Networking

In a cloud environment, software-defined networking establishes the boundaries, routing rules, and isolation perimeters that govern inter-service communication. When architected properly, databases and internal compute workloads are completely unreachable from the public internet by design. Conversely, flawed network topology can expose internal databases, unauthenticated caches, or management interfaces to automated internet port scanners.

Understanding cloud networking requires tracing how traffic moves through private networks, subnets, and routing gateways from the outside world inward.

Your private network

Cloud providers isolate tenant resources within a (VPC)—a private, software-defined network dedicated entirely to your account. Instances, container pods, and managed databases deployed inside a VPC communicate across private IP addresses that are isolated from other cloud tenants.

A VPC's address space is defined using Classless Inter-Domain Routing () notation, such as 10.0.0.0/16. The prefix indicates how many bits are fixed, determining the total number of allocatable IP addresses. Thorough CIDR block planning is critical: selecting an address range that avoids overlaps with corporate office networks, existing data centers, or peer VPCs prevents disruptive network re-addressing projects when connecting environments later.

Subnets

A VPC's IP block is divided into smaller , with each subnet mapped to a specific availability zone. Production topologies separate workloads into two distinct tiers:

• Public subnets: Configured with a direct route table entry pointing to an Internet Gateway. Compute instances and load balancers deployed in a public subnet can be assigned public IP addresses, enabling direct communication with the public internet.
• Private subnets: Have no direct route to an Internet Gateway. Instances located in private subnets receive only private IP addresses and cannot be reached directly from the internet. Application servers, background workers, and managed databases should always reside in private subnets.

When workloads in private subnets need outbound internet access (such as downloading operating system updates, pulling container images, or calling third-party APIs), traffic is routed through a located in a public subnet. The NAT gateway translates private IP addresses to its own public IP, allowing outbound connections while dropping unsolicited inbound connection attempts. Because NAT gateways charge per gigabyte of processed data, routing high-volume data transfers through a NAT gateway can quickly inflate network bills.

Firewalls and microsegmentation

At the network interface level, a acts as a stateful virtual firewall controlling inbound and outbound traffic. Security groups operate on an implicit default-deny model: any connection that is not explicitly permitted by an ingress rule is blocked. Because security groups are stateful, return traffic for initiated outbound connections is automatically allowed without requiring an explicit rule.

Rather than authoring firewall rules using static IP addresses, best practice is to reference other security groups as traffic sources. For example, a database security group can allow inbound connections on port 5432 strictly from the application server security group. As the application tier dynamically scales up and down, newly launched instances automatically inherit database access without requiring manual updates to firewall rule sets.

Opening a port

Enforce defense-in-depth by restricting firewall rules to specific security group origins.

1. Specify the security group identifier of the calling service tier as the allowed source, rather than open IP CIDR blocks.
2. Authorize only the exact TCP or UDP port required for the application protocol.
3. Never allow internet-wide access (0.0.0.0/0) on internal application or database ports.
4. Restrict 0.0.0.0/0 exposure exclusively to external load balancers on standard web ports (80 and 443).

Load balancers

A managed load balancer acts as the public entryway into the private cloud network. It hosts the public IP address, terminates TLS connections, conducts continuous health checks on backend instances, and balances traffic across multiple availability zones.

Providers supply two primary load balancer variants:

• Layer 4 load balancers: Operate at the transport layer (TCP/UDP), delivering ultra-high throughput and sub-millisecond latency for raw socket connections.
• Layer 7 load balancers: Operate at the application layer (HTTP/HTTPS), inspecting request paths, headers, and hostnames to route traffic across heterogeneous microservice backends behind a single public domain.

DNS and managed certificates

Managed DNS services resolve public and private domain names, routing client traffic to load balancers, cloud storage buckets, or health-checked multi-region failover endpoints. Integrated certificate managers automate the provisioning, domain validation, and annual renewal of TLS certificates on load balancers, eliminating service outages caused by expired certificates.

