AWS VPC, Subnets, and Security Groups
Design a small subsystem that relies on AWS VPC, Subnets, and Security Groups. Outline components, data flow, failure modes, and metrics.
Answers use simple, clear English.
Quick interview answer
Use AWS VPC, Subnets, and Security Groups as the core idea. Example shape: ALB in public subnets; ECS tasks in private; NAT for egress..
Detailed answer
Use AWS VPC, Subnets, and Security Groups as the core idea. Example shape: ALB in public subnets; ECS tasks in private; NAT for egress.. Watch for: Misconfigured routes cause outages.. Measure success via latency/error/saturation. Core: VPC CIDR, public/private subnets, IGW/NAT, route tables. Security groups stateful allow-lists; NACLs stateless. Private workloads without public IPs. Real-time example: ALB in public subnets; ECS tasks in private; NAT for egress. Pros: Strong network isolation primitives. Cons: Misconfigured routes cause outages. Common mistakes: 0.0.0.0/0 on SSH SG; databases in public subnets. Best practices: Least privilege SG; VPC endpoints for S3/ECR; flow logs. Audience level: Senior.
Full explanation
VPC CIDR, public/private subnets, IGW/NAT, route tables. Security groups stateful allow-lists; NACLs stateless. Private workloads without public IPs.
Real example & use case
ALB in public subnets; ECS tasks in private; NAT for egress.
Pros & cons
Pros: Strong network isolation primitives. Cons: Misconfigured routes cause outages.
Common mistakes
0.0.0.0/0 on SSH SG; databases in public subnets.
Best practices
Least privilege SG; VPC endpoints for S3/ECR; flow logs.
Follow-up questions
Open one as its own read / solve / listen card