that share health checks; sticky sessions bind a user session to a specific target using an application-, duration-, or load-balancer-generated cookie.
At the application edge, Amazon API Gateway creates, publishes, and secures REST, HTTP, and WebSocket APIs. HTTP API is roughly 70% cheaper than REST API, with lower latency and OIDC/OAuth2/JWT/CORS support but fewer features. REST API offers API keys, usage plans, request validation, AWS WAF integration, and request/response transformations. API Gateway throttles requests to protect backends: the default account limit is 10,000 RPS steady-state with 5,000 burst, and per-method or per-stage limits can be set lower, returning HTTP 429 when exceeded. A Lambda authorizer is a function that authenticates and authorizes requests before they reach the backend and caches its policy result for a configurable TTL (default 300 s). Usage plans tie throttling and quota limits to client API keys, tracking usage per key. For GraphQL APIs, AWS AppSync provides a managed service with real-time subscriptions, offline caching, and fine-grained auth via OIDC, Cognito, API keys, or IAM.