Amazon VPC Fundamentals: Regions, Subnets, Routing, and Endpoints

Purpose of This Lesson

This lesson establishes the networking model behind Amazon Virtual Private Cloud (VPC). It explains how VPCs relate to AWS Regions and Availability Zones, where subnets and resources are placed, how routing works, and how workloads access public AWS services such as Amazon S3.

For AWS Certified CloudOps Engineer Associate preparation, the key skill is recognizing the network boundary, selecting the correct connection path, and understanding whether traffic uses public or private addressing.

Key Concepts

• VPC: A logically isolated portion of AWS created within a single AWS Region.
• Availability Zone (AZ): One or more data centers within a Region. A VPC can use multiple AZs.
• Subnet: A smaller IP address range created inside a VPC and associated with exactly one AZ. A subnet cannot span multiple AZs.
• CIDR block: The overall IP address range assigned to a VPC or a smaller range assigned to a subnet. CIDR means Classless Inter-Domain Routing.
• Internet gateway: A VPC-level attachment used to connect the VPC to the internet.
• VPC router: An underlying router that handles traffic within the VPC and traffic leaving it. Administrators interact with its routing behavior through route tables rather than configuring the router as a visible resource.
• Route table: Defines destinations and targets for network traffic. A local route handles traffic within the VPC CIDR range; a route such as 0.0.0.0/0 can direct other traffic to an internet gateway.
• Public service: An AWS service located outside the VPC’s private address space, such as Amazon S3. It can be accessed through a public endpoint.
• VPC endpoint: A way to connect privately to supported AWS services using private connectivity and private IP addressing rather than sending the traffic through the public internet.
• Public and private subnets: These describe how resources are connected and reached. Resources in a public subnet can be reached through public connections when the required public addressing and routing are present; resources in a private subnet have private IP addresses only and are not directly reachable from the internet.

VPC Structure and Network Placement

A VPC is created within one AWS Region and provides an isolated network space. The VPC’s CIDR block defines its complete address range. Subnets divide that range into smaller blocks and are the locations where resources such as EC2 instances are launched.

Each subnet belongs to one Availability Zone. If an architecture uses multiple Availability Zones, it uses separate subnets in those AZs rather than one subnet spanning them. This relationship is important when interpreting diagrams and deciding where resources can be placed.

Multiple VPCs can be created in the same AWS Region, and each VPC uses its own address block. The VPC CIDR must be large enough to accommodate the subnet ranges and resources that will be placed inside it.

Routing Inside and Outside the VPC

The VPC router handles both internal and external traffic, but it is not presented as a normal configurable resource in the console. Route tables provide the administrative control point.

A typical route table includes:

Destination: VPC CIDR block       Target: local
Destination: 0.0.0.0/0            Target: Internet gateway ID

The local route allows traffic destined for addresses within the VPC CIDR to remain inside the VPC. The default route 0.0.0.0/0 represents destinations outside that range and sends matching traffic to the internet gateway.

The route table determines the path, but routing alone does not mean that every resource is publicly reachable. Whether a workload can be reached from outside the VPC also depends on whether it has public addressing and is placed in a subnet with the appropriate external route.

Public Services, Private Services, and Endpoints

Amazon S3 is outside the VPC and is treated in this lesson as a public AWS service. An EC2 instance can access S3 through a public connection, in which case traffic uses the public path and public IP addressing. A VPC endpoint provides an alternative private connection for supported services, using private connectivity and private IP addresses.

AWS services expose endpoints for programmatic access. The transcript identifies Amazon DynamoDB, Amazon Route 53, Amazon S3, and Amazon EC2 as examples. API access can use public endpoints whether the service is considered public or private in the architecture. This is separate from how an application or workload connects to a resource over the network.

For example, an EC2 instance may use an AWS service API through a public endpoint, while an application connection to an EC2 instance depends on the instance’s network placement:

• An EC2 instance in a public subnet can be accessed from the internet through a public connection when the necessary public address and routing are available.
• An EC2 instance in a private subnet has only private IP addressing and cannot be directly reached from the internet.
• An instance in a public subnet can communicate with an instance in a private subnet because both are inside the VPC and internal routing supports the connection.

