🌐 AWS Networking Deep Dive for Backend Engineers

VPC | Subnets | Route 53 | ALB/NLB | Security Groups

🚀 Introduction

Networking is the spine of cloud architecture.
Every EC2 instance, ECS task, EKS pod, or Lambda function lives inside a Virtual Private Cloud (VPC).
A backend engineer who understands VPCs, subnets, routing, load balancers, and security groups can design systems that are secure, scalable, and resilient.

🧱 1️⃣ Virtual Private Cloud (VPC)

🔹 Concept

A VPC is your private network inside AWS, similar to your on-prem data center, where you control:

IP addressing
Subnets
Route tables
Security boundaries

Analogy: Think of a VPC as a fenced compound where you decide who enters, who leaves, and how the rooms (subnets) connect.

💡 Real-World Use Case – Multi-Tier Web Application


VPC: 10.0.0.0/16
│
├── Public Subnet (10.0.1.0/24)
│   └── Application Load Balancer (ALB)
│
└── Private Subnet (10.0.2.0/24)
    ├── EC2 App Servers / EKS Pods
    └── RDS Database

Frontend (ALB) receives Internet traffic.
Backend (EC2/EKS) sits in a private subnet, not publicly accessible.
Database (RDS) is isolated within a private subnet.

✅ Interview Tip:

A VPC provides logical isolation and control over inbound/outbound network flows for AWS resources.

🧩 2️⃣ Subnets — Network Segmentation

🔹 Concept

Subnets divide your VPC into smaller logical sections.
Each subnet is tied to one Availability Zone (AZ) and can be public or private.

Subnet Type	Description	Typical Use
Public Subnet	Has a route to the Internet Gateway	ALB, NAT Gateway, Bastion host
Private Subnet	No direct Internet route	App servers, DBs, cache layers

💡 Real-World Use Case – Isolating Backend Tiers


            ┌──────────────────────┐
Internet ──▶│ Public Subnet (AZ-a) │──▶ ALB
            └────────┬─────────────┘
                     │
                     ▼
            ┌──────────────────────┐
            │ Private Subnet (AZ-a)│──▶ EC2 App Server
            └────────┬─────────────┘
                     │
                     ▼
            ┌──────────────────────┐
            │ Private Subnet (AZ-b)│──▶ RDS Database
            └──────────────────────┘

App and DB tiers are shielded from direct Internet access.
ALB handles all ingress traffic.
Outbound Internet traffic from private subnets goes via NAT Gateway.

✅ Interview Tip:

Always distribute subnets across multiple AZs for fault tolerance.

🧭 3️⃣ Route Tables — Controlling Traffic Flow

🔹 Concept

A route table defines how traffic exits or moves within your VPC.

Destination	Target	Description
`10.0.0.0/16`	local	Internal VPC traffic
`0.0.0.0/0`	Internet Gateway	Public Internet
`0.0.0.0/0`	NAT Gateway	Outbound for private subnets

💡 Real-World Use Case – App Server Outbound Internet Access


Private EC2 (10.0.2.15)
     │
     ▼
Route Table: 0.0.0.0/0 → NAT Gateway
     │
     ▼
NAT Gateway in Public Subnet
     │
     ▼
Internet

App servers in private subnets can download updates or call APIs.
NAT Gateway ensures only outbound traffic; no inbound requests allowed.

✅ Interview Tip:

Internet Gateway enables inbound + outbound; NAT Gateway = outbound only.

🌍 4️⃣ Route 53 — AWS DNS Service

🔹 Concept

Amazon Route 53 maps domain names to AWS resources (DNS resolution) and provides:

Domain registration
Health checks
Geo / latency-based routing
Private hosted zones for internal DNS

💡 Real-World Use Case – Routing Traffic to ALB


Browser Request: https://myapp.com
          │
          ▼
Route 53 Hosted Zone (myapp.com)
          │
          ▼
Alias Record → ALB DNS (myapp-prod-alb-1234.elb.amazonaws.com)
          │
          ▼
Public Subnet → ALB → Private EC2

✅ Interview Tip:

Route 53 Alias records are better than CNAMEs for AWS resources — they support root domain mapping and don’t add extra DNS lookups.

⚖️ 5️⃣ Load Balancers — ALB & NLB

🔹 Concept

AWS Load Balancers distribute traffic evenly across multiple backend targets.

