🌐 AWS VPC & Networking

Master VPC design, subnets, security groups, NACLs, VPC endpoints, and private connectivity for data engineering.

Module: AWS Data Engineering • Topic 3 of 65 • Premium Content

VPC Architecture for Data Engineering

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────────┐
│                    VPC: 10.0.0.0/16 (65,536 IPs)                            │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │                  PUBLIC SUBNETS (Internet-Facing)                    │    │
│  │                                                                     │    │
│  │  ┌─────────────────────┐  ┌─────────────────────┐                 │    │
│  │  │  Public Subnet-AZ-a │  │  Public Subnet-AZ-b │                 │    │
│  │  │  10.0.1.0/24        │  │  10.0.2.0/24        │                 │    │
│  │  │                     │  │                     │                 │    │
│  │  │  • NAT Gateway      │  │  • Bastion Host     │                 │    │
│  │  │  • ALB/NLB          │  │  • Load Balancers   │                 │    │
│  │  │  • Bastion Host     │  │                     │                 │    │
│  │  └──────────┬──────────┘  └──────────┬──────────┘                 │    │
│  │             │                        │                            │    │
│  └─────────────┼────────────────────────┼────────────────────────────┘    │
│                │                        │                                 │
│                ▼                        ▼                                 │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  INTERNET GATEWAY (igw-xxxxxxxx)                                    │    │
│  │  • Attached to VPC                                                  │    │
│  │  • Provides internet access for public subnets                      │    │
│  │  • Horizontal scaling, redundant, highly available                  │    │
│  └─────────────────────────────┬───────────────────────────────────────┘    │
│                                │                                           │
│                                ▼                                           │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │                  PRIVATE SUBNETS (Data Layer)                        │    │
│  │                                                                     │    │
│  │  ┌─────────────────────┐  ┌─────────────────────┐                 │    │
│  │  │  Private Subnet-AZ-a│  │  Private Subnet-AZ-b│                 │    │
│  │  │  10.0.10.0/24       │  │  10.0.20.0/24       │                 │    │
│  │  │                     │  │                     │                 │    │
│  │  │  • EMR Cluster      │  │  • Redshift Cluster │                 │    │
│  │  │  • EC2 Instances    │  │  • RDS Instances    │                 │    │
│  │  │  • ECS/Fargate      │  │  • ElastiCache      │                 │    │
│  │  └──────────┬──────────┘  └──────────┬──────────┘                 │    │
│  │             │                        │                            │    │
│  └─────────────┼────────────────────────┼────────────────────────────┘    │
│                │                        │                                 │
│                ▼                        ▼                                 │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  NAT GATEWAY (nat-gw-xxxxxxxx)                                      │    │
│  │  • Enables internet access for private subnets                      │    │
│  │  • One per AZ for high availability                                 │    │
│  │  • Manages network address translation                              │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  VPC ENDPOINTS (Private Connectivity to AWS Services)               │    │
│  │                                                                     │    │
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌───────────┐│    │
│  │  │ S3 Gateway  │  │ DynamoDB    │  │ Glue        │  │ Redshift  ││    │
│  │  │ Endpoint   │  │ Gateway     │  │ Interface   │  │ Interface ││    │
│  │  │            │  │ Endpoint    │  │ Endpoint    │  │ Endpoint  ││    │
│  │  └─────────────┘  └─────────────┘  └─────────────┘  └───────────┘│    │
│  └─────────────────────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────────────────────┘

Subnet Design Patterns

Three-Tier Data Architecture

Tier	Subnet Type	CIDR	Purpose	Services
Presentation	Public	10.0.1.0/24	External access	ALB, NAT GW
Application	Private	10.0.10.0/24	Compute	EMR, ECS, Lambda
Data	Isolated	10.0.20.0/24	Storage	RDS, Redshift

