AWS Cloud Practitioner Study Notes · Part 24
Amazon VPC: AWS Virtual Networks, Subnets, and Connectivity
AWS Cloud Practitioner study notes explaining Amazon VPCs, CIDR blocks, subnets, routing, gateways, NAT, security groups, NACLs, and high availability.
An Amazon Virtual Private Cloud (Amazon VPC) is the networking foundation for many AWS workloads. It is a logically isolated virtual network where you define IP ranges, subnets, routing, gateways, and traffic controls for resources such as EC2 instances, RDS databases, ECS tasks, and Lambda functions configured for VPC access.
This is Part 24 of the AWS Cloud Practitioner Study Notes series. Part 18 introduced AWS network components, while Parts 22 and 23 covered CIDR planning and subnet calculations.
What is an Amazon VPC?
AWS describes a VPC as a logically isolated virtual network that you define inside the AWS Cloud. It resembles a traditional data-centre network, but AWS manages the underlying infrastructure.
Inside a VPC, you choose:
- IPv4 and optional IPv6 address ranges
- Subnets and Availability Zones
- Route tables and network paths
- Internet, NAT, VPN, peering, and other gateways
- Security groups and network ACLs
- Network interfaces and endpoints
A VPC is Region-scoped. Its subnets belong to Availability Zones within that Region. To connect VPCs or networks in other Regions, you need an appropriate connectivity design such as inter-Region peering, Transit Gateway peering, or other AWS networking services.
The VPC mental model
Imagine AWS as a city and your VPC as your organisation’s isolated property. Within that property, you define:
- The land boundary: VPC CIDR block
- Sections of the property: subnets
- Roads and destinations: route tables
- Main entrance to the public road: Internet Gateway
- Controlled exit for private areas: NAT Gateway
- Building-level access rules: security groups
- Section-level access rules: network ACLs
This analogy helps with the exam, but remember that a VPC is a virtual network. It is not a physical data centre or a single hardware appliance.
Core VPC components
| Component | Main purpose |
|---|---|
| VPC CIDR block | Defines the overall IP address range |
| Subnet | Divides the VPC range and places resources in one Availability Zone |
| Route table | Determines where traffic is sent |
| Internet Gateway | Connects a VPC to the Internet when routing and addressing are configured |
| NAT Gateway | Allows private resources to initiate outbound IPv4 connections |
| Security group | Stateful, allow-only firewall for associated resources |
| Network ACL | Stateless subnet-level allow/deny filter |
| Elastic Network Interface | Virtual network interface for a resource |
| VPC endpoint | Private access to supported AWS services without an Internet Gateway or NAT device |
| VPC Flow Logs | Captures information about IP traffic to and from network interfaces |
1. VPC CIDR block
Every VPC needs an IP address range. For example:
10.0.0.0/16This covers 10.0.0.0 through 10.0.255.255. Subnet CIDR blocks must fit within the VPC range and cannot overlap.
The address plan should account for:
- Number of Availability Zones
- Public, private, database, inspection, and endpoint subnets
- Expected network interfaces and workload growth
- Connectivity to on-premises networks and other VPCs
- Development, staging, and production environments
See Part 22 for a detailed VPC CIDR planning approach.
2. Subnets
A subnet is a range of IP addresses inside a VPC. Each subnet belongs entirely to one Availability Zone and cannot span multiple zones.
Example VPC layout:
| Subnet | CIDR | Availability Zone | Typical role |
|---|---|---|---|
| Public A | 10.0.1.0/24 | AZ A | Load balancer or public entry point |
| Public B | 10.0.2.0/24 | AZ B | Load balancer or public entry point |
| Private application A | 10.0.11.0/24 | AZ A | Application workloads |
| Private application B | 10.0.12.0/24 | AZ B | Application workloads |
| Private database A | 10.0.21.0/24 | AZ A | Database resources |
| Private database B | 10.0.22.0/24 | AZ B | Database resources |
AWS reserves five IPv4 addresses in every subnet, so a /24 has 251 addresses available for resources rather than 256. Subnet design should also leave capacity for service-managed network interfaces.
3. Route tables
A route table contains rules that determine where traffic from a subnet or gateway is directed. Each route has:
- A destination CIDR, such as
0.0.0.0/0or10.0.0.0/16 - A target, such as an Internet Gateway, NAT Gateway, VPC peering connection, VPN, or Transit Gateway
Every subnet is associated with one route table at a time. If you do not explicitly associate a subnet with a custom route table, it uses the VPC’s main route table.
Typical public-subnet route table:
| Destination | Target |
|---|---|
10.0.0.0/16 | Local |
0.0.0.0/0 | Internet Gateway |
Typical private-subnet route table with outbound IPv4 access:
| Destination | Target |
|---|---|
10.0.0.0/16 | Local |
0.0.0.0/0 | NAT Gateway |
A route table controls the path; it does not replace security groups or NACLs. Traffic still needs to be permitted by the applicable security controls.
4. Internet Gateway
An Internet Gateway (IGW) is a highly available VPC component that provides a route between a VPC and the Internet. To use it, you attach the IGW to the VPC and add a route to it in the relevant subnet route table.
A subnet is considered public when its route table has a route to an Internet Gateway. For IPv4, that route is commonly:
0.0.0.0/0 → Internet GatewayFor IPv6, the equivalent default route is ::/0.
