VPC

The CIDR / subnet / route-table / security-group model seen as distinct SDK objects - what each resource is, the ids that wire them together, and why the console hides all of it.

Hands-on VPC basics: create a VPC, enable DNS, add public and private subnets, attach an internet gateway, wire a public route table, tag everything, and tear it down in order.

Wire public and private subnet routing via the SDK: create route tables, add a 0.0.0.0/0 route to an internet gateway, associate subnets, and understand the main route table and local route.

Stateful security groups vs stateless network ACLs via the SDK: authorize ingress/egress rules, why NACLs need both directions and ephemeral ports, and when to reach for each.

Enable and query VPC Flow Logs via the SDK: CreateFlowLogs to CloudWatch Logs or S3, choose ALL/ACCEPT/REJECT traffic, set a custom log format, and query with Logs Insights.

The VPC SDK habits that keep networks routable, secure, and cheap: plan non-overlapping CIDRs, tier subnets across AZs, keep the main route table private, least-privilege security groups, and control NAT cost.