AWS VPC, Subnets, and Security Groups
You are a Senior on-call. A production issue might involve AWS VPC, Subnets, and Security Groups. How do you diagnose and mitigate?
Answers use simple, clear English.
Audio N/AQuick interview answer
Mitigate first, then root-cause. Check symptoms against: 0.0.0.0/0 on SSH SG; databases in public subnets..
Detailed answer
Mitigate first, then root-cause. Check symptoms against: 0.0.0.0/0 on SSH SG; databases in public subnets.. Validate with: Least privilege SG; VPC endpoints for S3/ECR; flow logs.. Context: VPC CIDR, public/private subnets, IGW/NAT, route tables. Security groups stateful allow-lists; NACLs stateless. Private workloads without public IPs. Core: VPC CIDR, public/private subnets, IGW/NAT, route tables. Security groups stateful allow-lists; NACLs stateless. Private workloads without public IPs. Real-time example: ALB in public subnets; ECS tasks in private; NAT for egress. Pros: Strong network isolation primitives. Cons: Misconfigured routes cause outages. Common mistakes: 0.0.0.0/0 on SSH SG; databases in public subnets. Best practices: Least privilege SG; VPC endpoints for S3/ECR; flow logs. Audience level: Senior.
Full explanation
VPC CIDR, public/private subnets, IGW/NAT, route tables. Security groups stateful allow-lists; NACLs stateless. Private workloads without public IPs.
Real example & use case
ALB in public subnets; ECS tasks in private; NAT for egress.
Pros & cons
Pros: Strong network isolation primitives. Cons: Misconfigured routes cause outages.
Common mistakes
0.0.0.0/0 on SSH SG; databases in public subnets.
Best practices
Least privilege SG; VPC endpoints for S3/ECR; flow logs.
Follow-up questions
Open one as its own read / solve / listen card