Private connections to cloud services

Managed cloud services—such as object storage buckets and serverless message queues—typically expose public endpoints. By default, traffic from an internal compute instance to an object bucket would travel out through the NAT gateway across the public internet.

A (or private link) provisions an elastic network interface with a private IP directly inside your VPC, routing traffic to provider services entirely over the cloud platform's internal optical network backbone. Using private endpoints improves throughput, eliminates NAT gateway bandwidth processing charges, and ensures sensitive internal traffic never traverses the public internet.

Interconnecting networks

Connecting a cloud VPC to on-premises enterprise data centers is achieved via encrypted IPsec VPN tunnels across the public internet or through dedicated, physical leased lines.

Connecting separate VPCs within the cloud environment is accomplished through VPC . Peering routes traffic across the cloud provider's high-speed backbone using private IP addresses as if all resources resided on a single unified network, avoiding public internet transit.

Where network costs accumulate

Data transfer within a single availability zone is generally free. However, routing traffic between different availability zones within the same region incurs small per-gigabyte fees, and outbound internet traffic carries significant metered charges. Architecting applications to keep chatty inter-service calls within the same zone and offloading public media distribution to content delivery networks (CDNs) prevents unexpected network expenses.

Terms introduced

• Virtual private cloud: your own private network inside the provider, with an address range you choose.
• CIDR: the notation for an address range, where the number after the slash fixes how many addresses it holds.
• Subnet: a slice of the network in one zone, public if it routes to the internet and private if not.
• NAT gateway: the way out for private subnets, letting traffic leave and replies return.
• Security group: a stateful allow-list of sources and ports attached to a resource.
• Private endpoint: an address inside your network for a managed service, so calls to it never leave.
• Peering: joining two private networks so their addresses can reach each other.

---

How providers do it

Software-defined networking across the major cloud platforms incorporates familiar constructs—virtual networks, subnets, route tables, firewalls, and private endpoints. However, the scope of these boundaries differs significantly: AWS subnets are strictly zonal, Azure subnets span entire regions, and Google Cloud VPCs operate globally across all regions by default.

Concept	AWS	Azure	Google Cloud
Virtual private cloud	Amazon VPC (scoped to a single region)	Azure Virtual Network (VNet; scoped to a single region)	Google Cloud VPC (global across all regions)
Subnet scoping	Zonal (confined to a single availability zone)	Regional (spans all availability zones in the region)	Regional (spans all zones in the region)
Public subnet model	Route table directs 0.0.0.0/0 to an Internet Gateway	Subnet route table allows internet route; instances use public IPs	No explicit public subnet concept; instances attach external IPs
Outbound NAT service	AWS NAT Gateway	Azure NAT Gateway	Google Cloud NAT
Interface firewall	Security group (stateful); Network ACLs (stateless)	Network Security Group (NSG); Application Security Groups	VPC firewall rules (targeted via network tags or service accounts)
Load balancing tiers	Application Load Balancer, Network Load Balancer	Azure Application Gateway, Azure Load Balancer, Azure Front Door	Google Cloud Load Balancing (external/internal, Layer 4/Layer 7)
Managed DNS service	Amazon Route 53	Azure DNS, Azure Private DNS	Google Cloud DNS
Automated TLS certificates	AWS Certificate Manager (ACM)	Azure Key Vault certificates, Front Door managed certificates	Google Cloud Certificate Manager
Private service endpoints	AWS VPC Endpoints (Interface via PrivateLink, Gateway)	Azure Private Link, Private Endpoints	Private Service Connect, Private Google Access
Network peering and transit	VPC Peering, AWS Transit Gateway	VNet Peering, Azure Virtual WAN	VPC Network Peering, Shared VPC
Hybrid premises connectivity	AWS Site-to-Site VPN, AWS Direct Connect	Azure VPN Gateway, Azure ExpressRoute	Google Cloud VPN, Google Cloud Interconnect
Edge content delivery	Amazon CloudFront	Azure Front Door, Azure CDN	Google Cloud CDN

Every product name and technical mapping above is confirmed against provider documentation. Specific transitional policies regarding default outbound internet connectivity are marked unconfirmed in the provider tabs below.

