VPC Networking and DNS with Route 53

Let us start with the big picture. A VPC (Virtual Private Cloud) is a logically isolated section of the AWS cloud where you launch your resources. Think of it as your own private data centre inside AWS, but without the physical servers, cables, and air conditioning bills. You define the VPC's IP address range using CIDR notation (Classless Inter-Domain Routing), which is just a way of saying "my network uses these specific IP addresses." For example, 10.0.0.0/16 means your VPC can use any IP address from 10.0.0.0 to 10.0.255.255 — that is over 65,000 addresses. You must choose this range carefully because you cannot change it later without rebuilding the VPC.

Once you have a VPC, you need to divide it into subnets. A subnet is a smaller chunk of the VPC's IP range. Subnets live in a single Availability Zone (AZ) — that is a separate physical data centre in an AWS region. By putting subnets in different AZs, you protect your application from an entire data centre going offline. Each subnet can be either public or private. A public subnet has a route to the internet via an Internet Gateway (IGW) — a virtual router that connects your VPC to the internet. A private subnet does not have a direct internet route, so resources in that subnet (like databases) cannot be reached from the internet, which is a good security practice.

To get traffic into or out of a public subnet, you attach an Internet Gateway to your VPC. That is a one-way glass: you must also update the subnet's route table — a set of rules that tells traffic where to go. For a public subnet, the route table says "all traffic destined for 0.0.0.0/0 (the entire internet) goes to the Internet Gateway." For a private subnet, you might instead use a NAT Gateway (Network Address Translation) or a NAT Instance to allow instances in that subnet to initiate outbound internet traffic (to download patches, for example) while blocking inbound internet traffic from the outside world.

Now, how do you control who can talk to what? Two main tools: Security Groups and Network ACLs (NACLs). A Security Group acts as a virtual firewall for an individual resource, like an EC2 instance (a virtual server). It is stateful, meaning if you allow inbound traffic from a certain port, the response traffic is automatically allowed back out, regardless of outbound rules. You define rules like "allow HTTP (port 80) from 0.0.0.0/0" — meaning anyone on the internet can send web traffic to that instance. You can also reference other security groups: for instance, "allow MySQL traffic (port 3306) from the security group attached to my web servers only." That is powerful because it ties access to logical groups, not IP addresses.

A Network ACL, on the other hand, is stateless and operates at the subnet level. It is a numbered list of rules that are evaluated in order, from lowest number to highest. For each subnet, you have one NACL that applies to all traffic entering or leaving that subnet. Unlike security groups, NACLs require explicit rules for both inbound and outbound traffic. If you allow inbound web traffic but forget to allow outbound response traffic, the connection will fail. Because they are stateless, NACLs are a coarser control — they are good for blocking entire ranges of IP addresses (like a known attacker's IP range) before traffic even reaches your instances.

Finally, we need to connect the human-friendly names to these IP addresses. That is where Route 53 comes in. Route 53 is AWS's DNS (Domain Name System) service. DNS is the phonebook of the internet. When a user types "www.example.com" into their browser, their computer asks a DNS resolver (often their ISP) to find the IP address for that name. Route 53 can act as that authoritative source. You create a hosted zone for your domain, then add records such as an A record that maps a name to an IPv4 address, or a CNAME record that maps a name to another name. The exam tests particularly the following record types:

Route 53 also supports routing policies that control how traffic is directed. Simple routing sends traffic to a single resource (for example, one web server). Weighted routing lets you send a percentage of traffic to different endpoints (useful for A/B testing or blue/green deployments). Latency-based routing directs users to the AWS region that gives them the lowest latency. Failover routing lets you set up an active-passive configuration: if the primary health check fails, Route 53 automatically sends traffic to a secondary resource. Geolocation routing routes traffic based on the user's geographic location. These policies are tested heavily on the exam, especially the differences between weighted, latency, and failover.

To use Route 53 for a domain you own, you must first register the domain (or transfer it from another registrar) and then delegate authority by pointing the domain's registrar NS records to the Route 53 name servers listed in your hosted zone. Once that is done, Route 53 becomes the authoritative DNS for your domain. You can also configure health checks that monitor the health of your endpoints (like a web server). If an endpoint becomes unhealthy, Route 53 can route traffic away from it (used with failover routing or multi-value answer routing).

In summary, the VPC provides the isolated network, subnets segment it into public and private zones, security groups and NACLs lock the doors, and Route 53 translates domain names into the IP addresses of resources inside those VPCs. On the exam, you must know how these pieces interact, what each firewall layer does, and which Route 53 routing policy to choose for a given scenario.

An IT professional at a mid-sized e-commerce company is tasked with migrating their on-premises web application to AWS. They start by designing a VPC with an IP range of 10.1.0.0/16. Inside this VPC, they create two public subnets (one in us-east-1a, one in us-east-1b) for the web servers, and two private subnets (same AZs) for the database servers. Each subnet gets its own route table. The public subnets have a route to an Internet Gateway, while the private subnets have no direct internet route — they use a NAT Gateway placed in a public subnet to download security updates.

Now, the professional must secure traffic. They create a security group for the web servers (call it "Web-SG") that allows inbound HTTP (port 80) and HTTPS (port 443) from anywhere (0.0.0.0/0), and SSH (port 22) only from the company's corporate IP range. They create a separate security group for databases ("DB-SG") that allows inbound MySQL (port 3306) only from the Web-SG security group — not from the internet. They also set up a Network ACL at the subnet level that explicitly denies inbound traffic from a known malicious IP range (like a competitor's bot). The NACL rules are numbered: rule 100 allows HTTP/HTTPS from anywhere, rule 200 allows ephemeral ports (1024-65535) for return traffic, rule 300 denies the malicious IP range, and an asterisk rule (default deny) catches everything else.

For DNS, the company owns "myecomshop.com." The professional creates a public hosted zone in Route 53 for this domain. They add an A record for "www.myecomshop.com" that points to the public IP of an Application Load Balancer (ALB) sitting in front of the web servers. To handle direct traffic to the bare domain "myecomshop.com" (which cannot use a CNAME), they create an Alias record that also points to the same ALB. They set up a weighted routing policy to send 10% of traffic to a new blue version of the application for testing, and 90% to the stable green version. They configure health checks on both endpoints; if the primary fails, Route 53 automatically routes all traffic to the other.

Step by step, the professional:

If any step fails (such as a misconfigured route table), the website goes down. The professional troubleshoots using VPC Flow Logs (which record network traffic metadata) and Route 53 health check logs. They also use the AWS console's Reachability Analyzer to verify that a path exists between two resources. This is exactly the kind of end-to-end design you need to be able to step through quickly in the exam.