~3 sessions a week: read the lesson (~15 min) + run and change its section of vpc/demo.py (~25 min). Tick lessons off — progress is saved in this browser.
Why a VPC, CIDR, subnets and AZs. Lab: change the /20 plan to /22 and count what is left; list the 5 reserved addresses of a /28.
Route tables, the internet gateway, security groups vs NACLs. Lab: add a more specific route and watch it win; delete the NACL return-port rule and walk the packet again.
Endpoints, DNS, peering. Lab: route S3 through the endpoint instead of the NAT; try to peer two overlapping ranges; try school → vendor.
Transit Gateway, troubleshooting, production design. Lab: let dev reach shared but not prod; read three flow-log lines; design your own campus.
Next: the NAT school builds the gate private wings go out through, the API Gateway school builds the front office, and the School portal has the rest.