Cloud Networking
Course scope note: Cloud networking is an optional "Beyond the course" module showing how the core syllabus concepts (CIDR subnets, routing tables, NAT, and load balancers) are deployed in AWS, Azure, and GCP. It is not tested on the exam.
Cloud providers virtualise networking concepts you've learned into managed services. The fundamentals — subnets, route tables, NAT, load balancers — are identical; the implementation is software-defined and managed via APIs.
Virtual Private Cloud (VPC)
A VPC is a logically isolated virtual network within a cloud provider's infrastructure. You define its IP address space (a CIDR block, e.g. 10.0.0.0/16), divide it into subnets, and control traffic with route tables and security rules.
Subnets: public vs. private
Public subnets have a route to an Internet Gateway, making resources in them directly reachable from (and able to reach) the public internet. Used for load balancers, bastion hosts, and NAT gateways. Private subnets have no direct internet route. Resources here (databases, application servers) cannot be reached directly from the internet. They reach the internet via a NAT Gateway in a public subnet.
Route tables, Internet Gateway, NAT Gateway
Each subnet is associated with a route table that determines where traffic is forwarded. A public subnet's route table has a default route pointing to the Internet Gateway. A private subnet's route table has a default route pointing to a NAT Gateway (managed, highly available service in a public subnet) for outbound internet access only.
Security Groups vs. Network ACLs
| Feature | Security Group | Network ACL |
|---|---|---|
| Level | Instance/ENI level | Subnet level |
| Statefulness | Stateful (return traffic auto-allowed) | Stateless (must explicitly allow both directions) |
| Rules | Allow only; implicit deny | Allow and deny; numbered, evaluated in order |
| Typical use | Primary security boundary for instances | Subnet-wide coarse filtering (e.g. block a CIDR) |
Load balancers
- L4 (Network) Load Balancer: operates at TCP/UDP level. Forwards connections based on IP and port. Very fast, low latency. Used for non-HTTP traffic and extreme throughput.
- L7 (Application) Load Balancer: operates at HTTP level. Can route based on path, headers, hostname. Supports SSL termination, WebSockets, HTTP/2, sticky sessions. The most common choice for web applications.
VPC Peering and DNS in the cloud
VPC peering connects two VPCs (same or different accounts/regions) so their resources can communicate using private IP addresses, without traversing the public internet. Route tables in each VPC must be updated. Peering is not transitive — if VPC A peers with B and B peers with C, A cannot reach C through B.
Cloud DNS services (Route 53, Azure DNS, Cloud DNS) support private hosted zones for internal service discovery, health-check-based routing, and latency/geo routing policies.
Provider equivalents
| Concept | AWS | Azure | GCP |
|---|---|---|---|
| Virtual network | VPC | Virtual Network (VNet) | VPC (global) |
| Internet gateway | Internet Gateway | Public IP + route | Internet Gateway (implicit) |
| NAT gateway | NAT Gateway | NAT Gateway | Cloud NAT |
| L4 load balancer | Network LB (NLB) | Standard Load Balancer | Network Load Balancer |
| L7 load balancer | Application LB (ALB) | Application Gateway | HTTP(S) Load Balancer |
| Network ACL | Network ACL | NSG (subnet) | Firewall rules (VPC) |
| Security group | Security Group | NSG (NIC) | Firewall rules (instance) |
| DNS service | Route 53 | Azure DNS | Cloud DNS |
Key takeaways
- A VPC is an isolated virtual network with your own CIDR block.
- Public subnets route to an Internet Gateway; private subnets use a NAT Gateway for outbound-only internet access.
- Security groups are stateful and instance-level; NACLs are stateless and subnet-level.
- L7 load balancers route on HTTP content; L4 balancers route on TCP/IP.
- VPC peering is non-transitive; each pair needs its own route table entries.