A cloud network is software-defined, which makes it easy to create and easy to expose. The core controls are segmentation, least connectivity and visibility.
Subnets
- Public subnet: has a route to an internet gateway; resources can be directly reachable.
- Private subnet: no direct inbound internet route; outbound goes through NAT or a proxy.
- Isolated subnet: no internet route at all, often for databases.
Put databases and internal services in private or isolated subnets. Put only what must be public in a public subnet.
Security groups and ACLs
- Security groups are stateful, instance-level allow rules. Return traffic is automatic.
- Network ACLs are stateless, subnet-level allow/deny rules. Each direction needs its own rule.
Most teams rely on security groups; ACLs add a coarse boundary.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.