An Amazon VPC is an isolated virtual network. Public subnets have a route to an internet gateway; private subnets normally reach the internet through a NAT gateway for outbound-only access. Route tables decide where packets go.
Security groups are stateful instance-level firewalls. Network ACLs are stateless subnet-level rules. A common production layout places public load balancers in public subnets and application/database resources in private subnets.