An Internet Gateway route alone does not make an EC2 instance reachable. The resource also needs suitable public addressing, such as an automatically assigned public IPv4 address or Elastic IP, and its security groups, NACLs, operating system, and application must allow the traffic.
5. NAT Gateway
Private resources may need to initiate outbound Internet connections for operating-system updates, package downloads, or external APIs without accepting unsolicited inbound connections.
A NAT Gateway provides this pattern:
Private EC2 → Private route table → NAT Gateway → Internet Gateway → InternetThe NAT Gateway is normally placed in a public subnet with a route to the Internet Gateway. The private subnet route table sends Internet-bound traffic to the NAT Gateway.
The important exam distinction is:
- Internet Gateway: public connectivity for resources with appropriate public addressing and routes.
- NAT Gateway: outbound connectivity for resources without direct inbound Internet access.
For production high availability, deploy NAT Gateways across the Availability Zones that need them and route each private subnet to the local NAT design where appropriate. NAT Gateways also incur charges, so VPC endpoints may be a better choice for private access to supported AWS services.
6. Security groups
A security group is a stateful, allow-only virtual firewall associated with supported resources, such as an EC2 instance’s network interface. Rules can specify:
- Protocol, such as TCP, UDP, or ICMP
- Port or port range
- Source for inbound traffic
- Destination for outbound traffic
- IPv4 CIDR, IPv6 CIDR, security group, or prefix list
Example public HTTPS rule:
| Protocol | Port | Source |
|---|---|---|
| TCP | 443 | 0.0.0.0/0 |
This allows HTTPS attempts from all IPv4 addresses, assuming routing and the application are configured correctly. It does not automatically allow IPv6; an IPv6 rule using an appropriate range such as ::/0 must be configured separately.
Security groups are stateful. If an inbound connection is allowed, the response traffic is automatically allowed back. Security groups do not choose the route; route tables and gateways determine the path.
7. Network ACLs
A Network Access Control List (NACL) is associated with a subnet. It is a stateless traffic filter that supports both allow and deny rules.
| Characteristic | Security group | Network ACL |
|---|---|---|
| Scope | Resource or network interface | Subnet |
| State | Stateful | Stateless |
| Rule types | Allow only | Allow and deny |
| Return traffic | Automatically allowed for tracked connections | Must be allowed separately |
| Typical role | Primary resource-level firewall | Subnet-level guardrail or explicit deny |
Most workloads can be secured primarily with security groups. NACLs can add a second layer of defence or block a specific network range at the subnet boundary.
Public versus private subnets
The words public and private describe routing, not the subnet’s CIDR value.
Public subnet
A public subnet has a route to an Internet Gateway. Resources in it may be Internet-accessible when they have public IPv4 or IPv6 addressing and the security controls allow traffic.
Common examples:
- Application Load Balancer
- Network Load Balancer
- Bastion host, where still appropriate
- Public-facing EC2 resource
Private subnet
A private subnet does not have a direct route to an Internet Gateway. It may still have:
- A route to a NAT Gateway for outbound IPv4 Internet access
- A route to a VPC endpoint for private AWS service access
- A route to a Transit Gateway, VPN, or Direct Connect connection
Common examples:
- Application servers
- RDS databases
- Internal services
- Private ECS tasks
Putting a resource in a private subnet is a strong architectural boundary, but the route tables, security groups, NACLs, identity controls, and application authentication still need to be correct.
Example: a highly available web application
A common two-tier design uses two Availability Zones:
| Layer | AZ A | AZ B |
|---|---|---|
| Public entry | Load balancer subnet 10.0.1.0/24 | Load balancer subnet 10.0.2.0/24 |
| Application | Private subnet 10.0.11.0/24 | Private subnet 10.0.12.0/24 |
| Database | Private subnet 10.0.21.0/24 | Private subnet 10.0.22.0/24 |
The traffic pattern is:
- A user connects to the public load balancer.
- The Internet Gateway provides the VPC’s Internet path.
- The load balancer forwards traffic to application resources in private subnets.
- The application tier connects to the database through private IP routing.
- Private resources use NAT Gateway or VPC endpoints only when they need external access.
If one Availability Zone becomes unavailable, the load balancer and application resources in the other zone can continue serving traffic, assuming the application and data layers are designed for failover.
Common Cloud Practitioner questions
- Isolated virtual network inside AWS: Amazon VPC
- Divides a VPC into smaller networks: Subnets
- A subnet belongs to: One Availability Zone
- Determines where traffic goes: Route table
- Connects a VPC to the Internet: Internet Gateway
- Private outbound Internet access: NAT Gateway
- Stateful instance-level firewall: Security group
- Stateless subnet-level allow/deny filter: Network ACL
- Private access to supported AWS services: VPC endpoint
- Highly available subnet placement: Use multiple Availability Zones
Final takeaway
Amazon VPC gives you a private, logically isolated network that you configure with CIDRs, subnets, route tables, gateways, endpoints, and security controls. The most important exam distinction is to separate responsibilities:
- CIDR and subnets define where resources can live.
- Route tables define where traffic can go.
- Internet Gateways provide public network paths.
- NAT Gateways provide outbound access for private IPv4 resources.
- Security groups protect resources.
- NACLs protect subnet boundaries.
- Multiple Availability Zones improve resilience.
Once these relationships are clear, most introductory VPC questions become a matter of identifying which component controls the path, exposure, or security boundary described in the question.