advanced

VPC / networking

Design private networks with subnets, route tables, security groups, NAT, load balancers, DNS, and peering boundaries.

A VPC is your private network in the cloud: subnets, route tables, security groups or firewall rules, NAT gateways, load balancers, and DNS. For a Node.js API you typically place app servers in private subnets, expose HTTPS through a load balancer in public subnets, and restrict database access to the app tier only.

					Internet → ALB (public subnet) → ECS tasks (private)
                                      ↓
                                 RDS (private, SG locked)

| Component | Role | |-----------|------| | Public subnet | Load balancer, bastion (if any) | | Private subnet | App containers, workers | | Security group | Stateful allow/deny per ENI | | NAT gateway | Outbound internet from private subnets |

Peering and VPN connect VPCs to offices or other clouds. DNS (Route 53, Cloud DNS) maps names to load balancers. Design for least open ports — no SSH from `0.0.0.0/0` in production.

On interviews: public vs private subnets, NAT cost and need, security groups vs NACLs, internal service discovery, and how a misconfigured SG causes "works locally, fails in cloud".

Common pitfalls: databases with public IPs; flat `0.0.0.0/0` ingress on app ports; forgetting return path through NAT; hard-coded private IPs instead of service DNS.

The trade-off is network isolation and defense in depth versus NAT/load balancer cost and operational complexity for small teams.

Checklist:

Place data stores in private subnets only.
Restrict ingress to LB and known CIDRs.
Use service DNS names, not brittle IPs.
Document required egress for npm, APIs, and webhooks.