The VPC model
A virtual private cloud is your isolated address space, carved into subnets per availability zone. Public subnets route to an internet gateway; private subnets reach outbound through NAT and hold databases and internal services.
Controlling traffic
Security groups are stateful, instance-level allow-lists — return traffic is automatic. Network ACLs are stateless and subnet-level. Private endpoints keep traffic to managed services off the public internet entirely.
Balancing and the edge
Layer 7 load balancers route by host and path and terminate TLS; layer 4 balancers forward raw connections at very high throughput. A CDN caches responses in hundreds of points of presence, which cuts latency and origin load; anycast DNS with health checks steers users to the nearest healthy region.