The core four · 2 of 4
Networking
How does a request get there, and what can reach what?
A request from your browser has to find its way to Todo.io's code, and the database must be reachable by the code but not by the internet. Networking is the set of walls and doors that decides what can reach what.
The services
How it fits together
1. A place in the world
Everything Todo.io builds lives in one Region, us-east-1. Most things exist in exactly one Region.
2. A private network
Inside the Region, Todo.io's VPC is its own network, split into subnets. A public subnet has a route to an internet gateway; a private one doesn't, which is where the database goes.
3. The way in
With EC2 or ECS, the request comes through the internet gateway to a server with a public IP. With Lambda, API Gateway is the front door, and a WebSocket API keeps a live line open to your browser.
4. A firewall on every network card
Each server, task or attached function has an ENI, and the security group on it decides what may connect.
5. The way out
Things in a private subnet reach the internet through a NAT gateway: they can start connections out, but nothing outside can start one in.
See it in a request
What you need to know
Every Level 0 fact about this pillar's words. The exam and quizzes only ask about these.
Region A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).
- Most services are regional: an RDS database or a DynamoDB table exists only in the Region it was created in, so check the Region menu before you build or go looking. A few services, like IAM, are global.
- Each Region has several Availability Zones: separate data centres, so one failure doesn't take them all out.
VPC (Virtual Private Cloud) Your own private network inside an AWS Region.
- Every account has a default VPC in every Region, already set up with public subnets, so you can launch EC2 straight away.
- EC2 instances, RDS databases, Fargate tasks and VPC-attached Lambda functions live inside your VPC. API Gateway, S3, DynamoDB, SQS and CloudWatch Logs are public AWS services outside it, reached through the internet gateway, a NAT gateway or a VPC endpoint.
- A gateway endpoint (for S3 and DynamoDB) gives the VPC a route to the service that never crosses the internet, and it costs nothing. More in Level 1.
Subnet A slice of a VPC's addresses that lives in one Availability Zone.
- A subnet is public only if its route table sends
0.0.0.0/0to an internet gateway. Public IPs and security groups don't make a subnet public. - A subnet lives in exactly one Availability Zone, so surviving an AZ failure needs subnets in more than one.
- Databases go in private subnets, with no route to the internet gateway, and a security group that only lets the app in.
Internet gateway The VPC's door to the public internet.
- A VPC has at most one internet gateway. AWS runs it and scales it for you.
Public IP address An address the whole internet can reach.
- A normal public IP is released when an instance stops, and a new one is given when it starts. An Elastic IP stays fixed.
Security group A firewall attached to a network card, listing what traffic is allowed in and out.
- Security groups only have allow rules. Everything else is denied, and you can't use one to block a single address.
- Security groups are stateful: the reply to an allowed request goes back out automatically, whatever the outbound rules say.
- A rule's source can be another security group, meaning "anything wearing that group may connect". It keeps working as servers come and go and change IPs.
- Traffic a security group doesn't allow is dropped silently, so it shows up as a timeout: for example, an app that can't reach RDS on port 3306.
ENI (Elastic Network Interface) A virtual network card that gives something an address in a subnet.
- An ENI is a network card with a private IP in a subnet. EC2 instances, each Fargate task and VPC-attached Lambda functions get one, and security groups attach to ENIs, not to subnets.
NAT gateway Lets things in private subnets reach out to the internet, while nothing can reach in.
- A NAT gateway sits in a public subnet, and the private subnets' route tables send
0.0.0.0/0to it. Things in private subnets can then call out, while nothing can call in. - A VPC-attached Lambda function, or a Fargate task or EC2 instance in a private subnet, needs a NAT gateway (or a VPC endpoint) to reach the internet or public AWS services like SQS. Without one, calls time out.
API Gateway A managed HTTPS front door that passes requests to your code.
- API Gateway gives a backend (usually Lambda) a managed HTTPS endpoint, and handles throttling and authorisation before requests reach it. It runs outside your VPC.
- Throttling rejects requests above a rate limit with HTTP 429, so a flood never reaches the backend.
- API Gateway → Lambda → DynamoDB is the classic serverless pattern: nothing to patch or scale, and you pay per request.
- API Gateway is allowed to call a Lambda function by a resource-based policy on the function.
WebSocket (API Gateway WebSocket API) An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.
- A WebSocket API keeps each browser connection open so the backend can push messages at any time. Each connection gets a connection id.
- Every WebSocket API has built-in routes:
$connect,$disconnectand$default(any message no other route matches). - The backend pushes by POSTing to
@connections/{id}, which its role must allow withexecute-api:ManageConnections.