AWS02 · AWS cloud engineering

VPC, Subnets, Routes & Security Groups

Send packets through a VPC: route tables decide the path and security groups decide entry.

📶 L300⏱ 60 min🧪 Live lab

🎯 You will learn to

Tell public from private subnets
Read route tables
Use security groups

🧪 Live environment

Runs entirely in your browser: nothing is installed, no real cloud account is used and your code is never sent to our server.

Loading the lab…

✅ Steps & checkpoints

Send HTTPS to the load balancer
Send SSH to the app
Allow only the load balancer to the app
Test database access

🗺️ VPC route tables

Route tables decide where packets go; security groups decide whether an instance accepts them.

The 2D diagram shows the exact flow, ports and trust boundaries. The 3D scene is a concept view of the same parts; packets travel along the same arrows.

🤔 Think about it

Why are security groups stateful but NACLs are not?

Your answer (kept only on this device)

🛡️ Safety & cost

Mock mode by default. Real AWS practice is opt-in: use a sandbox account, AWS Budgets and least-privilege roles.

🧹 Cleanup

Delete the CloudFormation stack and check Cost Explorer the next day.

📚 Reference documents

Official sources, checked on 5 Nov 2026. Cloud services change often; check the official page before relying on a feature. All references