Data Engineering Subnet Strategy

# VPC Configuration for Data Engineering
vpc_config = {
    "vpc_cidr": "10.0.0.0/16",
    "subnets": {
        "public": [
            {"cidr": "10.0.1.0/24", "az": "us-east-1a", "purpose": "NAT/ALB"},
            {"cidr": "10.0.2.0/24", "az": "us-east-1b", "purpose": "NAT/ALB"},
            {"cidr": "10.0.3.0/24", "az": "us-east-1c", "purpose": "NAT/ALB"}
        ],
        "private_compute": [
            {"cidr": "10.0.10.0/24", "az": "us-east-1a", "purpose": "EMR/ECS"},
            {"cidr": "10.0.11.0/24", "az": "us-east-1b", "purpose": "EMR/ECS"},
            {"cidr": "10.0.12.0/24", "az": "us-east-1c", "purpose": "EMR/ECS"}
        ],
        "private_data": [
            {"cidr": "10.0.20.0/24", "az": "us-east-1a", "purpose": "RDS/Redshift"},
            {"cidr": "10.0.21.0/24", "az": "us-east-1b", "purpose": "RDS/Redshift"},
            {"cidr": "10.0.22.0/24", "az": "us-east-1c", "purpose": "RDS/Redshift"}
        ],
        "isolated": [
            {"cidr": "10.0.30.0/24", "az": "us-east-1a", "purpose": "No internet"},
            {"cidr": "10.0.31.0/24", "az": "us-east-1b", "purpose": "No internet"}
        ]
    }
}

ℹ️

Pro Tip: Always use /24 subnets for data layer services. This provides 251 usable IPs (5 reserved by AWS). For large EMR clusters, consider /23 or /22 subnets.

Security Groups vs NACLs

Security Groups (Stateful)

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────────┐
│                    SECURITY GROUPS (Stateful Firewall)                        │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  EMR Cluster Security Group (emr-sg)                                │    │
│  │                                                                     │    │
│  │  INBOUND RULES:                     OUTBOUND RULES:                 │    │
│  │  ┌─────────────────────────────┐  ┌─────────────────────────────┐  │    │
│  │  │ Type    │ Port  │ Source   │  │ Type    │ Port  │ Dest      │  │    │
│  │  ├─────────┼───────┼──────────┤  ├─────────┼───────┼───────────┤  │    │
│  │  │ SSH     │ 22    │ Bastion  │  │ All     │ All   │ 0.0.0.0/0 │  │    │
│  │  │ Custom  │ 8088  │ Mgmt-sg  │  │ TCP     │ 443   │ S3 VPCE  │  │    │
│  │  │ Custom  │ 18080 │ Mgmt-sg  │  │ TCP     │ 443   │ Glue VPCE│  │    │
│  │  │ Custom  │ 8020  │ Worker-sg│  │ TCP     │ 5439  │ Redshift  │  │    │
│  │  │ Custom  │ 7077  │ Worker-sg│  │ TCP     │ 3306  │ RDS       │  │    │
│  │  └─────────────────────────────┘  └─────────────────────────────┘  │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  KEY CHARACTERISTICS:                                                       │
│  • Stateful: Return traffic automatically allowed                          │
│  • Instance-level: Attached to ENIs                                        │
│  • Allow rules only (no deny)                                              │
│  • Evaluated before NACLs                                                   │
│  • Can reference other security groups                                     │
└─────────────────────────────────────────────────────────────────────────────┘

Network ACLs (Stateless)