The geographic scope of a VPC is an essential design factor:

• AWS and Azure treat virtual networks as regional constructs; connecting workloads across multiple regions requires inter-region VPC peering or managed transit hubs (AWS Transit Gateway or Azure Virtual WAN). Furthermore, in AWS, each individual subnet exists strictly within a single availability zone.
• Google Cloud implements VPCs as global software-defined networks. A single Google Cloud VPC spans every region worldwide, containing regional subnets that automatically communicate across Google's private global fiber network without requiring peering or VPN configurations.

AWS

What this maps to: Amazon VPC. The core page's layout is AWS's layout. The VPC is regional and subnets are zonal, with a route table deciding which subnets are public.

Concept	On AWS	Status
Virtual private cloud	A VPC, in one region, with a CIDR you choose	confirmed
Subnet	Zonal. A subnet is public if its route table sends 0.0.0.0/0 to an Internet Gateway	confirmed
NAT gateway	NAT Gateway, one per AZ for resilience, billed per hour and per GB	confirmed
Security group	Security group, stateful, attached to network interfaces. Network ACLs are a second, stateless layer on the subnet	confirmed
Load balancer	ALB (layer 7) and NLB (layer 4). Gateway Load Balancer for third-party appliances	confirmed
DNS	Route 53, public and private zones, with health checks and routing policies for failover across regions	confirmed
Certificates	AWS Certificate Manager (ACM), free for certificates used on ALB and CloudFront, auto-renewed	confirmed
Private endpoint	VPC endpoints: gateway endpoints for S3 and DynamoDB at no charge, interface endpoints (PrivateLink) for everything else, billed per hour and per GB	confirmed
Peering	VPC peering, non-transitive. Transit Gateway for a hub joining many VPCs and on-premises networks	confirmed
Connection to your premises	Site-to-Site VPN over the internet; Direct Connect for a dedicated line	confirmed
Cross-zone traffic	Charged per GB in each direction	unconfirmed; check current pricing

Their vocabulary

Standard term	Their term
Private network	VPC
Door to the internet	Internet Gateway
Address inside the network for a service	VPC endpoint
Content delivery	CloudFront

Where to look

Reachability Analyzer, in the VPC console, answers whether A can reach B and, if not, which rule is stopping it. VPC Flow Logs record what was accepted and what was rejected.

Last verified: never.

Azure

What this maps to: Azure Virtual Network (VNet). A VNet lives in one region. Its subnets span all the zones in that region, which puts the layout somewhere between the AWS and Google Cloud ones.

Concept	On Azure	Status
Virtual private cloud	A VNet, in one region, with one or more address spaces	confirmed
Subnet	Regional, spanning zones. Public or private depends on whether a resource has a public IP and what the route table and NAT gateway on the subnet allow. Default outbound access for new subnets is being retired in favour of explicit egress	unconfirmed; check the current default outbound access status
NAT gateway	Azure NAT Gateway, attached to subnets, zonal	confirmed
Security group	Network security group (NSG), stateful, on a subnet or a network interface. Application security groups let rules name a group of VMs as source or destination	confirmed
Load balancer	Azure Load Balancer (layer 4), Application Gateway (layer 7, with an optional web application firewall), and Azure Front Door for global HTTP entry across regions	confirmed
DNS	Azure DNS for public zones and Private DNS zones linked to VNets	confirmed
Certificates	Application Gateway can hold certificates from Key Vault; App Service and Front Door offer managed certificates	confirmed
Private endpoint	Private Link creates a private endpoint, a network interface in your subnet with a private IP for a PaaS service. Service endpoints are the older, cheaper alternative that keeps the service's public address	confirmed
Peering	VNet peering, non-transitive. Virtual WAN or a hub-and-spoke of peered VNets for many networks	confirmed
Connection to your premises	VPN Gateway; ExpressRoute for a dedicated line	confirmed
Cross-zone traffic	Charged per GB in some cases	unconfirmed; check current pricing

