I'm learning AWS and trying to connect the pieces. I think a VPC is an isolated network with public and private subnets, an internet gateway connects it to the internet, an ALB sends requests to servers, and EC2 or ECS can run the application.
What am I missing, especially about how the internet gateway works?
For internet access, the gateway is only one piece. You attach an internet gateway to the VPC, then configure a subnet's route table with a route to it. A subnet is considered public when it has that route.
An EC2 instance also needs a public IPv4 address or an appropriate IPv6 address for direct internet communication, and its security group and network ACL must permit the traffic. A private subnet can instead route outbound IPv4 traffic through a NAT gateway in a public subnet. That doesn't make the private instances directly reachable from the internet.
Your ALB description is close. A listener receives requests and applies rules that forward them to target groups. Those groups can contain different kinds of targets, not just EC2 instances, and health checks help the ALB avoid sending traffic to unhealthy targets.
Security groups are separate from target groups. A common setup allows the ALB to receive web traffic, then allows the application servers to receive traffic on their application port from the ALB's security group. An ALB can also be internal rather than internet-facing.
EC2 is the virtual machine option. ECR stores container images, while ECS schedules and runs containers. With ECS on EC2, you manage the EC2 instances that provide capacity. With ECS on Fargate, you specify task resources and AWS manages the underlying servers.
Also worth a look: EKS runs Kubernetes, and Lambda runs functions without you managing servers. You don't necessarily need to run your own VM for every application.
One networking nuance: don't assume every AWS service lives in your VPC or gets a private IP there. Resources such as EC2 instances have network interfaces in subnets, but plenty of AWS services are accessed as separate service endpoints.
A VPC is an isolated virtual network, but an account can have multiple VPCs. DNS can help resources find each other, though name resolution alone doesn't guarantee that routing and security rules allow the connection.
Answers are reviewed before publication.
Vanni:
The gateway handles the public IPv4 address mapping for an instance. The instance itself still uses its private IPv4 address inside the VPC.