sdlc.dev

AWS fundamentals path · The network · Topic 5 of 18

VPC networking: subnets, routes and NAT

Not started

A **VPC** (virtual private cloud) is an isolated network in one Region with an address range you choose, for example 10.20.0.0/16. You divide it into **subnets**, each a smaller range in exactly one Availability Zone, and attach a **route table** to each subnet. Every packet leaving an instance is matched against its subnet's route table, most specific route first, and that decides where it goes next.

Why it matters: Whether a database is reachable from the internet, whether a task can pull its image, and a surprising share of the bill are all decided by subnets and route tables.

  1. 1A VPC spans a Region, a subnet one zone

    You give the VPC an address range and carve it into subnets, each in a single Availability Zone.

  2. 2Routes make a subnet public or private

    A subnet is public only because its route table sends 0.0.0.0/0 to an internet gateway. Nothing else about it is special.

  3. 3NAT lets private subnets call out

    A NAT gateway lets instances without public addresses start outbound connections. It is billed per hour and per gigabyte processed.

  4. 4Endpoints keep AWS traffic private

    Gateway endpoints for S3 and DynamoDB are free and take that traffic off the NAT gateway.

1

How it works

The explanation, with examples you can run.

A common layout

VPC 10.20.0.0/16 (eu-west-1)  public-a   10.20.0.0/20    route 0.0.0.0/0 -> internet gateway   (load balancers, NAT)  public-b   10.20.16.0/20   route 0.0.0.0/0 -> internet gateway  private-a  10.20.64.0/19   route 0.0.0.0/0 -> NAT gateway        (app tasks, instances)  private-b  10.20.96.0/19   route 0.0.0.0/0 -> NAT gateway  data-a     10.20.160.0/21  no default route                      (databases)  data-b     10.20.168.0/21  no default route

Every route table also has a local route for the VPC's own range, so all subnets can reach each other unless security groups or network ACLs say otherwise. "Public" means only that the route table points 0.0.0.0/0 at an internet gateway; an instance there also needs a public IPv4 address (or IPv6) to be reachable. A private subnet has no such route, so nothing on the internet can start a connection to it.

NAT: outbound only, and not free

Instances in private subnets still need to call out: to download packages, pull images or call third-party APIs. A NAT gateway translates their private addresses to its own public one, so replies come back but nobody outside can start a connection. Two things bite:

  • Zones. A standard (zonal) NAT gateway lives in one zone. If every private subnet routes through the one in zone a, losing zone a cuts outbound access everywhere, and traffic from the other zones also pays cross-zone transfer. Run one per zone, each with its own route table, or use a regional NAT gateway, which expands across the zones where you have workloads and uses a single ID in all routes.
  • Cost. You pay for each hour the gateway exists and for every gigabyte it processes, on top of normal data transfer. A busy service pulling container images or talking to S3 through NAT can cost more in NAT processing than in compute.

Keep AWS traffic off the NAT

VPC endpoints let private subnets reach AWS services without the internet. Gateway endpoints (only S3 and DynamoDB) are entries in your route tables and have no charge. Interface endpoints (PrivateLink) put a network interface for a service such as ECR, SQS or Secrets Manager in your subnets; they are billed per hour and per gigabyte, but often still cost less than NAT for heavy traffic and keep that traffic inside AWS.

Plan addresses once

You cannot easily renumber a VPC later, and peering or Transit Gateway connections fail when ranges overlap. Pick non-overlapping ranges per VPC and environment from the start, leave room for more zones and subnets, and remember that AWS reserves five addresses in every subnet.

2

Check yourself

3 questions. Get them all right to finish this topic.

  1. 1.What makes a subnet public?
  2. 2.Tasks in private subnets download 5 TB a month from S3 through a NAT gateway. What is the cheapest fix?
  3. 3.You have one zonal NAT gateway in zone a, used by private subnets in zones a, b and c. Zone a fails. What happens?

0 of 3 right so far. Get all three to finish this topic.

Go deeper