LB Type	Layer	Use Case	Example
ALB	Layer 7 (HTTP/HTTPS)	Web apps, APIs, microservices	Path-based routing (`/api`, `/login`)
NLB	Layer 4 (TCP/UDP)	Low-latency traffic, gRPC, IoT	Static IP, extreme performance

💡 Real-World Use Case – Multi-Tier Web App Behind ALB


          Internet
              │
              ▼
     ┌────────────────┐
     │  ALB (Public)  │  ← handles HTTPS
     └────────────────┘
              │
       ┌──────┴──────┐
       ▼             ▼
  EC2 App A       EC2 App B
(Private Subnet) (Private Subnet)

ALB terminates SSL (HTTPS).
Routes traffic evenly to app servers in private subnets.
Auto Scaling ensures capacity.

✅ Interview Tip:

Use ALB for modern HTTP apps; NLB for extreme performance or non-HTTP traffic (e.g., gaming, IoT).

🔒 6️⃣ Security Groups (SGs) & Network ACLs (NACLs)

🔹 Security Groups

Stateful firewalls applied at instance or ENI level.
Automatically allow response traffic.
Define rules based on port, protocol, source/destination.

🔹 NACLs

Stateless firewalls at subnet level.
Must define both inbound and outbound rules explicitly.
Used for coarse-grained subnet filtering.

💡 Real-World Use Case – Layered Network Security


Client (Internet)
   │
   ▼
[ ALB-SG ] → allows TCP 443 (HTTPS)
   │
   ▼
[ APP-SG ] → allows 8080 from ALB-SG only
   │
   ▼
[ DB-SG ] → allows 3306 from APP-SG only

✅ Interview Tip:

Security Groups = who can talk to me; NACLs = what traffic can enter or leave a subnet.

🧱 7️⃣ Complete Backend Networking Architecture


VPC (10.0.0.0/16)
│
├── Public Subnet (10.0.1.0/24)
│   ├── ALB (HTTPS)
│   └── NAT Gateway
│
└── Private Subnet (10.0.2.0/24)
    ├── EC2 / EKS App Servers
    └── RDS (DB)

Traffic Flow


Internet → Route 53 → ALB → Private Subnet → EC2 → RDS
Private EC2 → NAT Gateway → Internet (outbound only)

✅ Interview Tip:

Always design for 2+ AZs and restrict direct Internet exposure to only ALB/NAT.

🧠 8️⃣ Security Layer (End-to-End Flow)


User Request → ALB (TLS Termination)
          ↓
Security Group (allow 443)
          ↓
EC2/EKS App (Private Subnet)
          ↓
Security Group (allow 3306 from App SG)
          ↓
RDS (DB Layer)

Defense in Depth

IAM controls at service level
SG + NACL at network level
KMS for encryption
GuardDuty + CloudTrail for monitoring

🧩 9️⃣ Interview Highlights

Topic	Key Question	Ideal Answer
VPC	What’s the purpose of a VPC?	Logical network isolation inside AWS.
Subnets	Difference between public and private subnet?	Public connects to IGW; private doesn’t.
Routing	NAT Gateway vs IGW?	NAT = outbound only, IGW = bidirectional.
ALB/NLB	When to use which?	ALB = HTTP, NLB = TCP/UDP, high perf.
SG vs NACL	Key difference?	SG = stateful; NACL = stateless.
Route 53	What is an Alias record?	AWS-optimized DNS record pointing to ALB, S3, etc.

🧰 10️⃣ Best Practices Summary

Area	Recommendation
VPC Design	Use CIDR like `10.0.0.0/16` and plan subnets per AZ.
Subnets	Split into private/public; span multiple AZs.
Routing	Keep minimal, explicit routes.
Load Balancers	Use ALB for web, NLB for low-latency TCP.
Security Groups	Follow least privilege; reference SGs instead of IPs.
DNS	Use Route 53 private zones for internal service discovery.
Monitoring	Enable VPC Flow Logs, CloudTrail, and GuardDuty.

🧠 Final Takeaways

VPC = Your private AWS network
Subnets = Logical zones
Route Tables = Traffic map
ALB/NLB = Load balancers for availability
Security Groups = Firewalls for protection
Route 53 = DNS & traffic management

Together, they define the core networking backbone every backend engineer must master.

The Backend Engineer’s Journal