Their vocabulary

Standard term	Their term
Private network	VNet
Security group	NSG
Address inside the network for a service	Private endpoint
Content delivery	Azure Front Door, or Azure CDN

Where to look

Network Watcher's Connection troubleshoot and NSG diagnostics answer "can A reach B, and which rule stops it". NSG flow logs record the traffic.

Last verified: never.

Google Cloud

What this maps to: Virtual Private Cloud, with one difference from the core page that changes the layout. A Google Cloud VPC is global, so a single network spans every region. Its subnets are regional rather than zonal and each one covers every zone in its region.

Concept	On Google Cloud	Status
Virtual private cloud	A VPC network, global, in auto mode (a subnet per region created for you) or custom mode (you create them). Use custom mode	confirmed
Subnet	Regional, with a primary range and optional secondary ranges. A VM is public if it has an external IP, not because of its subnet; the subnet has no route table of its own	confirmed
NAT gateway	Cloud NAT, a regional managed service attached to a Cloud Router	confirmed
Security group	VPC firewall rules on the network, targeted by network tag or by service account, and the newer hierarchical firewall policies at folder and organization level. Targeting by service account is the equivalent of naming a group as the source	confirmed
Load balancer	Cloud Load Balancing: the global external Application Load Balancer for HTTP(S) across regions with one anycast address, regional and internal variants, and Network Load Balancers for TCP/UDP	confirmed
DNS	Cloud DNS, public and private zones, with routing policies	confirmed
Certificates	Certificate Manager, or Google-managed certificates attached to a load balancer	confirmed
Private endpoint	Private Google Access lets VMs with no external IP reach Google APIs. Private Service Connect gives a Google or third-party service an address inside your network	confirmed
Peering	VPC Network Peering, non-transitive. Shared VPC lets one host project own the network and service projects attach to it. That is the usual way to run many projects on one network	confirmed
Connection to your premises	Cloud VPN; Cloud Interconnect for a dedicated or partner line	confirmed
Cross-zone traffic	Charged per GB within a region on some paths	unconfirmed; check current pricing

Their vocabulary

Standard term	Their term
Security group	Firewall rule with a target tag or service account
Public subnet	No direct equivalent; an external IP on the VM
Address inside the network for a service	Private Service Connect endpoint
Content delivery	Cloud CDN

Where to look

Network Intelligence Center's Connectivity Tests answer "can A reach B". VPC Flow Logs, enabled per subnet, record the traffic.

Last verified: never.

---

Check your understanding

0 of 4 answered

1. Where should a database sit, and why?

   In a private subnet, so it can be reached only from inside the network and has no route to the internet.In a public subnet, so administrators can connect from home.In a public subnet with a strong password.Outside the private network, so it can be shared with other teams.
2. What is the advantage of a security group rule that names another security group as its source, rather than an address range?

   A new machine that joins the source group can reach the resource, and nothing else can, however its address is chosen.It is faster to evaluate.It allows traffic from the internet as well.It does not need a port.
3. Two teams each built a private network on 10.0.0.0/16. What happens when they need to connect them?

   They cannot be peered, because the address ranges overlap. One of them has to re-address.Peering works, and the provider translates the addresses.Peering works as long as the subnets do not overlap.They are already connected, because they share a range.
4. A machine in a private subnet needs to download packages from the internet. How does the traffic get out?

   Through a NAT gateway in a public subnet, which lets traffic out and replies back and nothing else in.It cannot. Private subnets have no internet access in either direction.By giving the machine a public address.Through the load balancer.