Once you've built a VPC and launched an EC2, you soon run into two desires. "I want to SSH in from outside and get work done," and "I want my Private instance to call an external API." These two look similar, but they're traffic in exactly opposite directions, and AWS has prepared a different solution for each. The IGW and the NAT Gateway handle the flow of packets; the Bastion and Session Manager handle operator access. Mapping these four without confusing them directly decides about 30% of the network area on the SAA exam.
Today's topics are "how does a Private instance communicate safely with the outside," and "how does an operator reach that Private instance" — two of them