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────────┐
│                    NETWORK ACLS (Stateless Firewall)                         │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  Private Subnet NACL (nacl-private)                                  │    │
│  │                                                                     │    │
│  │  INBOUND RULES (evaluated in order):                                 │    │
│  │  ┌─────┬───────┬──────────┬──────────────────────────────────────┐  │    │
│  │  │ #   │ Type  │ Port     │ Description                          │  │    │
│  │  ├─────┼───────┼──────────┼──────────────────────────────────────┤  │    │
│  │  │ 100 │ SSH   │ 22       │ Allow SSH from Bastion               │  │    │
│  │  │ 110 │ TCP   │ 1024-65535│ Allow ephemeral (return traffic)   │  │    │
│  │  │ 120 │ TCP   │ 443      │ Allow HTTPS                          │  │    │
│  │  │ *   │ All   │ All      │ Deny all other traffic               │  │    │
│  │  └─────┴───────┴──────────┴──────────────────────────────────────┘  │    │
│  │                                                                     │    │
│  │  OUTBOUND RULES (evaluated in order):                                │    │
│  │  ┌─────┬───────┬──────────┬──────────────────────────────────────┐  │    │
│  │  │ #   │ Type  │ Port     │ Description                          │  │    │
│  │  ├─────┼───────┼──────────┼──────────────────────────────────────┤  │    │
│  │  │ 100 │ TCP   │ 22       │ Allow SSH to Bastion                 │  │    │
│  │  │ 110 │ TCP   │ 1024-65535│ Allow ephemeral ports              │  │    │
│  │  │ 120 │ TCP   │ 443      │ Allow HTTPS to internet              │  │    │
│  │  │ *   │ All   │ All      │ Deny all other traffic               │  │    │
│  │  └─────┴───────┴──────────┴──────────────────────────────────────┘  │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  KEY CHARACTERISTICS:                                                       │
│  • Stateless: Must explicitly allow return traffic                          │
│  • Subnet-level: Applied to all instances in subnet                        │
│  • Allow and Deny rules                                                     │
│  • Evaluated after Security Groups                                          │
│  • Rule numbers determine evaluation order                                  │
└─────────────────────────────────────────────────────────────────────────────┘

⚠️

Security Warning: NACLs are stateless. Always remember to allow ephemeral ports (1024-65535) for return traffic. Forgetting this is a common cause of connectivity issues.

VPC Endpoints for Data Services

Gateway Endpoints (Free)

Service	Endpoint Type	Use Case
S3	Gateway	Data lake access without internet
DynamoDB	Gateway	NoSQL database access

Interface Endpoints (Cost: $0.01/hr per ENI)

Service	Endpoint Type	Use Case
Glue	Interface	ETL job metadata access
Redshift	Interface	Data warehouse connectivity
Kinesis	Interface	Streaming data ingestion
Lambda	Interface	Serverless compute access
STS	Interface	Role assumption

VPC Endpoint Policy for S3

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAccessToSpecificBuckets",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::data-lake-*",
        "arn:aws:s3:::data-lake-*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:sourceVpce": "vpce-1234567890abcdef0"
        }
      }
    }
  ]
}

NAT Gateway Design

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────────┐
│                    HIGH-AVAILABILITY NAT GATEWAY DESIGN                      │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │                                                                     │    │
│  │  AZ-a                              AZ-b                            │    │
│  │  ┌─────────────────┐              ┌─────────────────┐              │    │
│  │  │  Public Subnet  │              │  Public Subnet  │              │    │
│  │  │  10.0.1.0/24    │              │  10.0.2.0/24    │              │    │
│  │  │                 │              │                 │              │    │
│  │  │  ┌───────────┐  │              │  ┌───────────┐  │              │    │
│  │  │  │NAT Gateway│  │              │  │NAT Gateway│  │              │    │
│  │  │  │nat-aaa111 │  │              │  │nat-bbb222 │  │              │    │
│  │  │  │EIP: 1.2.3 │  │              │  │EIP: 4.5.6 │  │              │    │
│  │  │  └─────┬─────┘  │              │  └─────┬─────┘  │              │    │
│  │  └────────┼────────┘              └────────┼────────┘              │    │
│  │           │                                │                       │    │
│  │           ▼                                ▼                       │    │
│  │  ┌─────────────────┐              ┌─────────────────┐              │    │
│  │  │Private Subnet   │              │Private Subnet   │              │    │
│  │  │10.0.10.0/24     │              │10.0.20.0/24     │              │    │
│  │  │                 │              │                 │              │    │
│  │  │ Route Table:    │              │ Route Table:    │              │    │
│  │  │ 0.0.0.0/0 →     │              │ 0.0.0.0/0 →     │              │    │
│  │  │ nat-aaa111      │              │ nat-bbb222      │              │    │
│  │  └─────────────────┘              └─────────────────┘              │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  KEY DESIGN PRINCIPLES:                                                     │
│  • One NAT Gateway per AZ for high availability                             │
│  • Route tables point to local NAT Gateway                                  │
│  • Each NAT Gateway has its own Elastic IP                                  │
│  • For cost optimization, consider NAT instances for dev/test               │
└─────────────────────────────────────────────────────────────────────────────┘

