Networking on AWS

Private-by-default VPCs and PrivateLink endpoints. No NAT, no open security groups and no path to the internet unless you add one.

Components

• Vpc — A VPC with public and private subnets across availability zones and a locked-down default security group. NAT, SSM bastion and flow logs are opt-in.
• VpcEndpoint — An interface VPC endpoint that keeps AWS traffic off the public internet, with its own security group open only to the compute you attach.