AWS VPC, Subnets, and Security Groups
What are the key trade-offs of AWS VPC, Subnets, and Security Groups? When would you choose it vs alternatives?
Answers use simple, clear English.
Quick interview answer
Pros: Strong network isolation primitives. Cons: Misconfigured routes cause outages.
Detailed answer
Pros: Strong network isolation primitives. Cons: Misconfigured routes cause outages. Decision: pick when benefits outweigh operational cost. Core: VPC CIDR, public/private subnets, IGW/NAT, route tables. Security groups stateful allow-lists; NACLs stateless. Private workloads without public IPs. Real-time example: ALB in public subnets; ECS tasks in private; NAT for egress. Pros: Strong network isolation primitives. Cons: Misconfigured routes cause outages. Common mistakes: 0.0.0.0/0 on SSH SG; databases in public subnets. Best practices: Least privilege SG; VPC endpoints for S3/ECR; flow logs. Audience level: Fresher.
Full explanation
VPC CIDR, public/private subnets, IGW/NAT, route tables. Security groups stateful allow-lists; NACLs stateless. Private workloads without public IPs.
Real example & use case
ALB in public subnets; ECS tasks in private; NAT for egress.
Pros & cons
Pros: Strong network isolation primitives. Cons: Misconfigured routes cause outages.
Common mistakes
0.0.0.0/0 on SSH SG; databases in public subnets.
Best practices
Least privilege SG; VPC endpoints for S3/ECR; flow logs.
Follow-up questions
- How would you test AWS VPC, Subnets, and Security Groups?
- What metrics prove AWS VPC, Subnets, and Security Groups is healthy in prod?
- How does AWS VPC, Subnets, and Security Groups change at 10× traffic?