VPC Subnetting
Virtual private cloud design — public/private subnets, route tables, egress paths, security groups. Core AWS SAA-C03 material, and directly relevant any time a private-subnet workload needs to call an external API.
Why we need this / what value this brings
Correct network segmentation (public vs private subnets) is a core defense layer — a DB directly reachable from the public internet is a common, serious misconfiguration.
When to use this
Whenever provisioning cloud infrastructure that includes both public-facing and internal-only resources, or debugging why a private resource can/can't reach something.
How to use or implement this
Put anything that shouldn't be internet-reachable (databases, internal services, agent runtimes) in private subnets, with only load balancers/gateways in public ones — then work through the subfolders here for how that private resource still reaches out when it needs to.
Subtopics
Research questions
- Concrete scenario: an app on an EC2 instance in a private subnet (e.g. inside Amazon Bedrock AgentCore) needs to call an external API like OpenRouter — which subfolder here answers 'how does it reach the internet at all'?
Empty folder — drop notes, links, and findings here as you research.