Exam- or Assessment-Relevant Takeaways

• A VPC is regional; its subnets are AZ-specific.
• A subnet cannot span Availability Zones.
• The VPC CIDR is the overall address range, while subnet CIDRs are smaller ranges carved from it.
• The VPC router is controlled indirectly through route tables.
• The local route keeps traffic destined for the VPC CIDR inside the VPC.
• A default route such as 0.0.0.0/0 can direct non-local traffic to an internet gateway.
• An internet gateway is attached at the VPC level, not directly to an individual subnet or instance.
• Public and private access describe the network path and addressing used to reach a resource; API endpoint access is a related but distinct concern.
• An EC2 instance with only a private IP address is not directly reachable from the public internet.
• A VPC endpoint is the appropriate concept when the requirement is private access to a supported AWS service instead of a public internet path.

Tool / Feature Decision Guide

Requirement	Appropriate concept	Reason
Divide a VPC address range for resource placement	Subnet	A subnet uses a smaller CIDR range within the VPC and belongs to one AZ.
Keep traffic to VPC addresses inside the VPC	Local route	The local route targets the VPC CIDR range.
Send traffic destined outside the VPC toward the internet	Internet gateway plus an appropriate route	The gateway provides the VPC’s internet connection, while the route selects it as the target.
Connect to a supported AWS service without using the public internet path	VPC endpoint	It provides private connectivity and private IP addressing.
Provide programmatic access to an AWS service API	Service endpoint	Public service endpoints can be used for API operations; this does not by itself define the application data path.
Prevent direct internet access to an EC2 instance	Private subnet with private addressing	The instance is reachable privately within the VPC rather than through a direct public connection.

Common Traps / Misconceptions

• Assuming a subnet can span AZs: It cannot. Every subnet is associated with one Availability Zone.
• Treating an internet gateway as a route: The gateway is the VPC-level connection target. A route table must direct matching traffic to it.
• Assuming the VPC router is a visible resource: The router is part of the VPC networking infrastructure; route tables are the way administrators define routing behavior.
• Assuming every resource in a VPC is internet-accessible: VPC membership does not make an instance public. A private-subnet instance has private IP addressing only.
• Confusing a public API endpoint with a public application connection: An AWS service API may be accessed through a public endpoint even when the application’s own resource-to-resource traffic is private.
• Assuming S3 is inside the VPC: S3 is outside the VPC’s private network boundary. Access can use a public path or, where supported, a VPC endpoint.
• Confusing the VPC CIDR with a subnet CIDR: The VPC CIDR is the larger overall range; subnet CIDRs are smaller ranges taken from it.

Real-World Engineer / Analyst Notes

• Plan CIDR ranges before creating subnets. Poorly chosen ranges can make later subnet design and connectivity more difficult.
• When troubleshooting connectivity, separate the questions: Is the destination inside the VPC? Which route matches the destination? Is the target public or private? Is the required addressing available?
• For an EC2-to-service connection, identify whether the requirement concerns API operations or application data traffic. The endpoint decision may differ from the way an application connects to an EC2 instance.
• In architecture diagrams, label the Region, AZ, VPC, subnet, route table, internet gateway, and endpoint path separately. This avoids treating them as interchangeable layers.
• A private subnet provides private network placement, but the transcript only establishes that the instance is not directly reachable from the internet; do not infer additional egress mechanisms from this lesson alone.

Quick Reference Summary

• Region: Contains the VPC.
• VPC: Regional, logically isolated network with an overall CIDR block.
• Availability Zone: One or more data centers within the Region.
• Subnet: Smaller CIDR range inside the VPC; always confined to one AZ.
• Route table: Defines traffic destinations and targets.
• Local route: Keeps traffic for the VPC CIDR inside the VPC.
• Internet gateway: VPC-level attachment used for internet connectivity.
• Public subnet/resource: Uses a public path when public addressing and routing are available.
• Private subnet/resource: Uses private IP addressing and is not directly reachable from the internet.
• VPC endpoint: Private connection to supported AWS services.
• Service endpoint: Programmatic access point for services such as DynamoDB, Route 53, S3, and EC2.

Flashcards

Q: A design requires subnets in three Availability Zones. How many AZ associations does each subnet have?

A: Each subnet is associated with exactly one Availability Zone. The design requires separate subnets for the different AZs.

Q: What is the difference between a VPC CIDR block and a subnet CIDR block?

A: The VPC CIDR is the overall address range for the VPC. A subnet CIDR is a smaller range carved from that overall block.

Q: Which route keeps traffic destined for addresses inside the VPC within the VPC?

A: The local route whose destination is the VPC CIDR block. Its target is local.

Q: A route table must send all destinations outside the VPC toward the internet. What type of route is used?

