VPC Fundamentals for Java Developers (Subnets, Security Groups)

Intermediate·3 min read·

Fast recall

Quick revision

Core answer

A VPC is an isolated virtual network in AWS. Every production resource lives inside a VPC. Subnets divide the VPC into public (internet-accessible) and private (internal-only) zones. Security groups are stateful firewalls that control inbound and outbound traffic. Java developers need this to understand why their app can't reach the database, why Lambda can't call an external API, or why the ALB is unreachable.

Interview Answer3 min

A VPC is an isolated virtual network in AWS where every production resource runs. Understanding the three-tier network model — public, private, and database subnets — explains why your ECS tasks can reach the internet but your RDS cannot be reached from it.

Three-tier subnet model

Public subnets have a route to an Internet Gateway — resources in public subnets (ALB, NAT Gateway, bastion hosts) can receive inbound traffic from the internet and initiate outbound traffic directly
Private subnets route outbound traffic through a NAT Gateway in the public subnet — which means ECS tasks can download dependencies, call external APIs, and connect to AWS services, but cannot receive inbound connections from the internet
Database subnets have no route to the internet at all — RDS instances in database subnets are only reachable from resources within the VPC, which means a compromised external system cannot connect to your database even if it knows the endpoint

Security Groups — stateful firewalls per resource

Every EC2 instance, RDS instance, and ECS task has a Security Group that acts as a stateful firewall — inbound rules specify what traffic is allowed in; outbound rules control what the resource can reach
Use Security Group references instead of IP ranges — the ALB's Security Group allows traffic from any IP on port 443; the ECS task's Security Group allows traffic only from the ALB's Security Group on port 8080; which means the task is unreachable from anywhere except the ALB, regardless of what IP addresses are involved

VPC Endpoints — private connectivity to AWS services

By default, calls from your VPC to AWS services (S3, DynamoDB, Secrets Manager) go through the public internet via the NAT Gateway — which costs money and adds latency
VPC Endpoints create a private connection from your VPC directly to the AWS service over the AWS backbone — S3 Gateway Endpoints are free; Interface Endpoints for Secrets Manager, ECR, and SSM cost per hour but eliminate NAT charges for those services

Interview-ready guide

Interview answer

Three-tier subnet model

Public subnets have a route to an Internet Gateway — resources in public subnets (ALB, NAT Gateway, bastion hosts) can receive inbound traffic from the internet and initiate outbound traffic directly
Private subnets route outbound traffic through a NAT Gateway in the public subnet — which means ECS tasks can download dependencies, call external APIs, and connect to AWS services, but cannot receive inbound connections from the internet
Database subnets have no route to the internet at all — RDS instances in database subnets are only reachable from resources within the VPC, which means a compromised external system cannot connect to your database even if it knows the endpoint

Security Groups — stateful firewalls per resource

Every EC2 instance, RDS instance, and ECS task has a Security Group that acts as a stateful firewall — inbound rules specify what traffic is allowed in; outbound rules control what the resource can reach
Use Security Group references instead of IP ranges — the ALB's Security Group allows traffic from any IP on port 443; the ECS task's Security Group allows traffic only from the ALB's Security Group on port 8080; which means the task is unreachable from anywhere except the ALB, regardless of what IP addresses are involved

VPC Endpoints — private connectivity to AWS services

By default, calls from your VPC to AWS services (S3, DynamoDB, Secrets Manager) go through the public internet via the NAT Gateway — which costs money and adds latency
VPC Endpoints create a private connection from your VPC directly to the AWS service over the AWS backbone — S3 Gateway Endpoints are free; Interface Endpoints for Secrets Manager, ECR, and SSM cost per hour but eliminate NAT charges for those services

03 · Deep dive