AWS networking and IAM

AWS networking and IAM are the two systems that decide what can talk to what in Amazon’s cloud. A VPC (virtual private cloud) is your own private network inside AWS, divided into subnets: public ones that can reach the internet directly and private ones that can’t. Security groups act as firewalls around individual machines, listing which traffic is allowed in. IAM (identity and access management) is the other half: it decides which people and services may call which AWS actions on which resources, using policies that are deny-by-default, where an explicit deny always wins. Most cloud security incidents come down to a mistake in one of these two.