Data Engineering Network Patterns

Pattern 1: Private Data Layer

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────────┐
│              PRIVATE DATA LAYER PATTERN                                      │
│                                                                             │
│  Internet ──► ALB ──► Public Subnet ──► NAT GW ──► Private Subnet         │
│                                              │                              │
│                                              ▼                              │
│                                    ┌─────────────────┐                      │
│                                    │  VPC Endpoints  │                      │
│                                    │                 │                      │
│                                    │  • S3 Gateway   │                      │
│                                    │  • Glue IF      │                      │
│                                    │  • Redshift IF  │                      │
│                                    │  • Lambda IF    │                      │
│                                    └─────────────────┘                      │
│                                              │                              │
│                                              ▼                              │
│                                    ┌─────────────────┐                      │
│                                    │  Data Services  │                      │
│                                    │                 │                      │
│                                    │  • EMR Cluster  │                      │
│                                    │  • Redshift     │                      │
│                                    │  • RDS Aurora   │                      │
│                                    │  • ElastiCache  │                      │
│                                    └─────────────────┘                      │
└─────────────────────────────────────────────────────────────────────────────┘

Pattern 2: Cross-VPC Data Sharing

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────────┐
│                    VPC PEERING FOR DATA SHARING                              │
│                                                                             │
│  ┌──────────────────────────────┐      ┌──────────────────────────────┐    │
│  │  VPC-A (Data Engineering)    │      │  VPC-B (Analytics)           │    │
│  │  10.0.0.0/16                 │◄────►│  10.1.0.0/16                 │    │
│  │                              │ Peering│                              │    │
│  │  ┌────────────────────────┐  │      │  ┌────────────────────────┐  │    │
│  │  │  Subnet: 10.0.10.0/24  │  │      │  │  Subnet: 10.1.10.0/24  │  │    │
│  │  │  Services: EMR, Glue   │  │      │  │  Services: Redshift    │  │    │
│  │  └────────────────────────┘  │      │  └────────────────────────┘  │    │
│  │                              │      │                              │    │
│  │  Route Table:               │      │  Route Table:               │    │
│  │  10.1.0.0/16 → pcx-xxx     │      │  10.0.0.0/16 → pcx-xxx     │    │
│  └──────────────────────────────┘      └──────────────────────────────┘    │
│                                                                             │
│  ALTERNATIVE: TRANSIT GATEWAY (for many VPCs)                               │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │                     TRANSIT GATEWAY                                  │    │
│  │                                                                     │    │
│  │  VPC-A ──► TGW ──► VPC-B                                           │    │
│  │  VPC-C ──► TGW ──► VPC-D                                           │    │
│  │  VPC-E ──► TGW ──► VPC-F                                           │    │
│  │                                                                     │    │
│  │  Benefits:                                                          │    │
│  │  • Hub-and-spoke topology                                           │    │
│  │  • Centralized routing                                              │    │
│  │  • Cross-region support                                             │    │
│  │  • Multicast support                                                │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────────────────────┘

VPC Flow Logs

Enabling Flow Logs

# Enable VPC Flow Logs to CloudWatch
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-1234567890abcdef0 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /aws/vpc/flowlogs \
  --deliver-logs-permission-arn arn:aws:iam::123456789012:role/VPCFlowLogsRole

# Enable VPC Flow Logs to S3
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-1234567890abcdef0 \
  --traffic-type ALL \
  --log-destination-type s3 \
  --log-destination arn:aws:s3:::vpc-flow-logs-bucket

Flow Log Query in Athena

-- Find top talkers in VPC
SELECT
  srcaddr,
  dstaddr,
  SUM(bytes) as total_bytes,
  COUNT(*) as packet_count
FROM vpc_flow_logs
WHERE account_id = '123456789012'
  AND region = 'us-east-1'
  AND day = '2024-01-15'
GROUP BY srcaddr, dstaddr
ORDER BY total_bytes DESC
LIMIT 20;

-- Find rejected connections
SELECT
  srcaddr,
  dstport,
  protocol,
  action,
  COUNT(*) as attempts
FROM vpc_flow_logs
WHERE action = 'REJECT'
GROUP BY srcaddr, dstport, protocol, action
ORDER BY attempts DESC;

ℹ️

Pro Tip: Use VPC Flow Logs to troubleshoot connectivity issues, monitor network traffic, and detect security anomalies. Store them in S3 and query with Athena for cost-effective analysis.

