Cloud Networking Fundamentals
VPCs, subnets, and security groups — the building blocks every other cloud topic assumes.
Virtual Private Clouds
A VPC is an isolated, private network within a cloud provider — your own address space, not shared with other customers by default. Everything else (subnets, routing, security) is configured inside it.
Subnets: public vs. private
A public subnet has a route to an internet gateway (resources can be reached from, and reach, the public internet directly). A private subnet has no direct internet route — resources there (databases, internal services) are reachable only from within the VPC, or via a NAT gateway for outbound-only internet access.
Security groups vs. network ACLs
A security group is a stateful firewall attached to individual resources (if inbound traffic is allowed, the matching outbound response is automatically allowed too). A network ACL is a stateless firewall attached to a subnet (inbound and outbound rules must both be defined explicitly) — security groups are the more common day-to-day tool, ACLs add a coarser subnet-level layer.
Why it's the root
IAM, infrastructure as code, and high-availability design all assume the resources they're securing/provisioning/replicating already live inside a properly network-isolated VPC.