A: A default route such as 0.0.0.0/0 with the internet gateway as its target.

Q: Where is an internet gateway attached?

A: It is attached at the VPC level and serves as the VPC’s connection to the internet.

Q: How do administrators control the behavior of the VPC’s router?

A: They define routes in route tables. The underlying router is not configured as a normal visible resource.

Q: An EC2 instance has only a private IP address. Can the public internet connect directly to it?

A: No. It can be reached through private connectivity within the VPC, but it is not directly reachable from the internet.

Q: An instance in a public subnet needs to communicate with an instance in a private subnet. Is that communication possible through the VPC?

A: Yes. Both instances are within the VPC, so internal routing can support communication between them.

Q: When should a VPC endpoint be considered instead of a public connection to S3?

A: Use a VPC endpoint when the requirement is private connectivity and private IP addressing to the supported service rather than sending traffic through the public internet path.

Q: What is the distinction between an AWS service API endpoint and an application network connection?

A: An API endpoint is used for programmatic service operations. An application’s network connection depends on the resource’s placement and whether it uses public or private IP addressing.

Q: Is Amazon S3 located inside a customer VPC?

A: No. S3 is outside the VPC’s private network boundary and is treated here as a public service, although private access can be provided through a VPC endpoint.

Q: What is the main architectural consequence of placing an EC2 instance in a private subnet?

A: The instance has private IP addressing only and cannot be directly reached from the public internet.

Practice Questions

Question 1

An engineer creates one subnet and attempts to associate it with two Availability Zones so that the same subnet can contain resources in both locations. What should the engineer do?

A. Attach an internet gateway to the subnet
B. Create a second subnet in the other Availability Zone
C. Expand the subnet CIDR to include both Availability Zones
D. Add a second local route to the subnet’s route table

Correct answer: B. Create a second subnet in the other Availability Zone.

A subnet is always contained within one Availability Zone; it cannot span multiple AZs.

Question 2

An EC2 instance must send traffic to destinations outside its VPC through an internet gateway. Which route-table entry is the decisive configuration?

A. The VPC CIDR with target local
B. The subnet CIDR with target local
C. 0.0.0.0/0 with the internet gateway as the target
D. The internet gateway ID as the destination with the VPC CIDR as the target

Correct answer: C. 0.0.0.0/0 with the internet gateway as the target.

The default route matches destinations outside the VPC CIDR and directs them to the internet gateway.

Question 3

A workload must access Amazon S3 without sending its traffic through the public internet path. Which option best matches the requirement described in the lesson?

A. Add another local route for the VPC CIDR
B. Use a VPC endpoint
C. Move S3 into a private subnet
D. Remove the VPC’s CIDR block

Correct answer: B. Use a VPC endpoint.

A VPC endpoint provides private connectivity and private IP addressing for supported AWS services such as S3.

Question 4

An analyst can access an EC2 instance from the internet, but cannot access another EC2 instance that has only a private IP address. Both instances belong to the same VPC. Which explanation is most accurate?

A. The private instance is in a different Region
B. Private IP addresses are used only by S3
C. The private instance is reachable through private VPC connectivity but not directly from the internet
D. A VPC can contain only one EC2 instance with a private IP address

Correct answer: C. The private instance is reachable through private VPC connectivity but not directly from the internet.

The lesson distinguishes public access to an instance in a public subnet from private-only access to an instance in a private subnet.

Question 5

A team says that because an AWS service has a public API endpoint, every application connection involving that service must use public IP addresses. What is the correct response?

A. Correct; API endpoints and application connections are always identical
B. Correct; private IP addresses cannot be used in a VPC
C. Incorrect; API access and the application’s network path are separate considerations
D. Incorrect; AWS services do not provide endpoints for programmatic access

Correct answer: C. Incorrect; API access and the application’s network path are separate considerations.

The lesson identifies public service endpoints for programmatic access while separately distinguishing public and private network connections.

WordPress Metadata

Suggested Slug:
amazon-vpc-fundamentals-regions-subnets-routing-endpoints

Meta Description:
Study the AWS VPC fundamentals tested in CloudOps operations, including regional isolation, Availability Zone subnets, CIDR blocks, route tables, internet gateways, and public versus private service access.

Tags:
AWS VPC, AWS Certified CloudOps Engineer, SOA-C03, CIDR, Subnets, Availability Zones, Route Tables, Internet Gateway, VPC Endpoints, Amazon EC2