Interview Questions & Answers

Q1: What is the difference between Security Groups and NACLs?

Answer:

Security Groups: Stateful, instance-level, allow rules only, evaluated before NACLs
NACLs: Stateless, subnet-level, allow and deny rules, evaluated after Security Groups

For data engineering, use Security Groups for fine-grained instance control and NACLs for broad subnet-level restrictions.

Q2: How do you design a VPC for a data lake?

Answer:

Use /16 CIDR for scalability (65,536 IPs)
Create subnets in multiple AZs
Use VPC endpoints for S3, Glue, Redshift
Place data services in private subnets
Use NAT Gateways for internet access
Implement flow logs for monitoring

Q3: What are VPC endpoints and when should you use them?

Answer: VPC endpoints allow private connectivity to AWS services without internet access. Use them for:

S3 Gateway Endpoint: Free, for data lake access
Interface Endpoints: $0.01/hr, for Glue, Redshift, Kinesis
Benefits: Reduced data transfer costs, improved security, lower latency

Q4: How do you handle cross-VPC data sharing?

Answer:

VPC Peering: Direct connectivity between two VPCs (non-transitive)
Transit Gateway: Hub-and-spoke for many VPCs (transitive)
Shared Services VPC: Central data services VPC with cross-account access
S3 Cross-Account Access: Bucket policies for cross-account reads

Q5: What is the maximum number of subnets per VPC?

Answer:

Default quota: 200 subnets per VPC
Adjustable: Can be increased via Service Quotas
Best practice: Use larger CIDR blocks (/16) for flexibility
Data engineering: Plan for growth, especially for EMR clusters

Cost Considerations

Component	Cost	Optimization
NAT Gateway	$0.045/hr + data	Use VPC endpoints instead
VPC Flow Logs	$0.50/GB (CW)	Use S3 for long-term storage
VPC Peering	Free	No cross-region peering
Transit Gateway	$0.05/hr per attachment	Use for many VPCs
VPC Endpoints (Gateway)	Free	Always use for S3/DynamoDB
VPC Endpoints (Interface)	$0.01/hr per ENI	Only when needed

⚠️

Cost Warning: NAT Gateway data processing charges can add up quickly for data engineering workloads. Always use VPC endpoints for S3 and other AWS services to avoid NAT Gateway costs.

Summary

VPC networking is critical for secure, high-performance data engineering. Key takeaways:

Design: Use /16 CIDR with /24 subnets for data services
Security: Security Groups (instance) + NACLs (subnet) for defense in depth
VPC Endpoints: Gateway (free) for S3/DynamoDB, Interface for other services
NAT Gateways: One per AZ for high availability
Monitoring: VPC Flow Logs for traffic analysis and troubleshooting
Cross-VPC: Use Transit Gateway for many VPCs, Peering for simple cases

AWS VPC & Networking for Data Engineers

🌐 AWS VPC & Networking

VPC Architecture for Data Engineering

Subnet Design Patterns

Three-Tier Data Architecture

Data Engineering Subnet Strategy

Security Groups vs NACLs

Security Groups (Stateful)

Network ACLs (Stateless)

VPC Endpoints for Data Services

Gateway Endpoints (Free)

Interface Endpoints (Cost: $0.01/hr per ENI)

VPC Endpoint Policy for S3

NAT Gateway Design

Data Engineering Network Patterns

Pattern 1: Private Data Layer

Pattern 2: Cross-VPC Data Sharing

VPC Flow Logs

Enabling Flow Logs

Flow Log Query in Athena

Interview Questions & Answers

Q1: What is the difference between Security Groups and NACLs?

Q2: How do you design a VPC for a data lake?

Q3: What are VPC endpoints and when should you use them?

Q4: How do you handle cross-VPC data sharing?

Q5: What is the maximum number of subnets per VPC?

Cost Considerations

Summary