Secure AWS VPC with NAT Gateway

A clean network baseline is the foundation everything else sits on. This project builds a VPC with a clear public/private split, so workloads can reach the internet for updates without being reachable from it.

Resources often need outbound internet access but should never accept inbound connections. Putting everything in a public subnet is the easy, wrong answer.

Public subnets host only what must be internet-facing. Private subnets hold the workloads and route outbound traffic through a NAT gateway. Route tables and security groups enforce the separation.

Private workloads have no public IP and no inbound path. The blast radius of a compromised instance is constrained by subnet and security-group boundaries.

Getting the route tables and the NAT placement right — and verifying the private tier truly had no inbound path — was the core of the work.

Network layout is a security control. A defensible baseline at this layer makes everything built on top of it easier to reason about.