VPC and Security groups architecture

1. Place the public boundary

Customers need a public web entry point. Your database only serves application requests.

Which layout expresses that boundary?

Public entry point; application and database in private subnets.

Give the public role to the entry point. Private application traffic does not require exposing the database.

The architecture separates inbound internet traffic from the private data tier.

Internet → public entry → private application → private database

2. Trace the route

A private application needs outbound internet access for an update, without accepting unsolicited inbound connections. Consider an IPv4 design.

Which option fits that specific need?

A NAT gateway path from the private subnet.

Routing decides where packets can go. A security-group allow rule does not create a route.

The private route table sends outbound IPv4 internet traffic through NAT.

Private route table:
0.0.0.0/0 → NAT gateway
NAT public subnet → internet gateway

3. Repair an overly broad rule

The database rule currently allows TCP 5432 from 0.0.0.0/0.

What source should this application use instead?

The application’s security group.

Security groups can reference other security groups. Match the actual application path.

The rule permits the application tier rather than the whole internet.

TCP 5432 · source: sg-application
Security groups allow traffic; they do not create routes.

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.