VPC
Practical VPC guides on PacketSensei: code-first articles on configuration, cost, and the AWS failure modes that show up in production.
4 articles in VPC, newest first.
Why AWS Reserves 5 IP Addresses in Every Subnet (and What Each One Does)
AWS takes five addresses out of every VPC subnet: network, router, DNS resolver, one in reserve, and broadcast. What each is for, and how it changes sizing.
Ephemeral Ports and the Network ACL Rule Everyone Forgets
Security groups are stateful, network ACLs are not. A NACL allowing inbound 443 but not outbound 1024-65535 lets a connection start, then kills it.
NAT Gateway vs NAT Instance vs VPC Endpoint: Which One, and What It Costs
Three ways to give private subnets outbound access, with very different bills. Where each one wins, and why an S3 gateway endpoint is the cheapest fix.
The VPC DNS Limit: 1,024 Packets per Second per ENI
The VPC resolver caps every network interface at 1,024 DNS packets per second. It is not adjustable, has no CloudWatch metric, and looks like random SERVFAIL.