IP

1. Every device connected to a network is assigned an IP address.
2. IPv4 is generally used.
3. If an IP address is 172.31.0.0/16...
   1. The first two blocks are the network part.
   2. The last two blocks are the host part (which tells you the servers reachable inside the network).
   3. After the slash is the "subnet mask." It means the first two blocks (8+8) are the network part.
4. If an IP address is 0.0.0.0/0, it means "the entire network."
   1. Used when working with an internet gateway.
5. Security groups and network ACLs are firewalls.
6. Router: the navigation for finding your way to an IP address. It finds the optimal route.
   1. Routing table: the map data. It says which endpoints to route through.

VPC

1. A VPC generally uses private IP addresses.
   1. Because if they overlap with external public IPs, communication is impossible.
   2. The CIDR must also not overlap with the network you connect to.
2. A VPC alone cannot create an EC2 instance. You have to create a subnet inside it.
3. A subnet can only be created in a single AZ.
4. You create a routing table in the VPC and assign it per subnet.

VPC to internet

1. By default you cannot communicate outside the VPC. (Put differently, inside is fine.)
   1. A subnet with an internet gateway attached is a public subnet.
   2. A bare subnet without one is a private subnet.
   3. A NAT gateway is the one-directional version of an internet gateway.
2. How to connect to the internet
   1. Subnet: internet gateway
   2. EC2: IP (there are public IPs and Elastic IPs. A public IP is free but changes every time. An Elastic IP is a dedicated IP that is yours alone.)

VPC to other AWS services

1. Use VPC peering or Transit Gateway.
   1. This goes over the internet.
   2. CIDRs must not overlap.
2. Use a gateway endpoint (S3, DynamoDB) or an interface endpoint.
   1. This uses a private network rather than the internet.

VPC to on-premises

1. Site-to-Site VPN
   1. A method using private IP addresses. (Because it is a private "IP," it uses the internet.)
   2. You install a router device on-premises.
   3. A comparable service is Client VPN. That one is for one-off use.
2. Direct Connect
   1. Connect over a dedicated line.
   2. Can also connect an AWS service to on-premises this way.

Network ACL

1. Set on a subnet.
   1. Security groups are set on EC2.
2. Can set both allow and deny.
   1. Security groups deny by default and can only allow.
3. Stateless (does not store information).
   1. Security groups are stateful (store information).

Route 53

1. Types of routing
   1. Simple routing
   2. Weighted routing
   3. Geolocation routing
   4. Latency routing
   5. Failover routing
   6. Multivalue answer routing (random)

CloudFront

1. Runs at the edge.
2. Good for availability, security, and speed.
3. Origin
   1. Anything can be set as the origin.
   2. Among AWS services, you can use S3 and ELB.