Azure Virtual Network

AWS Fundamentals Chapter 5 built a VPC around subnets each tied to exactly one Availability Zone. Azure's own Virtual Network (VNet) works on a genuinely different, more flexible real principle — and this chapter's own biggest structural difference from AWS shows up in the very first section.

VNets Are Free

Unlike almost everything else in this course, there is real, documented zero charge for the Virtual Network resource itself — standard charges still apply to the VMs, gateways, and other resources running inside it, but the VNet and its own subnets cost nothing on their own.

A Real, Major Structural Difference: Subnets Span Every AZ

This directly changes how a real multi-zone architecture is designed: rather than creating one subnet per AZ the way an AWS VPC requires, an Azure deployment typically uses a single subnet and specifies each individual VM's own zone separately, at creation time.

Real Reserved Addresses

Azure reserves the same real five addresses per subnet as AWS does (Chapter 5 of AWS Fundamentals) — the first four and the last one: the network address, the default gateway, two addresses reserved to map Azure's own DNS into the virtual network space, and the broadcast address. A genuine similarity, not a difference, between the two providers here.

Route Tables

Azure routes traffic between subnets, peered VNets, on-premises networks, and the internet automatically by default, using real system routes. You can override this default behavior with a user-defined route (UDR) — a real, custom route table entry directing specific traffic (e.g. 0.0.0.0/0) to a different next hop, such as a NAT Gateway or a network virtual appliance.

NAT Gateway

Azure's own real NAT Gateway attaches directly to a subnet and immediately provides outbound-only internet connectivity to every private resource in it — genuinely simpler to set up than AWS's own equivalent, since it requires no manual route table configuration at all once attached. Exactly like AWS's own NAT Gateway, Azure's version allows only response traffic back in; nothing outside the virtual network can initiate a new inbound connection through it.

VNet Peering

VNet peering connects two virtual networks directly, letting resources in either one communicate as though they shared a single network — the peered VNets can sit in the same region or in genuinely different regions.

Application Security Groups

An Application Security Group (ASG) lets you group VMs logically — by application role rather than by IP address — and then reference that whole group as the source or destination in an NSG rule (Chapter 3). Instead of hardcoding a specific set of IP addresses into a security rule and updating it every time a VM is added or removed, you add or remove VMs from the ASG itself, and every NSG rule referencing that ASG updates automatically.

VPC vs. VNet

Hands-On Exercises